6.6.55-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainerPATCH 111/386 ALSA: usb-audio: Replace complex quirk lines with macros
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit d79e13f8e8abb5cd3a2a0f9fc9bc3fc750c5b06f ]
Apply the newly introduced macros for reduce the complex expressions and cast in the quirk table definitions. It results in a significant code reduction, too.
There should be no functional changes.
--- sound/usb/quirks-table.h | 2210 ++++++++++---------------------------- 1 file changed, 593 insertions(+), 1617 deletions(-)
sound/usb/quirks-table.h +593 -1617
@@ -115,7 +115,7 @@/* FTDI devices */ {USB_DEVICE (0x0403 ,0xb8d8 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "STARR LABS", */ /* .product_name = "Starr Labs MIDI USB device", */ .ifnum = 0,
@@ -126,10 +126,8 @@ {/* Creative BT-D1 */ USB_DEVICE (0x041e ,0x0005 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 2, .iface = 1,
@@ -164,18 +162,11 @@*/ {USB_AUDIO_DEVICE (0x041e ,0x4095 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(2) }, { - .ifnum =3 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 2, .fmt_bits = 16,
@@ -191,9 +182,7 @@ .rate_table = (unsigned int[]) { 48000 }, }, }, - { - .ifnum = -1 - }, +QUIRK_COMPOSITE_END }, }, },
@@ -205,31 +194,18 @@*/ {USB_DEVICE (0x0424 ,0xb832 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Standard Microsystems Corp." , .product_name = "HP Wireless Audio", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE {/* Mixer */ - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE , - }, + { QUIRK_DATA_IGNORE(0) },/* Playback */ - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE , - }, + { QUIRK_DATA_IGNORE(1) },/* Capture */ - { - .ifnum =2 , - .type =QUIRK_IGNORE_INTERFACE , - }, + { QUIRK_DATA_IGNORE(2) },/* HID Device, .ifnum = 3 */ - { - .ifnum =-1 , - } + QUIRK_COMPOSITE_END } } },
@@ -252,20 +228,18 @@#define YAMAHA_DEVICE (id, name) { \ USB_DEVICE(0x0499, id), \ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \ + QUIRK_DRIVER_INFO { \ .vendor_name = "Yamaha", \ .product_name = name, \ - .ifnum = QUIRK_ANY_INTERFACE, \ - .type = QUIRK_MIDI_YAMAHA \ + QUIRK_DATA_MIDI_YAMAHA(QUIRK_ANY_INTERFACE) \ } \ }#define YAMAHA_INTERFACE (id, intf, name) { \ USB_DEVICE_VENDOR_SPEC(0x0499, id), \ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { \ + QUIRK_DRIVER_INFO { \ .vendor_name = "Yamaha", \ .product_name = name, \ - .ifnum = intf, \ - .type = QUIRK_MIDI_YAMAHA \ + QUIRK_DATA_MIDI_YAMAHA(intf) \ } \ } YAMAHA_DEVICE(0x1000, "UX256"),
@@ -353,135 +327,67 @@ YAMAHA_DEVICE(0x105d, NULL), YAMAHA_DEVICE(0x1718, "P-125"), { USB_DEVICE(0x0499, 0x1503), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "MOX6/MOX8", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x1507), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "THR10", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x1509), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "Steinberg UR22", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =4 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x150a), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "THR5A", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0499, 0x150c), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { /* .vendor_name = "Yamaha", */ /* .product_name = "THR10C", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_YAMAHA - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_MIDI_YAMAHA(3) }, + QUIRK_COMPOSITE_END } } },
@@ -515,7 +421,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), USB_DEVICE_ID_MATCH_INT_CLASS, .idVendor = 0x0499, .bInterfaceClass =USB_CLASS_VENDOR_SPEC , - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_ANY_INTERFACE , .type = QUIRK_AUTODETECT }
@@ -526,16 +432,12 @@ YAMAHA_DEVICE(0x7010, "UB99"),*/ {USB_DEVICE (0x0582 ,0x0000 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "UA-100", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 4, .iface = 0,
@@ -550,9 +452,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 2, .iface = 1,
@@ -567,106 +467,66 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables = 0x0007, .in_cables = 0x0007 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-4", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x000f , .in_cables = 0x000f } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0003 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SC-8850", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x003f , .in_cables = 0x003f } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0004 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "U-8", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0005 , .in_cables = 0x0005 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -674,152 +534,92 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Has ID 0x0099 when not in "Advanced Driver" mode. * The UM-2EX has only one input, but we cannot detect this. */ USB_DEVICE (0x0582 ,0x0005 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0003 , .in_cables = 0x0003 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0007 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SC-8820", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0013 , .in_cables = 0x0013 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0008 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "PC-300", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x009d when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0009 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-1", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x000b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SK-500", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0013 , .in_cables = 0x0013 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -827,31 +627,19 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* thanks to Emiliano Grilli <[email protected]> * for helping researching this data */ USB_DEVICE (0x0582 ,0x000c ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "SC-D70", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0007 , .in_cables = 0x0007 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -865,35 +653,23 @@ YAMAHA_DEVICE(0x7010, "UB99"),* the 96kHz sample rate. */ USB_DEVICE (0x0582 ,0x0010 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-5", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0013 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0012 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "XV-5050", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -902,12 +678,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0015 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0014 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-880", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x01ff , .in_cables = 0x01ff }
@@ -916,74 +690,48 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0017 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0016 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "SD-90", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x000f , .in_cables = 0x000f } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x001c when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x001b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "MMP-2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x001e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x001d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "V-SYNTH", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -992,12 +740,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0024 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0023 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-550", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x003f , .in_cables = 0x003f }
@@ -1010,20 +756,13 @@ YAMAHA_DEVICE(0x7010, "UB99"),* and no MIDI. */ USB_DEVICE (0x0582 ,0x0025 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-20", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 1,
@@ -1038,9 +777,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 2,
@@ -1055,28 +792,22 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 3, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0028 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0027 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "SD-20", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0007 }
@@ -1085,12 +816,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x002a when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0029 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "SD-80", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x000f , .in_cables = 0x000f }
@@ -1103,39 +832,24 @@ YAMAHA_DEVICE(0x7010, "UB99"),* but offers only 16-bit PCM and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x002b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-700", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =3 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + { QUIRK_DATA_EDIROL_UAXX(3) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x002e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x002d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "XV-2020", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1144,12 +858,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0030 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x002f ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "VariOS", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0007 , .in_cables = 0x0007 }
@@ -1158,12 +870,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0034 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0033 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PCR", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0007 }
@@ -1175,12 +885,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),* later revisions use IDs 0x0054 and 0x00a2. */ USB_DEVICE (0x0582 ,0x0037 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "Digital Piano", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1193,39 +901,24 @@ YAMAHA_DEVICE(0x7010, "UB99"),* and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x003b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="BOSS" , .product_name = "GS-10", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + { QUIRK_DATA_STANDARD_MIDI(3) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0041 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0040 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "GI-20", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1234,12 +927,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0043 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0042 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "RS-70", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1248,36 +939,24 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0049 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0047 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "UR-80", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE {/* in the 96 kHz modes, only interface 1 is there */ - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x004a when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0048 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "UR-80", */ - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables = 0x0003, .in_cables = 0x0007 }
@@ -1286,35 +965,23 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x004e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x004c ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PCR-A", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x004f when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x004d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PCR-A", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0007 }
@@ -1326,76 +993,52 @@ YAMAHA_DEVICE(0x7010, "UB99"),* is standard compliant, but has only 16-bit PCM. */ USB_DEVICE (0x0582 ,0x0050 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-3FX", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0052 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UM-1SX", - .ifnum =0 , - .type =QUIRK_MIDI_STANDARD_INTERFACE + QUIRK_DATA_STANDARD_MIDI(0) } }, {USB_DEVICE (0x0582 ,0x0060 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "EXR Series", - .ifnum =0 , - .type =QUIRK_MIDI_STANDARD_INTERFACE +QUIRK_DATA_STANDARD_MIDI (0 ) } }, {/* has ID 0x0066 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0064 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "PCR-1", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0067 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0065 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "EDIROL", */ /* .product_name = "PCR-1", */ - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables = 0x0001, .in_cables =0x0003 }
@@ -1404,12 +1047,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x006e when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x006d ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "FANTOM-X", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1422,39 +1063,24 @@ YAMAHA_DEVICE(0x7010, "UB99"),* offers only 16-bit PCM at 44.1 kHz and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x0074 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-25", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(0) }, + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + QUIRK_COMPOSITE_END } } }, {/* has ID 0x0076 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0075 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="BOSS" , .product_name = "DR-880", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1463,12 +1089,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x007b when not in "Advanced Driver" mode */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x007a ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" ,/* "RD" or "RD-700SX"? */ - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0003 , .in_cables = 0x0003 }
@@ -1477,12 +1101,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x0081 when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x0080 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Roland" , .product_name = "G-70", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1491,12 +1113,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* has ID 0x008c when not in "Advanced Driver" mode */ USB_DEVICE (0x0582 ,0x008b ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "PC-50", - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1508,56 +1128,31 @@ YAMAHA_DEVICE(0x7010, "UB99"),* is standard compliant, but has only 16-bit PCM and no MIDI. */ USB_DEVICE (0x0582 ,0x00a3 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-4FX", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(0) }, + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + QUIRK_COMPOSITE_END } } }, {/* Edirol M-16DX */ USB_DEVICE (0x0582 ,0x00c4 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -1567,37 +1162,22 @@ YAMAHA_DEVICE(0x7010, "UB99"),* offers only 16-bit PCM at 44.1 kHz and no MIDI. */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x00e6 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="EDIROL" , .product_name = "UA-25EX", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_EDIROL_UAXX - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_EDIROL_UAXX(0) }, + { QUIRK_DATA_EDIROL_UAXX(1) }, + { QUIRK_DATA_EDIROL_UAXX(2) }, + QUIRK_COMPOSITE_END } } }, {/* Edirol UM-3G */ USB_DEVICE_VENDOR_SPEC (0x0582 ,0x0108 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =0 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(0) { .out_cables = 0x0007, .in_cables =0x0007 }
@@ -1606,45 +1186,29 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* BOSS ME-25 */ USB_DEVICE (0x0582 ,0x0113 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* only 44.1 kHz works at the moment */ USB_DEVICE (0x0582 ,0x0120 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Roland", */ /* .product_name = "OCTO-CAPTURE", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 10, .iface = 0,
@@ -1660,9 +1224,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 12, .iface = 1,
@@ -1678,40 +1240,26 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = 3, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 4, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = -1 - } + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } }, {/* only 44.1 kHz works at the moment */ USB_DEVICE (0x0582 ,0x012f ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Roland", */ /* .product_name = "QUAD-CAPTURE", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 4, .iface = 0,
@@ -1727,9 +1275,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S32_LE, .channels = 6, .iface = 1,
@@ -1745,54 +1291,32 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = 3, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 4, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = -1 - } + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x0582 ,0x0159 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Roland", */ /* .product_name = "UA-22", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(2) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -1800,19 +1324,19 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* UA101 and co are supported by another driver */ {USB_DEVICE (0x0582 ,0x0044 ),/* UA-1000 high speed */ - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_NODEV_INTERFACE }, }, {USB_DEVICE (0x0582 ,0x007d ),/* UA-101 high speed */ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_NODEV_INTERFACE }, }, {USB_DEVICE (0x0582 ,0x008d ),/* UA-101 full speed */ - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_NODEV_INTERFACE }, },
@@ -1823,7 +1347,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), USB_DEVICE_ID_MATCH_INT_CLASS, .idVendor = 0x0582, .bInterfaceClass =USB_CLASS_VENDOR_SPEC , - .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =QUIRK_ANY_INTERFACE , .type = QUIRK_AUTODETECT }
@@ -1838,12 +1362,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),* compliant USB MIDI ports for external MIDI and controls. */ USB_DEVICE_VENDOR_SPEC (0x06f8 ,0xb000 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Hercules" , .product_name = "DJ Console (WE)", - .ifnum =4 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(4) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1853,12 +1375,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Midiman/M-Audio devices */ {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 2x2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x0003 , .in_cables = 0x0003 }
@@ -1866,12 +1386,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1011 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 1x1", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1879,12 +1397,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1015 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "Keystation", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -1892,12 +1408,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1021 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 4x4", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x000f , .in_cables = 0x000f }
@@ -1910,12 +1424,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),* Thanks to Olaf Giesbrecht <[email protected]> */ USB_DEVICE_VER (0x0763 ,0x1031 ,0x0100 ,0x0109 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 8x8", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x01ff , .in_cables = 0x01ff }
@@ -1923,12 +1435,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1033 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 8x8", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x01ff , .in_cables = 0x01ff }
@@ -1936,12 +1446,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x1041 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "MidiSport 2x4", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(QUIRK_ANY_INTERFACE) { .out_cables =0x000f , .in_cables = 0x0003 }
@@ -1949,76 +1457,41 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2001 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "Quattro", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE {/* * Interfaces 0-2 are "Windows-compatible", 16-bit only, * and share endpoints with the other interfaces. * Ignore them. The other interfaces can do 24 bits, * but captured samples are big-endian (see usbaudio.c). */ - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =4 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =5 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =6 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =7 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =8 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =9 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, + { QUIRK_DATA_IGNORE(2) }, + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_STANDARD_AUDIO(4) }, + { QUIRK_DATA_STANDARD_AUDIO(5) }, + { QUIRK_DATA_IGNORE(6) }, + { QUIRK_DATA_STANDARD_AUDIO(7) }, + { QUIRK_DATA_STANDARD_AUDIO(8) }, + { + QUIRK_DATA_MIDI_MIDIMAN(9) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } +QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2003 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "AudioPhile", - .ifnum =6 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(6) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -2026,12 +1499,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2008 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="M-Audio" , .product_name = "Ozone", - .ifnum =3 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(3) { .out_cables =0x0001 , .in_cables = 0x0001 }
@@ -2039,93 +1510,45 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, { USB_DEVICE_VENDOR_SPEC(0x0763, 0x200d), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name = "M-Audio", .product_name = "OmniStudio", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =4 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =5 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =6 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =7 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =8 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =9 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, + { QUIRK_DATA_IGNORE(2) }, + { QUIRK_DATA_IGNORE(3) }, + { QUIRK_DATA_STANDARD_AUDIO(4) }, + { QUIRK_DATA_STANDARD_AUDIO(5) }, + { QUIRK_DATA_IGNORE(6) }, + { QUIRK_DATA_STANDARD_AUDIO(7) }, + { QUIRK_DATA_STANDARD_AUDIO(8) }, + { + QUIRK_DATA_MIDI_MIDIMAN(9) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, { USB_DEVICE(0x0763, 0x2019), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { /* .vendor_name = "M-Audio", */ /* .product_name = "Ozone Academic", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =3 , - .type =QUIRK_MIDI_MIDIMAN , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(3) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -2135,21 +1558,14 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2030 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track C400", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(1) }, /* Playback */ { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 6, .iface = 2,
@@ -2173,9 +1589,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), },/* Capture */ { - .ifnum = 3, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 3,
@@ -2197,30 +1611,21 @@ YAMAHA_DEVICE(0x7010, "UB99"), .clock = 0x80, } }, -/* MIDI */ - { - .ifnum = -1 /* Interface = 4 */ - } +/* MIDI: Interface = 4*/ + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2031 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track C600", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(1) }, /* Playback */ { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -2244,9 +1649,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), },/* Capture */ { - .ifnum = 3, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 6, .iface = 3,
@@ -2268,29 +1671,20 @@ YAMAHA_DEVICE(0x7010, "UB99"), .clock = 0x80, } }, -/* MIDI */ - { - .ifnum = -1 /* Interface = 4 */ - } +/* MIDI: Interface = 4 */ + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2080 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track Ultra", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 1,
@@ -2312,9 +1706,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -2336,28 +1728,19 @@ YAMAHA_DEVICE(0x7010, "UB99"), } },/* interface 3 (MIDI) is standard compliant */ - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x0763 ,0x2081 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "M-Audio", */ /* .product_name = "Fast Track Ultra 8R", */ - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 1,
@@ -2379,9 +1762,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -2403,9 +1784,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } },/* interface 3 (MIDI) is standard compliant */ - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -2413,21 +1792,19 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Casio devices */ {USB_DEVICE (0x07cf ,0x6801 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Casio" , .product_name = "PL-40R", - .ifnum =0 , - .type =QUIRK_MIDI_YAMAHA + QUIRK_DATA_MIDI_YAMAHA(0) } }, {/* this ID is used by several devices without a product ID */ USB_DEVICE (0x07cf ,0x6802 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Casio" , .product_name = "Keyboard", - .ifnum =0 , - .type =QUIRK_MIDI_YAMAHA +QUIRK_DATA_MIDI_YAMAHA (0 ) } },
@@ -2440,23 +1817,13 @@ YAMAHA_DEVICE(0x7010, "UB99"), .idVendor = 0x07fd, .idProduct = 0x0001, .bDeviceSubClass = 2, - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name = "MOTU", .product_name = "Fastlane", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_MIDI_RAW_BYTES - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_RAW_BYTES(0) }, + { QUIRK_DATA_IGNORE(1) }, + QUIRK_COMPOSITE_END } } },
@@ -2464,12 +1831,10 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Emagic devices */ {USB_DEVICE (0x086a ,0x0001 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Emagic" , .product_name = "Unitor8", - .ifnum =2 , - .type =QUIRK_MIDI_EMAGIC , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_EMAGIC(2) { .out_cables =0x80ff , .in_cables = 0x80ff }
@@ -2477,12 +1842,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE (0x086a ,0x0002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Emagic" ,/* .product_name = "AMT8", */ - .ifnum =2 , - .type =QUIRK_MIDI_EMAGIC , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_EMAGIC(2) { .out_cables =0x80ff , .in_cables = 0x80ff }
@@ -2490,12 +1853,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE (0x086a ,0x0003 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Emagic" ,/* .product_name = "MT4", */ - .ifnum =2 , - .type =QUIRK_MIDI_EMAGIC , - .data = & (const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_EMAGIC(2) { .out_cables =0x800f , .in_cables = 0x8003 }
@@ -2505,38 +1866,35 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* KORG devices */ {USB_DEVICE_VENDOR_SPEC (0x0944 ,0x0200 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="KORG, Inc." ,/* .product_name = "PANDORA PX5D", */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE , + QUIRK_DATA_STANDARD_MIDI(3) } }, {USB_DEVICE_VENDOR_SPEC (0x0944 ,0x0201 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="KORG, Inc." ,/* .product_name = "ToneLab ST", */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE , +QUIRK_DATA_STANDARD_MIDI (3 ) } }, {USB_DEVICE_VENDOR_SPEC (0x0944 ,0x0204 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="KORG, Inc." ,/* .product_name = "ToneLab EX", */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE , +QUIRK_DATA_STANDARD_MIDI (3 ) } },/* AKAI devices */ {USB_DEVICE (0x09e8 ,0x0062 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="AKAI" , .product_name = "MPD16", .ifnum = 0,
@@ -2547,21 +1905,11 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* Akai MPC Element */ USB_DEVICE (0x09e8 ,0x0021 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_MIDI_STANDARD_INTERFACE - }, - { - .ifnum =-1 - } + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_STANDARD_MIDI(1) }, + QUIRK_COMPOSITE_END } } },
@@ -2570,66 +1918,36 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* Steinberg MI2 */ USB_DEVICE_VENDOR_SPEC (0x0a4e ,0x2040 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, { - .ifnum =3 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } }, {/* Steinberg MI4 */ USB_DEVICE_VENDOR_SPEC (0x0a4e ,0x4040 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = & (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(0) }, + { QUIRK_DATA_STANDARD_AUDIO(1) }, + { QUIRK_DATA_STANDARD_AUDIO(2) }, { - .ifnum =3 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables =0x0001 , .in_cables = 0x0001 } }, - { - .ifnum =-1 - } + QUIRK_COMPOSITE_END } } },
@@ -2637,34 +1955,31 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* TerraTec devices */ {USB_DEVICE_VENDOR_SPEC (0x0ccd ,0x0012 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TerraTec" , .product_name = "PHASE 26", - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE + QUIRK_DATA_STANDARD_MIDI(3) } }, {USB_DEVICE_VENDOR_SPEC (0x0ccd ,0x0013 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TerraTec" , .product_name = "PHASE 26", - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE +QUIRK_DATA_STANDARD_MIDI (3 ) } }, {USB_DEVICE_VENDOR_SPEC (0x0ccd ,0x0014 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TerraTec" , .product_name = "PHASE 26", - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE +QUIRK_DATA_STANDARD_MIDI (3 ) } }, {USB_DEVICE (0x0ccd ,0x0035 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Miditech" , .product_name = "Play'n Roll", .ifnum = 0,
@@ -2679,7 +1994,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Novation EMS devices */ {USB_DEVICE_VENDOR_SPEC (0x1235 ,0x0001 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "ReMOTE Audio/XStation", .ifnum = 4,
@@ -2688,7 +2003,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE_VENDOR_SPEC (0x1235 ,0x0002 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "Speedio", .ifnum = 3,
@@ -2697,38 +2012,29 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {USB_DEVICE (0x1235 ,0x000a ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Novation", */ /* .product_name = "Nocturn", */ - .ifnum =0 , - .type =QUIRK_MIDI_RAW_BYTES + QUIRK_DATA_RAW_BYTES(0) } }, {USB_DEVICE (0x1235 ,0x000e ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO {/* .vendor_name = "Novation", */ /* .product_name = "Launchpad", */ - .ifnum =0 , - .type =QUIRK_MIDI_RAW_BYTES + QUIRK_DATA_RAW_BYTES(0) } }, {USB_DEVICE (0x1235 ,0x0010 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Focusrite" , .product_name = "Saffire 6 USB", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, - { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 0,
@@ -2755,9 +2061,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 0, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 0,
@@ -2779,28 +2083,19 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = 1, - .type = QUIRK_MIDI_RAW_BYTES - }, - { - .ifnum = -1 - } + { QUIRK_DATA_RAW_BYTES(1) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE (0x1235 ,0x0018 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "Twitch", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { { - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = & (const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 0,
@@ -2819,19 +2114,14 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = 1, - .type = QUIRK_MIDI_RAW_BYTES - }, - { - .ifnum = -1 - } + { QUIRK_DATA_RAW_BYTES(1) }, + QUIRK_COMPOSITE_END } } }, {USB_DEVICE_VENDOR_SPEC (0x1235 ,0x4661 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Novation" , .product_name = "ReMOTE25", .ifnum = 0,
@@ -2843,25 +2133,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* VirusTI Desktop */ USB_DEVICE_VENDOR_SPEC (0x133e ,0x0815 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { { - .ifnum =3 , - .type =QUIRK_MIDI_FIXED_ENDPOINT , - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(3) { .out_cables = 0x0003, .in_cables = 0x0003 } }, - { - .ifnum =4 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =-1 - } + { QUIRK_DATA_IGNORE(4) }, + QUIRK_COMPOSITE_END } } },
@@ -2889,7 +2170,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* QinHeng devices */ {USB_DEVICE (0x1a86 ,0x752d ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="QinHeng" , .product_name = "CH345", .ifnum = 1,
@@ -2903,7 +2184,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Miditech devices */ {USB_DEVICE (0x4752 ,0x0011 ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Miditech" , .product_name = "Midistart-2", .ifnum = 0,
@@ -2915,7 +2196,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* this ID used by both Miditech MidiStudio-2 and CME UF-x */ USB_DEVICE (0x7104 ,0x2202 ), - .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) { + QUIRK_DRIVER_INFO { .ifnum =0 , .type = QUIRK_MIDI_CME }
@@ -2925,20 +2206,13 @@ YAMAHA_DEVICE(0x7010, "UB99"), {/* Thanks to Clemens Ladisch <[email protected]> */ USB_DEVICE (0x0dba ,0x1000 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Digidesign" , .product_name = "MBox", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []){ - { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, + QUIRK_DATA_COMPOSITE{ + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3BE, .channels = 2, .iface = 1,
@@ -2959,9 +2233,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3BE, .channels = 2, .iface = 1,
@@ -2982,9 +2254,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -2992,24 +2262,14 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* DIGIDESIGN MBOX 2 */ {USB_DEVICE (0x0dba ,0x3000 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Digidesign" , .product_name = "Mbox 2", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats =SNDRV_PCM_FMTBIT_S24_3BE , .channels = 2, .iface = 2,
@@ -3027,15 +2287,10 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, + { QUIRK_DATA_IGNORE(3) }, { - .ifnum = 3, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 4, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { - .formats =SNDRV_PCM_FMTBIT_S24_3BE , + QUIRK_DATA_AUDIOFORMAT(4) { + .formats = SNDRV_PCM_FMTBIT_S24_3BE, .channels = 2, .iface = 4, .altsetting = 2,
@@ -3052,14 +2307,9 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, + { QUIRK_DATA_IGNORE(5) }, { - .ifnum = 5, - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum = 6, - .type = QUIRK_MIDI_MIDIMAN, - .data = &(const struct snd_usb_midi_endpoint_info ) { + QUIRK_DATA_MIDI_MIDIMAN(6) { .out_ep = 0x02, .out_cables = 0x0001, .in_ep = 0x81,
@@ -3067,33 +2317,21 @@ YAMAHA_DEVICE(0x7010, "UB99"), .in_cables = 0x0001 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },/* DIGIDESIGN MBOX 3 */ {USB_DEVICE (0x0dba ,0x5000 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Digidesign" , .product_name = "Mbox 3", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, + { QUIRK_DATA_IGNORE(1) }, { - .ifnum =1 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =2 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats =SNDRV_PCM_FMTBIT_S24_3LE , .channels = 4, .iface = 2,
@@ -3113,9 +2351,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 3, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(3) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 3,
@@ -3136,36 +2372,25 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 4, - .type = QUIRK_MIDI_FIXED_ENDPOINT, - .data = &(const struct snd_usb_midi_endpoint_info) { + QUIRK_DATA_MIDI_FIXED_ENDPOINT(4) { .out_cables = 0x0001, .in_cables = 0x0001 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } }, {/* Tascam US122 MKII - playback-only support */ USB_DEVICE_VENDOR_SPEC (0x0644 ,0x8021 ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="TASCAM" , .product_name = "US122 MKII", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_IGNORE(0) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 2, .iface = 1,
@@ -3186,9 +2411,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -3196,20 +2419,13 @@ YAMAHA_DEVICE(0x7010, "UB99"),/* Denon DN-X1600 */ {USB_AUDIO_DEVICE (0x154e ,0x500e ), - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Denon" , .product_name = "DN-X1600", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []){ + QUIRK_DATA_COMPOSITE{ + { QUIRK_DATA_IGNORE(0) }, { - .ifnum =0 , - .type =QUIRK_IGNORE_INTERFACE , - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 1,
@@ -3230,9 +2446,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } }, { - .ifnum = 2, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(2) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 8, .iface = 2,
@@ -3252,13 +2466,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = 4, - .type = QUIRK_MIDI_STANDARD_INTERFACE, - }, - { - .ifnum = -1 - } + { QUIRK_DATA_STANDARD_MIDI(4) }, + QUIRK_COMPOSITE_END } } },
@@ -3267,17 +2476,13 @@ YAMAHA_DEVICE(0x7010, "UB99"), { USB_DEVICE(0x045e, 0x0283), .bInterfaceClass =USB_CLASS_PER_INTERFACE , - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + QUIRK_DRIVER_INFO { .vendor_name ="Microsoft" , .product_name = "XboxLive Headset/Xbox Communicator", - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { + QUIRK_DATA_COMPOSITE { {/* playback */ - .ifnum =0 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(0) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 1, .iface = 0,
@@ -3293,9 +2498,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), }, {/* capture */ - .ifnum = 1, - .type = QUIRK_AUDIO_FIXED_ENDPOINT, - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S16_LE, .channels = 1, .iface = 1,
@@ -3309,9 +2512,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), .rate_max = 16000 } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -3320,18 +2521,11 @@ YAMAHA_DEVICE(0x7010, "UB99"), {USB_DEVICE (0x200c ,0x100b ), .bInterfaceClass = USB_CLASS_PER_INTERFACE, - .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = &(const struct snd_usb_audio_quirk []) { + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_MIXER(0) }, { - .ifnum =0 , - .type =QUIRK_AUDIO_STANDARD_MIXER , - }, - { - .ifnum =1 , - .type =QUIRK_AUDIO_FIXED_ENDPOINT , - .data = &(const struct audioformat ) { + QUIRK_DATA_AUDIOFORMAT(1) { .formats = SNDRV_PCM_FMTBIT_S24_3LE, .channels = 4, .iface = 1,
@@ -3350,9 +2544,7 @@ YAMAHA_DEVICE(0x7010, "UB99"), } } }, - { - .ifnum = -1 - } + QUIRK_COMPOSITE_END } } },
@@ -3365,28 +2557,12 @@ YAMAHA_DEVICE(0x7010, "UB99"),* enabled in create_standard_audio_quirk(). */ USB_DEVICE (0x1686 ,0x00dd ), - .driver_info = (unsigned long ) & (const struct snd_usb_audio_quirk ) { - .ifnum =QUIRK_ANY_INTERFACE , - .type =QUIRK_COMPOSITE , - .data = (const struct snd_usb_audio_quirk []) { - { -/* Playback */ - .ifnum =1 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE , - }, - { -/* Capture */ - .ifnum =2 , - .type =QUIRK_AUDIO_STANDARD_INTERFACE , - }, - { -/* Midi */ - .ifnum =3 , - .type =QUIRK_MIDI_STANDARD_INTERFACE - }, - { - .ifnum =-1 - }, + QUIRK_DRIVER_INFO { + QUIRK_DATA_COMPOSITE { + { QUIRK_DATA_STANDARD_AUDIO(1) }, /* Playback */ + { QUIRK_DATA_STANDARD_AUDIO(2) }, /* Capture */ + { QUIRK_DATA_STANDARD_MIDI(3) }, /* Midi */ + QUIRK_COMPOSITE_END } } },
@@ -3400,18 +2576,16 @@ YAMAHA_DEVICE(0x7010, "UB99"), USB_DEVICE_ID_MATCH_INT_SUBCLASS,
Lines of this file are not shown. View the raw message.
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.43.0
Part of the diff is not shown here. View the raw message.
Greg Kroah-Hartman
maintainerPATCH 112/386 ALSA: usb-audio: Add logitech Audio profile quirk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Pius <[email protected]>
[ Upstream commit a51c925c11d7b855167e64b63eb4378e5adfc11d ]
Specify shortnames for the following Logitech Devices: Rally bar, Rally bar mini, Tap, MeetUp and Huddle.
--- sound/usb/card.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/usb/card.c +6 -0
@@ -384,6 +384,12 @@ static const struct usb_audio_device_name usb_audio_names[] = {/* Creative/Toshiba Multimedia Center SB-0500 */ DEVICE_NAME (0x041e ,0x3048 ,"Toshiba" ,"SB-0500" ), +/* Logitech Audio Devices */ +DEVICE_NAME (0x046d ,0x0867 ,"Logitech, Inc." ,"Logi-MeetUp" ), +DEVICE_NAME (0x046d ,0x0874 ,"Logitech, Inc." ,"Logi-Tap-Audio" ), +DEVICE_NAME (0x046d ,0x087c ,"Logitech, Inc." ,"Logi-Huddle" ), +DEVICE_NAME (0x046d ,0x0898 ,"Logitech, Inc." ,"Logi-RB-Audio" ), +DEVICE_NAME (0x046d ,0x08d2 ,"Logitech, Inc." ,"Logi-RBM-Audio" ),DEVICE_NAME (0x046d ,0x0990 ,"Logitech, Inc." ,"QuickCam Pro 9000" ), DEVICE_NAME(0x05e1, 0x0408, "Syntek", "STK1160"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/386 ASoC: codecs: wsa883x: Handle reading version failure
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 2fbf16992e5aa14acf0441320033a01a32309ded ]
If reading version and variant from registers fails (which is unlikely but possible, because it is a read over bus), the driver will proceed and perform device configuration based on uninitialized stack variables. Handle it a bit better - bail out without doing any init and failing the update status Soundwire callback.
--- sound/soc/codecs/wsa883x.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
sound/soc/codecs/wsa883x.c +11 -5
@@ -998,15 +998,19 @@ static const struct reg_sequence reg_init[] = { {WSA883X_GMAMP_SUP1, 0xE2}, }; -static void wsa883x_init (struct wsa883x_priv *wsa883x) +static int wsa883x_init (struct wsa883x_priv *wsa883x) {struct regmap *regmap = wsa883x->regmap; -int variant, version; +int variant, version, ret; -regmap_read (regmap,WSA883X_OTP_REG_0 , &variant); + ret =regmap_read (regmap,WSA883X_OTP_REG_0 , &variant); +if (ret) +return ret; wsa883x->variant = variant &WSA883X_ID_MASK ; -regmap_read (regmap,WSA883X_CHIP_ID0 , &version); + ret =regmap_read (regmap,WSA883X_CHIP_ID0 , &version); +if (ret) +return ret; wsa883x->version = version;switch (wsa883x->variant) {
@@ -1041,6 +1045,8 @@ static void wsa883x_init(struct wsa883x_priv *wsa883x)WSA883X_DRE_OFFSET_MASK , wsa883x->comp_offset); } + +return 0 ; } static int wsa883x_update_status(struct sdw_slave *slave,
@@ -1049,7 +1055,7 @@ static int wsa883x_update_status(struct sdw_slave *slave,struct wsa883x_priv *wsa883x =dev_get_drvdata (&slave->dev);if (status ==SDW_SLAVE_ATTACHED && slave->dev_num >0 ) -wsa883x_init (wsa883x); +return wsa883x_init (wsa883x);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/386 tools/x86/kcpuid: Protect against faulty "max subleaf" values
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmed S. Darwish <[email protected]>
[ Upstream commit cf96ab1a966b87b09fdd9e8cc8357d2d00776a3a ]
Protect against the kcpuid code parsing faulty max subleaf numbers through a min() expression. Thus, ensuring that max_subleaf will always be ≤ MAX_SUBLEAF_NUM.
