6.12.5-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 242/466 media: uvcvideo: Add a quirk for the Kaiweets KTI-W02 infrared camera
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Given <[email protected]>
[ Upstream commit b2ec92bb5605452d539a7aa1e42345b95acd8583 ]
Adds a quirk to make the NXP Semiconductors 1fc9:009b chipset work.
lsusb for the device reports:
Bus 003 Device 011: ID 1fc9:009b NXP Semiconductors IR VIDEO Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 239 Miscellaneous Device
bDeviceSubClass 2 [unknown]
bDeviceProtocol 1 Interface Association
bMaxPacketSize0 64
idVendor 0x1fc9 NXP Semiconductors
idProduct 0x009b IR VIDEO
bcdDevice 1.01
iManufacturer 1 Guide sensmart iProduct 2 IR VIDEO iSerial 0 bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x00c2
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 100mA
Interface Association:
bLength 8
bDescriptorType 11
bFirstInterface 0
bInterfaceCount 2
bFunctionClass 14 Video
bFunctionSubClass 3 Video Interface Collection
bFunctionProtocol 0
iFunction 3 IR Camera
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 14 Video
bInterfaceSubClass 1 Video Control
bInterfaceProtocol 0
iInterface 0
VideoControl Interface Descriptor:
bLength 13
bDescriptorType 36
bDescriptorSubtype 1 (HEADER)
bcdUVC 1.00
wTotalLength 0x0033
dwClockFrequency 6.000000MHz
bInCollection 1
baInterfaceNr( 0) 1
VideoControl Interface Descriptor:
bLength 18
bDescriptorType 36
bDescriptorSubtype 2 (INPUT_TERMINAL)
bTerminalID 1
wTerminalType 0x0201 Camera Sensor
bAssocTerminal 0
iTerminal 0
wObjectiveFocalLengthMin 0
wObjectiveFocalLengthMax 0
wOcularFocalLength 0
bControlSize 3
bmControls 0x00000000
VideoControl Interface Descriptor:
bLength 9
bDescriptorType 36
bDescriptorSubtype 3 (OUTPUT_TERMINAL)
bTerminalID 2
wTerminalType 0x0101 USB Streaming
bAssocTerminal 0
bSourceID 1
iTerminal 0
VideoControl Interface Descriptor:
bLength 11
bDescriptorType 36
bDescriptorSubtype 5 (PROCESSING_UNIT)
Warning: Descriptor too short
bUnitID 3
bSourceID 1
wMaxMultiplier 0
bControlSize 2
bmControls 0x00000000
iProcessing 0
bmVideoStandards 0x62
NTSC - 525/60
PAL - 525/60
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0008 1x 8 bytes
bInterval 1
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 14 Video
bInterfaceSubClass 2 Video Streaming
bInterfaceProtocol 0
iInterface 0
VideoStreaming Interface Descriptor:
bLength 14
bDescriptorType 36
bDescriptorSubtype 1 (INPUT_HEADER)
bNumFormats 1
wTotalLength 0x0055
bEndpointAddress 0x82 EP 2 IN
bmInfo 0
bTerminalLink 2
bStillCaptureMethod 2
bTriggerSupport 0
bTriggerUsage 0
bControlSize 1
bmaControls( 0) 0
VideoStreaming Interface Descriptor:
bLength 27
bDescriptorType 36
bDescriptorSubtype 4 (FORMAT_UNCOMPRESSED)
bFormatIndex 1
bNumFrameDescriptors 1
guidFormat {e436eb7b-524f-11ce-9f53-0020af0ba770}
bBitsPerPixel 16
bDefaultFrameIndex 1
bAspectRatioX 0
bAspectRatioY 0
bmInterlaceFlags 0x00
Interlaced stream or variable: No
Fields per frame: 2 fields
Field 1 first: No
Field pattern: Field 1 only
bCopyProtect 0
VideoStreaming Interface Descriptor:
bLength 34
bDescriptorType 36
bDescriptorSubtype 5 (FRAME_UNCOMPRESSED)
bFrameIndex 1
bmCapabilities 0x00
Still image unsupported
wWidth 240
wHeight 322
dwMinBitRate 12364800
dwMaxBitRate 30912000
dwMaxVideoFrameBufferSize 154560
dwDefaultFrameInterval 400000
bFrameIntervalType 2
dwFrameInterval( 0) 400000
dwFrameInterval( 1) 1000000
VideoStreaming Interface Descriptor:
bLength 10
bDescriptorType 36
bDescriptorSubtype 3 (STILL_IMAGE_FRAME)
bEndpointAddress 0x00 EP 0 OUT
bNumImageSizePatterns 1
wWidth( 0) 240
wHeight( 0) 322
bNumCompressionPatterns 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 1
bNumEndpoints 1
bInterfaceClass 14 Video
bInterfaceSubClass 2 Video Streaming
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 5
Transfer Type Isochronous
Synch Type Asynchronous
Usage Type Data
wMaxPacketSize 0x0400 1x 1024 bytes