Use "u32" for the subleaf numbers since kcpuid is compiled with -Wextra, which includes signed/unsigned comparisons warnings.
--- tools/arch/x86/kcpuid/kcpuid.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
tools/arch/x86/kcpuid/kcpuid.c +5 -7
@@ -7,7 +7,8 @@#include <string.h> #include <getopt.h> -#define ARRAY_SIZE (x) (sizeof(x) / sizeof((x)[0])) +#define ARRAY_SIZE (x) (sizeof(x) / sizeof((x)[0])) +#define min (a, b) (((a) < (b)) ? (a) : (b))typedef unsigned int u32 ;typedef unsigned long long u64 ;
@@ -207,12 +208,9 @@ static void raw_dump_range(struct cpuid_range *range)#define MAX_SUBLEAF_NUM 32struct cpuid_range *setup_cpuid_range (u32 input_eax) { -u32 max_func, idx_func; -int subleaf; +u32 max_func, idx_func, subleaf, max_subleaf; +u32 eax, ebx, ecx, edx, f = input_eax;struct cpuid_range *range; -u32 eax, ebx, ecx, edx; -u32 f = input_eax; -int max_subleaf;bool allzero; eax = input_eax;
@@ -258,7 +256,7 @@ struct cpuid_range *setup_cpuid_range(u32 input_eax)* others have to be tried (0xf) */ if (f ==0x7 || f ==0x14 || f ==0x17 || f ==0x18 ) - max_subleaf = (eax &0xff ) +1 ; + max_subleaf =min ((eax &0xff ) +1 , max_subleaf);if (f ==0xb ) max_subleaf =2 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/386 x86/pkeys: Add PKRU as a parameter in signal handling functions
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aruna Ramakrishna <[email protected]>
[ Upstream commit 24cf2bc982ffe02aeffb4a3885c71751a2c7023b ]
Assume there's a multithreaded application that runs untrusted user code. Each thread has its stack/code protected by a non-zero PKEY, and the PKRU register is set up such that only that particular non-zero PKEY is enabled. Each thread also sets up an alternate signal stack to handle signals, which is protected by PKEY zero. The PKEYs man page documents that the PKRU will be reset to init_pkru when the signal handler is invoked, which means that PKEY zero access will be enabled. But this reset happens after the kernel attempts to push fpu state to the alternate stack, which is not (yet) accessible by the kernel, which leads to a new SIGSEGV being sent to the application, terminating it.
Enabling both the non-zero PKEY (for the thread) and PKEY zero in userspace will not work for this use case. It cannot have the alt stack writeable by all - the rationale here is that the code running in that thread (using a non-zero PKEY) is untrusted and should not have access to the alternate signal stack (that uses PKEY zero), to prevent the return address of a function from being changed. The expectation is that kernel should be able to set up the alternate signal stack and deliver the signal to the application even if PKEY zero is explicitly disabled by the application. The signal handler accessibility should not be dictated by whatever PKRU value the thread sets up.
The PKRU register is managed by XSAVE, which means the sigframe contents must match the register contents - which is not the case here. It's required that the signal frame contains the user-defined PKRU value (so that it is restored correctly from sigcontext) but the actual register must be reset to init_pkru so that the alt stack is accessible and the signal can be delivered to the application. It seems that the proper fix here would be to remove PKRU from the XSAVE framework and manage it separately, which is quite complicated. As a workaround, do this:
orig_pkru = rdpkru();
wrpkru(orig_pkru & init_pkru_value);
xsave_to_user_sigframe();
put_user(pkru_sigframe_addr, orig_pkru)In preparation for writing PKRU to sigframe, pass PKRU as an additional parameter down the call chain from get_sigframe().
No functional change.
--- arch/x86/include/asm/fpu/signal.h | 2 +- arch/x86/kernel/fpu/signal.c | 6 +++--- arch/x86/kernel/signal.c | 3 ++- 3 files changed, 6 insertions(+), 5 deletions(-)
arch/x86/include/asm/fpu/signal.h +1 -1
@@ -29,7 +29,7 @@ fpu__alloc_mathframe(unsigned long sp, int ia32_frame,unsigned long fpu__get_fpstate_size (void ); -extern bool copy_fpstate_to_sigframe (void __user *buf,void __user *fp,int size); +extern bool copy_fpstate_to_sigframe (void __user *buf,void __user *fp,int size,u32 pkru);extern void fpu__clear_user_states (struct fpu *fpu);extern bool fpu__restore_sig (void __user *buf,int ia32_frame);
arch/x86/kernel/fpu/signal.c +3 -3
@@ -156,7 +156,7 @@ static inline bool save_xstate_epilog(void __user *buf, int ia32_frame,return !err; } -static inline int copy_fpregs_to_sigframe (struct xregs_state __user *buf) +static inline int copy_fpregs_to_sigframe (struct xregs_state __user *buf,u32 pkru) {if (use_xsave ())return xsave_to_user_sigframe (buf);
@@ -185,7 +185,7 @@ static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)* For [f]xsave state, update the SW reserved fields in the [f]xsave frame * indicating the absence/presence of the extended state to the user. */ -bool copy_fpstate_to_sigframe (void __user *buf,void __user *buf_fx,int size) +bool copy_fpstate_to_sigframe (void __user *buf,void __user *buf_fx,int size,u32 pkru) {struct task_struct *tsk = current;struct fpstate *fpstate = tsk->thread.fpu.fpstate;
@@ -228,7 +228,7 @@ bool copy_fpstate_to_sigframe(void __user *buf, void __user *buf_fx, int size)fpregs_restore_userregs ();pagefault_disable (); - ret =copy_fpregs_to_sigframe (buf_fx); + ret =copy_fpregs_to_sigframe (buf_fx, pkru);pagefault_enable ();fpregs_unlock ();
arch/x86/kernel/signal.c +2 -1
@@ -83,6 +83,7 @@ get_sigframe(struct ksignal *ksig, struct pt_regs *regs, size_t frame_size,unsigned long math_size =0 ;unsigned long sp = regs->sp;unsigned long buf_fx =0 ; +u32 pkru =read_pkru ();/* redzone */ if (!ia32_frame)
@@ -138,7 +139,7 @@ get_sigframe(struct ksignal *ksig, struct pt_regs *regs, size_t frame_size, }/* save i387 and extended state */ -if (!copy_fpstate_to_sigframe (*fpstate, (void __user *)buf_fx, math_size)) +if (!copy_fpstate_to_sigframe (*fpstate, (void __user *)buf_fx, math_size, pkru))return (void __user *)-1L ;return (void __user *)sp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/386 x86/pkeys: Restore altstack access in sigreturn()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aruna Ramakrishna <[email protected]>
[ Upstream commit d10b554919d4cc8fa8fe2e95b57ad2624728c8e4 ]
A process can disable access to the alternate signal stack by not enabling the altstack's PKEY in the PKRU register.
Nevertheless, the kernel updates the PKRU temporarily for signal handling. However, in sigreturn(), restore_sigcontext() will restore the PKRU to the user-defined PKRU value.
This will cause restore_altstack() to fail with a SIGSEGV as it needs read access to the altstack which is prohibited by the user-defined PKRU value.
Fix this by restoring altstack before restoring PKRU.
--- arch/x86/kernel/signal_64.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/signal_64.c +3 -3
@@ -260,13 +260,13 @@ SYSCALL_DEFINE0(rt_sigreturn)set_current_blocked (&set); -if (!restore_sigcontext (regs, &frame->uc.uc_mcontext, uc_flags)) +if (restore_altstack (&frame->uc.uc_stack)) goto badframe; -if (restore_signal_shadow_stack ()) +if (!restore_sigcontext (regs, &frame->uc.uc_mcontext, uc_flags)) goto badframe; -if (restore_altstack (&frame->uc.uc_stack)) +if (restore_signal_shadow_stack ()) goto badframe;return regs->ax;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/386 x86/kexec: Add EFI config table identity mapping for kexec kernel
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Liu <[email protected]>
[ Upstream commit 5760929f6545c651682de3c2c6c6786816b17bb1 ]
A kexec kernel boot failure is sometimes observed on AMD CPUs due to an unmapped EFI config table array. This can be seen when "nogbpages" is on the kernel command line, and has been observed as a full BIOS reboot rather than a successful kexec.
This was also the cause of reported regressions attributed to Commit 7143c5f4cf20 ("x86/mm/ident_map: Use gbpages only where full GB page should be mapped.") which was subsequently reverted.
To avoid this page fault, explicitly include the EFI config table array in the kexec identity map.
Further explanation:
The following 2 commits caused the EFI config table array to be accessed when enabling sev at kernel startup.
commit ec1c66af3a30 ("x86/compressed/64: Detect/setup SEV/SME features
earlier during boot")
commit c01fce9cef84 ("x86/compressed: Add SEV-SNP feature
detection/setup")
This is in the code that examines whether SEV should be enabled or not, so it can even affect systems that are not SEV capable.
This may result in a page fault if the EFI config table array's address is unmapped. Since the page fault occurs before the new kernel establishes its own identity map and page fault routines, it is unrecoverable and kexec fails.
Most often, this problem is not seen because the EFI config table array gets included in the map by the luck of being placed at a memory address close enough to other memory areas that *are* included in the map created by kexec.
Both the "nogbpages" command line option and the "use gpbages only where full GB page should be mapped" change greatly reduce the chance of being included in the map by luck, which is why the problem appears.
--- arch/x86/kernel/machine_kexec_64.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
arch/x86/kernel/machine_kexec_64.c +27 -0
@@ -28,6 +28,7 @@#include <asm/setup.h> #include <asm/set_memory.h> #include <asm/cpu.h> +#include <asm/efi.h> #ifdef CONFIG_ACPI /*
@@ -90,6 +91,8 @@ map_efi_systab(struct x86_mapping_info *info, pgd_t *level4p) {#ifdef CONFIG_EFI unsigned long mstart, mend; +void *kaddr; +int ret;if (!efi_enabled (EFI_BOOT ))return 0 ;
@@ -105,6 +108,30 @@ map_efi_systab(struct x86_mapping_info *info, pgd_t *level4p)if (!mstart)return 0 ; + ret =kernel_ident_mapping_init (info, level4p, mstart, mend); +if (ret) +return ret; + + kaddr =memremap (mstart, mend - mstart,MEMREMAP_WB ); +if (!kaddr) { +pr_err ("Could not map UEFI system table\n" ); +return -ENOMEM ; + } + + mstart = efi_config_table; + +if (efi_enabled (EFI_64BIT )) { +efi_system_table_64_t *stbl = (efi_system_table_64_t *)kaddr; + + mend = mstart +sizeof (efi_config_table_64_t) * stbl->nr_tables; + }else { +efi_system_table_32_t *stbl = (efi_system_table_32_t *)kaddr; + + mend = mstart +sizeof (efi_config_table_32_t) * stbl->nr_tables; + } + +memunmap (kaddr); +return kernel_ident_mapping_init (info, level4p, mstart, mend);#endif return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/386 ALSA: asihpi: Fix potential OOB array access
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96 ]
ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly.
This patch adds a sanity check of the array index to fit in the array size.
--- sound/pci/asihpi/hpimsgx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/asihpi/hpimsgx.c +1 -1
@@ -708,7 +708,7 @@ static u16 HPIMSGX__init(struct hpi_message *phm, phr->error =HPI_ERROR_PROCESSING_MESSAGE ;return phr->error; } -if (hr.error ==0 ) { +if (hr.error ==0 && hr.u.s.adapter_index <HPI_MAX_ADAPTERS ) {/* the adapter was created successfully save the mapping for future use */ hpi_entry_points[hr.u.s.adapter_index] = entry_point_func;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/386 ALSA: hdsp: Break infinite MIDI input flush loop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit c01f3815453e2d5f699ccd8c8c1f93a5b8669e59 ]
The current MIDI input flush on HDSP and HDSPM drivers relies on the hardware reporting the right value. If the hardware doesn't give the proper value but returns -1, it may be stuck at an infinite loop.
Add a counter and break if the loop is unexpectedly too long.
--- sound/pci/rme9652/hdsp.c | 6 ++++-- sound/pci/rme9652/hdspm.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
sound/pci/rme9652/hdsp.c +4 -2
@@ -1298,8 +1298,10 @@ static int snd_hdsp_midi_output_possible (struct hdsp *hdsp, int id)static void snd_hdsp_flush_midi_input (struct hdsp *hdsp,int id) { -while (snd_hdsp_midi_input_available (hdsp, id)) -snd_hdsp_midi_read_byte (hdsp, id); +int count =256 ; + +while (snd_hdsp_midi_input_available (hdsp, id) && --count) +snd_hdsp_midi_read_byte (hdsp, id); }static int snd_hdsp_midi_output_write (struct hdsp_midi *hmidi)
sound/pci/rme9652/hdspm.c +4 -2
@@ -1838,8 +1838,10 @@ static inline int snd_hdspm_midi_output_possible (struct hdspm *hdspm, int id)static void snd_hdspm_flush_midi_input (struct hdspm *hdspm,int id) { -while (snd_hdspm_midi_input_available (hdspm, id)) -snd_hdspm_midi_read_byte (hdspm, id); +int count =256 ; + +while (snd_hdspm_midi_input_available (hdspm, id) && --count) +snd_hdspm_midi_read_byte (hdspm, id); }static int snd_hdspm_midi_output_write (struct hdspm_midi *hmidi)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/386 tools/nolibc: powerpc: limit stack-protector workaround to GCC
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 1daea158d0aae0770371f3079305a29fdb66829e ]
As mentioned in the comment, the workaround for __attribute__((no_stack_protector)) is only necessary on GCC. Avoid applying the workaround on clang, as clang does not recognize __attribute__((__optimize__)) and would fail.
--- tools/include/nolibc/arch-powerpc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/include/nolibc/arch-powerpc.h +1 -1
@@ -172,7 +172,7 @@ _ret; \ }) -#ifndef __powerpc64__ +#if !defined(__powerpc64__) && !defined(__clang__)/* FIXME: For 32-bit PowerPC, with newer gcc compilers (e.g. gcc 13.1.0), * "omit-frame-pointer" fails with __attribute__((no_stack_protector)) but * works with __attribute__((__optimize__("-fno-stack-protector")))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/386 selftests/nolibc: avoid passing NULL to printf("%s")
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit f1a58f61d88642ae1e6e97e9d72d73bc70a93cb8 ]
Clang on higher optimization levels detects that NULL is passed to printf("%s") and warns about it.
While printf() from nolibc gracefully handles that NULL, it is undefined behavior as per POSIX, so the warning is reasonable. Avoid the warning by transforming NULL into a non-NULL placeholder.
--- tools/testing/selftests/nolibc/nolibc-test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/nolibc/nolibc-test.c +2 -2
@@ -522,7 +522,7 @@ int expect_strzr(const char *expr, int llen) {int ret =0 ; - llen +=printf (" = <%s> " , expr); + llen +=printf (" = <%s> " , expr ? expr :"(null)" );if (expr) { ret =1 ;result (llen,FAIL );
@@ -541,7 +541,7 @@ int expect_strnz(const char *expr, int llen) {int ret =0 ; - llen +=printf (" = <%s> " , expr); + llen +=printf (" = <%s> " , expr ? expr :"(null)" );if (!expr) { ret =1 ;result (llen,FAIL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/386 x86/syscall: Avoid memcpy() for ia32 syscall_get_arguments()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit d19d638b1e6cf746263ef60b7d0dee0204d8216a ]
Modern (fortified) memcpy() prefers to avoid writing (or reading) beyond the end of the addressed destination (or source) struct member:
In function ‘fortify_memcpy_chk’,
inlined from ‘syscall_get_arguments’ at ./arch/x86/include/asm/syscall.h:85:2,
inlined from ‘populate_seccomp_data’ at kernel/seccomp.c:258:2,
inlined from ‘__seccomp_filter’ at kernel/seccomp.c:1231:3:./include/linux/fortify-string.h:580:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
580 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~As already done for x86_64 and compat mode, do not use memcpy() to extract syscall arguments from struct pt_regs but rather just perform direct assignments. Binary output differences are negligible, and actually ends up using less stack space:
- sub $0x84,%esp + sub $0x6c,%esp
and less text size:
text data bss dec hex filename
10794 252 0 11046 2b26 gcc-32b/kernel/seccomp.o.stock 10714 252 0 10966 2ad6 gcc-32b/kernel/seccomp.o.after
--- arch/x86/include/asm/syscall.h | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/include/asm/syscall.h +6 -1
@@ -82,7 +82,12 @@ static inline void syscall_get_arguments(struct task_struct *task,struct pt_regs *regs, unsigned long *args) { - memcpy(args, ®s->bx, 6 * sizeof(args[0])); + args[0 ] = regs->bx; + args[1 ] = regs->cx; + args[2 ] = regs->dx; + args[3 ] = regs->si; + args[4 ] = regs->di; + args[5 ] = regs->bp; }static inline int syscall_get_arch (struct task_struct *task)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/386 hwmon: (nct6775) add G15CF to ASUS WMI monitoring list
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Pauk <[email protected]>
[ Upstream commit 1f432e4cf1dd3ecfec5ed80051b4611632a0fd51 ]
Boards G15CF has got a nct6775 chip, but by default there's no use of it because of resource conflict with WMI method.
Add the board to the WMI monitoring list.
Message-ID: <[email protected]>
--- drivers/hwmon/nct6775-platform.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/nct6775-platform.c +1 -0
@@ -1269,6 +1269,7 @@ static const char * const asus_msi_boards[] = {"EX-B760M-V5 D4" ,"EX-H510M-V3" ,"EX-H610M-V3 D4" , +"G15CF" ,"PRIME A620M-A" ,"PRIME B560-PLUS" , "PRIME B560-PLUS AC-HES",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/386 fbdev: efifb: Register sysfs groups through driver core
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 95cdd538e0e5677efbdf8aade04ec098ab98f457 ]
The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanup.
Also avoid a UAF race during unregistering where the sysctl attributes were usable after the info struct was freed.
--- drivers/video/fbdev/efifb.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/video/fbdev/efifb.c +2 -9
@@ -571,15 +571,10 @@ static int efifb_probe(struct platform_device *dev)break ; } - err =sysfs_create_groups (&dev->dev.kobj, efifb_groups); -if (err) { -pr_err ("efifb: cannot add sysfs attrs\n" ); - goto err_unmap; - } err =fb_alloc_cmap (&info->cmap,256 ,0 );if (err <0 ) {pr_err ("efifb: cannot allocate colormap\n" ); - goto err_groups; + goto err_unmap; }if (efifb_pci_dev)
@@ -603,8 +598,6 @@ static int efifb_probe(struct platform_device *dev)pm_runtime_put (&efifb_pci_dev->dev);fb_dealloc_cmap (&info->cmap); -err_groups: -sysfs_remove_groups (&dev->dev.kobj, efifb_groups); err_unmap:if (mem_flags & (EFI_MEMORY_UC |EFI_MEMORY_WC ))iounmap (info->screen_base);
@@ -624,12 +617,12 @@ static void efifb_remove(struct platform_device *pdev)/* efifb_destroy takes care of info cleanup */ unregister_framebuffer (info); -sysfs_remove_groups (&pdev->dev.kobj, efifb_groups); }static struct platform_driver efifb_driver = { .driver = { .name ="efi-framebuffer" , + .dev_groups = efifb_groups, }, .probe = efifb_probe, .remove_new = efifb_remove,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/386 fbdev: pxafb: Fix possible use after free in pxafb_task()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit 4a6921095eb04a900e0000da83d9475eb958e61e ]
In the pxafb_probe function, it calls the pxafb_init_fbinfo function, after which &fbi->task is associated with pxafb_task. Moreover, within this pxafb_init_fbinfo function, the pxafb_blank function within the &pxafb_ops struct is capable of scheduling work.
If we remove the module which will call pxafb_remove to make cleanup, it will call unregister_framebuffer function which can call do_unregister_framebuffer to free fbi->fb through put_fb_info(fb_info), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| pxafb_task
pxafb_remove |
unregister_framebuffer(info) |
do_unregister_framebuffer(fb_info) |
put_fb_info(fb_info) |
// free fbi->fb | set_ctrlr_state(fbi, state)
| __pxafb_lcd_power(fbi, 0)
| fbi->lcd_power(on, &fbi->fb.var)
| //use fbi->fbFix it by ensuring that the work is canceled before proceeding with the cleanup in pxafb_remove.
Note that only root user can remove the driver at runtime.
--- drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/pxafb.c +1 -0
@@ -2403,6 +2403,7 @@ static void pxafb_remove(struct platform_device *dev) info = &fbi->fb;pxafb_overlay_exit (fbi); +cancel_work_sync (&fbi->task);unregister_framebuffer (info);pxafb_disable_controller (fbi);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/386 rcuscale: Provide clear error when async specified without primitives
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 11377947b5861fa59bf77c827e1dd7c081842cc9 ]
Currently, if the rcuscale module's async module parameter is specified for RCU implementations that do not have async primitives such as RCU Tasks Rude (which now lacks a call_rcu_tasks_rude() function), there will be a series of splats due to calls to a NULL pointer. This commit therefore warns of this situation, but switches to non-async testing.
--- kernel/rcu/rcuscale.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/rcu/rcuscale.c +2 -2
@@ -498,7 +498,7 @@ rcu_scale_writer(void *arg)schedule_timeout_idle (torture_random (&tr) % writer_holdoff_jiffies +1 ); wdp = &wdpp[i]; *wdp =ktime_get_mono_fast_ns (); -if (gp_async) { +if (gp_async && !WARN_ON_ONCE (!cur_ops->async)) { retry:if (!rhp) rhp =kmalloc (sizeof (*rhp),GFP_KERNEL );
@@ -554,7 +554,7 @@ rcu_scale_writer(void *arg) i++;rcu_scale_wait_shutdown (); }while (!torture_must_stop ()); -if (gp_async) { +if (gp_async && cur_ops->async) { cur_ops->gp_barrier (); } writer_n_durations[me] = i_max +1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/386 power: reset: brcmstb: Do not go into infinite loop if reset fails
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <[email protected]>
[ Upstream commit cf8c39b00e982fa506b16f9d76657838c09150cb ]
There may be other backup reset methods available, do not halt here so that other reset methods can be tried.
--- drivers/power/reset/brcmstb-reboot.c | 3 --- 1 file changed, 3 deletions(-)
drivers/power/reset/brcmstb-reboot.c +0 -3
@@ -62,9 +62,6 @@ static int brcmstb_restart_handler(struct notifier_block *this,return NOTIFY_DONE ; } -while (1 ) - ; -return NOTIFY_DONE ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/386 iommu/vt-d: Always reserve a domain ID for identity setup
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
[ Upstream commit 2c13012e09190174614fd6901857a1b8c199e17d ]
We will use a global static identity domain. Reserve a static domain ID for it.
--- drivers/iommu/intel/iommu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/iommu/intel/iommu.c +3 -3
@@ -1692,10 +1692,10 @@ static int iommu_init_domains(struct intel_iommu *iommu)* entry for first-level or pass-through translation modes should * be programmed with a domain id different from those used for * second-level or nested translation. We reserve a domain id for -* this purpose. +* this purpose. This domain id is also used for identity domain +* in legacy mode. */ -if (sm_supported (iommu)) -set_bit (FLPT_DEFAULT_DID , iommu->domain_ids); +set_bit (FLPT_DEFAULT_DID , iommu->domain_ids);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/386 iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay K Kumar <[email protected]>
[ Upstream commit 3cf74230c139f208b7fb313ae0054386eee31a81 ]
If qi_submit_sync() is invoked with 0 invalidation descriptors (for instance, for DMA draining purposes), we can run into a bug where a submitting thread fails to detect the completion of invalidation_wait. Subsequently, this led to a soft lockup. Currently, there is no impact by this bug on the existing users because no callers are submitting invalidations with 0 descriptors. This fix will enable future users (such as DMA drain) calling qi_submit_sync() with 0 count.
Suppose thread T1 invokes qi_submit_sync() with non-zero descriptors, while concurrently, thread T2 calls qi_submit_sync() with zero descriptors. Both threads then enter a while loop, waiting for their respective descriptors to complete. T1 detects its completion (i.e., T1's invalidation_wait status changes to QI_DONE by HW) and proceeds to call reclaim_free_desc() to reclaim all descriptors, potentially including adjacent ones of other threads that are also marked as QI_DONE.
During this time, while T2 is waiting to acquire the qi->q_lock, the IOMMU hardware may complete the invalidation for T2, setting its status to QI_DONE. However, if T1's execution of reclaim_free_desc() frees T2's invalidation_wait descriptor and changes its status to QI_FREE, T2 will not observe the QI_DONE status for its invalidation_wait and will indefinitely remain stuck.
This soft lockup does not occur when only non-zero descriptors are submitted.In such cases, invalidation descriptors are interspersed among wait descriptors with the status QI_IN_USE, acting as barriers. These barriers prevent the reclaim code from mistakenly freeing descriptors belonging to other submitters.
Considered the following example timeline:
T1 T2 ======================================== ID1 WD1 while(WD1!=QI_DONE) unlock lock WD1=QI_DONE* WD2 while(WD2!=QI_DONE) unlock lock WD1==QI_DONE? ID1=QI_DONE WD2=DONE* reclaim() ID1=FREE WD1=FREE WD2=FREE unlock soft lockup! T2 never sees QI_DONE in WD2
Where:
ID = invalidation descriptor
WD = wait descriptor
* Written by hardware
The root of the problem is that the descriptor status QI_DONE flag is used for two conflicting purposes:
1. signal a descriptor is ready for reclaim (to be freed)
2. signal by the hardware that a wait descriptor is complete
The solution (in this patch) is state separation by using QI_FREE flag for #1.
Once a thread's invalidation descriptors are complete, their status would be set to QI_FREE. The reclaim_free_desc() function would then only free descriptors marked as QI_FREE instead of those marked as QI_DONE. This change ensures that T2 (from the previous example) will correctly observe the completion of its invalidation_wait (marked as QI_DONE).
--- drivers/iommu/intel/dmar.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/iommu/intel/dmar.c +11 -5
@@ -1202,9 +1202,7 @@ static void free_iommu(struct intel_iommu *iommu)*/ static inline void reclaim_free_desc (struct q_inval *qi) { -while (qi->desc_status[qi->free_tail] ==QI_DONE || - qi->desc_status[qi->free_tail] ==QI_ABORT ) { - qi->desc_status[qi->free_tail] =QI_FREE ; +while (qi->desc_status[qi->free_tail] ==QI_FREE && qi->free_tail != qi->free_head) { qi->free_tail = (qi->free_tail +1 ) %QI_LENGTH ; qi->free_cnt++; }
@@ -1439,8 +1437,16 @@ int qi_submit_sync(struct intel_iommu *iommu, struct qi_desc *desc,raw_spin_lock (&qi->q_lock); } -for (i =0 ; i < count; i++) - qi->desc_status[(index + i) %QI_LENGTH ] =QI_DONE ; +/* +* The reclaim code can free descriptors from multiple submissions +* starting from the tail of the queue. When count == 0, the +* status of the standalone wait descriptor at the tail of the queue +* must be set to QI_FREE to allow the reclaim code to proceed. +* It is also possible that descriptors from one of the previous +* submissions has to be reclaimed by a subsequent submission. +*/ +for (i =0 ; i <= count; i++) + qi->desc_status[(index + i) %QI_LENGTH ] =QI_FREE ;reclaim_free_desc (qi);raw_spin_unlock_irqrestore (&qi->q_lock, flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/386 cgroup: Disallow mounting v1 hierarchies without controller implementation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Koutný <[email protected]>
[ Upstream commit 3c41382e920f1dd5c9f432948fe799c07af1cced ]
The configs that disable some v1 controllers would still allow mounting them but with no controller-specific files. (Making such hierarchies equivalent to named v1 hierarchies.) To achieve behavior consistent with actual out-compilation of a whole controller, the mounts should treat respective controllers as non-existent.
Wrap implementation into a helper function, leverage legacy_files to detect compiled out controllers. The effect is that mounts on v1 would fail and produce a message like:
[ 1543.999081] cgroup: Unknown subsys name 'memory'
--- kernel/cgroup/cgroup-v1.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
kernel/cgroup/cgroup-v1.c +10 -2
@@ -46,6 +46,12 @@ bool cgroup1_ssid_disabled(int ssid)return cgroup_no_v1_mask & (1 << ssid); } +static bool cgroup1_subsys_absent (struct cgroup_subsys *ss) +{ +/* Check also dfl_cftypes for file-less controllers, i.e. perf_event */ +return ss->legacy_cftypes ==NULL && ss->dfl_cftypes; +} +/** * cgroup_attach_task_all - attach task 'tsk' to all cgroups of task 'from' * @from: attach to all cgroups of a given task
@@ -932,7 +938,8 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param)if (ret != -ENOPARAM )return ret;for_each_subsys (ss, i) { -if (strcmp (param->key, ss->legacy_name)) +if (strcmp (param->key, ss->legacy_name) || +cgroup1_subsys_absent (ss))continue ;if (!cgroup_ssid_enabled (i) ||cgroup1_ssid_disabled (i)) return invalfc(fc, "Disabled controller '%s'",
@@ -1024,7 +1031,8 @@ static int check_cgroupfs_options(struct fs_context *fc) mask = ~((u16 )1 << cpuset_cgrp_id);#endif for_each_subsys (ss, i) -if (cgroup_ssid_enabled (i) && !cgroup1_ssid_disabled (i)) +if (cgroup_ssid_enabled (i) && !cgroup1_ssid_disabled (i) && + !cgroup1_subsys_absent (ss)) enabled |=1 << i; ctx->subsys_mask &= enabled;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/386 drm/stm: Avoid use-after-free issues with crtc and plane
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Katya Orlova <[email protected]>
[ Upstream commit 19dd9780b7ac673be95bf6fd6892a184c9db611f ]
ltdc_load() calls functions drm_crtc_init_with_planes(), drm_universal_plane_init() and drm_encoder_init(). These functions should not be called with parameters allocated with devm_kzalloc() to avoid use-after-free issues [1].
Use allocations managed by the DRM framework.
Found by Linux Verification Center (linuxtesting.org).
[1]
https://lore.kernel.org/lkml/u366i76e3qhh3ra5oxrtngjtm2u5lterkekcz6y2jkndhuxzli@diujon4h7qwb/
--- drivers/gpu/drm/stm/drv.c | 3 +- drivers/gpu/drm/stm/ltdc.c | 73 ++++++++++---------------------------- 2 files changed, 20 insertions(+), 56 deletions(-)
drivers/gpu/drm/stm/drv.c +2 -1
@@ -25,6 +25,7 @@#include <drm/drm_module.h> #include <drm/drm_probe_helper.h> #include <drm/drm_vblank.h> +#include <drm/drm_managed.h> #include "ltdc.h"
@@ -75,7 +76,7 @@ static int drv_load(struct drm_device *ddev)DRM_DEBUG ("%s\n" , __func__); - ldev =devm_kzalloc (ddev->dev,sizeof (*ldev),GFP_KERNEL ); + ldev =drmm_kzalloc (ddev,sizeof (*ldev),GFP_KERNEL );if (!ldev)return -ENOMEM ;
drivers/gpu/drm/stm/ltdc.c +18 -55
177 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/386 drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Eric Pelloux-Prayer <[email protected]>
[ Upstream commit fec5f8e8c6bcf83ed7a392801d7b44c5ecfc1e82 ]
Before this commit, only submits with both a BO_HANDLES chunk and a 'bo_list_handle' would be rejected (by amdgpu_cs_parser_bos).
But if UMD sent multiple BO_HANDLES, what would happen is:
* only the last one would be really used
* all the others would leak memory as amdgpu_cs_p1_bo_handles would overwrite the previous p->bo_list value
This commit rejects submissions with multiple BO_HANDLES chunks to match the implementation of the parser.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +4 -0
@@ -263,6 +263,10 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,if (size <sizeof (struct drm_amdgpu_bo_list_in )) goto free_partial_kdata; +/* Only a single BO list is allowed to simplify handling. */ +if (p->bo_list) + ret = -EINVAL ; + ret =amdgpu_cs_p1_bo_handles (p, p->chunks[i].kdata);if (ret) goto free_partial_kdata;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/386 drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit c86ad39140bbcb9dc75a10046c2221f657e8083b ]
Pass pointer reference to amdgpu_bo_unref to clear the correct pointer, otherwise amdgpu_bo_unref clear the local variable, the original pointer not set to NULL, this could cause use-after-free bug.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 14 +++++++------- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 ++-- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 4 ++-- 8 files changed, 16 insertions(+), 16 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +7 -7
@@ -335,15 +335,15 @@ int amdgpu_amdkfd_alloc_gtt_mem(struct amdgpu_device *adev, size_t size,return r; } -void amdgpu_amdkfd_free_gtt_mem (struct amdgpu_device *adev,void *mem_obj) +void amdgpu_amdkfd_free_gtt_mem (struct amdgpu_device *adev,void **mem_obj) { -struct amdgpu_bo *bo = (struct amdgpu_bo *) mem_obj; +struct amdgpu_bo **bo = (struct amdgpu_bo **) mem_obj; -amdgpu_bo_reserve (bo, true); -amdgpu_bo_kunmap (bo); -amdgpu_bo_unpin (bo); -amdgpu_bo_unreserve (bo); -amdgpu_bo_unref (&(bo)); +amdgpu_bo_reserve (*bo, true); +amdgpu_bo_kunmap (*bo); +amdgpu_bo_unpin (*bo); +amdgpu_bo_unreserve (*bo); +amdgpu_bo_unref (bo); } int amdgpu_amdkfd_alloc_gws(struct amdgpu_device *adev, size_t size,
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +1 -1
@@ -221,7 +221,7 @@ int amdgpu_amdkfd_evict_userptr(struct mmu_interval_notifier *mni,int amdgpu_amdkfd_alloc_gtt_mem (struct amdgpu_device *adev,size_t size,void **mem_obj,uint64_t *gpu_addr,void **cpu_ptr,bool mqd_gfx9); -void amdgpu_amdkfd_free_gtt_mem (struct amdgpu_device *adev,void *mem_obj); +void amdgpu_amdkfd_free_gtt_mem (struct amdgpu_device *adev,void **mem_obj);int amdgpu_amdkfd_alloc_gws (struct amdgpu_device *adev,size_t size,void **mem_obj);void amdgpu_amdkfd_free_gws (struct amdgpu_device *adev,void *mem_obj);
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +1 -1
@@ -417,7 +417,7 @@ static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p, err_create_queue:if (wptr_bo) -amdgpu_amdkfd_free_gtt_mem (dev->adev, wptr_bo); +amdgpu_amdkfd_free_gtt_mem (dev->adev, (void **)&wptr_bo); err_wptr_map_gart: err_bind_process: err_pdd:
drivers/gpu/drm/amd/amdkfd/kfd_device.c +2 -2
@@ -838,7 +838,7 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, kfd_doorbell_error:kfd_gtt_sa_fini (kfd); kfd_gtt_sa_init_error: -amdgpu_amdkfd_free_gtt_mem (kfd->adev, kfd->gtt_mem); +amdgpu_amdkfd_free_gtt_mem (kfd->adev, &kfd->gtt_mem); alloc_gtt_mem_failure: dev_err(kfd_device, "device %x:%x NOT added due to errors\n",
@@ -856,7 +856,7 @@ void kgd2kfd_device_exit(struct kfd_dev *kfd)kfd_doorbell_fini (kfd);ida_destroy (&kfd->doorbell_ida);kfd_gtt_sa_fini (kfd); -amdgpu_amdkfd_free_gtt_mem (kfd->adev, kfd->gtt_mem); +amdgpu_amdkfd_free_gtt_mem (kfd->adev, &kfd->gtt_mem); }kfree (kfd);
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c +1 -1
@@ -2610,7 +2610,7 @@ static void deallocate_hiq_sdma_mqd(struct kfd_node *dev, {WARN (!mqd,"No hiq sdma mqd trunk to free" ); -amdgpu_amdkfd_free_gtt_mem (dev->adev, mqd->gtt_mem); +amdgpu_amdkfd_free_gtt_mem (dev->adev, &mqd->gtt_mem); }void device_queue_manager_uninit (struct device_queue_manager *dqm)
drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c +1 -1
@@ -223,7 +223,7 @@ void kfd_free_mqd_cp(struct mqd_manager *mm, void *mqd, struct kfd_mem_obj *mqd_mem_obj) {if (mqd_mem_obj->gtt_mem) { -amdgpu_amdkfd_free_gtt_mem (mm->dev->adev, mqd_mem_obj->gtt_mem); +amdgpu_amdkfd_free_gtt_mem (mm->dev->adev, &mqd_mem_obj->gtt_mem);kfree (mqd_mem_obj); }else {kfd_gtt_sa_free (mm->dev, mqd_mem_obj);
drivers/gpu/drm/amd/amdkfd/kfd_process.c +1 -1
@@ -1047,7 +1047,7 @@ static void kfd_process_destroy_pdds(struct kfd_process *p)if (pdd->dev->kfd->shared_resources.enable_mes)amdgpu_amdkfd_free_gtt_mem (pdd->dev->adev, - pdd->proc_ctx_bo); + &pdd->proc_ctx_bo);/* * before destroying pdd, make sure to report availability * for auto suspend
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +2 -2
@@ -199,9 +199,9 @@ static void pqm_clean_queue_resource(struct process_queue_manager *pqm, }if (dev->kfd->shared_resources.enable_mes) { -amdgpu_amdkfd_free_gtt_mem (dev->adev, pqn->q->gang_ctx_bo); +amdgpu_amdkfd_free_gtt_mem (dev->adev, &pqn->q->gang_ctx_bo);if (pqn->q->wptr_bo) -amdgpu_amdkfd_free_gtt_mem (dev->adev, pqn->q->wptr_bo); +amdgpu_amdkfd_free_gtt_mem (dev->adev, (void **)&pqn->q->wptr_bo); } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/386 drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 66d71a72539e173a9b00ca0b1852cbaa5f5bf1ad ]
This commit addresses a null pointer dereference issue in the commit_planes_for_stream function at line 4140. The issue could occur when top_pipe_to_program is null.
The fix adds a check to ensure top_pipe_to_program is not null before accessing its stream_res. This prevents a null pointer dereference.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:4140 commit_planes_for_stream() error: we previously assumed 'top_pipe_to_program' could be null (see line 3906)
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -1
@@ -3797,7 +3797,8 @@ static void commit_planes_for_stream(struct dc *dc, }if ((update_type !=UPDATE_TYPE_FAST ) && stream->update_flags.bits.dsc_changed) -if (top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { +if (top_pipe_to_program && + top_pipe_to_program->stream_res.tg->funcs->lock_doublebuffer_enable) { top_pipe_to_program->stream_res.tg->funcs->wait_for_state ( top_pipe_to_program->stream_res.tg,CRTC_STATE_VACTIVE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/386 ata: pata_serverworks: Do not use the term blacklist
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 858048568c9e3887d8b19e101ee72f129d65cb15 ]
Let's not use the term blacklist in the function serverworks_osb4_filter() documentation comment and rather simply refer to what that function looks at: the list of devices with groken UDMA5.
While at it, also constify the values of the csb_bad_ata100 array.
Of note is that all of this should probably be handled using libata quirk mechanism but it is unclear if these UDMA5 quirks are specific to this controller only.
--- drivers/ata/pata_serverworks.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/ata/pata_serverworks.c +9 -7
@@ -46,10 +46,11 @@#define SVWKS_CSB5_REVISION_NEW 0x92/* min PCI_REVISION_ID for UDMA5 (A2.0) */ #define SVWKS_CSB6_REVISION 0xa0/* min PCI_REVISION_ID for UDMA4 (A1.0) */ -/* Seagate Barracuda ATA IV Family drives in UDMA mode 5 -* can overrun their FIFOs when used with the CSB5 */ - -static const char *csb_bad_ata100[] = { +/* +* Seagate Barracuda ATA IV Family drives in UDMA mode 5 +* can overrun their FIFOs when used with the CSB5. +*/ +static const char *const csb_bad_ata100[] = {"ST320011A" ,"ST340016A" ,"ST360021A" ,
@@ -163,10 +164,11 @@ static unsigned int serverworks_osb4_filter(struct ata_device *adev, unsigned in* @adev: ATA device * @mask: Mask of proposed modes * -* Check the blacklist and disable UDMA5 if matched +* Check the list of devices with broken UDMA5 and +* disable UDMA5 if matched. */ - -static unsigned int serverworks_csb_filter (struct ata_device *adev,unsigned int mask) +static unsigned int serverworks_csb_filter (struct ata_device *adev, +unsigned int mask) {const char *p;char model_num[ATA_ID_PROD_LEN +1 ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/386 ata: sata_sil: Rename sil_blacklist to sil_quirks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <[email protected]>
[ Upstream commit 93b0f9e11ce511353c65b7f924cf5f95bd9c3aba ]
Rename the array sil_blacklist to sil_quirks as this name is more neutral and is also consistent with how this driver define quirks with the SIL_QUIRK_XXX flags.
--- drivers/ata/sata_sil.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/ata/sata_sil.c +6 -6
@@ -128,7 +128,7 @@ static const struct pci_device_id sil_pci_tbl[] = {static const struct sil_drivelist {const char *product;unsigned int quirk; -} sil_blacklist [] = { +} sil_quirks[] = { {"ST320012AS" ,SIL_QUIRK_MOD15WRITE }, {"ST330013AS" ,SIL_QUIRK_MOD15WRITE }, {"ST340017AS" ,SIL_QUIRK_MOD15WRITE },
@@ -600,8 +600,8 @@ static void sil_thaw(struct ata_port *ap)* list, and apply the fixups to only the specific * devices/hosts/firmwares that need it. * -* 20040111 - Seagate drives affected by the Mod15Write bug are blacklisted -* The Maxtor quirk is in the blacklist, but I'm keeping the original +* 20040111 - Seagate drives affected by the Mod15Write bug are quirked +* The Maxtor quirk is in sil_quirks, but I'm keeping the original * pessimistic fix for the following reasons... * - There seems to be less info on it, only one device gleaned off the * Windows driver, maybe only one is affected. More info would be greatly
@@ -620,9 +620,9 @@ static void sil_dev_config(struct ata_device *dev)ata_id_c_string (dev->id, model_num,ATA_ID_PROD ,sizeof (model_num)); -for (n =0 ; sil_blacklist[n].product; n++) -if (!strcmp (sil_blacklist[n].product, model_num)) { - quirks = sil_blacklist[n].quirk; +for (n =0 ; sil_quirks[n].product; n++) +if (!strcmp (sil_quirks[n].product, model_num)) { + quirks = sil_quirks[n].quirk;break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/386 HID: Ignore battery for all ELAN I2C-HID devices
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit bcc31692a1d1e21f0d06c5f727c03ee299d2264e ]
Before this change there were 16 vid:pid based quirks to ignore the battery reported by Elan I2C-HID touchscreens on various Asus and HP laptops.
And a report has been received that the 04F3:2A00 I2C touchscreen on the HP ProBook x360 11 G5 EE/86CF also reports a non present battery.
Since I2C-HID devices are always builtin to laptops they are not battery owered so it should be safe to just ignore the battery on all Elan I2C-HID devices, rather then adding a 17th quirk for the 04F3:2A00 touchscreen.
As reported in the changelog of commit a3a5a37efba1 ("HID: Ignore battery for ELAN touchscreens 2F2C and 4116"), which added 2 new Elan touchscreen quirks about a month ago, the HID reported battery seems to be related to a stylus being used. But even when a stylus is in use it does not properly report the charge of the stylus battery, instead the reported battery charge jumps from 0% to 1%. So it is best to just ignore the HID battery.
--- drivers/hid/hid-ids.h | 16 ---------------- drivers/hid/hid-input.c | 37 +++++-------------------------------- 2 files changed, 5 insertions(+), 48 deletions(-)
drivers/hid/hid-ids.h +0 -16
@@ -411,24 +411,8 @@#define USB_DEVICE_ID_TOSHIBA_CLICK_L9W 0x0401#define USB_DEVICE_ID_HP_X2 0x074d#define USB_DEVICE_ID_HP_X2_10_COVER 0x0755 -#define I2C_DEVICE_ID_HP_ENVY_X360_15 0x2d05 -#define I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100 0x29CF -#define I2C_DEVICE_ID_HP_ENVY_X360_EU0009NV 0x2CF9 -#define I2C_DEVICE_ID_HP_SPECTRE_X360_15 0x2817 -#define I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG 0x29DF -#define I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN 0x2BC8 -#define I2C_DEVICE_ID_ASUS_GV301RA_TOUCHSCREEN 0x2C82 -#define I2C_DEVICE_ID_ASUS_UX3402_TOUCHSCREEN 0x2F2C -#define I2C_DEVICE_ID_ASUS_UX6404_TOUCHSCREEN 0x4116#define USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN 0x2544#define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706 -#define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN 0x261A -#define I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN 0x2A1C -#define I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN 0x279F -#define I2C_DEVICE_ID_HP_SPECTRE_X360_13T_AW100 0x29F5 -#define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V1 0x2BED -#define I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V2 0x2BEE -#define I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG 0x2D02#define I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM 0x2F81#define USB_VENDOR_ID_ELECOM 0x056e
drivers/hid/hid-input.c +5 -32
@@ -373,14 +373,6 @@ static const struct hid_device_id hid_battery_quirks[] = { {HID_BLUETOOTH_DEVICE (USB_VENDOR_ID_LOGITECH ,USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD ), HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_TP420IA_TOUCHSCREEN), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_GV301RA_TOUCHSCREEN), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_UX3402_TOUCHSCREEN), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_ASUS_UX6404_TOUCHSCREEN), - HID_BATTERY_QUIRK_IGNORE }, { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN), HID_BATTERY_QUIRK_IGNORE }, { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ASUS_UX550VE_TOUCHSCREEN),
@@ -391,32 +383,13 @@ static const struct hid_device_id hid_battery_quirks[] = { HID_BATTERY_QUIRK_AVOID_QUERY }, {HID_USB_DEVICE (USB_VENDOR_ID_UGEE ,USB_DEVICE_ID_UGEE_XPPEN_TABLET_DECO_PRO_SW ), HID_BATTERY_QUIRK_AVOID_QUERY }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15T_DR100), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_EU0009NV), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_13_AW0020NG), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO2_TOUCHSCREEN), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_LENOVO_YOGA_C630_TOUCHSCREEN), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_13T_AW100), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V1), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_14T_EA100_V2), - HID_BATTERY_QUIRK_IGNORE }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_ENVY_X360_15_EU0556NG), - HID_BATTERY_QUIRK_IGNORE }, { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM), HID_BATTERY_QUIRK_AVOID_QUERY }, +/* +* Elan I2C-HID touchscreens seem to all report a non present battery, +* set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices. +*/ + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, {} };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/386 drm/amd/display: Handle null stream_status in planes_changed_for_existing_stream
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 8141f21b941710ecebe49220b69822cab3abd23d ]
This commit adds a null check for 'stream_status' in the function 'planes_changed_for_existing_stream'. Previously, the code assumed 'stream_status' could be null, but did not handle the case where it was actually null. This could lead to a null pointer dereference.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc_resource.c:3784 planes_changed_for_existing_stream() error: we previously assumed 'stream_status' could be null (see line 3774)
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +3 -1
@@ -2877,8 +2877,10 @@ static bool planes_changed_for_existing_stream(struct dc_state *context, } } -if (!stream_status) +if (!stream_status) {ASSERT (0 ); +return false; + }for (i =0 ; i < set_count; i++)if (set[i].stream == stream)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/386 drm/amd/display: Check null pointers before using dc->clk_mgr
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 95d9e0803e51d5a24276b7643b244c7477daf463 ]
[WHY & HOW]dc->clk_mgr is null checked previously in the same function, indicating it might be null.
Passing "dc" to "dc->hwss.apply_idle_power_optimizations", which dereferences null "dc->clk_mgr". (The function pointer resolves to "dcn35_apply_idle_power_optimizations".)
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +2 -1
@@ -4716,7 +4716,8 @@ void dc_allow_idle_optimizations(struct dc *dc, bool allow)if (allow == dc->idle_optimizations_allowed)return ; -if (dc->hwss.apply_idle_power_optimizations && dc->hwss.apply_idle_power_optimizations (dc, allow)) +if (dc->hwss.apply_idle_power_optimizations && dc->clk_mgr !=NULL && + dc->hwss.apply_idle_power_optimizations (dc, allow)) dc->idle_optimizations_allowed = allow; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/386 drm/amd/display: Add null check for afb in amdgpu_dm_plane_handle_cursor_update (v2)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit cd9e9e0852d501f169aa3bb34e4b413d2eb48c37 ]
This commit adds a null check for the 'afb' variable in the amdgpu_dm_plane_handle_cursor_update function. Previously, 'afb' was assumed to be null, but was used later in the code without a null check. This could potentially lead to a null pointer dereference.
Changes since v1:
- Moved the null check for 'afb' to the line where 'afb' is used. (Alex)
Fixes the below:drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_plane.c:1298 amdgpu_dm_plane_handle_cursor_update() error: we previously assumed 'afb' could be null (see line 1252)
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c +2 -1
@@ -1281,7 +1281,8 @@ void amdgpu_dm_plane_handle_cursor_update(struct drm_plane *plane, adev->dm.dc->caps.color.dpp.gamma_corr) attributes.attribute_flags.bits.ENABLE_CURSOR_DEGAMMA =1 ; - attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ]; +if (afb) + attributes.pitch = afb->base.pitches[0 ] / afb->base.format->cpp[0 ];if (crtc_state->stream) {mutex_lock (&adev->dm.dc_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/386 drm/amd/display: fix double free issue during amdgpu module unload
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 20b5a8f9f4670a8503aa9fa95ca632e77c6bf55d ]
Flexible endpoints use DIGs from available inflexible endpoints, so only the encoders of inflexible links need to be freed. Otherwise, a double free issue may occur when unloading the amdgpu module.
[ 279.190523] RIP: 0010:__slab_free+0x152/0x2f0 [ 279.190577] Call Trace: [ 279.190580] <TASK> [ 279.190582] ? show_regs+0x69/0x80 [ 279.190590] ? die+0x3b/0x90 [ 279.190595] ? do_trap+0xc8/0xe0 [ 279.190601] ? do_error_trap+0x73/0xa0 [ 279.190605] ? __slab_free+0x152/0x2f0 [ 279.190609] ? exc_invalid_op+0x56/0x70 [ 279.190616] ? __slab_free+0x152/0x2f0 [ 279.190642] ? asm_exc_invalid_op+0x1f/0x30 [ 279.190648] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191096] ? __slab_free+0x152/0x2f0 [ 279.191102] ? dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191469] kfree+0x260/0x2b0 [ 279.191474] dcn10_link_encoder_destroy+0x19/0x30 [amdgpu] [ 279.191821] link_destroy+0xd7/0x130 [amdgpu] [ 279.192248] dc_destruct+0x90/0x270 [amdgpu] [ 279.192666] dc_destroy+0x19/0x40 [amdgpu] [ 279.193020] amdgpu_dm_fini+0x16e/0x200 [amdgpu] [ 279.193432] dm_hw_fini+0x26/0x40 [amdgpu] [ 279.193795] amdgpu_device_fini_hw+0x24c/0x400 [amdgpu] [ 279.194108] amdgpu_driver_unload_kms+0x4f/0x70 [amdgpu] [ 279.194436] amdgpu_pci_remove+0x40/0x80 [amdgpu] [ 279.194632] pci_device_remove+0x3a/0xa0 [ 279.194638] device_remove+0x40/0x70 [ 279.194642] device_release_driver_internal+0x1ad/0x210 [ 279.194647] driver_detach+0x4e/0xa0 [ 279.194650] bus_remove_driver+0x6f/0xf0 [ 279.194653] driver_unregister+0x33/0x60 [ 279.194657] pci_unregister_driver+0x44/0x90 [ 279.194662] amdgpu_exit+0x19/0x1f0 [amdgpu] [ 279.194939] __do_sys_delete_module.isra.0+0x198/0x2f0 [ 279.194946] __x64_sys_delete_module+0x16/0x20 [ 279.194950] do_syscall_64+0x58/0x120 [ 279.194954] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 279.194980] </TASK>
--- drivers/gpu/drm/amd/display/dc/link/link_factory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/link/link_factory.c +1 -1
@@ -403,7 +403,7 @@ static void link_destruct(struct dc_link *link)if (link->panel_cntl) link->panel_cntl->funcs->destroy (&link->panel_cntl); -if (link->link_enc) { +if (link->link_enc && !link->is_dig_mapping_flexible) {/* Update link encoder resource tracking variables. These are used for * the dynamic assignment of link encoders to streams. Virtual links * are not assigned encoder resources on creation.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/386 jfs: UBSAN: shift-out-of-bounds in dbFindBits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remington Brasga <[email protected]>
[ Upstream commit b0b2fc815e514221f01384f39fbfbff65d897e1c ]
Fix issue with UBSAN throwing shift-out-of-bounds warning.
--- fs/jfs/jfs_dmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +1 -1
@@ -3022,7 +3022,7 @@ static int dbFindBits(u32 word, int l2nb)/* scan the word for nb free bits at nb alignments. */ -for (bitno =0 ; mask !=0 ; bitno += nb, mask >>= nb) { +for (bitno =0 ; mask !=0 ; bitno += nb, mask = (mask >> nb)) {if ((mask & word) == mask)break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/386 jfs: Fix uaf in dbFreeBits
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234 ]
[syzbot reported]
==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 Read of size 8 at addr ffff8880229254b0 by task syz-executor357/5216 CPU: 0 UID: 0 PID: 5216 Comm: syz-executor357 Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __mutex_lock_common kernel/locking/mutex.c:587 [inline] __mutex_lock+0xfe/0xd70 kernel/locking/mutex.c:752 dbFreeBits+0x7ea/0xd90 fs/jfs/jfs_dmap.c:2390 dbFreeDmap fs/jfs/jfs_dmap.c:2089 [inline] dbFree+0x35b/0x680 fs/jfs/jfs_dmap.c:409 dbDiscardAG+0x8a9/0xa20 fs/jfs/jfs_dmap.c:1650 jfs_ioc_trim+0x433/0x670 fs/jfs/jfs_discard.c:100 jfs_ioctl+0x2d0/0x3e0 fs/jfs/ioctl.c:131 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 Freed by task 5218: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kfree+0x149/0x360 mm/slub.c:4594 dbUnmount+0x11d/0x190 fs/jfs/jfs_dmap.c:278 jfs_mount_rw+0x4ac/0x6a0 fs/jfs/jfs_mount.c:247 jfs_remount+0x3d1/0x6b0 fs/jfs/super.c:454 reconfigure_super+0x445/0x880 fs/super.c:1083 vfs_cmd_reconfigure fs/fsopen.c:263 [inline] vfs_fsconfig_locked fs/fsopen.c:292 [inline] __do_sys_fsconfig fs/fsopen.c:473 [inline] __se_sys_fsconfig+0xb6e/0xf80 fs/fsopen.c:345 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Analysis]
There are two paths (dbUnmount and jfs_ioc_trim) that generate race condition when accessing bmap, which leads to the occurrence of uaf.
Use the lock s_umount to synchronize them, in order to avoid uaf caused by race condition.
--- fs/jfs/jfs_discard.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
fs/jfs/jfs_discard.c +9 -2
@@ -65,7 +65,7 @@ void jfs_issue_discard(struct inode *ip, u64 blkno, u64 nblocks)int jfs_ioc_trim (struct inode *ip,struct fstrim_range *range) {struct inode *ipbmap =JFS_SBI (ip->i_sb)->ipbmap; -struct bmap *bmp =JFS_SBI (ip->i_sb)->bmap; +struct bmap *bmp;struct super_block *sb = ipbmap->i_sb;int agno, agno_end;u64 start, end, minlen;
@@ -83,10 +83,15 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range)if (minlen ==0 ) minlen =1 ; +down_read (&sb->s_umount); + bmp =JFS_SBI (ip->i_sb)->bmap; +if (minlen > bmp->db_agsize || start >= bmp->db_mapsize || - range->len < sb->s_blocksize) + range->len < sb->s_blocksize) { +up_read (&sb->s_umount);return -EINVAL ; + }if (end >= bmp->db_mapsize) end = bmp->db_mapsize -1 ;
@@ -100,6 +105,8 @@ int jfs_ioc_trim(struct inode *ip, struct fstrim_range *range) trimmed +=dbDiscardAG (ip, agno, minlen); agno++; } + +up_read (&sb->s_umount); range->len = trimmed << sb->s_blocksize_bits;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/386 jfs: check if leafidx greater than num leaves per dmap tree
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
[ Upstream commit d64ff0d2306713ff084d4b09f84ed1a8c75ecc32 ]
syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.
Shaggy:
Modified sanity check to apply to control pages as well as leaf pages.
--- fs/jfs/jfs_dmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +4 -1
@@ -2944,9 +2944,10 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)static int dbFindLeaf (dmtree_t *tp,int l2nb,int *leafidx,bool is_ctl) {int ti, n =0 , k, x =0 ; -int max_size; +int max_size, max_idx; max_size = is_ctl ?CTLTREESIZE :TREESIZE ; + max_idx = is_ctl ?LPERCTL :LPERDMAP ;/* first check the root of the tree to see if there is * sufficient free space.
@@ -2978,6 +2979,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)*/ assert (n <4 ); } +if (le32_to_cpu (tp->dmt_leafidx) >= max_idx) +return -ENOSPC ;/* set the return to the leftmost leaf describing sufficient * free space.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/386 scsi: smartpqi: correct stream detection
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Rajashekhara <[email protected]>
[ Upstream commit 4c76114932d1d6fad2e72823e7898a3c960cf2a7 ]
Correct stream detection by initializing the structure pqi_scsi_dev_raid_map_data to 0s.
When the OS issues SCSI READ commands, the driver erroneously considers them as SCSI WRITES. If they are identified as sequential IOs, the driver then submits those requests via the RAID path instead of the AIO path.
The 'is_write' flag might be set for SCSI READ commands also. The driver may interpret SCSI READ commands as SCSI WRITE commands, resulting in IOs being submitted through the RAID path.
Note: This does not cause data corruption.
--- drivers/scsi/smartpqi/smartpqi_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/smartpqi/smartpqi_init.c +1 -1
@@ -5918,7 +5918,7 @@ static bool pqi_is_parity_write_stream(struct pqi_ctrl_info *ctrl_info,int rc;struct pqi_scsi_dev *device;struct pqi_stream_data *pqi_stream_data; -struct pqi_scsi_dev_raid_map_data rmd; +struct pqi_scsi_dev_raid_map_data rmd = {0 };if (!ctrl_info->enable_stream_detection)return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/386 drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 16007768551d5bfe53426645401435ca8d2ef54f ]
There are some cases, such as the one uncovered by Commit 46d4efcccc68 ("drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails") where
msm_gpu_cleanup() : platform_set_drvdata(gpu->pdev, NULL);
is called on gpu->pdev == NULL, as the GPU device has not been fully initialized yet.
Turns out that there's more than just the aforementioned path that causes this to happen (e.g. the case when there's speedbin data in the catalog, but opp-supported-hw is missing in DT).
Assigning msm_gpu->pdev earlier seems like the least painful solution to this, therefore do so.
Patchwork: https://patchwork.freedesktop.org/patch/602742/
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 + drivers/gpu/drm/msm/msm_gpu.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +1 -0
@@ -1071,6 +1071,7 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, adreno_gpu->chip_id = config->chip_id; gpu->allow_relocs = config->info->family <ADRENO_6XX_GEN1 ; + gpu->pdev = pdev;/* Only handle the core clock when GMU is not in use (or is absent). */ if (adreno_has_gmu_wrapper(adreno_gpu) ||
drivers/gpu/drm/msm/msm_gpu.c +0 -1
@@ -927,7 +927,6 @@ int msm_gpu_init(struct drm_device *drm, struct platform_device *pdev,if (IS_ERR (gpu->gpu_cx)) gpu->gpu_cx =NULL ; - gpu->pdev = pdev;platform_set_drvdata (pdev, &gpu->adreno_smmu);msm_devfreq_init (gpu);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/386 jfs: Fix uninit-value access of new_ea in ea_buffer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Mengmeng <[email protected]>
[ Upstream commit 2b59ffad47db1c46af25ccad157bb3b25147c35c ]
syzbot reports that lzo1x_1_do_compress is using uninit-value:
=====================================================
BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178
...
Uninit was stored to memory at:
ea_put fs/jfs/xattr.c:639 [inline]
...
Local variable ea_buf created at:
__jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934
=====================================================
The reason is ea_buf->new_ea is not initialized properly.
Fix this by using memset to empty its content at the beginning in ea_get().
--- fs/jfs/xattr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/jfs/xattr.c +2 -0
@@ -434,6 +434,8 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)int rc;int quota_allocation =0 ; +memset (&ea_buf->new_ea,0 ,sizeof (ea_buf->new_ea)); +/* When fsck.jfs clears a bad ea, it doesn't clear the size */ if (ji->ea.flag ==0 ) ea_size =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/386 drm/amdgpu: add raven1 gfxoff quirk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 0126c0ae11e8b52ecfde9d1b174ee2f32d6c3a5d ]
Fix screen corruption with openkylin.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -1172,6 +1172,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = { { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 },/* Apple MacBook Pro (15-inch, 2019) Radeon Pro Vega 20 4 GB */ { 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 }, +/* https://bbs.openkylin.top/t/topic/171497 */ + { 0x1002, 0x15d8, 0x19e5, 0x3e14, 0xc2 }, { 0, 0, 0, 0, 0 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/386 drm/amdgpu: enable gfxoff quirk on HP 705G4
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Liu <[email protected]>
[ Upstream commit 2c7795e245d993bcba2f716a8c93a5891ef910c9 ]
Enabling gfxoff quirk results in perfectly usable graphical user interface on HP 705G4 DM with R5 2400G.
Without the quirk, X server is completely unusable as every few seconds there is gpu reset due to ring gfx timeout.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -1174,6 +1174,8 @@ static const struct amdgpu_gfxoff_quirk amdgpu_gfxoff_quirk_list[] = { { 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 },/* https://bbs.openkylin.top/t/topic/171497 */ { 0x1002, 0x15d8, 0x19e5, 0x3e14, 0xc2 }, +/* HP 705G4 DM with R5 2400G */ + { 0x1002, 0x15dd, 0x103c, 0x8464, 0xd6 }, { 0, 0, 0, 0, 0 }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/386 drm/amdkfd: Fix resource leak in criu restore queue
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit aa47fe8d3595365a935921a90d00bc33ee374728 ]
To avoid memory leaks, release q_extra_data when exiting the restore queue.
v2: Correct the proto (Alex)
--- drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c +1 -0
@@ -982,6 +982,7 @@ int kfd_criu_restore_queue(struct kfd_process *p,pr_debug ("Queue id %d was restored successfully\n" , queue_id);kfree (q_data); +kfree (q_extra_data);return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/386 HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vishnu Sankar <[email protected]>
[ Upstream commit 65b72ea91a257a5f0cb5a26b01194d3dd4b85298 ]
This applies similar quirks used by previous generation device, so that Trackpoint and buttons on the touchpad works. New USB KBD PID 0x61AE for Thinkpad X12 Tab is added.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -788,6 +788,7 @@#define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5#define USB_DEVICE_ID_LENOVO_X12_TAB 0x60fe +#define USB_DEVICE_ID_LENOVO_X12_TAB2 0x61ae#define USB_DEVICE_ID_LENOVO_OPTICAL_USB_MOUSE_600E 0x600e#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019
drivers/hid/hid-multitouch.c +6 -0
@@ -2116,6 +2116,12 @@ static const struct hid_device_id mt_devices[] = { USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) }, +/* Lenovo X12 TAB Gen 2 */ + { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU, +HID_DEVICE (BUS_USB ,HID_GROUP_MULTITOUCH_WIN_8 , +USB_VENDOR_ID_LENOVO , + USB_DEVICE_ID_LENOVO_X12_TAB2) }, + /* Logitech devices */ { .driver_data = MT_CLS_NSMU, HID_DEVICE(BUS_BLUETOOTH, HID_GROUP_MULTITOUCH_WIN_8,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/386 platform/x86: touchscreen_dmi: add nanote-next quirk
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ckath <[email protected]>
[ Upstream commit c11619af35bae5884029bd14170c3e4b55ddf6f3 ]
Add touschscreen info for the nanote next (UMPC-03-SR).
After checking with multiple owners the DMI info really is this generic.
--- drivers/platform/x86/touchscreen_dmi.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +26 -0
@@ -885,6 +885,21 @@ static const struct ts_dmi_data rwc_nanote_p8_data = { .properties = rwc_nanote_p8_props, }; +static const struct property_entry rwc_nanote_next_props[] = { +PROPERTY_ENTRY_U32 ("touchscreen-min-x" ,5 ), +PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,5 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1785 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1145 ), +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), +PROPERTY_ENTRY_STRING ("firmware-name" ,"gsl1680-rwc-nanote-next.fw" ), + { } +}; + +static const struct ts_dmi_data rwc_nanote_next_data = { + .acpi_name ="MSSL1680:00" , + .properties = rwc_nanote_next_props, +}; +static const struct property_entry schneider_sct101ctm_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1715 ),PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1140 ),
@@ -1648,6 +1663,17 @@ const struct dmi_system_id touchscreen_dmi_table[] = {DMI_MATCH (DMI_PRODUCT_SKU ,"0001" ) }, }, + { +/* RWC NANOTE NEXT */ + .driver_data = (void *)&rwc_nanote_next_data, + .matches = { +DMI_MATCH (DMI_PRODUCT_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_NAME ,"To be filled by O.E.M." ), +DMI_MATCH (DMI_BOARD_VENDOR ,"To be filled by O.E.M." ), +/* Above matches are too generic, add bios-version match */ + DMI_MATCH(DMI_BIOS_VERSION, "S8A70R100-V005"), + }, + }, {/* Schneider SCT101CTM */ .driver_data = (void *)&schneider_sct101ctm_data,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 153/386 drm/stm: ltdc: reset plane transparency after plane disable
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yannick Fertre <[email protected]>
[ Upstream commit 02fa62d41c8abff945bae5bfc3ddcf4721496aca ]
The plane's opacity should be reseted while the plane is disabled. It prevents from seeing a possible global or layer background color set earlier.
--- drivers/gpu/drm/stm/ltdc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/stm/ltdc.c +3 -0
@@ -1513,6 +1513,9 @@ static void ltdc_plane_atomic_disable(struct drm_plane *plane,/* Disable layer */ regmap_write_bits (ldev->regmap,LTDC_L1CR + lofs,LXCR_LEN |LXCR_CLUTEN |LXCR_HMEN ,0 ); +/* Reset the layer transparency to hide any related background color */ +regmap_write_bits (ldev->regmap,LTDC_L1CACR + lofs,LXCACR_CONSTA ,0x00 ); +/* Commit shadow registers = update plane at next vblank */ if (ldev->caps.plane_reg_shadow) regmap_write_bits(ldev->regmap, LTDC_L1RCR + lofs,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 154/386 drm/amd/display: Check stream before comparing them
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 35ff747c86767937ee1e0ca987545b7eed7a0810 ]
[WHAT & HOW]amdgpu_dm can pass a null stream to dc_is_stream_unchanged. It is necessary to check for null before dereferencing them.