bInterval 1
Device Status: 0x0001
Self Powered
--- drivers/media/usb/uvc/uvc_driver.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/media/usb/uvc/uvc_driver.c +11 -0
@@ -2474,6 +2474,8 @@ static const struct uvc_device_info uvc_quirk_force_y8 = {* The Logitech cameras listed below have their interface class set to * VENDOR_SPEC because they don't announce themselves as UVC devices, even * though they are compliant. +* +* Sort these by vendor/product ID. */ static const struct usb_device_id uvc_ids[] = {/* Quanta ACER HD User Facing */
@@ -3010,6 +3012,15 @@ static const struct usb_device_id uvc_ids[] = { .bInterfaceProtocol = 0, .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_PROBE_MINMAX | UVC_QUIRK_IGNORE_SELECTOR_UNIT) }, +/* NXP Semiconductors IR VIDEO */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, + .idVendor = 0x1fc9, + .idProduct = 0x009b, + .bInterfaceClass = USB_CLASS_VIDEO, + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = (kernel_ulong_t)&uvc_quirk_probe_minmax },/* Oculus VR Positional Tracker DK2 */ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 243/466 media: uvcvideo: Force UVC version to 1.0a for 0408:4033
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <[email protected]>
[ Upstream commit c9df99302fff53b6007666136b9f43fbac7ee3d8 ]
The Quanta ACER HD User Facing camera reports a UVC 1.50 version, but implements UVC 1.0a as shown by the UVC probe control being 26 bytes long. Force the UVC version for that device.
--- drivers/media/usb/uvc/uvc_driver.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/media/usb/uvc/uvc_driver.c +11 -0
@@ -2479,6 +2479,17 @@ static const struct uvc_device_info uvc_quirk_force_y8 = {*/ static const struct usb_device_id uvc_ids[] = {/* Quanta ACER HD User Facing */ + { .match_flags =USB_DEVICE_ID_MATCH_DEVICE + |USB_DEVICE_ID_MATCH_INT_INFO , + .idVendor =0x0408 , + .idProduct =0x4033 , + .bInterfaceClass =USB_CLASS_VIDEO , + .bInterfaceSubClass =1 , + .bInterfaceProtocol =UVC_PC_PROTOCOL_15 , + .driver_info = (kernel_ulong_t)&(const struct uvc_device_info ){ + .uvc_version =0x010a , + } }, +/* Quanta ACER HD User Facing */ { .match_flags =USB_DEVICE_ID_MATCH_DEVICE |USB_DEVICE_ID_MATCH_INT_INFO , .idVendor =0x0408 ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 244/466 media: cx231xx: Add support for Dexatek USB Video Grabber 1d19:6108
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan Barar <[email protected]>
[ Upstream commit 61a830bc0ea69a05d8a4534f825c6aa618263649 ]
Add Dexatek Technology Ltd USB Video Grabber 1d19:6108 to the cx231xx driver. This device is sold under the name "BAUHN DVD Maker (DK8723)" by ALDI in Australia.
This device is similar to 1d19:6109, which is already included in cx231xx.
Both video and audio capture function correctly after installing the patched cx231xx driver.
Patch Changelog
v1:
- Initial submission.
v2:
- Fix SoB + Improve subject.
v3:
- Rephrase message to not exceed 75 characters per line.
- Removed reference to external GitHub URL.
--- drivers/media/usb/cx231xx/cx231xx-cards.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/cx231xx/cx231xx-cards.c +2 -0
@@ -994,6 +994,8 @@ const unsigned int cx231xx_bcount = ARRAY_SIZE(cx231xx_boards);/* table of devices that work with this driver */ struct usb_device_id cx231xx_id_table[] = { + {USB_DEVICE (0x1D19 ,0x6108 ), + .driver_info =CX231XX_BOARD_PV_XCAPTURE_USB }, {USB_DEVICE (0x1D19 ,0x6109 ), .driver_info =CX231XX_BOARD_PV_XCAPTURE_USB }, {USB_DEVICE (0x0572 ,0x5A3C ),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 245/466 mmc: core: Add SD card quirk for broken poweroff notification
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keita Aihara <[email protected]>
[ Upstream commit cd068d51594d9635bf6688fc78717572b78bce6a ]
GIGASTONE Gaming Plus microSD cards manufactured on 02/2022 report that they support poweroff notification and cache, but they are not working correctly.