This fixes 1 FORWARD_NULL issue reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -0
@@ -2154,6 +2154,8 @@ static bool are_stream_backends_same(bool dc_is_stream_unchanged (struct dc_stream_state *old_stream,struct dc_stream_state *stream) { +if (!old_stream || !stream) +return false;if (!are_stream_backends_same (old_stream, stream))return false;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 155/386 drm/amd/display: Check link_res->hpo_dp_link_enc before using it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 0beca868cde8742240cd0038141c30482d2b7eb8 ]
[WHAT & HOW]
Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing.
This fixes 2 FORWARD_NULL issues reported by Coverity.
--- .../gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c +7 -0
@@ -28,6 +28,8 @@#include "dccg.h" #include "clk_mgr.h" +#define DC_LOGGER link->ctx->logger +void set_hpo_dp_throttled_vcp_size (struct pipe_ctx *pipe_ctx,struct fixed31_32 throttled_vcp_size) {
@@ -124,6 +126,11 @@ void disable_hpo_dp_link_output(struct dc_link *link,const struct link_resource *link_res, enum signal_type signal) { + if (!link_res->hpo_dp_link_enc) { + DC_LOG_ERROR("%s: invalid hpo_dp_link_enc\n", __func__); +return ; + } + link_res->hpo_dp_link_enc->funcs->link_disable (link_res->hpo_dp_link_enc); link_res->hpo_dp_link_enc->funcs->disable_link_phy ( link_res->hpo_dp_link_enc, signal);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/386 drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit bc50b614d59990747dd5aeced9ec22f9258991ff ]
This commit addresses a potential index out of bounds issue in the cm3_helper_translate_curve_to_degamma_hw_format function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:338 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:339 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:340 cm3_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +2 -0
@@ -355,6 +355,8 @@ bool cm3_helper_translate_curve_to_degamma_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/386 drm/amd/display: Fix index out of bounds in degamma hardware format translation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit b7e99058eb2e86aabd7a10761e76cae33d22b49f ]
Fixes index out of bounds issue in cm_helper_translate_curve_to_degamma_hw_format function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error.
Reported by smatch:drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +2 -0
@@ -571,6 +571,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 158/386 drm/amd/display: Fix index out of bounds in DCN30 color transformation
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit d81873f9e715b72d4f8d391c8eb243946f784dfc ]
This commit addresses a potential index out of bounds issue in the cm3_helper_translate_curve_to_hw_format function in the DCN30 color management module. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).
The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds, the function returns false to indicate an error.
drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:180 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:181 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn30/dcn30_cm_common.c:182 cm3_helper_translate_curve_to_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_cm_common.c +2 -0
@@ -178,6 +178,8 @@ bool cm3_helper_translate_curve_to_hw_format( i += increment) {if (j == hw_points -1 )break ; +if (i >=TRANSFER_FUNC_POINTS ) +return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 159/386 drm/amd/display: Avoid overflow assignment in link_dp_cts
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit a15268787b79fd183dd526cc16bec9af4f4e49a1 ]
sampling_rate is an uint8_t but is assigned an unsigned int, and thus it can overflow. As a result, sampling_rate is changed to uint32_t.
Similarly, LINK_QUAL_PATTERN_SET has a size of 2 bits, and it should only be assigned to a value less or equal than 4.
This fixes 2 INTEGER_OVERFLOW issues reported by Coverity.
--- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c | 3 ++- drivers/gpu/drm/amd/display/include/dpcd_defs.h | 1 + 3 files changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dc_dp_types.h +1 -1
@@ -721,7 +721,7 @@ struct dp_audio_test_data_flags {struct dp_audio_test_data {struct dp_audio_test_data_flags flags; -uint8_t sampling_rate; +uint32_t sampling_rate;uint8_t channel_count;uint8_t pattern_type;uint8_t pattern_period[8 ];
drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c +2 -1
@@ -849,7 +849,8 @@ bool dp_set_test_pattern(core_link_read_dpcd (link,DP_TRAINING_PATTERN_SET , &training_pattern.raw,sizeof (training_pattern)); - training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern; +if (pattern <=PHY_TEST_PATTERN_END_DP11 ) + training_pattern.v1_3.LINK_QUAL_PATTERN_SET = pattern;core_link_write_dpcd (link,DP_TRAINING_PATTERN_SET , &training_pattern.raw,sizeof (training_pattern));
drivers/gpu/drm/amd/display/include/dpcd_defs.h +1 -0
@@ -76,6 +76,7 @@ enum dpcd_phy_test_patterns {PHY_TEST_PATTERN_D10_2 ,PHY_TEST_PATTERN_SYMBOL_ERROR ,PHY_TEST_PATTERN_PRBS7 , +PHY_TEST_PATTERN_END_DP11 =PHY_TEST_PATTERN_PRBS7 ,PHY_TEST_PATTERN_80BIT_CUSTOM ,/* For DP1.2 only */ PHY_TEST_PATTERN_CP2520_1 , PHY_TEST_PATTERN_CP2520_2,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 160/386 drm/amd/display: Initialize get_bytes_per_elements default to 1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <[email protected]>
[ Upstream commit 4067f4fa0423a89fb19a30b57231b384d77d2610 ]
Variables, used as denominators and maybe not assigned to other values, should not be 0. bytes_per_element_y & bytes_per_element_c are initialized by get_bytes_per_element() which should never return 0.
This fixes 10 DIVIDE_BY_ZERO issues reported by Coverity.
--- .../gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn20/display_rq_dlg_calc_20v2.c +1 -1
@@ -78,7 +78,7 @@ static void calculate_ttu_cursor(struct display_mode_lib *mode_lib,static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
drivers/gpu/drm/amd/display/dc/dml/dcn21/display_rq_dlg_calc_21.c +1 -1
@@ -53,7 +53,7 @@ static void calculate_ttu_cursor(static unsigned int get_bytes_per_element (enum source_format_class source_format,bool is_chroma) { -unsigned int ret_val =0 ; +unsigned int ret_val =1 ;if (source_format == dm_444_16) {if (!is_chroma)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 161/386 drm/printer: Allow NULL data in devcoredump printer
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <[email protected]>
[ Upstream commit 53369581dc0c68a5700ed51e1660f44c4b2bb524 ]
We want to determine the size of the devcoredump before writing it out. To that end, we will run the devcoredump printer with NULL data to get the size, alloc data based on the generated offset, then run the devcorecump again with a valid data pointer to print. This necessitates not writing data to the data pointer on the initial pass, when it is NULL.
v5:
- Better commit message (Jonathan)
- Add kerenl doc with examples (Jani)
--- drivers/gpu/drm/drm_print.c | 13 +++++---- include/drm/drm_print.h | 54 ++++++++++++++++++++++++++++++++++++- 2 files changed, 61 insertions(+), 6 deletions(-)
drivers/gpu/drm/drm_print.c +8 -5
@@ -100,8 +100,9 @@ void __drm_puts_coredump(struct drm_printer *p, const char *str) copy = iterator->remain;/* Copy out the bit of the string that we need */ -memcpy (iterator->data, - str + (iterator->start - iterator->offset), copy); +if (iterator->data) +memcpy (iterator->data, + str + (iterator->start - iterator->offset), copy); iterator->offset = iterator->start + copy; iterator->remain -= copy;
@@ -110,7 +111,8 @@ void __drm_puts_coredump(struct drm_printer *p, const char *str) len =min_t (ssize_t,strlen (str), iterator->remain); -memcpy (iterator->data + pos, str, len); +if (iterator->data) +memcpy (iterator->data + pos, str, len); iterator->offset += len; iterator->remain -= len;
@@ -140,8 +142,9 @@ void __drm_printfn_coredump(struct drm_printer *p, struct va_format *vaf)if ((iterator->offset >= iterator->start) && (len < iterator->remain)) {ssize_t pos = iterator->offset - iterator->start; -snprintf (((char *) iterator->data) + pos, - iterator->remain,"%pV" , vaf); +if (iterator->data) +snprintf (((char *) iterator->data) + pos, + iterator->remain,"%pV" , vaf); iterator->offset += len; iterator->remain -= len;
include/drm/drm_print.h +53 -1
66 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 162/386 perf,x86: avoid missing caller address in stack traces captured in uprobe
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit cfa7f3d2c526c224a6271cc78a4a27a0de06f4f0 ]
When tracing user functions with uprobe functionality, it's common to install the probe (e.g., a BPF program) at the first instruction of the function. This is often going to be push %rbp instruction in function preamble, which means that within that function frame pointer hasn't been established yet. This leads to consistently missing an actual caller of the traced function, because perf_callchain_user() only records current IP (capturing traced function) and then following frame pointer chain (which would be caller's frame, containing the address of caller's caller).
So when we have target_1 -> target_2 -> target_3 call chain and we are tracing an entry to target_3, captured stack trace will report target_1 -> target_3 call chain, which is wrong and confusing.
This patch proposes a x86-64-specific heuristic to detect push %rbp (push %ebp on 32-bit architecture) instruction being traced. Given entire kernel implementation of user space stack trace capturing works under assumption that user space code was compiled with frame pointer register (%rbp/%ebp) preservation, it seems pretty reasonable to use this instruction as a strong indicator that this is the entry to the function. In that case, return address is still pointed to by %rsp/%esp, so we fetch it and add to stack trace before proceeding to unwind the rest using frame pointer-based logic.
We also check for endbr64 (for 64-bit modes) as another common pattern for function entry, as suggested by Josh Poimboeuf. Even if we get this wrong sometimes for uprobes attached not at the function entry, it's OK because stack trace will still be overall meaningful, just with one extra bogus entry. If we don't detect this, we end up with guaranteed to be missing caller function entry in the stack trace, which is worse overall.
--- arch/x86/events/core.c | 63 +++++++++++++++++++++++++++++++++++++++++ include/linux/uprobes.h | 2 ++ kernel/events/uprobes.c | 2 ++ 3 files changed, 67 insertions(+)
arch/x86/events/core.c +63 -0
@@ -41,6 +41,8 @@#include <asm/desc.h> #include <asm/ldt.h> #include <asm/unwind.h> +#include <asm/uprobes.h> +#include <asm/ibt.h> #include "perf_event.h"
@@ -2816,6 +2818,46 @@ static unsigned long get_segment_base(unsigned int segment)return get_desc_base (desc); } +#ifdef CONFIG_UPROBES +/* +* Heuristic-based check if uprobe is installed at the function entry. +* +* Under assumption of user code being compiled with frame pointers, +* `push %rbp/%ebp` is a good indicator that we indeed are. +* +* Similarly, `endbr64` (assuming 64-bit mode) is also a common pattern. +* If we get this wrong, captured stack trace might have one extra bogus +* entry, but the rest of stack trace will still be meaningful. +*/ +static bool is_uprobe_at_func_entry (struct pt_regs *regs) +{ +struct arch_uprobe *auprobe; + +if (!current->utask) +return false; + + auprobe = current->utask->auprobe; +if (!auprobe) +return false; + +/* push %rbp/%ebp */ +if (auprobe->insn[0 ] ==0x55 ) +return true; + +/* endbr64 (64-bit only) */ +if (user_64bit_mode (regs) &&is_endbr (*(u32 *)auprobe->insn)) +return true; + +return false; +} + +#else +static bool is_uprobe_at_func_entry (struct pt_regs *regs) +{ +return false; +} +#endif /* CONFIG_UPROBES */ +#ifdef CONFIG_IA32_EMULATION #include <linux/compat.h>
@@ -2827,6 +2869,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *entunsigned long ss_base, cs_base;struct stack_frame_ia32 frame;const struct stack_frame_ia32 __user *fp; +u32 ret_addr;if (user_64bit_mode (regs))return 0 ;
@@ -2836,6 +2879,12 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry_ctx *ent fp =compat_ptr (ss_base + regs->bp);pagefault_disable (); + +/* see perf_callchain_user() below for why we do this */ +if (is_uprobe_at_func_entry (regs) && + !get_user (ret_addr, (const u32 __user *)regs->sp)) +perf_callchain_store (entry, ret_addr); +while (entry->nr < entry->max_stack) {if (!valid_user_frame (fp,sizeof (frame)))break ;
@@ -2864,6 +2913,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs {struct stack_frame frame;const struct stack_frame __user *fp; +unsigned long ret_addr;if (perf_guest_state ()) {/* TODO: We don't support guest os callchain now */
@@ -2887,6 +2937,19 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regsreturn ;pagefault_disable (); + +/* +* If we are called from uprobe handler, and we are indeed at the very +* entry to user function (which is normally a `push %rbp` instruction, +* under assumption of application being compiled with frame pointers), +* we should read return address from *regs->sp before proceeding +* to follow frame pointers, otherwise we'll skip immediate caller +* as %rbp is not yet setup. +*/ +if (is_uprobe_at_func_entry (regs) && + !get_user (ret_addr, (const unsigned long __user *)regs->sp)) +perf_callchain_store (entry, ret_addr); +while (entry->nr < entry->max_stack) {if (!valid_user_frame (fp,sizeof (frame)))break ;
include/linux/uprobes.h +2 -0
@@ -76,6 +76,8 @@ struct uprobe_task {struct uprobe *active_uprobe;unsigned long xol_vaddr; +struct arch_uprobe *auprobe; +struct return_instance *return_instances;unsigned int depth; };
kernel/events/uprobes.c +2 -0
@@ -2071,6 +2071,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs)bool need_prep = false;/* prepare return uprobe, when needed */ down_read (&uprobe->register_rwsem); + current->utask->auprobe = &uprobe->arch;for (uc = uprobe->consumers; uc; uc = uc->next) {int rc =0 ;
@@ -2085,6 +2086,7 @@ static void handler_chain(struct uprobe *uprobe, struct pt_regs *regs) remove &= rc; } + current->utask->auprobe =NULL ;if (need_prep && !remove)prepare_uretprobe (uprobe, regs);/* put bp at return */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 163/386 scsi: aacraid: Rearrange order of struct aac_srb_unit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit 6e5860b0ad4934baee8c7a202c02033b2631bb44 ]
struct aac_srb_unit contains struct aac_srb, which contains struct sgmap, which ends in a (currently) "fake" (1-element) flexible array. Converting this to a flexible array is needed so that runtime bounds checking won't think the array is fixed size (i.e. under CONFIG_FORTIFY_SOURCE=y and/or CONFIG_UBSAN_BOUNDS=y), as other parts of aacraid use struct sgmap as a flexible array.
It is not legal to have a flexible array in the middle of a structure, so it either needs to be split up or rearranged so that it is at the end of the structure. Luckily, struct aac_srb_unit, which is exclusively consumed/updated by aac_send_safw_bmic_cmd(), does not depend on member ordering.
The values set in the on-stack struct aac_srb_unit instance "srbu" by the only two callers, aac_issue_safw_bmic_identify() and aac_get_safw_ciss_luns(), do not contain anything in srbu.srb.sgmap.sg, and they both implicitly initialize srbu.srb.sgmap.count to 0 during memset(). For example:
memset(&srbu, 0, sizeof(struct aac_srb_unit));
srbcmd = &srbu.srb;
srbcmd->flags = cpu_to_le32(SRB_DataIn);
srbcmd->cdb[0] = CISS_REPORT_PHYSICAL_LUNS;
srbcmd->cdb[1] = 2; /* extended reporting */
srbcmd->cdb[8] = (u8)(datasize >> 8);
srbcmd->cdb[9] = (u8)(datasize);
rcode = aac_send_safw_bmic_cmd(dev, &srbu, phys_luns, datasize);During aac_send_safw_bmic_cmd(), a separate srb is mapped into DMA, and has srbu.srb copied into it:
srb = fib_data(fibptr);
memcpy(srb, &srbu->srb, sizeof(struct aac_srb));Only then is srb.sgmap.count written and srb->sg populated:
srb->count = cpu_to_le32(xfer_len);
sg64 = (struct sgmap64 *)&srb->sg;
sg64->count = cpu_to_le32(1);
sg64->sg[0].addr[1] = cpu_to_le32(upper_32_bits(addr));
sg64->sg[0].addr[0] = cpu_to_le32(lower_32_bits(addr));
sg64->sg[0].count = cpu_to_le32(xfer_len);But this is happening in the DMA memory, not in srbu.srb. An attempt to copy the changes back to srbu does happen:
/*
* Copy the updated data for other dumping or other usage if
* needed
*/
memcpy(&srbu->srb, srb, sizeof(struct aac_srb));But this was never correct: the sg64 (3 u32s) overlap of srb.sg (2 u32s) always meant that srbu.srb would have held truncated information and any attempt to walk srbu.srb.sg.sg based on the value of srbu.srb.sg.count would result in attempting to parse past the end of srbu.srb.sg.sg[0] into srbu.srb_reply.
After getting a reply from hardware, the reply is copied into srbu.srb_reply:
srb_reply = (struct aac_srb_reply *)fib_data(fibptr);
memcpy(&srbu->srb_reply, srb_reply, sizeof(struct aac_srb_reply));This has always been fixed-size, so there's no issue here. It is worth noting that the two callers _never check_ srbu contents -- neither srbu.srb nor srbu.srb_reply is examined. (They depend on the mapped xfer_buf instead.)
Therefore, the ordering of members in struct aac_srb_unit does not matter, and the flexible array member can moved to the end.
(Additionally, the two memcpy()s that update srbu could be entirely removed as they are never consumed, but I left that as-is.)
--- drivers/scsi/aacraid/aacraid.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/aacraid/aacraid.h +1 -1
@@ -2029,8 +2029,8 @@ struct aac_srb_reply };struct aac_srb_unit { -struct aac_srb srb;struct aac_srb_reply srb_reply; +struct aac_srb srb; };/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 164/386 scsi: lpfc: Update PRLO handling in direct attached topology
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 1f0f7679ad8942f810b0f19ee9cf098c3502d66a ]
A kref imbalance occurs when handling an unsolicited PRLO in direct attached topology.
Rework PRLO rcv handling when in MAPPED state. Save the state that we were handling a PRLO by setting nlp_last_elscmd to ELS_CMD_PRLO. Then in the lpfc_cmpl_els_logo_acc() completion routine, manually restart discovery. By issuing the PLOGI, which nlp_gets, before nlp_put at the end of the lpfc_cmpl_els_logo_acc() routine, we are saving us from a final nlp_put. And, we are still allowing the unreg_rpi to happen.
--- drivers/scsi/lpfc/lpfc_els.c | 27 ++++++++++++++++----------- drivers/scsi/lpfc/lpfc_nportdisc.c | 22 ++++++++++++++++++++-- 2 files changed, 36 insertions(+), 13 deletions(-)
drivers/scsi/lpfc/lpfc_els.c +16 -11
@@ -5228,9 +5228,10 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,/* ACC to LOGO completes to NPort <nlp_DID> */ lpfc_printf_vlog (vport,KERN_INFO ,LOG_ELS ,"0109 ACC to LOGO completes to NPort x%x refcnt %d " -"Data: x%x x%x x%x\n" , - ndlp->nlp_DID,kref_read (&ndlp->kref), ndlp->nlp_flag, - ndlp->nlp_state, ndlp->nlp_rpi); +"last els x%x Data: x%x x%x x%x\n" , + ndlp->nlp_DID,kref_read (&ndlp->kref), + ndlp->nlp_last_elscmd, ndlp->nlp_flag, ndlp->nlp_state, + ndlp->nlp_rpi);/* This clause allows the LOGO ACC to complete and free resources * for the Fabric Domain Controller. It does deliberately skip
@@ -5242,18 +5243,22 @@ lpfc_cmpl_els_logo_acc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, goto out;if (ndlp->nlp_state ==NLP_STE_NPR_NODE ) { -/* If PLOGI is being retried, PLOGI completion will cleanup the -* node. The NLP_NPR_2B_DISC flag needs to be retained to make -* progress on nodes discovered from last RSCN. -*/ -if ((ndlp->nlp_flag &NLP_DELAY_TMO ) && - (ndlp->nlp_last_elscmd ==ELS_CMD_PLOGI )) - goto out; -if (ndlp->nlp_flag &NLP_RPI_REGISTERED )lpfc_unreg_rpi (vport, ndlp); +/* If came from PRLO, then PRLO_ACC is done. +* Start rediscovery now. +*/ +if (ndlp->nlp_last_elscmd ==ELS_CMD_PRLO ) { +spin_lock_irq (&ndlp->lock); + ndlp->nlp_flag |=NLP_NPR_2B_DISC ; +spin_unlock_irq (&ndlp->lock); + ndlp->nlp_prev_state = ndlp->nlp_state; +lpfc_nlp_set_state (vport, ndlp,NLP_STE_PLOGI_ISSUE ); +lpfc_issue_els_plogi (vport, ndlp->nlp_DID,0 ); + } } + out:/* * The driver received a LOGO from the rport and has ACK'd it.
drivers/scsi/lpfc/lpfc_nportdisc.c +20 -2
@@ -2635,8 +2635,26 @@ lpfc_rcv_prlo_mapped_node(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,/* flush the target */ lpfc_sli_abort_iocb (vport, ndlp->nlp_sid,0 ,LPFC_CTX_TGT ); -/* Treat like rcv logo */ -lpfc_rcv_logo (vport, ndlp, cmdiocb,ELS_CMD_PRLO ); +/* Send PRLO_ACC */ +spin_lock_irq (&ndlp->lock); + ndlp->nlp_flag |=NLP_LOGO_ACC ; +spin_unlock_irq (&ndlp->lock); +lpfc_els_rsp_acc (vport,ELS_CMD_PRLO , cmdiocb, ndlp,NULL ); + +/* Save ELS_CMD_PRLO as the last elscmd and then set to NPR. +* lpfc_cmpl_els_logo_acc is expected to restart discovery. +*/ + ndlp->nlp_last_elscmd =ELS_CMD_PRLO ; + ndlp->nlp_prev_state = ndlp->nlp_state; + +lpfc_printf_vlog (vport,KERN_INFO ,LOG_NODE |LOG_ELS |LOG_DISCOVERY , +"3422 DID x%06x nflag x%x lastels x%x ref cnt %u\n" , + ndlp->nlp_DID, ndlp->nlp_flag, + ndlp->nlp_last_elscmd, +kref_read (&ndlp->kref)); + +lpfc_nlp_set_state (vport, ndlp,NLP_STE_NPR_NODE ); +return ndlp->nlp_state; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 165/386 drm/amdgpu: fix unchecked return value warning for amdgpu_gfx
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit c0277b9d7c2ee9ee5dbc948548984f0fbb861301 ]
This resolves the unchecded return value warning reported by Coverity.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +14 -4
@@ -793,8 +793,11 @@ int amdgpu_gfx_ras_late_init(struct amdgpu_device *adev, struct ras_common_if *rint r;if (amdgpu_ras_is_supported (adev, ras_block->block)) { -if (!amdgpu_persistent_edc_harvesting_supported (adev)) -amdgpu_ras_reset_error_status (adev,AMDGPU_RAS_BLOCK__GFX ); +if (!amdgpu_persistent_edc_harvesting_supported (adev)) { + r =amdgpu_ras_reset_error_status (adev,AMDGPU_RAS_BLOCK__GFX ); +if (r) +return r; + } r =amdgpu_ras_block_late_init (adev, ras_block);if (r)
@@ -938,7 +941,10 @@ uint32_t amdgpu_kiq_rreg(struct amdgpu_device *adev, uint32_t reg)pr_err ("critical bug! too many kiq readers\n" ); goto failed_unlock; } -amdgpu_ring_alloc (ring,32 ); + r =amdgpu_ring_alloc (ring,32 ); +if (r) + goto failed_unlock; +amdgpu_ring_emit_rreg (ring, reg, reg_val_offs); r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT );if (r)
@@ -1004,7 +1010,10 @@ void amdgpu_kiq_wreg(struct amdgpu_device *adev, uint32_t reg, uint32_t v) }spin_lock_irqsave (&kiq->ring_lock, flags); -amdgpu_ring_alloc (ring,32 ); + r =amdgpu_ring_alloc (ring,32 ); +if (r) + goto failed_unlock; +amdgpu_ring_emit_wreg (ring, reg, v); r =amdgpu_fence_emit_polling (ring, &seq,MAX_KIQ_REG_WAIT );if (r)
@@ -1040,6 +1049,7 @@ void amdgpu_kiq_wreg(struct amdgpu_device *adev, uint32_t reg, uint32_t v) failed_undo:amdgpu_ring_undo (ring); +failed_unlock:spin_unlock_irqrestore (&kiq->ring_lock, flags); failed_kiq_write:dev_err (adev->dev,"failed to write reg:%x\n" , reg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/386 perf: Fix event_function_call() locking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
[ Upstream commit 558abc7e3f895049faa46b08656be4c60dc6e9fd ]
All the event_function/@func call context already uses perf_ctx_lock() except for the !ctx->is_active case. Make it all consistent.
--- kernel/events/core.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
kernel/events/core.c +5 -4
@@ -263,6 +263,7 @@ static int event_function(void *info)static void event_function_call (struct perf_event *event,event_f func,void *data) {struct perf_event_context *ctx = event->ctx; +struct perf_cpu_context *cpuctx =this_cpu_ptr (&perf_cpu_context);struct task_struct *task =READ_ONCE (ctx->task);/* verified in event_function */ struct event_function_struct efs = { .event = event,
@@ -291,22 +292,22 @@ static void event_function_call(struct perf_event *event, event_f func, void *daif (!task_function_call (task, event_function, &efs))return ; -raw_spin_lock_irq (&ctx->lock); +perf_ctx_lock (cpuctx, ctx);/* * Reload the task pointer, it might have been changed by * a concurrent perf_event_context_sched_out(). */ task = ctx->task;if (task ==TASK_TOMBSTONE ) { -raw_spin_unlock_irq (&ctx->lock); +perf_ctx_unlock (cpuctx, ctx);return ; }if (ctx->is_active) { -raw_spin_unlock_irq (&ctx->lock); +perf_ctx_unlock (cpuctx, ctx); goto again; }func (event,NULL , ctx, data); -raw_spin_unlock_irq (&ctx->lock); +perf_ctx_unlock (cpuctx, ctx); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/386 scsi: NCR5380: Initialize buffer for MSG IN and STATUS transfers
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 1c71065df2df693d208dd32758171c1dece66341 ]
Following an incomplete transfer in MSG IN phase, the driver would not notice the problem and would make use of invalid data. Initialize 'tmp' appropriately and bail out if no message was received. For STATUS phase, preserve the existing status code unless a new value was transferred.
--- drivers/scsi/NCR5380.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/NCR5380.c +4 -0
@@ -1807,8 +1807,11 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)return ;case PHASE_MSGIN : len =1 ; + tmp =0xff ; data = &tmp;NCR5380_transfer_pio (instance, &phase, &len, &data,0 ); +if (tmp ==0xff ) +break ; ncmd->message = tmp;switch (tmp) {
@@ -1996,6 +1999,7 @@ static void NCR5380_information_transfer(struct Scsi_Host *instance)break ;case PHASE_STATIN : len =1 ; + tmp = ncmd->status; data = &tmp;NCR5380_transfer_pio (instance, &phase, &len, &data,0 ); ncmd->status = tmp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/386 drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit c6dbab46324b1742b50dc2fb5c1fee2c28129439 ]
With -Werror:
In function ‘r100_cp_init_microcode’,
inlined from ‘r100_cp_init’ at drivers/gpu/drm/radeon/r100.c:1136:7:
include/linux/printk.h:465:44: error: ‘%s’ directive argument is null [-Werror=format-overflow=]
465 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
| ^
include/linux/printk.h:437:17: note: in definition of macro ‘printk_index_wrap’
437 | _p_func(_fmt, ##__VA_ARGS__); \
| ^~~~~~~
include/linux/printk.h:508:9: note: in expansion of macro ‘printk’
508 | printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~
drivers/gpu/drm/radeon/r100.c:1062:17: note: in expansion of macro ‘pr_err’
1062 | pr_err("radeon_cp: Failed to load firmware \"%s\"\n", fw_name);
| ^~~~~~Fix this by converting the if/else if/... construct into a proper switch() statement with a default to handle the error case.
As a bonus, the generated code is ca. 100 bytes smaller (with gcc 11.4.0 targeting arm32).
--- drivers/gpu/drm/radeon/r100.c | 70 ++++++++++++++++++++++------------- 1 file changed, 45 insertions(+), 25 deletions(-)
drivers/gpu/drm/radeon/r100.c +45 -25
@@ -1015,45 +1015,65 @@ static int r100_cp_init_microcode(struct radeon_device *rdev)DRM_DEBUG_KMS ("\n" ); -if ((rdev->family ==CHIP_R100 ) || (rdev->family ==CHIP_RV100 ) || - (rdev->family ==CHIP_RV200 ) || (rdev->family ==CHIP_RS100 ) || - (rdev->family ==CHIP_RS200 )) { +switch (rdev->family) { +case CHIP_R100 : +case CHIP_RV100 : +case CHIP_RV200 : +case CHIP_RS100 : +case CHIP_RS200 :DRM_INFO ("Loading R100 Microcode\n" ); fw_name =FIRMWARE_R100 ; - }else if ((rdev->family ==CHIP_R200 ) || - (rdev->family ==CHIP_RV250 ) || - (rdev->family ==CHIP_RV280 ) || - (rdev->family ==CHIP_RS300 )) { +break ; + +case CHIP_R200 : +case CHIP_RV250 : +case CHIP_RV280 : +case CHIP_RS300 :DRM_INFO ("Loading R200 Microcode\n" ); fw_name =FIRMWARE_R200 ; - }else if ((rdev->family ==CHIP_R300 ) || - (rdev->family ==CHIP_R350 ) || - (rdev->family ==CHIP_RV350 ) || - (rdev->family ==CHIP_RV380 ) || - (rdev->family ==CHIP_RS400 ) || - (rdev->family ==CHIP_RS480 )) { +break ; + +case CHIP_R300 : +case CHIP_R350 : +case CHIP_RV350 : +case CHIP_RV380 : +case CHIP_RS400 : +case CHIP_RS480 :DRM_INFO ("Loading R300 Microcode\n" ); fw_name =FIRMWARE_R300 ; - }else if ((rdev->family ==CHIP_R420 ) || - (rdev->family ==CHIP_R423 ) || - (rdev->family ==CHIP_RV410 )) { +break ; + +case CHIP_R420 : +case CHIP_R423 : +case CHIP_RV410 :DRM_INFO ("Loading R400 Microcode\n" ); fw_name =FIRMWARE_R420 ; - }else if ((rdev->family ==CHIP_RS690 ) || - (rdev->family ==CHIP_RS740 )) { +break ; + +case CHIP_RS690 : +case CHIP_RS740 :DRM_INFO ("Loading RS690/RS740 Microcode\n" ); fw_name =FIRMWARE_RS690 ; - }else if (rdev->family ==CHIP_RS600 ) { +break ; + +case CHIP_RS600 :DRM_INFO ("Loading RS600 Microcode\n" ); fw_name =FIRMWARE_RS600 ; - }else if ((rdev->family ==CHIP_RV515 ) || - (rdev->family ==CHIP_R520 ) || - (rdev->family ==CHIP_RV530 ) || - (rdev->family ==CHIP_R580 ) || - (rdev->family ==CHIP_RV560 ) || - (rdev->family ==CHIP_RV570 )) { +break ; + +case CHIP_RV515 : +case CHIP_R520 : +case CHIP_RV530 : +case CHIP_R580 : +case CHIP_RV560 : +case CHIP_RV570 :DRM_INFO ("Loading R500 Microcode\n" ); fw_name =FIRMWARE_R520 ; +break ; + +default : +DRM_ERROR ("Unsupported Radeon family %u\n" , rdev->family); +return -EINVAL ; } err =request_firmware (&rdev->me_fw, fw_name, rdev->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/386 drm/amdgpu: Block MMR_READ IOCTL in reset
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Skvortsov <[email protected]>
[ Upstream commit 9e823f307074c0f82b5f6044943b0086e3079bed ]
Register access from userspace should be blocked until reset is complete.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 43 ++++++++++++++++++------- 1 file changed, 31 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +31 -12
@@ -43,6 +43,7 @@#include "amdgpu_gem.h" #include "amdgpu_display.h" #include "amdgpu_ras.h" +#include "amdgpu_reset.h" #include "amd_pcie.h" void amdgpu_unregister_gpu_instance (struct amdgpu_device *adev)
@@ -722,6 +723,7 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) ? -EFAULT :0 ; }case AMDGPU_INFO_READ_MMR_REG : { +int ret =0 ;unsigned int n, alloc_size;uint32_t *regs; unsigned int se_num = (info->read_mmr_reg.instance >>
@@ -731,24 +733,37 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) AMDGPU_INFO_MMR_SH_INDEX_SHIFT) &AMDGPU_INFO_MMR_SH_INDEX_MASK ; +if (!down_read_trylock (&adev->reset_domain->sem)) +return -ENOENT ; +/* set full masks if the userspace set all bits * in the bitfields */ -if (se_num ==AMDGPU_INFO_MMR_SE_INDEX_MASK ) +if (se_num ==AMDGPU_INFO_MMR_SE_INDEX_MASK ) { se_num =0xffffffff ; -else if (se_num >=AMDGPU_GFX_MAX_SE ) -return -EINVAL ; -if (sh_num ==AMDGPU_INFO_MMR_SH_INDEX_MASK ) + }else if (se_num >=AMDGPU_GFX_MAX_SE ) { + ret = -EINVAL ; + goto out; + } + +if (sh_num ==AMDGPU_INFO_MMR_SH_INDEX_MASK ) { sh_num =0xffffffff ; -else if (sh_num >=AMDGPU_GFX_MAX_SH_PER_SE ) -return -EINVAL ; + }else if (sh_num >=AMDGPU_GFX_MAX_SH_PER_SE ) { + ret = -EINVAL ; + goto out; + } -if (info->read_mmr_reg.count >128 ) -return -EINVAL ; +if (info->read_mmr_reg.count >128 ) { + ret = -EINVAL ; + goto out; + } regs =kmalloc_array (info->read_mmr_reg.count,sizeof (*regs),GFP_KERNEL ); -if (!regs) -return -ENOMEM ; +if (!regs) { + ret = -ENOMEM ; + goto out; + } + alloc_size = info->read_mmr_reg.count *sizeof (*regs);amdgpu_gfx_off_ctrl (adev, false);
@@ -760,13 +775,17 @@ int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp) info->read_mmr_reg.dword_offset + i);kfree (regs);amdgpu_gfx_off_ctrl (adev, true); -return -EFAULT ; + ret = -EFAULT ; + goto out; } }amdgpu_gfx_off_ctrl (adev, true); n =copy_to_user (out, regs,min (size, alloc_size));kfree (regs); -return n ? -EFAULT :0 ; + ret = (n ? -EFAULT :0 ); +out: +up_read (&adev->reset_domain->sem); +return ret; }case AMDGPU_INFO_DEV_INFO : {struct drm_amdgpu_info_device *dev_info;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/386 drm/amdgpu/gfx9: use rlc safe mode for soft recovery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 3ec2ad7c34c412bd9264cd1ff235d0812be90e82 ]
Protect the MMIO access with safe mode.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +2 -0
@@ -5709,7 +5709,9 @@ static void gfx_v9_0_ring_soft_recovery(struct amdgpu_ring *ring, unsigned vmid) value =REG_SET_FIELD (value,SQ_CMD ,MODE ,0x01 ); value =REG_SET_FIELD (value,SQ_CMD ,CHECK_VMID ,1 ); value =REG_SET_FIELD (value,SQ_CMD ,VM_ID , vmid); +amdgpu_gfx_rlc_enter_safe_mode (adev,0 );WREG32_SOC15 (GC ,0 , mmSQ_CMD, value); +amdgpu_gfx_rlc_exit_safe_mode (adev,0 ); } static void gfx_v9_0_set_gfx_eop_interrupt_state(struct amdgpu_device *adev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/386 drm/amd/pm: ensure the fw_info is not null before using it
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Huang <[email protected]>
[ Upstream commit 186fb12e7a7b038c2710ceb2fb74068f1b5d55a4 ]
This resolves the dereference null return value warning reported by Coverity.
--- drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/processpptables.c +2 -0
@@ -1185,6 +1185,8 @@ static int init_overdrive_limits(struct pp_hwmgr *hwmgr, fw_info =smu_atom_get_data_table (hwmgr->adev,GetIndexIntoMasterTable (DATA , FirmwareInfo), &size, &frev, &crev); +PP_ASSERT_WITH_CODE (fw_info !=NULL , +"Missing firmware info!" , return -EINVAL );if ((fw_info->ucTableFormatRevision ==1 ) && (le16_to_cpu (fw_info->usStructureSize) >=sizeof (ATOM_FIRMWARE_INFO_V1_4 )))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 172/386 of/irq: Refer to actual buffer size in of_irq_parse_one()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 39ab331ab5d377a18fbf5a0e0b228205edfcc7f4 ]
Replace two open-coded calculations of the buffer size by invocations of sizeof() on the buffer itself, to make sure the code will always use the actual buffer size.
--- drivers/of/irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/of/irq.c +2 -2
@@ -357,8 +357,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar addr =of_get_property (device,"reg" , &addr_len);/* Prevent out-of-bounds read in case of longer interrupt parent address size */ -if (addr_len > (3 *sizeof (__be32))) - addr_len =3 *sizeof (__be32); +if (addr_len >sizeof (addr_buf)) + addr_len =sizeof (addr_buf);if (addr)memcpy (addr_buf, addr, addr_len);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/386 powerpc/pseries: Use correct data types from pseries_hp_errorlog struct
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haren Myneni <[email protected]>
[ Upstream commit b76e0d4215b6b622127ebcceaa7f603313ceaec4 ]
_be32 type is defined for some elements in pseries_hp_errorlog struct but also used them u32 after be32_to_cpu() conversion.
Example: In handle_dlpar_errorlog() hp_elog->_drc_u.drc_index = be32_to_cpu(hp_elog->_drc_u.drc_index);
And later assigned to u32 typedlpar_cpu() - u32 drc_index = hp_elog->_drc_u.drc_index;
This incorrect usage is giving the following warnings and the patch resolve these warnings with the correct assignment.
arch/powerpc/platforms/pseries/dlpar.c:398:53: sparse: sparse:
incorrect type in argument 1 (different base types) @@ expected unsigned int [usertype] drc_index @@
got restricted __be32 [usertype] drc_index @@
...arch/powerpc/platforms/pseries/dlpar.c:418:43: sparse: sparse:
incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] drc_count @@ got unsigned int [usertype] @@
v3:
- Fix warnings from using incorrect data types in pseries_hp_errorlog struct
v2:
- Remove pr_info() and TODO comments
- Update more information in the commit logs
--- arch/powerpc/platforms/pseries/dlpar.c | 17 ----------------- arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +- arch/powerpc/platforms/pseries/hotplug-memory.c | 16 ++++++++-------- arch/powerpc/platforms/pseries/pmem.c | 2 +- 4 files changed, 10 insertions(+), 27 deletions(-)
arch/powerpc/platforms/pseries/dlpar.c +0 -17
@@ -334,23 +334,6 @@ int handle_dlpar_errorlog(struct pseries_hp_errorlog *hp_elog) {int rc; -/* pseries error logs are in BE format, convert to cpu type */ -switch (hp_elog->id_type) { -case PSERIES_HP_ELOG_ID_DRC_COUNT : - hp_elog->_drc_u.drc_count = -be32_to_cpu (hp_elog->_drc_u.drc_count); -break ; -case PSERIES_HP_ELOG_ID_DRC_INDEX : - hp_elog->_drc_u.drc_index = -be32_to_cpu (hp_elog->_drc_u.drc_index); -break ; -case PSERIES_HP_ELOG_ID_DRC_IC : - hp_elog->_drc_u.ic.count = -be32_to_cpu (hp_elog->_drc_u.ic.count); - hp_elog->_drc_u.ic.index = -be32_to_cpu (hp_elog->_drc_u.ic.index); - } -switch (hp_elog->resource) {case PSERIES_HP_ELOG_RESOURCE_MEM : rc =dlpar_memory (hp_elog);
arch/powerpc/platforms/pseries/hotplug-cpu.c +1 -1
@@ -757,7 +757,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)u32 drc_index;int rc; - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index);lock_device_hotplug ();
arch/powerpc/platforms/pseries/hotplug-memory.c +8 -8
@@ -811,16 +811,16 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)case PSERIES_HP_ELOG_ACTION_ADD :switch (hp_elog->id_type) {case PSERIES_HP_ELOG_ID_DRC_COUNT : - count = hp_elog->_drc_u.drc_count; + count =be32_to_cpu (hp_elog->_drc_u.drc_count); rc =dlpar_memory_add_by_count (count);break ;case PSERIES_HP_ELOG_ID_DRC_INDEX : - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index); rc =dlpar_memory_add_by_index (drc_index);break ;case PSERIES_HP_ELOG_ID_DRC_IC : - count = hp_elog->_drc_u.ic.count; - drc_index = hp_elog->_drc_u.ic.index; + count =be32_to_cpu (hp_elog->_drc_u.ic.count); + drc_index =be32_to_cpu (hp_elog->_drc_u.ic.index); rc =dlpar_memory_add_by_ic (count, drc_index);break ;default :
@@ -832,16 +832,16 @@ int dlpar_memory(struct pseries_hp_errorlog *hp_elog)case PSERIES_HP_ELOG_ACTION_REMOVE :switch (hp_elog->id_type) {case PSERIES_HP_ELOG_ID_DRC_COUNT : - count = hp_elog->_drc_u.drc_count; + count =be32_to_cpu (hp_elog->_drc_u.drc_count); rc =dlpar_memory_remove_by_count (count);break ;case PSERIES_HP_ELOG_ID_DRC_INDEX : - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index); rc =dlpar_memory_remove_by_index (drc_index);break ;case PSERIES_HP_ELOG_ID_DRC_IC : - count = hp_elog->_drc_u.ic.count; - drc_index = hp_elog->_drc_u.ic.index; + count =be32_to_cpu (hp_elog->_drc_u.ic.count); + drc_index =be32_to_cpu (hp_elog->_drc_u.ic.index); rc =dlpar_memory_remove_by_ic (count, drc_index);break ;default :
arch/powerpc/platforms/pseries/pmem.c +1 -1
@@ -121,7 +121,7 @@ int dlpar_hp_pmem(struct pseries_hp_errorlog *hp_elog)return -EINVAL ; } - drc_index = hp_elog->_drc_u.drc_index; + drc_index =be32_to_cpu (hp_elog->_drc_u.drc_index);lock_device_hotplug ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/386 drm/amdgpu/gfx11: use rlc safe mode for soft recovery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 3f2d35c325534c1b7ac5072173f0dc7ca969dec2 ]
Protect the MMIO access with safe mode.
--- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c +2 -0
@@ -5701,7 +5701,9 @@ static void gfx_v11_0_ring_soft_recovery(struct amdgpu_ring *ring, value =REG_SET_FIELD (value,SQ_CMD ,MODE ,0x01 ); value =REG_SET_FIELD (value,SQ_CMD ,CHECK_VMID ,1 ); value =REG_SET_FIELD (value,SQ_CMD ,VM_ID , vmid); +amdgpu_gfx_rlc_enter_safe_mode (adev,0 );WREG32_SOC15 (GC ,0 , regSQ_CMD, value); +amdgpu_gfx_rlc_exit_safe_mode (adev,0 ); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 175/386 drm/amdgpu/gfx10: use rlc safe mode for soft recovery
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit ead60e9c4e29c8574cae1be4fe3af1d9a978fb0f ]
Protect the MMIO access with safe mode.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +2 -0
@@ -8748,7 +8748,9 @@ static void gfx_v10_0_ring_soft_recovery(struct amdgpu_ring *ring, value =REG_SET_FIELD (value,SQ_CMD ,MODE ,0x01 ); value =REG_SET_FIELD (value,SQ_CMD ,CHECK_VMID ,1 ); value =REG_SET_FIELD (value,SQ_CMD ,VM_ID , vmid); +amdgpu_gfx_rlc_enter_safe_mode (adev,0 );WREG32_SOC15 (GC ,0 , mmSQ_CMD, value); +amdgpu_gfx_rlc_exit_safe_mode (adev,0 ); } static void
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/386 platform/x86: lenovo-ymc: Ignore the 0x0 state
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <[email protected]>
[ Upstream commit d9dca215708d32e7f88ac0591fbb187cbf368adb ]
While booting, Lenovo 14ARB7 reports 'lenovo-ymc: Unknown key 0 pressed' warning. This is caused by lenovo_ymc_probe() calling lenovo_ymc_notify() at probe time to get the initial tablet-mode-switch state and the key-code lenovo_ymc_notify() reads from the firmware is not initialized at probe time yet on the Lenovo 14ARB7.
The hardware/firmware does an ACPI notify on the WMI device itself when it initializes the tablet-mode-switch state later on.
Add 0x0 YMC state to the sparse keymap to silence the warning.
--- drivers/platform/x86/lenovo-ymc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/lenovo-ymc.c +2 -0
@@ -78,6 +78,8 @@ static void lenovo_ymc_trigger_ec(struct wmi_device *wdev, struct lenovo_ymc_pri }static const struct key_entry lenovo_ymc_keymap[] = { +/* Ignore the uninitialized state */ + {KE_IGNORE ,0x00 },/* Laptop */ {KE_SW ,0x01 , { .sw = {SW_TABLET_MODE ,0 } } },/* Tablet */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/386 ksmbd: add refcnt to ksmbd_conn struct
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namjae Jeon <[email protected]>
[ Upstream commit ee426bfb9d09b29987369b897fe9b6485ac2be27 ]
When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel.
This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used.
--- fs/smb/server/connection.c | 4 ++- fs/smb/server/connection.h | 1 + fs/smb/server/oplock.c | 55 +++++++++++--------------------------- fs/smb/server/vfs_cache.c | 3 +++ 4 files changed, 23 insertions(+), 40 deletions(-)
fs/smb/server/connection.c +3 -1
@@ -39,7 +39,8 @@ void ksmbd_conn_free(struct ksmbd_conn *conn)xa_destroy (&conn->sessions);kvfree (conn->request_buf);kfree (conn->preauth_info); -kfree (conn); +if (atomic_dec_and_test (&conn->refcnt)) +kfree (conn); }/**
@@ -68,6 +69,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) conn->um =NULL ;atomic_set (&conn->req_running,0 );atomic_set (&conn->r_count,0 ); +atomic_set (&conn->refcnt,1 ); conn->total_credits =1 ; conn->outstanding_credits =0 ;
fs/smb/server/connection.h +1 -0
@@ -106,6 +106,7 @@ struct ksmbd_conn {bool signing_negotiated;__le16 signing_algorithm;bool binding; +atomic_t refcnt; };struct ksmbd_conn_ops {
fs/smb/server/oplock.c +16 -39
148 lines not on this page · raw message
fs/smb/server/vfs_cache.c +3 -0
@@ -710,6 +710,8 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon,list_for_each_entry_rcu (op, &ci->m_op_list, op_entry) {if (op->conn != conn)continue ; +if (op->conn &&atomic_dec_and_test (&op->conn->refcnt)) +kfree (op->conn); op->conn =NULL ; }up_write (&ci->m_lock);
@@ -807,6 +809,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp)if (op->conn)continue ; op->conn = fp->conn; +atomic_inc (&op->conn->refcnt); }up_write (&ci->m_lock);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 178/386 ext4: dont set SB_RDONLY after filesystem errors
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 ]
When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that.
--- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ext4/super.c +5 -4
@@ -744,11 +744,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error,ext4_msg (sb,KERN_CRIT ,"Remounting filesystem read-only" );/* -* Make sure updated value of ->s_mount_flags will be visible before -* ->s_flags update +* EXT4_FLAGS_SHUTDOWN was set which stops all filesystem +* modifications. We don't set SB_RDONLY because that requires +* sb->s_umount semaphore and setting it without proper remount +* procedure is confusing code such as freeze_super() leading to +* deadlocks and other problems. */ -smp_wmb (); - sb->s_flags |=SB_RDONLY ; }static void update_super_work (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 179/386 bpf: Make the pointer returned by iter next method valid
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juntong Deng <[email protected]>
[ Upstream commit 4cc8c50c9abcb2646a7a4fcef3cea5dcb30c06cf ]
Currently we cannot pass the pointer returned by iter next method as argument to KF_TRUSTED_ARGS or KF_RCU kfuncs, because the pointer returned by iter next method is not "valid".
This patch sets the pointer returned by iter next method to be valid.
This is based on the fact that if the iterator is implemented correctly, then the pointer returned from the iter next method should be valid.
This does not make NULL pointer valid. If the iter next method has KF_RET_NULL flag, then the verifier will ask the ebpf program to check NULL pointer.
KF_RCU_PROTECTED iterator is a special case, the pointer returned by iter next method should only be valid within RCU critical section, so it should be with MEM_RCU, not PTR_TRUSTED.
Another special case is bpf_iter_num_next, which returns a pointer with base type PTR_TO_MEM. PTR_TO_MEM should not be combined with type flag PTR_TRUSTED (PTR_TO_MEM already means the pointer is valid).
The pointer returned by iter next method of other types of iterators is with PTR_TRUSTED.
In addition, this patch adds get_iter_from_state to help us get the current iterator from the current state.
--- kernel/bpf/verifier.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-)
kernel/bpf/verifier.c +22 -4
@@ -7846,6 +7846,15 @@ static int widen_imprecise_scalars(struct bpf_verifier_env *env,return 0 ; } +static struct bpf_reg_state *get_iter_from_state (struct bpf_verifier_state *cur_st, +struct bpf_kfunc_call_arg_meta *meta) +{ +int iter_frameno = meta->iter.frameno; +int iter_spi = meta->iter.spi; + +return &cur_st->frame[iter_frameno]->stack[iter_spi].spilled_ptr; +} +/* process_iter_next_call() is called when verifier gets to iterator's next * "method" (e.g., bpf_iter_num_next() for numbers iterator) call. We'll refer * to it as just "iter_next()" in comments below.
@@ -7930,12 +7939,10 @@ static int process_iter_next_call(struct bpf_verifier_env *env, int insn_idx,struct bpf_verifier_state *cur_st = env->cur_state, *queued_st, *prev_st;struct bpf_func_state *cur_fr = cur_st->frame[cur_st->curframe], *queued_fr;struct bpf_reg_state *cur_iter, *queued_iter; -int iter_frameno = meta->iter.frameno; -int iter_spi = meta->iter.spi;BTF_TYPE_EMIT (struct bpf_iter ); - cur_iter = &env->cur_state->frame[iter_frameno]->stack[iter_spi].spilled_ptr; + cur_iter =get_iter_from_state (cur_st, meta);if (cur_iter->iter.state !=BPF_ITER_STATE_ACTIVE && cur_iter->iter.state !=BPF_ITER_STATE_DRAINED ) {
@@ -7963,7 +7970,7 @@ static int process_iter_next_call(struct bpf_verifier_env *env, int insn_idx,if (!queued_st)return -ENOMEM ; - queued_iter = &queued_st->frame[iter_frameno]->stack[iter_spi].spilled_ptr; + queued_iter =get_iter_from_state (queued_st, meta); queued_iter->iter.state =BPF_ITER_STATE_ACTIVE ; queued_iter->iter.depth++;if (prev_st)
@@ -11995,6 +12002,17 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn, regs[BPF_REG_0 ].btf = desc_btf; regs[BPF_REG_0 ].type =PTR_TO_BTF_ID ; regs[BPF_REG_0 ].btf_id = ptr_type_id; + +if (is_iter_next_kfunc (&meta)) { +struct bpf_reg_state *cur_iter; + + cur_iter =get_iter_from_state (env->cur_state, &meta); + +if (cur_iter->type &MEM_RCU )/* KF_RCU_PROTECTED */ + regs[BPF_REG_0 ].type |=MEM_RCU ; +else + regs[BPF_REG_0 ].type |=PTR_TRUSTED ; + } }if (is_kfunc_ret_null (&meta)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 180/386 ext4: ext4_search_dir should return a proper error
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit cd69f8f9de280e331c9e6ff689ced0a688a9ce8f ]
ext4_search_dir currently returns -1 in case of a failure, while it returns 0 when the name is not found. In such failure cases, it should return an error code instead.
This becomes even more important when ext4_find_inline_entry returns an error code as well in the next commit.
-EFSCORRUPTED seems appropriate as such error code as these failures would be caused by unexpected record lengths and is in line with other instances of ext4_check_dir_entry failures.
In the case of ext4_dx_find_entry, the current use of ERR_BAD_DX_DIR was left as is to reduce the risk of regressions.
--- fs/ext4/namei.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/ext4/namei.c +7 -5
@@ -1526,7 +1526,7 @@ static bool ext4_match(struct inode *parent, }/* -* Returns 0 if not found, -1 on failure, and 1 on success +* Returns 0 if not found, -EFSCORRUPTED on failure, and 1 on success */ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, struct inode *dir, struct ext4_filename *fname,
@@ -1547,7 +1547,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size,* a full check */ if (ext4_check_dir_entry (dir,NULL , de, bh, search_buf, buf_size, offset)) -return -1 ; +return -EFSCORRUPTED ; *res_dir = de;return 1 ; }
@@ -1555,7 +1555,7 @@ int ext4_search_dir(struct buffer_head *bh, char *search_buf, int buf_size, de_len =ext4_rec_len_from_disk (de->rec_len, dir->i_sb->s_blocksize);if (de_len <=0 ) -return -1 ; +return -EFSCORRUPTED ; offset += de_len; de = (struct ext4_dir_entry_2 *) ((char *) de + de_len); }
@@ -1707,8 +1707,10 @@ static struct buffer_head *__ext4_find_entry(struct inode *dir, goto cleanup_and_exit; }else {brelse (bh); -if (i <0 ) +if (i <0 ) { + ret =ERR_PTR (i); goto cleanup_and_exit; + } } next:if (++block >= nblocks)
@@ -1803,7 +1805,7 @@ static struct buffer_head * ext4_dx_find_entry(struct inode *dir,if (retval ==1 ) goto success;brelse (bh); -if (retval ==-1 ) { +if (retval <0 ) { bh =ERR_PTR (ERR_BAD_DX_DIR ); goto errout; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 181/386 ext4: avoid use-after-free in ext4_ext_show_leaf()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 4e2524ba2ca5f54bdbb9e5153bea00421ef653f5 ]
In ext4_find_extent(), path may be freed by error or be reallocated, so using a previously saved *ppath may have been freed and thus may trigger use-after-free, as follows:
ext4_split_extent
path = *ppath;
ext4_split_extent_at(ppath)
path = ext4_find_extent(ppath)
ext4_split_extent_at(ppath)
// ext4_find_extent fails to free path
// but zeroout succeeds ext4_ext_show_leaf(inode, path)
eh = path[depth].p_hdr
// path use-after-free !!!
Similar to ext4_split_extent_at(), we use *ppath directly as an input to ext4_ext_show_leaf(). Fix a spelling error by the way.
Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.
This issue is triggered only when EXT_DEBUG is defined and therefore does not affect functionality.
--- fs/ext4/extents.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
fs/ext4/extents.c +4 -5
@@ -3287,7 +3287,7 @@ static int ext4_split_extent_at(handle_t *handle, }/* -* ext4_split_extents() splits an extent and mark extent which is covered +* ext4_split_extent() splits an extent and mark extent which is covered * by @map as split_flags indicates * * It may result in splitting the extent into multiple extents (up to three)
@@ -3363,7 +3363,7 @@ static int ext4_split_extent(handle_t *handle, goto out; } -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath); out:return err ? err : allocated; }
@@ -3828,14 +3828,13 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode, struct ext4_ext_path **ppath, int flags, unsigned int allocated, ext4_fsblk_t newblock) { - struct ext4_ext_path __maybe_unused *path = *ppath; int ret = 0;int err =0 ;ext_debug (inode,"logical block %llu, max_blocks %u, flags 0x%x, allocated %u\n" , (unsigned long long )map->m_lblk, map->m_len, flags, allocated); -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath);/* * When writing into unwritten space, we should not fail to
@@ -3932,7 +3931,7 @@ ext4_ext_handle_unwritten_extents(handle_t *handle, struct inode *inode,if (allocated > map->m_len) allocated = map->m_len; map->m_len = allocated; -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath); out2:return err ? err : allocated; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 182/386 ext4: fix i_data_sem unlock order in ext4_ind_migrate()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Sadovnikov <[email protected]>
[ Upstream commit cc749e61c011c255d81b192a822db650c68b313f ]
Fuzzing reports a possible deadlock in jbd2_log_wait_commit.
This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require synchronous updates because the file descriptor is opened with O_SYNC. This can lead to the jbd2_journal_stop() function calling jbd2_might_wait_for_commit(), potentially causing a deadlock if the EXT4_IOC_MIGRATE call races with a write(2) system call.
This problem only arises when CONFIG_PROVE_LOCKING is enabled. In this case, the jbd2_might_wait_for_commit macro locks jbd2_handle in the jbd2_journal_stop function while i_data_sem is locked. This triggers lockdep because the jbd2_journal_start function might also lock the same jbd2_handle simultaneously.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Rule: add
--- fs/ext4/migrate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/migrate.c +1 -1
@@ -663,8 +663,8 @@ int ext4_ind_migrate(struct inode *inode)if (unlikely (ret2 && !ret)) ret = ret2; errout: -ext4_journal_stop (handle);up_write (&EXT4_I (inode)->i_data_sem); +ext4_journal_stop (handle); out_unlock:ext4_writepages_up_write (inode->i_sb, alloc_ctx);return ret;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 183/386 bpftool: Fix undefined behavior caused by shifting into the sign bit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
[ Upstream commit 4cdc0e4ce5e893bc92255f5f734d983012f2bc2e ]
Replace shifts of '1' with '1U' in bitwise operations within __show_dev_tc_bpf() to prevent undefined behavior caused by shifting into the sign bit of a signed integer. By using '1U', the operations are explicitly performed on unsigned integers, avoiding potential integer overflow or sign-related issues.
--- tools/bpf/bpftool/net.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/bpf/bpftool/net.c +4 -4
@@ -480,9 +480,9 @@ static void __show_dev_tc_bpf(const struct ip_devname_ifindex *dev,if (prog_flags[i] || json_output) {NET_START_ARRAY ("prog_flags" ,"%s " );for (j =0 ; prog_flags[i] && j <32 ; j++) { -if (!(prog_flags[i] & (1 << j))) +if (!(prog_flags[i] & (1U << j)))continue ; -NET_DUMP_UINT_ONLY (1 << j); +NET_DUMP_UINT_ONLY (1U << j); }NET_END_ARRAY ("" ); }
@@ -491,9 +491,9 @@ static void __show_dev_tc_bpf(const struct ip_devname_ifindex *dev,if (link_flags[i] || json_output) {NET_START_ARRAY ("link_flags" ,"%s " );for (j =0 ; link_flags[i] && j <32 ; j++) { -if (!(link_flags[i] & (1 << j))) +if (!(link_flags[i] & (1U << j)))continue ; -NET_DUMP_UINT_ONLY (1 << j); +NET_DUMP_UINT_ONLY (1U << j); }NET_END_ARRAY ("" ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 184/386 iomap: handle a post-direct I/O invalidate race in iomap_write_delalloc_release
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 7a9d43eace888a0ee6095035997bb138425844d3 ]
When direct I/O completions invalidates the page cache it holds neither the i_rwsem nor the invalidate_lock so it can be racing with iomap_write_delalloc_release. If the search for the end of the region that contains data returns the start offset we hit such a race and just need to look for the end of the newly created hole instead.
--- fs/iomap/buffered-io.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/iomap/buffered-io.c +9 -1
@@ -1177,7 +1177,15 @@ static int iomap_write_delalloc_release(struct inode *inode, error = data_end; goto out_unlock; } -WARN_ON_ONCE (data_end <= start_byte); + +/* +* If we race with post-direct I/O invalidation of the page cache, +* there might be no data left at start_byte. +*/ +if (data_end == start_byte) +continue ; + +WARN_ON_ONCE (data_end < start_byte);WARN_ON_ONCE (data_end > scan_end_byte); error = iomap_write_delalloc_scan(inode, &punch_start_byte,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 185/386 bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuan-Wei Chiu <[email protected]>
[ Upstream commit f04e2ad394e2755d0bb2d858ecb5598718bf00d5 ]
When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports:
net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null
Although the C standard does not explicitly state whether calling qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of library functions) mentions:
"Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined."
To avoid this, add an early return when nf_link_info is NULL to prevent calling qsort with a NULL pointer.
--- tools/bpf/bpftool/net.c | 3 +++ 1 file changed, 3 insertions(+)
tools/bpf/bpftool/net.c +3 -0
@@ -819,6 +819,9 @@ static void show_link_netfilter(void) nf_link_count++; } +if (!nf_link_info) +return ; +qsort (nf_link_info, nf_link_count,sizeof (*nf_link_info), netfilter_link_compar);for (id =0 ; id < nf_link_count; id++) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 186/386 spi: spi-imx: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit b6e05ba0844139dde138625906015c974c86aa93 ]
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/spi/spi-imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-imx.c +1 -1
@@ -1870,8 +1870,8 @@ static int spi_imx_probe(struct platform_device *pdev)spi_imx_sdma_exit (spi_imx); out_runtime_pm_put:pm_runtime_dont_use_autosuspend (spi_imx->dev); -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (spi_imx->dev); +pm_runtime_set_suspended (&pdev->dev);clk_disable_unprepare (spi_imx->clk_ipg); out_put_per:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 187/386 spi: spi-cadence: Use helper function devm_clk_get_enabled()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zetao <[email protected]>
[ Upstream commit f64b1600f92e786e502cc30d31d9e3c5f2f6d682 ]
Since commit 7ef9651e9792 ("clk: Provide new devm_clk helpers for prepared and enabled clocks"), devm_clk_get() and clk_prepare_enable() can now be replaced by devm_clk_get_enabled() when driver enables (and possibly prepares) the clocks for the whole lifetime of the device. Moreover, it is no longer necessary to unprepare and disable the clocks explicitly.
Stable-dep-of: 67d4a70faa66 ("spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled")
--- drivers/spi/spi-cadence.c | 23 +++-------------------- 1 file changed, 3 insertions(+), 20 deletions(-)
drivers/spi/spi-cadence.c +3 -20
@@ -581,31 +581,19 @@ static int cdns_spi_probe(struct platform_device *pdev) goto remove_ctlr; } - xspi->pclk =devm_clk_get (&pdev->dev,"pclk" ); + xspi->pclk =devm_clk_get_enabled (&pdev->dev,"pclk" );if (IS_ERR (xspi->pclk)) {dev_err (&pdev->dev,"pclk clock not found.\n" ); ret =PTR_ERR (xspi->pclk); goto remove_ctlr; } - ret =clk_prepare_enable (xspi->pclk); -if (ret) { -dev_err (&pdev->dev,"Unable to enable APB clock.\n" ); - goto remove_ctlr; - } -if (!spi_controller_is_target (ctlr)) { - xspi->ref_clk =devm_clk_get (&pdev->dev,"ref_clk" ); + xspi->ref_clk =devm_clk_get_enabled (&pdev->dev,"ref_clk" );if (IS_ERR (xspi->ref_clk)) {dev_err (&pdev->dev,"ref_clk clock not found.\n" ); ret =PTR_ERR (xspi->ref_clk); - goto clk_dis_apb; - } - - ret =clk_prepare_enable (xspi->ref_clk); -if (ret) { -dev_err (&pdev->dev,"Unable to enable device clock.\n" ); - goto clk_dis_apb; + goto remove_ctlr; }pm_runtime_use_autosuspend (&pdev->dev);
@@ -679,10 +667,7 @@ static int cdns_spi_probe(struct platform_device *pdev)if (!spi_controller_is_target (ctlr)) {pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); -clk_disable_unprepare (xspi->ref_clk); } -clk_dis_apb: -clk_disable_unprepare (xspi->pclk); remove_ctlr:spi_controller_put (ctlr);return ret;
@@ -703,8 +688,6 @@ static void cdns_spi_remove(struct platform_device *pdev)cdns_spi_write (xspi,CDNS_SPI_ER ,CDNS_SPI_ER_DISABLE ); -clk_disable_unprepare (xspi->ref_clk); -clk_disable_unprepare (xspi->pclk);pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 188/386 spi: spi-cadence: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 67d4a70faa662df07451e83db1546d3ca0695e08 ]
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/spi/spi-cadence.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-cadence.c +2 -2
@@ -665,8 +665,8 @@ static int cdns_spi_probe(struct platform_device *pdev) clk_dis_all:if (!spi_controller_is_target (ctlr)) { -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev); } remove_ctlr:spi_controller_put (ctlr);
@@ -688,8 +688,8 @@ static void cdns_spi_remove(struct platform_device *pdev)cdns_spi_write (xspi,CDNS_SPI_ER ,CDNS_SPI_ER_DISABLE ); -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev);spi_unregister_controller (ctlr); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 189/386 spi: spi-cadence: Fix missing spi_controller_is_target() check
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 3eae4a916fc0eb6f85b5d399e10335dbd24dd765 ]
The spi_controller_is_target() check is missing for pm_runtime_disable() in cdns_spi_remove(), add it.
--- drivers/spi/spi-cadence.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/spi/spi-cadence.c +4 -2
@@ -688,8 +688,10 @@ static void cdns_spi_remove(struct platform_device *pdev)cdns_spi_write (xspi,CDNS_SPI_ER ,CDNS_SPI_ER_DISABLE ); -pm_runtime_disable (&pdev->dev); -pm_runtime_set_suspended (&pdev->dev); +if (!spi_controller_is_target (ctlr)) { +pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev); + }spi_unregister_controller (ctlr); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 190/386 selftest: hid: add missing run-hid-tools-tests.sh
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Lu <[email protected]>
[ Upstream commit 160c826b4dd0d570f0f51cf002cb49bda807e9f5 ]
HID test cases run tests using the run-hid-tools-tests.sh script. When installed with "make install", the run-hid-tools-tests.sh script will not be copied over, resulting in the following error message.
make -C tools/testing/selftests/ TARGETS=hid install \ INSTALL_PATH=$KSFT_INSTALL_PATH
cd $KSFT_INSTALL_PATH
./run_kselftest.sh -c hid
selftests: hid: hid-core.sh
bash: ./run-hid-tools-tests.sh: No such file or directory
Add the run-hid-tools-tests.sh script to the TEST_FILES in the Makefile for it to be installed.
--- tools/testing/selftests/hid/Makefile | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/hid/Makefile +2 -0
@@ -17,6 +17,8 @@ TEST_PROGS += hid-tablet.sh TEST_PROGS += hid-usb_crash.sh TEST_PROGS += hid-wacom.sh +TEST_FILES := run-hid-tools-tests.sh + CXX ?= $(CROSS_COMPILE)g++ HOSTPKG_CONFIG := pkg-config
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 191/386 spi: s3c64xx: fix timeout counters in flush_fifo
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Dooks <[email protected]>
[ Upstream commit 68a16708d2503b6303d67abd43801e2ca40c208d ]
In the s3c64xx_flush_fifo() code, the loops counter is post-decremented in the do { } while(test && loops--) condition. This means the loops is left at the unsigned equivalent of -1 if the loop times out. The test after will never pass as if tests for loops == 0.
--- drivers/spi/spi-s3c64xx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spi-s3c64xx.c +2 -2
@@ -239,7 +239,7 @@ static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd) loops =msecs_to_loops (1 );do { val =readl (regs +S3C64XX_SPI_STATUS ); - }while (TX_FIFO_LVL (val, sdd) && loops--); + }while (TX_FIFO_LVL (val, sdd) && --loops);if (loops ==0 )dev_warn (&sdd->pdev->dev,"Timed out flushing TX FIFO\n" );
@@ -252,7 +252,7 @@ static void s3c64xx_flush_fifo(struct s3c64xx_spi_driver_data *sdd)readl (regs +S3C64XX_SPI_RX_DATA ); else break; - }while (loops--); + }while (--loops);if (loops ==0 )dev_warn (&sdd->pdev->dev,"Timed out flushing RX FIFO\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 192/386 selftests: breakpoints: use remaining time to check if suspend succeed
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifei Liu <[email protected]>
[ Upstream commit c66be905cda24fb782b91053b196bd2e966f95b7 ]
step_after_suspend_test fails with device busy error while writing to /sys/power/state to start suspend. The test believes it failed to enter suspend state with
$ sudo ./step_after_suspend_test TAP version 13 Bail out! Failed to enter Suspend state
However, in the kernel message, I indeed see the system get suspended and then wake up later.
[611172.033108] PM: suspend entry (s2idle) [611172.044940] Filesystems sync: 0.006 seconds [611172.052254] Freezing user space processes [611172.059319] Freezing user space processes completed (elapsed 0.001 seconds) [611172.067920] OOM killer disabled. [611172.072465] Freezing remaining freezable tasks [611172.080332] Freezing remaining freezable tasks completed (elapsed 0.001 seconds) [611172.089724] printk: Suspending console(s) (use no_console_suspend to debug) [611172.117126] serial 00:03: disabled some other hardware get reconnected [611203.136277] OOM killer enabled. [611203.140637] Restarting tasks ... [611203.141135] usb 1-8.1: USB disconnect, device number 7 [611203.141755] done. [611203.155268] random: crng reseeded on system resumption [611203.162059] PM: suspend exit
After investigation, I noticed that for the code block if (write(power_state_fd, "mem", strlen("mem")) != strlen("mem"))
ksft_exit_fail_msg("Failed to enter Suspend state\n");The write will return -1 and errno is set to 16 (device busy). It should be caused by the write function is not successfully returned before the system suspend and the return value get messed when waking up. As a result, It may be better to check the time passed of those few instructions to determine whether the suspend is executed correctly for it is pretty hard to execute those few lines for 5 seconds.
The timer to wake up the system is set to expire after 5 seconds and no re-arm. If the timer remaining time is 0 second and 0 nano secomd, it means the timer expired and wake the system up. Otherwise, the system could be considered to enter the suspend state failed if there is any remaining time.
After appling this patch, the test would not fail for it believes the system does not go to suspend by mistake. It now could continue to the rest part of the test after suspend.
--- .../testing/selftests/breakpoints/step_after_suspend_test.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/testing/selftests/breakpoints/step_after_suspend_test.c +4 -1
@@ -153,7 +153,10 @@ void suspend(void)if (err <0 )ksft_exit_fail_msg ("timerfd_settime() failed\n" ); -if (write (power_state_fd,"mem" ,strlen ("mem" )) !=strlen ("mem" )) +system ("(echo mem > /sys/power/state) 2> /dev/null" ); + +timerfd_gettime (timerfd, &spec); +if (spec.it_value.tv_sec !=0 || spec.it_value.tv_nsec !=0 )ksft_exit_fail_msg ("Failed to enter Suspend state\n" );close (timerfd);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 193/386 accel/ivpu: Add missing MODULE_FIRMWARE metadata
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander F. Lent <[email protected]>
[ Upstream commit 58b5618ba80a5e5a8d531a70eae12070e5bd713f ]
Modules that load firmware from various paths at runtime must declare those paths at compile time, via the MODULE_FIRMWARE macro, so that the firmware paths are included in the module's metadata.
The accel/ivpu driver loads firmware but lacks this metadata, preventing dracut from correctly locating firmware files. Fix it.
--- drivers/accel/ivpu/ivpu_fw.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/accel/ivpu/ivpu_fw.c +4 -0
@@ -55,6 +55,10 @@ static struct { { IVPU_HW_40XX, "intel/vpu/vpu_40xx_v0.0.bin" }, }; +/* Production fw_names from the table above */ +MODULE_FIRMWARE ("intel/vpu/vpu_37xx_v0.0.bin" ); +MODULE_FIRMWARE ("intel/vpu/vpu_40xx_v0.0.bin" ); +static int ivpu_fw_request (struct ivpu_device *vdev) {int ret = -ENOENT ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 194/386 spi: rpc-if: Add missing MODULE_DEVICE_TABLE
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 0880f669436028c5499901e5acd8f4b4ea0e0c6a ]
Add missing MODULE_DEVICE_TABLE definition for automatic loading of the driver when it is built as a module.
--- drivers/spi/spi-rpc-if.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/spi/spi-rpc-if.c +7 -0
@@ -198,9 +198,16 @@ static int __maybe_unused rpcif_spi_resume(struct device *dev) static SIMPLE_DEV_PM_OPS(rpcif_spi_pm_ops, rpcif_spi_suspend, rpcif_spi_resume); +static const struct platform_device_id rpc_if_spi_id_table[] = { + { .name ="rpc-if-spi" }, + {/* sentinel */ } +}; +MODULE_DEVICE_TABLE (platform, rpc_if_spi_id_table); +static struct platform_driver rpcif_spi_driver = { .probe = rpcif_spi_probe, .remove_new = rpcif_spi_remove, + .id_table = rpc_if_spi_id_table, .driver = { .name ="rpc-if-spi" , #ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 195/386 perf callchain: Fix stitch LBR memory leaks
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 599c19397b17d197fc1184bbc950f163a292efc9 ]
The 'struct callchain_cursor_node' has a 'struct map_symbol' whose maps and map members are reference counted. Ensure these values use a _get routine to increment the reference counts and use map_symbol__exit() to release the reference counts.
Do similar for 'struct thread's prev_lbr_cursor, but save the size of the prev_lbr_cursor array so that it may be iterated.
Ensure that when stitch_nodes are placed on the free list the map_symbols are exited.
Fix resolve_lbr_callchain_sample() by replacing list_replace_init() to list_splice_init(), so the whole list is moved and nodes aren't leaked.
A reproduction of the memory leaks is possible with a leak sanitizer build in the perf report command of:
``` $ perf record -e cycles --call-graph lbr perf test -w thloop $ perf report --stitch-lbr ```
--- tools/perf/util/machine.c | 17 +++++++++++++++-- tools/perf/util/thread.c | 4 ++++ tools/perf/util/thread.h | 1 + 3 files changed, 20 insertions(+), 2 deletions(-)
tools/perf/util/machine.c +15 -2
@@ -2536,8 +2536,12 @@ static void save_lbr_cursor_node(struct thread *thread, cursor->curr = cursor->first; else cursor->curr = cursor->curr->next; + +map_symbol__exit (&lbr_stitch->prev_lbr_cursor[idx].ms);memcpy (&lbr_stitch->prev_lbr_cursor[idx], cursor->curr,sizeof (struct callchain_cursor_node )); + lbr_stitch->prev_lbr_cursor[idx].ms.maps =maps__get (cursor->curr->ms.maps); + lbr_stitch->prev_lbr_cursor[idx].ms.map =map__get (cursor->curr->ms.map); lbr_stitch->prev_lbr_cursor[idx].valid = true; cursor->pos++;
@@ -2748,6 +2752,9 @@ static bool has_stitched_lbr(struct thread *thread,memcpy (&stitch_node->cursor, &lbr_stitch->prev_lbr_cursor[i],sizeof (struct callchain_cursor_node )); + stitch_node->cursor.ms.maps =maps__get (lbr_stitch->prev_lbr_cursor[i].ms.maps); + stitch_node->cursor.ms.map =map__get (lbr_stitch->prev_lbr_cursor[i].ms.map); +if (callee)list_add (&stitch_node->node, &lbr_stitch->lists);else
@@ -2771,6 +2778,8 @@ static bool alloc_lbr_stitch(struct thread *thread, unsigned int max_lbr)if (!thread__lbr_stitch (thread)->prev_lbr_cursor) goto free_lbr_stitch; +thread__lbr_stitch (thread)->prev_lbr_cursor_size = max_lbr +1 ; +INIT_LIST_HEAD (&thread__lbr_stitch (thread)->lists);INIT_LIST_HEAD (&thread__lbr_stitch (thread)->free_lists);
@@ -2826,8 +2835,12 @@ static int resolve_lbr_callchain_sample(struct thread *thread, max_lbr, callee);if (!stitched_lbr && !list_empty (&lbr_stitch->lists)) { -list_replace_init (&lbr_stitch->lists, - &lbr_stitch->free_lists); +struct stitch_list *stitch_node; + +list_for_each_entry (stitch_node, &lbr_stitch->lists, node) +map_symbol__exit (&stitch_node->cursor.ms); + +list_splice_init (&lbr_stitch->lists, &lbr_stitch->free_lists); }memcpy (&lbr_stitch->prev_sample, sample,sizeof (*sample)); }
tools/perf/util/thread.c +4 -0
@@ -478,6 +478,7 @@ void thread__free_stitch_list(struct thread *thread)return ;list_for_each_entry_safe (pos, tmp, &lbr_stitch->lists, node) { +map_symbol__exit (&pos->cursor.ms);list_del_init (&pos->node);free (pos); }
@@ -487,6 +488,9 @@ void thread__free_stitch_list(struct thread *thread)free (pos); } +for (unsigned int i =0 ; i < lbr_stitch->prev_lbr_cursor_size; i++) +map_symbol__exit (&lbr_stitch->prev_lbr_cursor[i].ms); +zfree (&lbr_stitch->prev_lbr_cursor);free (thread__lbr_stitch (thread));thread__set_lbr_stitch (thread,NULL );
tools/perf/util/thread.h +1 -0
@@ -28,6 +28,7 @@ struct lbr_stitch {struct list_head free_lists;struct perf_sample prev_sample;struct callchain_cursor_node *prev_lbr_cursor; +unsigned int prev_lbr_cursor_size; };struct thread_rb_node {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 196/386 perf: Really fix event_function_call() locking
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit fe826cc2654e8561b64246325e6a51b62bf2488c ]
Commit 558abc7e3f89 ("perf: Fix event_function_call() locking") lost IRQ disabling by mistake.
--- kernel/events/core.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
kernel/events/core.c +8 -5
@@ -263,8 +263,8 @@ static int event_function(void *info)static void event_function_call (struct perf_event *event,event_f func,void *data) {struct perf_event_context *ctx = event->ctx; -struct perf_cpu_context *cpuctx =this_cpu_ptr (&perf_cpu_context);struct task_struct *task =READ_ONCE (ctx->task);/* verified in event_function */ +struct perf_cpu_context *cpuctx;struct event_function_struct efs = { .event = event, .func = func,
@@ -292,22 +292,25 @@ static void event_function_call(struct perf_event *event, event_f func, void *daif (!task_function_call (task, event_function, &efs))return ; +local_irq_disable (); + cpuctx =this_cpu_ptr (&perf_cpu_context);perf_ctx_lock (cpuctx, ctx);/* * Reload the task pointer, it might have been changed by * a concurrent perf_event_context_sched_out(). */ task = ctx->task; -if (task ==TASK_TOMBSTONE ) { -perf_ctx_unlock (cpuctx, ctx); -return ; - } +if (task ==TASK_TOMBSTONE ) + goto unlock;if (ctx->is_active) {perf_ctx_unlock (cpuctx, ctx); +local_irq_enable (); goto again; }func (event,NULL , ctx, data); +unlock:perf_ctx_unlock (cpuctx, ctx); +local_irq_enable (); }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 197/386 selftests: vDSO: fix vDSO name for powerpc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 59eb856c3ed9b3552befd240c0c339f22eed3fa1 ]
Following error occurs when running vdso_test_correctness on powerpc:
~ # ./vdso_test_correctness
[WARN] failed to find vDSO
[SKIP] No vDSO, so skipping clock_gettime() tests
[SKIP] No vDSO, so skipping clock_gettime64() tests
[RUN] Testing getcpu...
[OK] CPU 0: syscall: cpu 0, node 0
On powerpc, vDSO is neither called linux-vdso.so.1 nor linux-gate.so.1 but linux-vdso32.so.1 or linux-vdso64.so.1.
Also search those two names before giving up.
--- tools/testing/selftests/vDSO/vdso_test_correctness.c | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/vDSO/vdso_test_correctness.c +6 -0
@@ -114,6 +114,12 @@ static void fill_function_pointers()if (!vdso) vdso =dlopen ("linux-gate.so.1" ,RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD ); +if (!vdso) + vdso =dlopen ("linux-vdso32.so.1" , +RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD ); +if (!vdso) + vdso =dlopen ("linux-vdso64.so.1" , +RTLD_LAZY |RTLD_LOCAL |RTLD_NOLOAD );if (!vdso) {printf ("[WARN]\tfailed to find vDSO\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 198/386 selftests: vDSO: fix vdso_config for powerpc
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7d297c419b08eafa69ce27243ee9bbecab4fcaa4 ]
Running vdso_test_correctness on powerpc64 gives the following warning:
~ # ./vdso_test_correctness
Warning: failed to find clock_gettime64 in vDSO
This is because vdso_test_correctness was built with VDSO_32BIT defined.
__powerpc__ macro is defined on both powerpc32 and powerpc64 so __powerpc64__ needs to be checked first in vdso_config.h
--- tools/testing/selftests/vDSO/vdso_config.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/vDSO/vdso_config.h +3 -3
@@ -18,13 +18,13 @@#elif defined(__aarch64__)#define VDSO_VERSION 3#define VDSO_NAMES 0 -#elif defined(__powerpc__) +#elif defined(__powerpc64__)#define VDSO_VERSION 1#define VDSO_NAMES 0 -#define VDSO_32BIT 1 -#elif defined(__powerpc64__) +#elif defined(__powerpc__)#define VDSO_VERSION 1#define VDSO_NAMES 0 +#define VDSO_32BIT 1#elif defined (__s390__)#define VDSO_VERSION 2#define VDSO_NAMES 0
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 199/386 selftests: vDSO: fix vDSO symbols lookup for powerpc64
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit ba83b3239e657469709d15dcea5f9b65bf9dbf34 ]
On powerpc64, following tests fail locating vDSO functions:
~ # ./vdso_test_abi
TAP version 13
1..16
# [vDSO kselftest] VDSO_VERSION: LINUX_2.6.15 # Couldn't find __kernel_gettimeofday
ok 1 # SKIP __kernel_gettimeofday
# clock_id: CLOCK_REALTIME
# Couldn't find __kernel_clock_gettime
ok 2 # SKIP __kernel_clock_gettime CLOCK_REALTIME # Couldn't find __kernel_clock_getres
ok 3 # SKIP __kernel_clock_getres CLOCK_REALTIME
...
# Couldn't find __kernel_time
ok 16 # SKIP __kernel_time
# Totals: pass:0 fail:0 xfail:0 xpass:0 skip:16 error:0
~ # ./vdso_test_getrandom
__kernel_getrandom is missing!
~ # ./vdso_test_gettimeofday
Could not find __kernel_gettimeofday
~ # ./vdso_test_getcpu
Could not find __kernel_getcpu
On powerpc64, as shown below by readelf, vDSO functions symbols have type NOTYPE, so also accept that type when looking for symbols.
$ powerpc64-linux-gnu-readelf -a arch/powerpc/kernel/vdso/vdso64.so.dbg ELF Header: Magic: 7f 45 4c 46 02 02 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, big endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Shared object file) Machine: PowerPC64 Version: 0x1 ...
Symbol table '.dynsym' contains 12 entries:
Num: Value Size Type Bind Vis Ndx Name
0: 0000000000000000 0 NOTYPE LOCAL DEFAULT UND
1: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
2: 00000000000005f0 36 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
3: 0000000000000578 68 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
4: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
5: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
6: 0000000000000614 172 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
7: 00000000000006f0 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
8: 000000000000047c 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
9: 0000000000000454 12 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
10: 00000000000004d0 84 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15
11: 00000000000005bc 52 NOTYPE GLOBAL DEFAULT 8 __[...]@@LINUX_2.6.15Symbol table '.symtab' contains 56 entries:
Num: Value Size Type Bind Vis Ndx Name
...
45: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LINUX_2.6.15
46: 00000000000006c0 48 NOTYPE GLOBAL DEFAULT 8 __kernel_getcpu
47: 0000000000000524 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_getres
48: 00000000000005f0 36 NOTYPE GLOBAL DEFAULT 8 __kernel_get_tbfreq
49: 000000000000047c 84 NOTYPE GLOBAL DEFAULT 8 __kernel_gettimeofday
50: 0000000000000614 172 NOTYPE GLOBAL DEFAULT 8 __kernel_sync_dicache
51: 00000000000006f0 84 NOTYPE GLOBAL DEFAULT 8 __kernel_getrandom
52: 0000000000000454 12 NOTYPE GLOBAL DEFAULT 8 __kernel_sigtram[...]
53: 0000000000000578 68 NOTYPE GLOBAL DEFAULT 8 __kernel_time
54: 00000000000004d0 84 NOTYPE GLOBAL DEFAULT 8 __kernel_clock_g[...]
55: 00000000000005bc 52 NOTYPE GLOBAL DEFAULT 8 __kernel_get_sys[...]--- tools/testing/selftests/vDSO/parse_vdso.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/vDSO/parse_vdso.c +2 -1
@@ -216,7 +216,8 @@ void *vdso_sym(const char *version, const char *name)ELF (Sym) *sym = &vdso_info.symtab[chain];/* Check for a defined global or weak function w/ right name. */ -if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC ) +if (ELF64_ST_TYPE (sym->st_info) !=STT_FUNC && +ELF64_ST_TYPE (sym->st_info) !=STT_NOTYPE )continue ;if (ELF64_ST_BIND (sym->st_info) !=STB_GLOBAL &&ELF64_ST_BIND (sym->st_info) !=STB_WEAK )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 200/386 selftests/mm: fix charge_reserved_hugetlb.sh test
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Hildenbrand <[email protected]>
[ Upstream commit c41a701d18efe6b8aa402efab16edbaba50c9548 ]
Currently, running the charge_reserved_hugetlb.sh selftest we can sometimes observe something like:
$ ./charge_reserved_hugetlb.sh -cgroup-v2 ... write_result is 0 After write: hugetlb_usage=0 reserved_usage=10485760 killing write_to_hugetlbfs Received 2. Deleting the memory Detach failure: Invalid argument umount: /mnt/huge: target is busy.
Both cases are issues in the test.
While the unmount error seems to be racy, it will make the test fail:
$ ./run_vmtests.sh -t hugetlb ... # [FAIL] not ok 10 charge_reserved_hugetlb.sh -cgroup-v2 # exit=32
The issue is that we are not waiting for the write_to_hugetlbfs process to quit. So it might still have a hugetlbfs file open, about which umount is not happy. Fix that by making "killall" wait for the process to quit.
The other error ("Detach failure: Invalid argument") does not seem to result in a test error, but is misleading. Turns out write_to_hugetlbfs.c unconditionally tries to cleanup using shmdt(), even when we only mmap()'ed a hugetlb file. Even worse, shmaddr is never even set for the SHM case. Fix that as well.
With this change it seems to work as expected.
--- .../selftests/mm/charge_reserved_hugetlb.sh | 2 +- .../testing/selftests/mm/write_to_hugetlbfs.c | 21 +++++++++++-------- 2 files changed, 13 insertions(+), 10 deletions(-)
tools/testing/selftests/mm/charge_reserved_hugetlb.sh +1 -1
@@ -252,7 +252,7 @@ function cleanup_hugetlb_memory() { local cgroup="$1" if [[ "$(pgrep -f write_to_hugetlbfs)" != "" ]]; then echo killing write_to_hugetlbfs - killall -2 write_to_hugetlbfs + killall -2 --wait write_to_hugetlbfs wait_for_hugetlb_memory_to_get_depleted $cgroup fi set -e
tools/testing/selftests/mm/write_to_hugetlbfs.c +12 -9
@@ -28,7 +28,7 @@ enum method {/* Global variables. */ static const char *self; -static char *shmaddr; +static int *shmaddr;static int shmid;/*
@@ -47,15 +47,17 @@ void sig_handler(int signo) {printf ("Received %d.\n" , signo);if (signo ==SIGINT ) { -printf ("Deleting the memory\n" ); -if (shmdt ((const void *)shmaddr) !=0 ) { -perror ("Detach failure" ); +if (shmaddr) { +printf ("Deleting the memory\n" ); +if (shmdt ((const void *)shmaddr) !=0 ) { +perror ("Detach failure" ); +shmctl (shmid,IPC_RMID ,NULL ); +exit (4 ); + } +shmctl (shmid,IPC_RMID ,NULL ); -exit (4 ); +printf ("Done deleting the memory\n" ); } - -shmctl (shmid,IPC_RMID ,NULL ); -printf ("Done deleting the memory\n" ); }exit (2 ); }
@@ -211,7 +213,8 @@ int main(int argc, char **argv)shmctl (shmid,IPC_RMID ,NULL );exit (2 ); } -printf ("shmaddr: %p\n" , ptr); + shmaddr = ptr; +printf ("shmaddr: %p\n" , shmaddr);break ;default :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 201/386 powerpc/vdso: Fix VDSO data access when running in a non-root time namespace
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit c73049389e58c01e2e3bbfae900c8daeee177191 ]
When running in a non-root time namespace, the global VDSO data page is replaced by a dedicated namespace data page and the global data page is mapped next to it. Detailed explanations can be found at commit 660fd04f9317 ("lib/vdso: Prepare for time namespace support").
When it happens, __kernel_get_syscall_map and __kernel_get_tbfreq and __kernel_sync_dicache don't work anymore because they read 0 instead of the data they need.
To address that, clock_mode has to be read. When it is set to VDSO_CLOCKMODE_TIMENS, it means it is a dedicated namespace data page and the global data is located on the following page.
Add a macro called get_realdatapage which reads clock_mode and add PAGE_SIZE to the pointer provided by get_datapage macro when clock_mode is equal to VDSO_CLOCKMODE_TIMENS. Use this new macro instead of get_datapage macro except for time functions as they handle it internally.
--- arch/powerpc/include/asm/vdso_datapage.h | 15 +++++++++++++++ arch/powerpc/kernel/asm-offsets.c | 2 ++ arch/powerpc/kernel/vdso/cacheflush.S | 2 +- arch/powerpc/kernel/vdso/datapage.S | 4 ++-- 4 files changed, 20 insertions(+), 3 deletions(-)
arch/powerpc/include/asm/vdso_datapage.h +15 -0
@@ -111,6 +111,21 @@ extern struct vdso_arch_data *vdso_data; addi \ptr, \ptr, (_vdso_datapage - 999b)@l .endm +#include <asm/asm-offsets.h> +#include <asm/page.h> + +.macro get_realdatapage ptr scratch + get_datapage \ptr +#ifdef CONFIG_TIME_NS + lwz \scratch, VDSO_CLOCKMODE_OFFSET(\ptr) + xoris \scratch, \scratch, VDSO_CLOCKMODE_TIMENS@h + xori \scratch, \scratch, VDSO_CLOCKMODE_TIMENS@l + cntlzw \scratch, \scratch + rlwinm \scratch, \scratch, PAGE_SHIFT - 5, 1 << PAGE_SHIFT + add \ptr, \ptr, \scratch +#endif +.endm + #endif /* __ASSEMBLY__ */ #endif /* __KERNEL__ */
arch/powerpc/kernel/asm-offsets.c +2 -0
@@ -348,6 +348,8 @@ int main(void)#else OFFSET (CFG_SYSCALL_MAP32 , vdso_arch_data, syscall_map);#endif +OFFSET (VDSO_CLOCKMODE_OFFSET , vdso_arch_data, data[0 ].clock_mode); +DEFINE (VDSO_CLOCKMODE_TIMENS ,VDSO_CLOCKMODE_TIMENS );#ifdef CONFIG_BUG DEFINE (BUG_ENTRY_SIZE ,sizeof (struct bug_entry ));
arch/powerpc/kernel/vdso/cacheflush.S +1 -1
@@ -30,7 +30,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) #ifdef CONFIG_PPC64 mflr r12 .cfi_register lr,r12 - get_datapage r10 + get_realdatapage r10, r11 mtlr r12 .cfi_restore lr #endif
arch/powerpc/kernel/vdso/datapage.S +2 -2
@@ -28,7 +28,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map) mflr r12 .cfi_register lr,r12 mr. r4,r3 - get_datapage r3 + get_realdatapage r3, r11 mtlr r12 #ifdef __powerpc64__ addi r3,r3,CFG_SYSCALL_MAP64
@@ -52,7 +52,7 @@ V_FUNCTION_BEGIN(__kernel_get_tbfreq) .cfi_startproc mflr r12 .cfi_register lr,r12 - get_datapage r3 + get_realdatapage r3, r11 #ifndef __powerpc64__ lwz r4,(CFG_TB_TICKS_PER_SEC + 4)(r3) #endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 202/386 selftests: vDSO: fix ELF hash table entry size for s390x
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Remus <[email protected]>
[ Upstream commit 14be4e6f35221c4731b004553ecf7cbc6dc1d2d8 ]
The vDSO self tests fail on s390x for a vDSO linked with the GNU linker ld as follows:
# ./vdso_test_gettimeofday Floating point exception (core dumped)
On s390x the ELF hash table entries are 64 bits instead of 32 bits in size (see Glibc sysdeps/unix/sysv/linux/s390/bits/elfclass.h).
--- tools/testing/selftests/vDSO/parse_vdso.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
tools/testing/selftests/vDSO/parse_vdso.c +10 -4
@@ -36,6 +36,12 @@#define ELF_BITS_XFORM (bits, x) ELF_BITS_XFORM2(bits, x)#define ELF (x) ELF_BITS_XFORM(ELF_BITS, x) +#ifdef __s390x__ +#define ELF_HASH_ENTRY ELF(Xword) +#else +#define ELF_HASH_ENTRY ELF(Word) +#endif + static struct vdso_info { bool valid;
@@ -47,8 +53,8 @@ static struct vdso_info/* Symbol table */ ELF (Sym) *symtab;const char *symstrings; -ELF (Word) *bucket, *chain; -ELF (Word) nbucket, nchain; +ELF_HASH_ENTRY *bucket, *chain; +ELF_HASH_ENTRY nbucket, nchain;/* Version table */ ELF (Versym) *versym;
@@ -115,7 +121,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base)/* * Fish out the useful bits of the dynamic table. */ -ELF (Word) *hash =0 ; +ELF_HASH_ENTRY *hash =0 ; vdso_info.symstrings =0 ; vdso_info.symtab =0 ; vdso_info.versym =0 ;
@@ -133,7 +139,7 @@ void vdso_init_from_sysinfo_ehdr(uintptr_t base) + vdso_info.load_offset);break ;case DT_HASH : - hash = (ELF (Word) *) + hash = (ELF_HASH_ENTRY *) ((uintptr_t )dyn[i].d_un.d_ptr + vdso_info.load_offset);break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 203/386 selftests: vDSO: fix vdso_config for s390
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
[ Upstream commit a6e23fb8d3c0e3904da70beaf5d7e840a983c97f ]
Running vdso_test_correctness on s390x (aka s390 64 bit) emits a warning:
Warning: failed to find clock_gettime64 in vDSO
This is caused by the "#elif defined (__s390__)" check in vdso_config.h which the defines VDSO_32BIT.
If __s390x__ is defined also __s390__ is defined. Therefore the correct check must make sure that only __s390__ is defined.
Therefore add the missing !defined(__s390x__). Also use common __s390x__ define instead of __s390X__.
--- tools/testing/selftests/vDSO/vdso_config.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/vDSO/vdso_config.h +2 -2
@@ -25,11 +25,11 @@#define VDSO_VERSION 1#define VDSO_NAMES 0#define VDSO_32BIT 1 -#elif defined (__s390__) +#elif defined (__s390__) && !defined(__s390x__)#define VDSO_VERSION 2#define VDSO_NAMES 0#define VDSO_32BIT 1 -#elif defined (__s390X__) +#elif defined (__s390x__)#define VDSO_VERSION 2#define VDSO_NAMES 0#elif defined(__mips__)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 204/386 Revert "ALSA: hda: Conditionally use snooping for AMD HDMI"
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 3f7f36a4559ef78a6418c5f0447fbfbdcf671956 upstream.
This reverts commit 478689b5990deb626a0b3f1ebf165979914d6be4.
The fix seems leading to regressions for other systems. Also, the way to check the presence of IOMMU via get_dma_ops() isn't reliable and it's no longer applicable for 6.12. After all, it's no right fix, so let's revert it at first.
To be noted, the PCM buffer allocation has been changed to try the continuous pages at first since 6.12, so the problem could be already addressed without this hackish workaround.
--- sound/pci/hda/hda_controller.h | 2 +- sound/pci/hda/hda_intel.c | 10 +--------- 2 files changed, 2 insertions(+), 10 deletions(-)
sound/pci/hda/hda_controller.h +1 -1
@@ -28,7 +28,7 @@#else #define AZX_DCAPS_I915_COMPONENT 0/* NOP */ #endif -#define AZX_DCAPS_AMD_ALLOC_FIX (1 << 14)/* AMD allocation workaround */ +/* 14 unused */ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15)/* X-Fi workaround */ #define AZX_DCAPS_POSFIX_LPIB (1 << 16)/* Use LPIB as default */ #define AZX_DCAPS_AMD_WORKAROUND (1 << 17)/* AMD-specific workaround */
sound/pci/hda/hda_intel.c +1 -9
@@ -40,7 +40,6 @@#ifdef CONFIG_X86 /* for snoop control */ -#include <linux/dma-map-ops.h> #include <asm/set_memory.h> #include <asm/cpufeature.h> #endif
@@ -302,7 +301,7 @@ enum {/* quirks for ATI HDMI with snoop off */ #define AZX_DCAPS_PRESET_ATI_HDMI_NS \ - (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_AMD_ALLOC_FIX) + (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)/* quirks for AMD SB */ #define AZX_DCAPS_PRESET_AMD_SB \
@@ -1716,13 +1715,6 @@ static void azx_check_snoop_available(stif (chip->driver_caps &AZX_DCAPS_SNOOP_OFF ) snoop = false; -#ifdef CONFIG_X86 -/* check the presence of DMA ops (i.e. IOMMU), disable snoop conditionally */ -if ((chip->driver_caps &AZX_DCAPS_AMD_ALLOC_FIX ) && - !get_dma_ops (chip->card->dev)) - snoop = false; -#endif - chip->snoop = snoop;if (!snoop) {dev_info (chip->card->dev,"Force to non-snoop mode\n" );
Greg Kroah-Hartman
maintainerPATCH 205/386 platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zach Wade <[email protected]>
commit 7d59ac07ccb58f8f604f8057db63b8efcebeb3de upstream.
Attaching SST PCI device to VM causes "BUG: KASAN: slab-out-of-bounds". kasan report:
[ 19.411889] ================================================================== [ 19.413702] BUG: KASAN: slab-out-of-bounds in _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.415634] Read of size 8 at addr ffff888829e65200 by task cpuhp/16/113 [ 19.417368] [ 19.418627] CPU: 16 PID: 113 Comm: cpuhp/16 Tainted: G E 6.9.0 #10 [ 19.420435] Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.20192059.B64.2207280713 07/28/2022 [ 19.422687] Call Trace: [ 19.424091] <TASK> [ 19.425448] dump_stack_lvl+0x5d/0x80 [ 19.426963] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.428694] print_report+0x19d/0x52e [ 19.430206] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 19.431837] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.433539] kasan_report+0xf0/0x170 [ 19.435019] ? _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.436709] _isst_if_get_pci_dev+0x3d5/0x400 [isst_if_common] [ 19.438379] ? __pfx_sched_clock_cpu+0x10/0x10 [ 19.439910] isst_if_cpu_online+0x406/0x58f [isst_if_common] [ 19.441573] ? __pfx_isst_if_cpu_online+0x10/0x10 [isst_if_common] [ 19.443263] ? ttwu_queue_wakelist+0x2c1/0x360 [ 19.444797] cpuhp_invoke_callback+0x221/0xec0 [ 19.446337] cpuhp_thread_fun+0x21b/0x610 [ 19.447814] ? __pfx_cpuhp_thread_fun+0x10/0x10 [ 19.449354] smpboot_thread_fn+0x2e7/0x6e0 [ 19.450859] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 19.452405] kthread+0x29c/0x350 [ 19.453817] ? __pfx_kthread+0x10/0x10 [ 19.455253] ret_from_fork+0x31/0x70 [ 19.456685] ? __pfx_kthread+0x10/0x10 [ 19.458114] ret_from_fork_asm+0x1a/0x30 [ 19.459573] </TASK> [ 19.460853] [ 19.462055] Allocated by task 1198: [ 19.463410] kasan_save_stack+0x30/0x50 [ 19.464788] kasan_save_track+0x14/0x30 [ 19.466139] __kasan_kmalloc+0xaa/0xb0 [ 19.467465] __kmalloc+0x1cd/0x470 [ 19.468748] isst_if_cdev_register+0x1da/0x350 [isst_if_common] [ 19.470233] isst_if_mbox_init+0x108/0xff0 [isst_if_mbox_msr] [ 19.471670] do_one_initcall+0xa4/0x380 [ 19.472903] do_init_module+0x238/0x760 [ 19.474105] load_module+0x5239/0x6f00 [ 19.475285] init_module_from_file+0xd1/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.476506] idempotent_init_module+0x23b/0x650 [ 19.477725] __x64_sys_finit_module+0xbe/0x130 [ 19.478920] do_syscall_64+0x82/0x160 [ 19.480036] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 19.481292] [ 19.482205] The buggy address belongs to the object at ffff888829e65000 which belongs to the cache kmalloc-512 of size 512 [ 19.484818] The buggy address is located 0 bytes to the right of allocated 512-byte region [ffff888829e65000, ffff888829e65200) [ 19.487447] [ 19.488328] The buggy address belongs to the physical page: [ 19.489569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888829e60c00 pfn:0x829e60 [ 19.491140] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 19.492466] anon flags: 0x57ffffc0000840(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [ 19.493914] page_type: 0xffffffff() [ 19.494988] raw: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.496451] raw: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.497906] head: 0057ffffc0000840 ffff88810004cc80 0000000000000000 0000000000000001 [ 19.499379] head: ffff888829e60c00 0000000080200018 00000001ffffffff 0000000000000000 [ 19.500844] head: 0057ffffc0000003 ffffea0020a79801 ffffea0020a79848 00000000ffffffff [ 19.502316] head: 0000000800000000 0000000000000000 00000000ffffffff 0000000000000000 [ 19.503784] page dumped because: kasan: bad access detected [ 19.505058] [ 19.505970] Memory state around the buggy address: [ 19.507172] ffff888829e65100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.508599] ffff888829e65180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 19.510013] >ffff888829e65200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.510014] ^ [ 19.510016] ffff888829e65280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.510018] ffff888829e65300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 19.515367] ==================================================================
The reason for this error is physical_package_ids assigned by VMware VMM are not continuous and have gaps. This will cause value returned by topology_physical_package_id() to be more than topology_max_packages().
Here the allocation uses topology_max_packages(). The call to topology_max_packages() returns maximum logical package ID not physical ID. Hence use topology_logical_package_id() instead of topology_physical_package_id().
--- drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/speed_select_if/isst_if_common.c +3 -1
@@ -316,7 +316,9 @@ static struct pci_dev *_isst_if_get_pci_ cpu >= nr_cpu_ids || cpu >= num_possible_cpus())return NULL ; - pkg_id =topology_physical_package_id (cpu); + pkg_id =topology_logical_package_id (cpu); +if (pkg_id >=topology_max_packages ()) +return NULL ; bus_number = isst_cpu_info[cpu].bus_info[bus_no];if (bus_number <0 )
Greg Kroah-Hartman
maintainerPATCH 206/386 i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
commit 048bbbdbf85e5e00258dfb12f5e368f908801d7b upstream.
In case there is any sort of clock controller attached to this I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec, then an I2C transfer triggered from the clock controller clk_ops .prepare callback may trigger a deadlock on drivers/clk/clk.c prepare_lock mutex.
This is because the clock controller first grabs the prepare_lock mutex and then performs the prepare operation, including its I2C access. The I2C access resumes this I2C bus controller via .runtime_resume callback, which calls clk_prepare_enable(), which attempts to grab the prepare_lock mutex again and deadlocks.
Since the clock are already prepared since probe() and unprepared in remove(), use simple clk_enable()/clk_disable() calls to enable and disable the clock on runtime suspend and resume, to avoid hitting the prepare_lock mutex.
--- drivers/i2c/busses/i2c-stm32f7.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-stm32f7.c +3 -3
@@ -2394,7 +2394,7 @@ static int __maybe_unused stm32f7_i2c_rustruct stm32f7_i2c_dev *i2c_dev =dev_get_drvdata (dev);if (!stm32f7_i2c_is_slave_registered (i2c_dev)) -clk_disable_unprepare (i2c_dev->clk); +clk_disable (i2c_dev->clk);return 0 ; }
@@ -2405,9 +2405,9 @@ static int __maybe_unused stm32f7_i2c_ruint ret;if (!stm32f7_i2c_is_slave_registered (i2c_dev)) { - ret =clk_prepare_enable (i2c_dev->clk); + ret =clk_enable (i2c_dev->clk);if (ret) { -dev_err (dev,"failed to prepare_enable clock\n" ); +dev_err (dev,"failed to enable clock\n" );return ret; } }
Greg Kroah-Hartman
maintainerPATCH 207/386 i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit e2c85d85a05f16af2223fcc0195ff50a7938b372 upstream.
disable_irq() after request_irq() still has a time gap in which interrupts can come. request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when request IRQ.
--- drivers/i2c/busses/i2c-qcom-geni.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/i2c/busses/i2c-qcom-geni.c +1 -3
@@ -819,15 +819,13 @@ static int geni_i2c_probe(struct platforinit_completion (&gi2c->done);spin_lock_init (&gi2c->lock);platform_set_drvdata (pdev, gi2c); - ret =devm_request_irq (dev, gi2c->irq, geni_i2c_irq,0 , + ret =devm_request_irq (dev, gi2c->irq, geni_i2c_irq,IRQF_NO_AUTOEN ,dev_name (dev), gi2c);if (ret) {dev_err (dev,"Request_irq failed:%d: err:%d\n" , gi2c->irq, ret);return ret; } -/* Disable the interrupt so that the system can enter low-power mode */ -disable_irq (gi2c->irq);i2c_set_adapdata (&gi2c->adap, gi2c); gi2c->adap.dev.parent = dev; gi2c->adap.dev.of_node = dev->of_node;
Greg Kroah-Hartman
maintainerPATCH 208/386 i2c: xiic: Wait for TX empty to avoid missed TX NAKs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robert Hancock <[email protected]>
commit 521da1e9225450bd323db5fa5bca942b1dc485b7 upstream.
Frequently an I2C write will be followed by a read, such as a register address write followed by a read of the register value. In this driver, when the TX FIFO half empty interrupt was raised and it was determined that there was enough space in the TX FIFO to send the following read command, it would do so without waiting for the TX FIFO to actually empty.
Unfortunately it appears that in some cases this can result in a NAK that was raised by the target device on the write, such as due to an unsupported register address, being ignored and the subsequent read being done anyway. This can potentially put the I2C bus into an invalid state and/or result in invalid read data being processed.
To avoid this, once a message has been fully written to the TX FIFO, wait for the TX FIFO empty interrupt before moving on to the next message, to ensure NAKs are handled properly.
--- drivers/i2c/busses/i2c-xiic.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/i2c/busses/i2c-xiic.c +9 -10
@@ -772,14 +772,17 @@ static irqreturn_t xiic_process(int irq, goto out; } -xiic_fill_tx_fifo (i2c); - -/* current message sent and there is space in the fifo */ -if (!xiic_tx_space (i2c) &&xiic_tx_fifo_space (i2c) >=2 ) { +if (xiic_tx_space (i2c)) { +xiic_fill_tx_fifo (i2c); + }else { +/* current message fully written */ dev_dbg (i2c->adap.dev.parent,"%s end of message sent, nmsgs: %d\n" , __func__, i2c->nmsgs); -if (i2c->nmsgs >1 ) { +/* Don't move onto the next message until the TX FIFO empties, +* to ensure that a NAK is not missed. +*/ +if (i2c->nmsgs >1 && (pend &XIIC_INTR_TX_EMPTY_MASK )) { i2c->nmsgs--; i2c->tx_msg++; xfer_more =1 ;
@@ -790,11 +793,7 @@ static irqreturn_t xiic_process(int irq,"%s Got TX IRQ but no more to do...\n" , __func__); } - }else if (!xiic_tx_space (i2c) && (i2c->nmsgs ==1 )) -/* current frame is sent and is last, -* make sure to disable tx half -*/ -xiic_irq_dis (i2c,XIIC_INTR_TX_HALF_MASK ); + } }if (pend &XIIC_INTR_BNB_MASK ) {
Greg Kroah-Hartman
maintainerPATCH 209/386 media: i2c: ar0521: Use cansleep version of gpiod_set_value()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <[email protected]>
commit bee1aed819a8cda47927436685d216906ed17f62 upstream.
If we use GPIO reset from I2C port expander, we must use *_cansleep() variant of GPIO functions.
This was not done in ar0521_power_on()/ar0521_power_off() functions. Let's fix that.
------------[ cut here ]------------ WARNING: CPU: 0 PID: 11 at drivers/gpio/gpiolib.c:3496 gpiod_set_value+0x74/0x7c Modules linked in: CPU: 0 PID: 11 Comm: kworker/u16:0 Not tainted 6.10.0 #53 Hardware name: Diasom DS-RK3568-SOM-EVB (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : gpiod_set_value+0x74/0x7c lr : ar0521_power_on+0xcc/0x290
sp : ffffff8001d7ab70
x29: ffffff8001d7ab70 x28: ffffff80027dcc90 x27: ffffff8003c82000
x26: ffffff8003ca9250 x25: ffffffc080a39c60 x24: ffffff8003ca9088
x23: ffffff8002402720 x22: ffffff8003ca9080 x21: ffffff8003ca9088
x20: 0000000000000000 x19: ffffff8001eb2a00 x18: ffffff80efeeac80
x17: 756d2d6332692f30 x16: 0000000000000000 x15: 0000000000000000
x14: ffffff8001d91d40 x13: 0000000000000016 x12: ffffffc080e98930
x11: ffffff8001eb2880 x10: 0000000000000890 x9 : ffffff8001d7a9f0 x8 : ffffff8001d92570 x7 : ffffff80efeeac80 x6 : 000000003fc6e780 x5 : ffffff8001d91c80 x4 : 0000000000000002 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000001
Call trace: gpiod_set_value+0x74/0x7c ar0521_power_on+0xcc/0x290
...
--- drivers/media/i2c/ar0521.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/media/i2c/ar0521.c +3 -2
@@ -847,7 +847,8 @@ static int ar0521_power_off(struct devicclk_disable_unprepare (sensor->extclk);if (sensor->reset_gpio) -gpiod_set_value (sensor->reset_gpio,1 );/* assert RESET signal */ +/* assert RESET signal */ +gpiod_set_value_cansleep (sensor->reset_gpio,1 );for (i =ARRAY_SIZE (ar0521_supply_names) -1 ; i >=0 ; i--) {if (sensor->supplies[i])
@@ -881,7 +882,7 @@ static int ar0521_power_on(struct deviceif (sensor->reset_gpio)/* deassert RESET signal */ -gpiod_set_value (sensor->reset_gpio,0 ); +gpiod_set_value_cansleep (sensor->reset_gpio,0 );usleep_range (4500 ,5000 );/* min 45000 clocks */ for (cnt =0 ; cnt <ARRAY_SIZE (initial_regs); cnt++) {
Greg Kroah-Hartman
maintainerPATCH 210/386 i2c: xiic: Fix pm_runtime_set_suspended() with runtime pm enabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 0c8d604dea437b69a861479b413d629bc9b3da70 upstream.
It is not valid to call pm_runtime_set_suspended() for devices with runtime PM enabled because it returns -EAGAIN if it is enabled already and working. So, call pm_runtime_disable() before to fix it.
--- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-xiic.c +1 -1
@@ -1337,8 +1337,8 @@ static int xiic_i2c_probe(struct platforreturn 0 ; err_pm_disable: -pm_runtime_set_suspended (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev);return ret; }
Greg Kroah-Hartman
maintainerPATCH 211/386 i2c: designware: fix controller is holding SCL low while ENABLE bit is disabled
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kimriver Liu <[email protected]>
commit 5d69d5a00f80488ddcb4dee7d1374a0709398178 upstream.
It was observed that issuing the ABORT bit (IC_ENABLE[1]) will not work when IC_ENABLE is already disabled.
Check if the ENABLE bit (IC_ENABLE[0]) is disabled when the controller is holding SCL low. If the ENABLE bit is disabled, the software needs to enable it before trying to issue the ABORT bit. otherwise, the controller ignores any write to ABORT bit.
These kernel logs show up whenever an I2C transaction is attempted after this failure.i2c_designware e95e0000.i2c: timeout waiting for bus ready i2c_designware e95e0000.i2c: timeout in disabling adapter
The patch fixes the issue where the controller cannot be disabled while SCL is held low if the ENABLE bit is already disabled.
--- drivers/i2c/busses/i2c-designware-common.c | 14 ++++++++++ drivers/i2c/busses/i2c-designware-core.h | 1 drivers/i2c/busses/i2c-designware-master.c | 38 +++++++++++++++++++++++++++++ 3 files changed, 53 insertions(+)
drivers/i2c/busses/i2c-designware-common.c +14 -0
@@ -441,6 +441,7 @@ err_release_lock:void __i2c_dw_disable (struct dw_i2c_dev *dev) { +struct i2c_timings *t = &dev->timings;unsigned int raw_intr_stats;unsigned int enable;int timeout =100 ;
@@ -453,6 +454,19 @@ void __i2c_dw_disable(struct dw_i2c_dev abort_needed = raw_intr_stats &DW_IC_INTR_MST_ON_HOLD ;if (abort_needed) { +if (!(enable &DW_IC_ENABLE_ENABLE )) { +regmap_write (dev->map,DW_IC_ENABLE ,DW_IC_ENABLE_ENABLE ); +/* +* Wait 10 times the signaling period of the highest I2C +* transfer supported by the driver (for 400KHz this is +* 25us) to ensure the I2C ENABLE bit is already set +* as described in the DesignWare I2C databook. +*/ +fsleep (DIV_ROUND_CLOSEST_ULL (10 *MICRO , t->bus_freq_hz)); +/* Set ENABLE bit before setting ABORT */ + enable |=DW_IC_ENABLE_ENABLE ; + } +regmap_write (dev->map,DW_IC_ENABLE , enable |DW_IC_ENABLE_ABORT ); ret = regmap_read_poll_timeout(dev->map, DW_IC_ENABLE, enable, !(enable & DW_IC_ENABLE_ABORT), 10,
drivers/i2c/busses/i2c-designware-core.h +1 -0
@@ -109,6 +109,7 @@ DW_IC_INTR_RX_UNDER | \ DW_IC_INTR_RD_REQ) +#define DW_IC_ENABLE_ENABLE BIT(0)#define DW_IC_ENABLE_ABORT BIT(1)#define DW_IC_STATUS_ACTIVITY BIT(0)
drivers/i2c/busses/i2c-designware-master.c +38 -0
@@ -253,6 +253,34 @@ static void i2c_dw_xfer_init(struct dw_iregmap_write (dev->map,DW_IC_INTR_MASK ,DW_IC_INTR_MASTER_MASK ); } +/* +* This function waits for the controller to be idle before disabling I2C +* When the controller is not in the IDLE state, the MST_ACTIVITY bit +* (IC_STATUS[5]) is set. +* +* Values: +* 0x1 (ACTIVE): Controller not idle +* 0x0 (IDLE): Controller is idle +* +* The function is called after completing the current transfer. +* +* Returns: +* False when the controller is in the IDLE state. +* True when the controller is in the ACTIVE state. +*/ +static bool i2c_dw_is_controller_active (struct dw_i2c_dev *dev) +{ +u32 status; + +regmap_read (dev->map,DW_IC_STATUS , &status); +if (!(status &DW_IC_STATUS_MASTER_ACTIVITY )) +return false; + +return regmap_read_poll_timeout (dev->map,DW_IC_STATUS , status, + !(status &DW_IC_STATUS_MASTER_ACTIVITY ), +1100 ,20000 ) !=0 ; +} +static int i2c_dw_check_stopbit (struct dw_i2c_dev *dev) {u32 val;
@@ -695,6 +723,16 @@ i2c_dw_xfer(struct i2c_adapter *adap, st }/* +* This happens rarely (~1:500) and is hard to reproduce. Debug trace +* showed that IC_STATUS had value of 0x23 when STOP_DET occurred, +* if disable IC_ENABLE.ENABLE immediately that can result in +* IC_RAW_INTR_STAT.MASTER_ON_HOLD holding SCL low. Check if +* controller is still ACTIVE before disabling I2C. +*/ +if (i2c_dw_is_controller_active (dev)) +dev_err (dev->dev,"controller active\n" ); + +/* * We must disable the adapter before returning and signaling the end * of the current transfer. Otherwise the hardware might continue * generating interrupts which in turn causes a race condition with
Greg Kroah-Hartman
maintainerPATCH 212/386 rust: sync: require `T: Sync` for `LockedBy::access`
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alice Ryhl <[email protected]>
commit a8ee30f45d5d57467ddb7877ed6914d0eba0af7f upstream.
The LockedBy::access method only requires a shared reference to the owner, so if we have shared access to the LockedBy from several threads at once, then two threads could call access in parallel and both obtain a shared reference to the inner value. Thus, require that T: Sync when calling the access method.
An alternative is to require T: Sync in the impl Sync for LockedBy. This patch does not choose that approach as it gives up the ability to use LockedBy with !Sync types, which is okay as long as you only use access_mut.
--- rust/kernel/sync/locked_by.rs | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
rust/kernel/sync/locked_by.rs +14 -4
@@ -80,8 +80,12 @@ pub struct LockedBy<T: ?Sized, U: ?Sized// SAFETY: `LockedBy` can be transferred across thread boundaries iff the data it protects can. unsafe impl <T : ?Sized +Send ,U : ?Sized >Send for LockedBy <T ,U > {} -// SAFETY: `LockedBy` serialises the interior mutability it provides, so it is `Sync` as long as the -// data it protects is `Send`. +// SAFETY: If `T` is not `Sync`, then parallel shared access to this `LockedBy` allows you to use +// `access_mut` to hand out `&mut T` on one thread at the time. The requirement that `T: Send` is +// sufficient to allow that. +// +// If `T` is `Sync`, then the `access` method also becomes available, which allows you to obtain +// several `&T` from several threads at once. However, this is okay as `T` is `Sync`. unsafe impl <T : ?Sized +Send ,U : ?Sized >Sync for LockedBy <T ,U > {}impl <T ,U >LockedBy <T ,U > {
@@ -115,7 +119,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {/// /// Panics if `owner` is different from the data protected by the lock used in /// [`new`](LockedBy::new). -pub fn access <'a>(&'a self, owner: &'aU ) -> &'aT { +pub fn access <'a>(&'a self, owner: &'aU ) -> &'aT +where +T :Sync , + {build_assert! (size_of ::<U >() >0 ,"`U` cannot be a ZST because `owner` wouldn't be unique"
@@ -124,7 +131,10 @@ impl<T: ?Sized, U> LockedBy<T, U> {panic! ("mismatched owners" ); } -// SAFETY: `owner` is evidence that the owner is locked. +// SAFETY: `owner` is evidence that there are only shared references to the owner for the +// duration of 'a, so it's not possible to use `Self::access_mut` to obtain a mutable +// reference to the inner value that aliases with this shared reference. The type is `Sync` +// so there are no other requirements. unsafe { &*self.data.get () } }
Greg Kroah-Hartman
maintainerPATCH 213/386 ovl: fail if trusted xattrs are needed but caller lacks permission
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Baynton <[email protected]>
commit 6c4a5f96450415735c31ed70ff354f0ee5cbf67b upstream.
Some overlayfs features require permission to read/write trusted.* xattrs. These include redirect_dir, verity, metacopy, and data-only layers. This patch adds additional validations at mount time to stop overlays from mounting in certain cases where the resulting mount would not function according to the user's expectations because they lack permission to access trusted.* xattrs (for example, not global root.)
Similar checks in ovl_make_workdir() that disable features instead of failing are still relevant and used in cases where the resulting mount can still work "reasonably well." Generally, if the feature was enabled through kernel config or module option, any mount that worked before will still work the same; this applies to redirect_dir and metacopy. The user must explicitly request these features in order to generate a mount failure. Verity and data-only layers on the other hand must be explictly requested and have no "reasonable" disabled or degraded alternative, so mounts attempting either always fail.
"lower data-only dirs require metacopy support" moved down in case userxattr is set, which disables metacopy.
--- fs/overlayfs/params.c | 38 +++++++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-)
fs/overlayfs/params.c +33 -5
@@ -761,11 +761,6 @@ int ovl_fs_params_verify(const struct ov {struct ovl_opt_set set = ctx->set; -if (ctx->nr_data >0 && !config->metacopy) { -pr_err ("lower data-only dirs require metacopy support.\n" ); -return -EINVAL ; - } -/* Workdir/index are useless in non-upper mount */ if (!config->upperdir) {if (config->workdir) {
@@ -917,6 +912,39 @@ int ovl_fs_params_verify(const struct ov config->metacopy = false; } +/* +* Fail if we don't have trusted xattr capability and a feature was +* explicitly requested that requires them. +*/ +if (!config->userxattr && !capable (CAP_SYS_ADMIN )) { +if (set.redirect && + config->redirect_mode !=OVL_REDIRECT_NOFOLLOW ) { +pr_err ("redirect_dir requires permission to access trusted xattrs\n" ); +return -EPERM ; + } +if (config->metacopy && set.metacopy) { +pr_err ("metacopy requires permission to access trusted xattrs\n" ); +return -EPERM ; + } +if (config->verity_mode) { +pr_err ("verity requires permission to access trusted xattrs\n" ); +return -EPERM ; + } +if (ctx->nr_data >0 ) { +pr_err ("lower data-only dirs require permission to access trusted xattrs\n" ); +return -EPERM ; + } +/* +* Other xattr-dependent features should be disabled without +* great disturbance to the user in ovl_make_workdir(). +*/ + } + +if (ctx->nr_data >0 && !config->metacopy) { +pr_err ("lower data-only dirs require metacopy support.\n" ); +return -EINVAL ; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 214/386 firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 9c3a62c20f7fb00294a4237e287254456ba8a48b upstream.
mbox_client_to_bpmp() is not used, W=1 builds:
drivers/firmware/tegra/bpmp.c:28:1: error: unused function 'mbox_client_to_bpmp' [-Werror,-Wunused-function]
--- drivers/firmware/tegra/bpmp.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/firmware/tegra/bpmp.c +0 -6
@@ -24,12 +24,6 @@#define MSG_RING BIT(1)#define TAG_SZ 32 -static inline struct tegra_bpmp * -mbox_client_to_bpmp (struct mbox_client *client) -{ - return container_of(client, struct tegra_bpmp, mbox.client); -} -static inline const struct tegra_bpmp_ops *channel_to_ops (struct tegra_bpmp_channel *channel) {
Greg Kroah-Hartman
maintainerPATCH 215/386 memory: tegra186-emc: drop unused to_tegra186_emc()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 67dd9e861add38755a7c5d29e25dd0f6cb4116ab upstream.
to_tegra186_emc() is not used, W=1 builds:
tegra186-emc.c:38:36: error: unused function 'to_tegra186_emc' [-Werror,-Wunused-function]
--- drivers/memory/tegra/tegra186-emc.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/memory/tegra/tegra186-emc.c +0 -5
@@ -35,11 +35,6 @@ struct tegra186_emc {struct icc_provider provider; }; -static inline struct tegra186_emc *to_tegra186_emc (struct icc_provider *provider) -{ - return container_of(provider, struct tegra186_emc, provider); -} -/* * debugfs interface *
Greg Kroah-Hartman
maintainerPATCH 216/386 dt-bindings: clock: exynos7885: Fix duplicated binding
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Virag <[email protected]>
commit abf3a3ea9acb5c886c8729191a670744ecd42024 upstream.
The numbering in Exynos7885's FSYS CMU bindings has 4 duplicated by accident, with the rest of the bindings continuing with 5.
Fix this by moving CLK_MOUT_FSYS_USB30DRD_USER to the end as 11.
Since CLK_MOUT_FSYS_USB30DRD_USER is not used in any device tree as of now, and there are no other clocks affected (maybe apart from CLK_MOUT_FSYS_MMC_SDIO_USER which the number was shared with, also not used in a device tree), this is the least impactful way to solve this problem.
--- include/dt-bindings/clock/exynos7885.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/dt-bindings/clock/exynos7885.h +1 -1
@@ -136,12 +136,12 @@#define CLK_MOUT_FSYS_MMC_CARD_USER 2#define CLK_MOUT_FSYS_MMC_EMBD_USER 3#define CLK_MOUT_FSYS_MMC_SDIO_USER 4 -#define CLK_MOUT_FSYS_USB30DRD_USER 4#define CLK_GOUT_MMC_CARD_ACLK 5#define CLK_GOUT_MMC_CARD_SDCLKIN 6#define CLK_GOUT_MMC_EMBD_ACLK 7#define CLK_GOUT_MMC_EMBD_SDCLKIN 8#define CLK_GOUT_MMC_SDIO_ACLK 9#define CLK_GOUT_MMC_SDIO_SDCLKIN 10 +#define CLK_MOUT_FSYS_USB30DRD_USER 11#endif /* _DT_BINDINGS_CLOCK_EXYNOS_7885_H */
Greg Kroah-Hartman
maintainerPATCH 217/386 spi: bcm63xx: Fix module autoloading
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 909f34f2462a99bf876f64c5c61c653213e32fce upstream.
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table.
--- drivers/spi/spi-bcm63xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-bcm63xx.c +1 -0
@@ -466,6 +466,7 @@ static const struct platform_device_id b { }, }; +MODULE_DEVICE_TABLE (platform, bcm63xx_spi_dev_match);static const struct of_device_id bcm63xx_spi_of_match[] = { { .compatible ="brcm,bcm6348-spi" , .data = &bcm6348_spi_reg_offsets },
Greg Kroah-Hartman
maintainerPATCH 218/386 spi: bcm63xx: Fix missing pm_runtime_disable()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
commit 265697288ec2160ca84707565d6641d46f69b0ff upstream.
The pm_runtime_disable() is missing in the remove function, fix it by using devm_pm_runtime_enable(), so the pm_runtime_disable() in the probe error path can also be removed.
--- drivers/spi/spi-bcm63xx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/spi/spi-bcm63xx.c +4 -4
@@ -584,13 +584,15 @@ static int bcm63xx_spi_probe(struct platbcm_spi_writeb (bs,SPI_INTR_CLEAR_ALL ,SPI_INT_STATUS ); -pm_runtime_enable (&pdev->dev); + ret =devm_pm_runtime_enable (&pdev->dev); +if (ret) + goto out_clk_disable;/* register and we are done */ ret =devm_spi_register_controller (dev, host);if (ret) {dev_err (dev,"spi register failed\n" ); - goto out_pm_disable; + goto out_clk_disable; } dev_info(dev, "at %pr (irq %d, FIFOs size %d)\n",
@@ -598,8 +600,6 @@ static int bcm63xx_spi_probe(struct platreturn 0 ; -out_pm_disable: -pm_runtime_disable (&pdev->dev); out_clk_disable:clk_disable_unprepare (clk); out_err:
Greg Kroah-Hartman
maintainerPATCH 219/386 power: supply: hwmon: Fix missing temp1_max_alarm attribute
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit e50a57d16f897e45de1112eb6478577b197fab52 upstream.
Temp channel 0 aka temp1 can have a temp1_max_alarm attribute for power_supply devices which have a POWER_SUPPLY_PROP_TEMP_ALERT_MAX property.
HWMON_T_MAX_ALARM was missing from power_supply_hwmon_info for temp channel 0, causing the hwmon temp1_max_alarm attribute to be missing from such power_supply devices.
Add this to power_supply_hwmon_info to fix this.
--- drivers/power/supply/power_supply_hwmon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/power_supply_hwmon.c +2 -1
@@ -299,7 +299,8 @@ static const struct hwmon_channel_info *HWMON_T_INPUT |HWMON_T_MAX |HWMON_T_MIN | -HWMON_T_MIN_ALARM , +HWMON_T_MIN_ALARM | +HWMON_T_MAX_ALARM ,HWMON_T_LABEL | HWMON_T_INPUT |
Greg Kroah-Hartman
maintainerPATCH 220/386 perf/core: Fix small negative period being ignored
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Gengkun <[email protected]>
commit 62c0b1061593d7012292f781f11145b2d46f43ab upstream.
In perf_adjust_period, we will first calculate period, and then use this period to calculate delta. However, when delta is less than 0, there will be a deviation compared to when delta is greater than or equal to 0. For example, when delta is in the range of [-14,-1], the range of delta = delta + 7 is between [-7,6], so the final value of delta/8 is 0. Therefore, the impact of -1 and -2 will be ignored. This is unacceptable when the target period is very short, because we will lose a lot of samples.
Here are some tests and analyzes:
before:
# perf record -e cs -F 1000 ./a.out [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.022 MB perf.data (518 samples) ]
# perf script ... a.out 396 257.956048: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.957891: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.959730: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.961545: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.963355: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.965163: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.966973: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.968785: 23 cs: ffffffff81f4eeec schedul> a.out 396 257.970593: 23 cs: ffffffff81f4eeec schedul> ...
after:
# perf record -e cs -F 1000 ./a.out [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.058 MB perf.data (1466 samples) ]
# perf script ... a.out 395 59.338813: 11 cs: ffffffff81f4eeec schedul> a.out 395 59.339707: 12 cs: ffffffff81f4eeec schedul> a.out 395 59.340682: 13 cs: ffffffff81f4eeec schedul> a.out 395 59.341751: 13 cs: ffffffff81f4eeec schedul> a.out 395 59.342799: 12 cs: ffffffff81f4eeec schedul> a.out 395 59.343765: 11 cs: ffffffff81f4eeec schedul> a.out 395 59.344651: 11 cs: ffffffff81f4eeec schedul> a.out 395 59.345539: 12 cs: ffffffff81f4eeec schedul> a.out 395 59.346502: 13 cs: ffffffff81f4eeec schedul> ...
test.c
int main() {
for (int i = 0; i < 20000; i++)
usleep(10);
return 0;
}# time ./a.out real 0m1.583s user 0m0.040s sys 0m0.298s
The above results were tested on x86-64 qemu with KVM enabled using test.c as test program. Ideally, we should have around 1500 samples, but the previous algorithm had only about 500, whereas the modified algorithm now has about 1400. Further more, the new version shows 1 sample per 0.001s, while the previous one is 1 sample per 0.002s.This indicates that the new algorithm is more sensitive to small negative values compared to old algorithm.
--- kernel/events/core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/events/core.c +5 -1
@@ -4104,7 +4104,11 @@ static void perf_adjust_period(struct pe period =perf_calculate_period (event, nsec, count); delta = (s64)(period - hwc->sample_period); - delta = (delta +7 ) /8 ;/* low pass filter */ +if (delta >=0 ) + delta +=7 ; +else + delta -=7 ; + delta /=8 ;/* low pass filter */ sample_period = hwc->sample_period + delta;
Greg Kroah-Hartman
maintainerPATCH 221/386 parisc: Fix itlb miss handler for 64-bit programs
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 9542130937e9dc707dd7c6b7af73326437da2d50 upstream.
For an itlb miss when executing code above 4 Gb on ILP64 adjust the iasq/iaoq in the same way isr/ior was adjusted. This fixes signal delivery for the 64-bit static test program from
http://ftp.parisc-linux.org/src/64bit.tar.gz. Note that signals are handled by the signal trampoline code in the 64-bit VDSO which is mapped into high userspace memory region above 4GB for 64-bit processes.
--- arch/parisc/kernel/entry.S | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
arch/parisc/kernel/entry.S +2 -4
@@ -1051,8 +1051,7 @@ ENTRY_CFI(intr_save) /* for os_hpmc */ STREG %r16, PT_ISR(%r29) STREG %r17, PT_IOR(%r29) -#if 0 && defined(CONFIG_64BIT) - /* Revisit when we have 64-bit code above 4Gb */ +#if defined(CONFIG_64BIT) b,n intr_save2 skip_save_ior:
@@ -1060,8 +1059,7 @@ skip_save_ior: * need to adjust iasq/iaoq here in the same way we adjusted isr/ior * above. */ - extrd,u,* %r8,PSW_W_BIT,1,%r1 - cmpib,COND(=),n 1,%r1,intr_save2 + bb,COND(>=),n %r8,PSW_W_BIT,intr_save2 LDREG PT_IASQ0(%r29), %r16 LDREG PT_IAOQ0(%r29), %r17 /* adjust iasq/iaoq */
Greg Kroah-Hartman
maintainerPATCH 222/386 drm/mediatek: ovl_adaptor: Add missing of_node_put()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <[email protected]>
commit 5beb6fba25db235b52eab34bde8112f07bb31d75 upstream.
Error paths that exit for_each_child_of_node() need to call of_node_put() to decerement the child refcount and avoid memory leaks.
Add the missing of_node_put().
--- drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/mediatek/mtk_disp_ovl_adaptor.c +3 -1
@@ -436,8 +436,10 @@ static int ovl_adaptor_comp_init(struct } comp_pdev =of_find_device_by_node (node); -if (!comp_pdev) +if (!comp_pdev) { +of_node_put (node);return -EPROBE_DEFER ; + } priv->ovl_adaptor_comp[id] = &comp_pdev->dev;
Greg Kroah-Hartman
maintainerPATCH 223/386 drm: Consistently use struct drm_mode_rect for FB_DAMAGE_CLIPS
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 8b0d2f61545545ab5eef923ed6e59fc3be2385e0 upstream.
FB_DAMAGE_CLIPS is a plane property for damage handling. Its UAPI should only use UAPI types. Hence replace struct drm_rect with struct drm_mode_rect in drm_atomic_plane_set_property(). Both types are identical in practice, so there's no change in behavior.
--- drivers/gpu/drm/drm_atomic_uapi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_atomic_uapi.c +1 -1
@@ -585,7 +585,7 @@ static int drm_atomic_plane_set_property &state->fb_damage_clips, val,-1 , -sizeof (struct drm_rect ), +sizeof (struct drm_mode_rect ), &replaced);return ret; }else if (property == plane->scaling_filter_property) {
Greg Kroah-Hartman
maintainerPATCH 224/386 ALSA: hda/tas2781: Add new quirk for Lenovo Y990 Laptop
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baojun Xu <[email protected]>
commit 49f5ee951f11f4d6a124f00f71b2590507811a55 upstream.
Add new vendor_id and subsystem_id in quirk for Lenovo Y990 Laptop.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10330,6 +10330,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x38cd ,"Y790 VECO DUAL" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x38d2 ,"Lenovo Yoga 9 14IMH9" ,ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN ),SND_PCI_QUIRK (0x17aa ,0x38d7 ,"Lenovo Yoga 9 14IMH9" ,ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN ), +SND_PCI_QUIRK (0x17aa ,0x38df ,"Y990 YG DUAL" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x38f9 ,"Thinkbook 16P Gen5" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x38fa ,"Thinkbook 16P Gen5" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
Greg Kroah-Hartman
maintainerPATCH 225/386 ALSA: core: add isascii() check to card ID generator
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaroslav Kysela <[email protected]>
commit d278a9de5e1837edbe57b2f1f95a104ff6c84846 upstream.
The card identifier should contain only safe ASCII characters. The isalnum() returns true also for characters for non-ASCII characters.
--- sound/core/init.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
sound/core/init.c +10 -4
@@ -666,13 +666,19 @@ void snd_card_free(struct snd_card *card }EXPORT_SYMBOL (snd_card_free); +/* check, if the character is in the valid ASCII range */ +static inline bool safe_ascii_char (char c) +{ +return isascii (c) &&isalnum (c); +} +/* retrieve the last word of shortname or longname */ static const char *retrieve_id_from_card_name (const char *name) {const char *spos = name;while (*name) { -if (isspace (*name) &&isalnum (name[1 ])) +if (isspace (*name) &&safe_ascii_char (name[1 ])) spos = name +1 ; name++; }
@@ -699,12 +705,12 @@ static void copy_valid_id_string(struct {char *id = card->id; -while (*nid && !isalnum (*nid)) +while (*nid && !safe_ascii_char (*nid)) nid++;if (isdigit (*nid)) *id++ =isalpha (*src) ? *src :'D' ;while (*nid && (size_t )(id - card->id) <sizeof (card->id) -1 ) { -if (isalnum (*nid)) +if (safe_ascii_char (*nid)) *id++ = *nid; nid++; }
@@ -800,7 +806,7 @@ static ssize_t id_store(struct device *dfor (idx =0 ; idx < copy; idx++) { c = buf[idx]; -if (!isalnum (c) && c !='_' && c !='-' ) +if (!safe_ascii_char (c) && c !='_' && c !='-' )return -EINVAL ; }memcpy (buf1, buf, copy);
Greg Kroah-Hartman
maintainerPATCH 226/386 ALSA: usb-audio: Add delay quirk for VIVO USB-C HEADSET
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianqin Hu <[email protected]>
commit 73385f3e0d8088b715ae8f3f66d533c482a376ab upstream.
Audio control requests that sets sampling frequency sometimes fail on this card. Adding delay between control messages eliminates that problem.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2181,6 +2181,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_GENERIC_IMPLICIT_FB),DEVICE_FLG (0x2b53 ,0x0031 ,/* Fiero SC-01 (firmware v1.1.0) */ QUIRK_FLAG_GENERIC_IMPLICIT_FB ), +DEVICE_FLG (0x2d95 ,0x8011 ,/* VIVO USB-C HEADSET */ +QUIRK_FLAG_CTL_MSG_DELAY_1M ),DEVICE_FLG (0x2d95 ,0x8021 ,/* VIVO USB-C-XE710 HEADSET */ QUIRK_FLAG_CTL_MSG_DELAY_1M ), DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */
Greg Kroah-Hartman
maintainerPATCH 227/386 ALSA: usb-audio: Add native DSD support for Luxman D-08u
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Lalinsky <[email protected]>
commit 6b0bde5d8d4078ca5feec72fd2d828f0e5cf115d upstream.
Add native DSD support for Luxman D-08u DAC, by adding the PID/VID 1852:5062. This makes DSD playback work, and also sound quality when playing PCM files is improved, crackling sounds are gone.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2123,6 +2123,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_DISABLE_AUTOSUSPEND),DEVICE_FLG (0x17aa ,0x104d ,/* Lenovo ThinkStation P620 Internal Speaker + Front Headset */ QUIRK_FLAG_DISABLE_AUTOSUSPEND ), +DEVICE_FLG (0x1852 ,0x5062 ,/* Luxman D-08u */ +QUIRK_FLAG_ITF_USB_DSD_DAC |QUIRK_FLAG_CTL_MSG_DELAY ),DEVICE_FLG (0x1852 ,0x5065 ,/* Luxman DA-06 */ QUIRK_FLAG_ITF_USB_DSD_DAC |QUIRK_FLAG_CTL_MSG_DELAY ), DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */
Greg Kroah-Hartman
maintainerPATCH 228/386 ALSA: line6: add hw monitor volume control to POD HD500X
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans P. Moller <[email protected]>
commit 703235a244e533652346844cfa42623afb36eed1 upstream.
Add hw monitor volume control for POD HD500X. This is done adding LINE6_CAP_HWMON_CTL to the capabilities
--- sound/usb/line6/podhd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/line6/podhd.c +1 -1
@@ -507,7 +507,7 @@ static const struct line6_properties pod [LINE6_PODHD500X] = { .id = "PODHD500X", .name = "POD HD500X", - .capabilities =LINE6_CAP_CONTROL + .capabilities =LINE6_CAP_CONTROL |LINE6_CAP_HWMON_CTL | LINE6_CAP_PCM | LINE6_CAP_HWMON, .altsetting = 1, .ep_ctrl_r = 0x81,
Greg Kroah-Hartman
maintainerPATCH 229/386 ALSA: hda/realtek: Add quirk for Huawei MateBook 13 KLV-WX9
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ai Chao <[email protected]>
commit dee476950cbd83125655a3f49e00d63b79f6114e upstream.
The headset mic requires a fixup to be properly detected/used.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -10363,6 +10363,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1849 ,0xa233 ,"Positivo Master C6300" ,ALC269_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x19e5 ,0x3204 ,"Huawei MACH-WX9" ,ALC256_FIXUP_HUAWEI_MACH_WX9_PINS ),SND_PCI_QUIRK (0x19e5 ,0x320f ,"Huawei WRT-WX9 " ,ALC256_FIXUP_ASUS_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x19e5 ,0x3212 ,"Huawei KLV-WX9 " ,ALC256_FIXUP_ACER_HEADSET_MIC ),SND_PCI_QUIRK (0x1b35 ,0x1235 ,"CZC B20" ,ALC269_FIXUP_CZC_B20 ),SND_PCI_QUIRK (0x1b35 ,0x1236 ,"CZC TMI" ,ALC269_FIXUP_CZC_TMI ), SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101),
Greg Kroah-Hartman
maintainerPATCH 230/386 ALSA: hda/realtek: Add a quirk for HP Pavilion 15z-ec200
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Tamboli <[email protected]>
commit d75dba49744478c32f6ce1c16b5f391c2d5cef5f upstream.
Add the quirk for HP Pavilion Gaming laptop 15z-ec200 for enabling the mute led. The fix apply the ALC285_FIXUP_HP_MUTE_LED quirk for this model.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9923,6 +9923,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8896 ,"HP EliteBook 855 G8 Notebook PC" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x8898 ,"HP EliteBook 845 G8 Notebook PC" ,ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x103c ,0x88d0 ,"HP Pavilion 15-eh1xxx (mainboard 88D0)" ,ALC287_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x88dd ,"HP Pavilion 15z-ec200" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x8902 ,"HP OMEN 16" ,ALC285_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK (0x103c ,0x890e ,"HP 255 G8 Notebook PC" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ), SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 231/386 ext4: no need to continue when the number of entries is 1
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <[email protected]>
commit 1a00a393d6a7fb1e745a41edd09019bd6a0ad64c upstream.
--- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/namei.c +1 -1
@@ -2047,7 +2047,7 @@ static struct ext4_dir_entry_2 *do_split split = count/2 ; hash2 = map[split].hash; - continued = hash2 == map[split -1 ].hash; + continued = split >0 ? hash2 == map[split -1 ].hash :0 ;dxtrace (printk (KERN_INFO "Split block %lu at %x, %i/%i\n" , (unsigned long )dx_get_block (frame->at), hash2, split, count-split));
Greg Kroah-Hartman
maintainerPATCH 232/386 ext4: correct encrypted dentry name hash when not casefolded
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: yao.ly <[email protected]>
commit 70dd7b573afeba9b8f8a33f2ae1e4a9a2ec8c1ec upstream.
EXT4_DIRENT_HASH and EXT4_DIRENT_MINOR_HASH will access struct ext4_dir_entry_hash followed ext4_dir_entry. But there is no ext4_dir_entry_hash followed when inode is encrypted and not casefolded
--- fs/ext4/dir.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/ext4/dir.c +11 -3
@@ -279,12 +279,20 @@ static int ext4_readdir(struct file *filstruct fscrypt_str de_name =FSTR_INIT (de->name, de->name_len); +u32 hash; +u32 minor_hash; + +if (IS_CASEFOLDED (inode)) { + hash =EXT4_DIRENT_HASH (de); + minor_hash =EXT4_DIRENT_MINOR_HASH (de); + }else { + hash =0 ; + minor_hash =0 ; + }/* Directory is encrypted */ err =fscrypt_fname_disk_to_usr (inode, -EXT4_DIRENT_HASH (de), -EXT4_DIRENT_MINOR_HASH (de), - &de_name, &fstr); + hash, minor_hash, &de_name, &fstr); de_name = fstr; fstr.len = save_len;if (err)
Greg Kroah-Hartman
maintainerPATCH 233/386 ext4: fix slab-use-after-free in ext4_split_extent_at()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit c26ab35702f8cd0cdc78f96aa5856bfb77be798f upstream.
We hit the following use-after-free:
==================================================================
BUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0 Read of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40 CPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirty #724 Call Trace: <TASK> kasan_report+0x93/0xc0 ext4_split_extent_at+0xba8/0xcc0 ext4_split_extent.isra.0+0x18f/0x500 ext4_split_convert_extents+0x275/0x750 ext4_ext_handle_unwritten_extents+0x73e/0x1580 ext4_ext_map_blocks+0xe20/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70
[...]
Allocated by task 40: __kmalloc_noprof+0x1ac/0x480 ext4_find_extent+0xf3b/0x1e70 ext4_ext_map_blocks+0x188/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70
[...]
Freed by task 40: kfree+0xf1/0x2b0 ext4_find_extent+0xa71/0x1e70 ext4_ext_insert_extent+0xa22/0x3260 ext4_split_extent_at+0x3ef/0xcc0 ext4_split_extent.isra.0+0x18f/0x500 ext4_split_convert_extents+0x275/0x750 ext4_ext_handle_unwritten_extents+0x73e/0x1580 ext4_ext_map_blocks+0xe20/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70
[...]
==================================================================
The flow of issue triggering is as follows:
ext4_split_extent_at
path = *ppath ext4_ext_insert_extent(ppath)
ext4_ext_create_new_leaf(ppath)
ext4_find_extent(orig_path)
path = *orig_path read_extent_tree_block
// return -ENOMEM or -EIO
ext4_free_ext_path(path)
kfree(path)
*orig_path = NULL
a. If err is -ENOMEM:
ext4_ext_dirty(path + path->p_depth)
// path use-after-free !!!
b. If err is -EIO and we have EXT_DEBUG defined:
ext4_ext_show_leaf(path)
eh = path[depth].p_hdr
// path also use-after-free !!!
So when trying to zeroout or fix the extent length, call ext4_find_extent() to update the path.
In addition we use *ppath directly as an ext4_ext_show_leaf() input to avoid possible use-after-free when EXT_DEBUG is defined, and to avoid unnecessary path updates.
--- fs/ext4/extents.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
fs/ext4/extents.c +20 -1
@@ -3230,6 +3230,25 @@ static int ext4_split_extent_at(handle_tif (err != -ENOSPC && err != -EDQUOT && err != -ENOMEM ) goto out; +/* +* Update path is required because previous ext4_ext_insert_extent() +* may have freed or reallocated the path. Using EXT4_EX_NOFAIL +* guarantees that ext4_find_extent() will not return -ENOMEM, +* otherwise -ENOMEM will cause a retry in do_writepages(), and a +* WARN_ON may be triggered in ext4_da_update_reserve_space() due to +* an incorrect ee_len causing the i_reserved_data_blocks exception. +*/ + path =ext4_find_extent (inode, ee_block, ppath, + flags |EXT4_EX_NOFAIL ); +if (IS_ERR (path)) { +EXT4_ERROR_INODE (inode,"Failed split extent on %u, err %ld" , + split,PTR_ERR (path)); +return PTR_ERR (path); + } + depth =ext_depth (inode); + ex = path[depth].p_ext; + *ppath = path; +if (EXT4_EXT_MAY_ZEROOUT & split_flag) {if (split_flag & (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )) {if (split_flag &EXT4_EXT_DATA_VALID1 ) {
@@ -3282,7 +3301,7 @@ fix_extent_len:ext4_ext_dirty (handle, inode, path + path->p_depth);return err; out: -ext4_ext_show_leaf (inode, path); +ext4_ext_show_leaf (inode, *ppath);return err; }
Greg Kroah-Hartman
maintainerPATCH 234/386 ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 369c944ed1d7c3fb7b35f24e4735761153afe7b3 upstream.
Even though ext4_find_extent() returns an error, ext4_insert_range() still returns 0. This may confuse the user as to why fallocate returns success, but the contents of the file are not as expected. So propagate the error returned by ext4_find_extent() to avoid inconsistencies.
--- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/extents.c +1 -0
@@ -5549,6 +5549,7 @@ static int ext4_insert_range(struct file path =ext4_find_extent (inode, offset_lblk,NULL ,0 );if (IS_ERR (path)) {up_write (&EXT4_I (inode)->i_data_sem); + ret =PTR_ERR (path); goto out_stop; }
Greg Kroah-Hartman
maintainerPATCH 235/386 ext4: fix incorrect tid assumption in ext4_fc_mark_ineligible()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
commit ebc4b2c1ac92fc0f8bf3f5a9c285a871d5084a6b upstream.
Function jbd2_journal_shrink_checkpoint_list() assumes that '0' is not a valid value for transaction IDs, which is incorrect.
Furthermore, the sbi->s_fc_ineligible_tid handling also makes the same assumption by being initialised to '0'. Fortunately, the sb flag EXT4_MF_FC_INELIGIBLE can be used to check whether sbi->s_fc_ineligible_tid has been previously set instead of comparing it with '0'.
--- fs/ext4/fast_commit.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
fs/ext4/fast_commit.c +11 -4
@@ -339,22 +339,29 @@ void ext4_fc_mark_ineligible(struct supe {struct ext4_sb_info *sbi =EXT4_SB (sb);tid_t tid; +bool has_transaction = true; +bool is_ineligible;if (ext4_fc_disabled (sb))return ; -ext4_set_mount_flag (sb,EXT4_MF_FC_INELIGIBLE );if (handle && !IS_ERR (handle)) tid = handle->h_transaction->t_tid;else {read_lock (&sbi->s_journal->j_state_lock); - tid = sbi->s_journal->j_running_transaction ? - sbi->s_journal->j_running_transaction->t_tid :0 ; +if (sbi->s_journal->j_running_transaction) + tid = sbi->s_journal->j_running_transaction->t_tid; +else + has_transaction = false;read_unlock (&sbi->s_journal->j_state_lock); }spin_lock (&sbi->s_fc_lock); -if (tid_gt (tid, sbi->s_fc_ineligible_tid)) + is_ineligible =ext4_test_mount_flag (sb,EXT4_MF_FC_INELIGIBLE ); +if (has_transaction && + (!is_ineligible || + (is_ineligible &&tid_gt (tid, sbi->s_fc_ineligible_tid)))) sbi->s_fc_ineligible_tid = tid; +ext4_set_mount_flag (sb,EXT4_MF_FC_INELIGIBLE );spin_unlock (&sbi->s_fc_lock);WARN_ON (reason >=EXT4_FC_REASON_MAX ); sbi->s_fc_stats.fc_ineligible_reason_count[reason]++;
Greg Kroah-Hartman
maintainerPATCH 236/386 ext4: dax: fix overflowing extents beyond inode size when partially writing
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhihao Cheng <[email protected]>
commit dda898d7ffe85931f9cca6d702a51f33717c501e upstream.
The dax_iomap_rw() does two things in each iteration: map written blocks and copy user data to blocks. If the process is killed by user(See signal handling in dax_iomap_iter()), the copied data will be returned and added on inode size, which means that the length of written extents may exceed the inode size, then fsck will fail. An example is given as:
dd if=/dev/urandom of=file bs=4M count=1
dax_iomap_rw
iomap_iter // round 1
ext4_iomap_begin
ext4_iomap_alloc // allocate 0~2M extents(written flag)
dax_iomap_iter // copy 2M data
iomap_iter // round 2
iomap_iter_advance
iter->pos += iter->processed // iter->pos = 2M
ext4_iomap_begin
ext4_iomap_alloc // allocate 2~4M extents(written flag)
dax_iomap_iter
fatal_signal_pending
done = iter->pos - iocb->ki_pos // done = 2M
ext4_handle_inode_extension
ext4_update_inode_size // inode size = 2M
fsck reports: Inode 13, i_size is 2097152, should be 4194304. Fix?
Fix the problem by truncating extents if the written length is smaller than expected.
--- fs/ext4/file.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/ext4/file.c +4 -4
@@ -334,10 +334,10 @@ static ssize_t ext4_handle_inode_extensi* Clean up the inode after DIO or DAX extending write has completed and the * inode size has been updated using ext4_handle_inode_extension(). */ -static void ext4_inode_extension_cleanup (struct inode *inode,ssize_t count) +static void ext4_inode_extension_cleanup (struct inode *inode,bool need_trunc) {lockdep_assert_held_write (&inode->i_rwsem); -if (count <0 ) { +if (need_trunc) {ext4_truncate_failed_write (inode);/* * If the truncate operation failed early, then the inode may
@@ -586,7 +586,7 @@ static ssize_t ext4_dio_write_iter(struc* writeback of delalloc blocks. */ WARN_ON_ONCE (ret == -EIOCBQUEUED ); -ext4_inode_extension_cleanup (inode, ret); +ext4_inode_extension_cleanup (inode, ret <0 ); } out:
@@ -670,7 +670,7 @@ ext4_dax_write_iter(struct kiocb *iocb,if (extend) { ret =ext4_handle_inode_extension (inode, offset, ret); -ext4_inode_extension_cleanup (inode, ret); +ext4_inode_extension_cleanup (inode, ret < (ssize_t )count); } out:inode_unlock (inode);
Greg Kroah-Hartman
maintainerPATCH 237/386 ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
commit 972090651ee15e51abfb2160e986fa050cfc7a40 upstream.
Function __jbd2_log_wait_for_space() assumes that '0' is not a valid value for transaction IDs, which is incorrect. Don't assume that and invoke jbd2_log_wait_commit() if the journal had a committing transaction instead.
--- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/jbd2/checkpoint.c +5 -2
@@ -79,9 +79,12 @@ __releases(&journal->j_state_lock)if (space_left < nblocks) {int chkpt = journal->j_checkpoint_transactions !=NULL ;tid_t tid =0 ; +bool has_transaction = false; -if (journal->j_committing_transaction) +if (journal->j_committing_transaction) { tid = journal->j_committing_transaction->t_tid; + has_transaction = true; + }spin_unlock (&journal->j_list_lock);write_unlock (&journal->j_state_lock);if (chkpt) {
@@ -89,7 +92,7 @@ __releases(&journal->j_state_lock) }else if (jbd2_cleanup_journal_tail (journal) ==0 ) {/* We were able to recover space; yay! */ ; - }else if (tid) { + }else if (has_transaction) {/* * jbd2_journal_commit_transaction() may want * to take the checkpoint_mutex if JBD2_FLUSHED
Greg Kroah-Hartman
maintainerPATCH 238/386 ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 5c0f4cc84d3a601c99bc5e6e6eb1cbda542cce95 upstream.
When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus potentially triggering a double-free in the following process:
ext4_ext_replay_update_ex
ppath = path
ext4_force_split_extent_at(&ppath)
ext4_split_extent_at
ext4_ext_insert_extent
ext4_ext_create_new_leaf
ext4_ext_grow_indepth
ext4_find_extent
if (depth > path[0].p_maxdepth)
kfree(path) ---> path First freed
*orig_path = path = NULL ---> null ppathkfree(path) ---> path double-free !!!
So drop the unnecessary ppath and use path directly to avoid this problem. And use ext4_find_extent() directly to update path, avoiding unnecessary memory allocation and freeing. Also, propagate the error returned by ext4_find_extent() instead of using strange error codes.
--- fs/ext4/extents.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
fs/ext4/extents.c +10 -11
@@ -5895,7 +5895,7 @@ out:int ext4_ext_replay_update_ex (struct inode *inode,ext4_lblk_t start,int len,int unwritten,ext4_fsblk_t pblk) { -struct ext4_ext_path *path =NULL , *ppath; +struct ext4_ext_path *path;struct ext4_extent *ex;int ret;
@@ -5911,30 +5911,29 @@ int ext4_ext_replay_update_ex(struct inoif (le32_to_cpu (ex->ee_block) != start ||ext4_ext_get_actual_len (ex) != len) {/* We need to split this extent to match our extent first */ - ppath = path;down_write (&EXT4_I (inode)->i_data_sem); - ret =ext4_force_split_extent_at (NULL , inode, &ppath, start,1 ); + ret =ext4_force_split_extent_at (NULL , inode, &path, start,1 );up_write (&EXT4_I (inode)->i_data_sem);if (ret) goto out; -kfree (path); - path =ext4_find_extent (inode, start,NULL ,0 ); + + path =ext4_find_extent (inode, start, &path,0 );if (IS_ERR (path)) -return -1 ; - ppath = path; +return PTR_ERR (path); ex = path[path->p_depth].p_ext;WARN_ON (le32_to_cpu (ex->ee_block) != start); +if (ext4_ext_get_actual_len (ex) != len) {down_write (&EXT4_I (inode)->i_data_sem); - ret =ext4_force_split_extent_at (NULL , inode, &ppath, + ret =ext4_force_split_extent_at (NULL , inode, &path, start + len,1 );up_write (&EXT4_I (inode)->i_data_sem);if (ret) goto out; -kfree (path); - path =ext4_find_extent (inode, start,NULL ,0 ); + + path =ext4_find_extent (inode, start, &path,0 );if (IS_ERR (path)) -return -EINVAL ; +return PTR_ERR (path); ex = path[path->p_depth].p_ext; } }
Greg Kroah-Hartman
maintainerPATCH 239/386 ext4: aovid use-after-free in ext4_ext_insert_extent()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit a164f3a432aae62ca23d03e6d926b122ee5b860d upstream.
As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values:
ext4_ext_insert_extent
path = *ppath = 2000
ext4_ext_create_new_leaf(ppath)
ext4_find_extent(ppath)
path = *ppath = 2000
if (depth > path[0].p_maxdepth)
kfree(path = 2000);
*ppath = path = NULL;
path = kcalloc() = 3000
*ppath = 3000;
return path; /* here path is still 2000, UAF! */
eh = path[depth].p_hdr
==================================================================
BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace: <TASK> ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800
[...]
Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700
[...]
Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700
[...]
==================================================================
So use *ppath to update the path to avoid the above problem.
--- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/extents.c +1 -0
@@ -2103,6 +2103,7 @@ prepend: ppath, newext);if (err) goto cleanup; + path = *ppath; depth =ext_depth (inode); eh = path[depth].p_hdr;
Greg Kroah-Hartman
maintainerPATCH 240/386 ext4: fix double brelse() the buffer of the extents path
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit dcaa6c31134c0f515600111c38ed7750003e1b9c upstream.
In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows:
split2 map split1
|--------|-------|--------|
ext4_ext_map_blocks
ext4_ext_handle_unwritten_extents
ext4_split_convert_extents
// path->p_depth == 0
ext4_split_extent
// 1. do split1
ext4_split_extent_at
|ext4_ext_insert_extent
| ext4_ext_create_new_leaf
| ext4_ext_grow_indepth
| le16_add_cpu(&neh->eh_depth, 1)
| ext4_find_extent
| // return -ENOMEM
|// get error and try zeroout
|path = ext4_find_extent
| path->p_depth = 1
|ext4_ext_try_to_merge
| ext4_ext_try_to_merge_up
| path->p_depth = 0
| brelse(path[1].p_bh) ---> not set to NULL here
|// zeroout success
// 2. update path
ext4_find_extent
// 3. do split2
ext4_split_extent_at
ext4_ext_insert_extent
ext4_ext_create_new_leaf
ext4_ext_grow_indepth
le16_add_cpu(&neh->eh_depth, 1)
ext4_find_extent
path[0].p_bh = NULL;
path->p_depth = 1
read_extent_tree_block ---> return err
// path[1].p_bh is still the old value
ext4_free_ext_path
ext4_ext_drop_refs
// path->p_depth == 1
brelse(path[1].p_bh) ---> brelse a buffer twiceFinally got the following WARRNING when removing the buffer from lru:
============================================
VFS: brelse: Trying to free free buffer
WARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Call Trace: <TASK> __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70
[...]
============================================
--- fs/ext4/extents.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/extents.c +1 -0
@@ -1877,6 +1877,7 @@ static void ext4_ext_try_to_merge_up(han path[0 ].p_hdr->eh_max =cpu_to_le16 (max_root);brelse (path[1 ].p_bh); + path[1 ].p_bh =NULL ;ext4_free_blocks (handle, inode,NULL , blk,1 ,EXT4_FREE_BLOCKS_METADATA |EXT4_FREE_BLOCKS_FORGET ); }
Greg Kroah-Hartman
maintainerPATCH 241/386 ext4: fix timer use-after-free on failed mount
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaxi Shen <[email protected]>
commit 0ce160c5bdb67081a62293028dc85758a8efb22a upstream.
Syzbot has found an ODEBUG bug in ext4_fill_super
The del_timer_sync function cancels the s_err_report timer, which reminds about filesystem errors daily. We should guarantee the timer is no longer active before kfree(sbi).
When filesystem mounting fails, the flow goes to failed_mount3, where an error occurs when ext4_stop_mmpd is called, causing a read I/O failure. This triggers the ext4_handle_error function that ultimately re-arms the timer,
leaving the s_err_report timer active before kfree(sbi) is called.
Fix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd.
--- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
@@ -5659,8 +5659,8 @@ failed_mount3a: failed_mount3:/* flush s_sb_upd_work before sbi destroy */ flush_work (&sbi->s_sb_upd_work); -del_timer_sync (&sbi->s_err_report);ext4_stop_mmpd (sbi); +del_timer_sync (&sbi->s_err_report);ext4_group_desc_free (sbi); failed_mount:if (sbi->s_chksum_driver)
Greg Kroah-Hartman
maintainerPATCH 242/386 ext4: update orig_path in ext4_find_extent()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
commit 5b4b2dcace35f618fe361a87bae6f0d13af31bc1 upstream.
In ext4_find_extent(), if the path is not big enough, we free it and set *orig_path to NULL. But after reallocating and successfully initializing the path, we don't update *orig_path, in which case the caller gets a valid path but a NULL ppath, and this may cause a NULL pointer dereference or a path memory leak. For example:
ext4_split_extent
path = *ppath = 2000
ext4_find_extent
if (depth > path[0].p_maxdepth)
kfree(path = 2000);
*orig_path = path = NULL;
path = kcalloc() = 3000
ext4_split_extent_at(*ppath = NULL)
path = *ppath;
ex = path[depth].p_ext;
// NULL pointer dereference!==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000010 CPU: 6 UID: 0 PID: 576 Comm: fsstress Not tainted 6.11.0-rc2-dirty #847 RIP: 0010:ext4_split_extent_at+0x6d/0x560 Call Trace: <TASK> ext4_split_extent.isra.0+0xcb/0x1b0 ext4_ext_convert_to_initialized+0x168/0x6c0 ext4_ext_handle_unwritten_extents+0x325/0x4d0 ext4_ext_map_blocks+0x520/0xdb0 ext4_map_blocks+0x2b0/0x690 ext4_iomap_begin+0x20e/0x2c0
[...]
==================================================================
Therefore, *orig_path is updated when the extent lookup succeeds, so that the caller can safely use path or *ppath.
--- fs/ext4/extents.c | 3 ++- fs/ext4/move_extent.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-)
fs/ext4/extents.c +2 -1
@@ -957,6 +957,8 @@ ext4_find_extent(struct inode *inode, exext4_ext_show_path (inode, path); +if (orig_path) + *orig_path = path;return path; err:
@@ -3249,7 +3251,6 @@ static int ext4_split_extent_at(handle_t } depth =ext_depth (inode); ex = path[depth].p_ext; - *ppath = path;if (EXT4_EXT_MAY_ZEROOUT & split_flag) {if (split_flag & (EXT4_EXT_DATA_VALID1 |EXT4_EXT_DATA_VALID2 )) {
fs/ext4/move_extent.c +0 -1
@@ -36,7 +36,6 @@ get_ext_path(struct inode *inode, ext4_l *ppath =NULL ;return -ENODATA ; } - *ppath = path;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 243/386 ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
commit dd589b0f1445e1ea1085b98edca6e4d5dedb98d0 upstream.
Function ext4_wait_for_tail_page_commit() assumes that '0' is not a valid value for transaction IDs, which is incorrect. Don't assume that and invoke jbd2_log_wait_commit() if the journal had a committing transaction instead.
--- fs/ext4/inode.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/ext4/inode.c +7 -4
@@ -5257,8 +5257,9 @@ static void ext4_wait_for_tail_page_comm {unsigned offset;journal_t *journal =EXT4_SB (inode->i_sb)->s_journal; -tid_t commit_tid =0 ; +tid_t commit_tid;int ret; +bool has_transaction; offset = inode->i_size & (PAGE_SIZE -1 );/*
@@ -5283,12 +5284,14 @@ static void ext4_wait_for_tail_page_commfolio_put (folio);if (ret != -EBUSY )return ; - commit_tid =0 ; + has_transaction = false;read_lock (&journal->j_state_lock); -if (journal->j_committing_transaction) +if (journal->j_committing_transaction) { commit_tid = journal->j_committing_transaction->t_tid; + has_transaction = true; + }read_unlock (&journal->j_state_lock); -if (commit_tid) +if (has_transaction)jbd2_log_wait_commit (journal, commit_tid); } }
Greg Kroah-Hartman
maintainerPATCH 244/386 ext4: fix incorrect tid assumption in jbd2_journal_shrink_checkpoint_list()
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
commit 7a6443e1dad70281f99f0bd394d7fd342481a632 upstream.
Function jbd2_journal_shrink_checkpoint_list() assumes that '0' is not a valid value for transaction IDs, which is incorrect. Don't assume that and use two extra boolean variables to control the loop iterations and keep track of the first and last tid.
--- fs/jbd2/checkpoint.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/jbd2/checkpoint.c +5 -2
@@ -412,6 +412,7 @@ unsigned long jbd2_journal_shrink_checkptid_t tid =0 ;unsigned long nr_freed =0 ;unsigned long freed; +bool first_set = false; again:spin_lock (&journal->j_list_lock);
@@ -431,8 +432,10 @@ again:else transaction = journal->j_checkpoint_transactions; -if (!first_tid) +if (!first_set) { first_tid = transaction->t_tid; + first_set = true; + } last_transaction = journal->j_checkpoint_transactions->t_cpprev; next_transaction = transaction; last_tid = last_transaction->t_tid;
@@ -462,7 +465,7 @@ again:spin_unlock (&journal->j_list_lock);cond_resched (); -if (*nr_to_scan && next_tid) +if (*nr_to_scan && journal->j_shrink_transaction) goto again; out: trace_jbd2_shrink_checkpoint_list(journal, first_tid, tid, last_tid,
Greg Kroah-Hartman
maintainerPATCH 245/386 ext4: fix fast commit inode enqueueing during a full journal commit
In reply to Greg Kroah-Hartman6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques (SUSE) <[email protected]>
commit 6db3c1575a750fd417a70e0178bdf6efa0dd5037 upstream.
When a full journal commit is on-going, any fast commit has to be enqueued into a different queue: FC_Q_STAGING instead of FC_Q_MAIN. This enqueueing is done only once, i.e. if an inode is already queued in a previous fast commit entry it won't be enqueued again. However, if a full commit starts _after_ the inode is enqueued into FC_Q_MAIN, the next fast commit needs to be done into FC_Q_STAGING. And this is not being done in function ext4_fc_track_template().
This patch fixes the issue by re-enqueuing an inode into the STAGING queue during the fast commit clean-up callback when doing a full commit. However, to prevent a race with a fast-commit, the clean-up callback has to be called with the journal locked.
This bug was found using fstest generic/047. This test creates several 32k bytes files, sync'ing each of them after it's creation, and then shutting down the filesystem. Some data may be loss in this operation; for example a file may have it's size truncated to zero.
--- fs/ext4/fast_commit.c | 15 ++++++++++++++- fs/jbd2/journal.c | 2 +- 2 files changed, 15 insertions(+), 2 deletions(-)
fs/ext4/fast_commit.c +14 -1
@@ -1295,8 +1295,21 @@ static void ext4_fc_cleanup(journal_t *jlist_del_init (&iter->i_fc_list);ext4_clear_inode_state (&iter->vfs_inode,EXT4_STATE_FC_COMMITTING ); -if (tid_geq (tid, iter->i_sync_tid)) +if (tid_geq (tid, iter->i_sync_tid)) {ext4_fc_reset_inode (&iter->vfs_inode); + }else if (full) { +/* +* We are called after a full commit, inode has been +* modified while the commit was running. Re-enqueue +* the inode into STAGING, which will then be splice +* back into MAIN. This cannot happen during +* fastcommit because the journal is locked all the +* time in that case (and tid doesn't increase so +* tid check above isn't reliable). +*/ +list_add_tail (&EXT4_I (&iter->vfs_inode)->i_fc_list, + &sbi->s_fc_q[FC_Q_STAGING ]); + }/* Make sure EXT4_STATE_FC_COMMITTING bit is clear */ smp_mb ();#if (BITS_PER_LONG <64 )
fs/jbd2/journal.c +1 -1
@@ -755,9 +755,9 @@ EXPORT_SYMBOL(jbd2_fc_begin_commit);*/ static int __jbd2_fc_end_commit (journal_t *journal,tid_t tid,bool fallback) { -jbd2_journal_unlock_updates (journal);if (journal->j_fc_cleanup_callback) journal->j_fc_cleanup_callback (journal,0 , tid); +jbd2_journal_unlock_updates (journal);write_lock (&journal->j_state_lock); journal->j_flags &= ~JBD2_FAST_COMMIT_ONGOING ;if (fallback)