Flush Cache bit never gets cleared in sd_flush_cache() and Poweroff Notification Ready bit also never gets set to 1 within 1 second from the end of busy of CMD49 in sd_poweroff_notify().
This leads to I/O error and runtime PM error state.
I observed that the same card manufactured on 01/2024 works as expected.
This problem seems similar to the Kingston cards fixed with commit c467c8f08185 ("mmc: Add MMC_QUIRK_BROKEN_SD_CACHE for Kingston Canvas Go Plus from 11/2019") and should be handled using quirks.
CID for the problematic card is here.
12345641535443002000000145016200
Manufacturer ID is 0x12 and defined as CID_MANFID_GIGASTONE as of now, but would like comments on what naming is appropriate because MID list is not public and not sure it's right.
--- drivers/mmc/core/card.h | 7 +++++++ drivers/mmc/core/quirks.h | 9 +++++++++ drivers/mmc/core/sd.c | 2 +- include/linux/mmc/card.h | 1 + 4 files changed, 18 insertions(+), 1 deletion(-)
drivers/mmc/core/card.h +7 -0
@@ -85,6 +85,7 @@ struct mmc_fixup {#define CID_MANFID_SANDISK_SD 0x3#define CID_MANFID_ATP 0x9#define CID_MANFID_TOSHIBA 0x11 +#define CID_MANFID_GIGASTONE 0x12#define CID_MANFID_MICRON 0x13#define CID_MANFID_SAMSUNG 0x15#define CID_MANFID_APACER 0x27
@@ -287,4 +288,10 @@ static inline int mmc_card_broken_cache_flush(const struct mmc_card *c) {return c->quirks &MMC_QUIRK_BROKEN_CACHE_FLUSH ; } + +static inline int mmc_card_broken_sd_poweroff_notify (const struct mmc_card *c) +{ +return c->quirks &MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY ; +} +#endif
drivers/mmc/core/quirks.h +9 -0
@@ -25,6 +25,15 @@ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = { 0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd, MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY), +/* +* GIGASTONE Gaming Plus microSD cards manufactured on 02/2022 never +* clear Flush Cache bit and set Poweroff Notification Ready bit. +*/ +_FIXUP_EXT ("ASTC" ,CID_MANFID_GIGASTONE ,0x3456 ,2022 ,2 , +0 ,-1ull ,SDIO_ANY_ID ,SDIO_ANY_ID , add_quirk_sd, +MMC_QUIRK_BROKEN_SD_CACHE |MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY , +EXT_CSD_REV_ANY ), + END_FIXUP };
drivers/mmc/core/sd.c +1 -1
@@ -1113,7 +1113,7 @@ static int sd_parse_ext_reg_power(struct mmc_card *card, u8 fno, u8 page, card->ext_power.rev = reg_buf[0 ] &0xf ;/* Power Off Notification support at bit 4. */ -if (reg_buf[1 ] &BIT (4 )) +if ((reg_buf[1 ] &BIT (4 )) && !mmc_card_broken_sd_poweroff_notify (card)) card->ext_power.feature_support |=SD_EXT_POWER_OFF_NOTIFY ;/* Power Sustenance support at bit 5. */
include/linux/mmc/card.h +1 -0
@@ -294,6 +294,7 @@ struct mmc_card {#define MMC_QUIRK_BROKEN_SD_DISCARD (1<<14)/* Disable broken SD discard support */ #define MMC_QUIRK_BROKEN_SD_CACHE (1<<15)/* Disable broken SD cache support */ #define MMC_QUIRK_BROKEN_CACHE_FLUSH (1<<16)/* Don't flush cache until the write has occurred */ +#define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY (1<<17)/* Disable broken SD poweroff notify support */ bool written_flag;/* Indicates eMMC has been written since power on */ bool reenable_cmdq;/* Re-enable Command Queue */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 246/466 mmc: sdhci-esdhc-imx: enable quirks SDHCI_QUIRK_NO_LED
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <[email protected]>
[ Upstream commit 4dede2b76f4a760e948e1a49b1520881cb459bd3 ]
Enable SDHCI_QUIRK_NO_LED for i.MX7ULP, i.MX8MM, i.MX8QXP and i.MXRT1050. Even there is LCTL register bit, there is no IOMUX PAD for it. So there is no sense to enable LED for SDHCI for these SoCs.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/mmc/host/sdhci-esdhc-imx.c +6 -0
@@ -238,6 +238,7 @@ struct esdhc_platform_data {struct esdhc_soc_data {u32 flags; +u32 quirks; };static const struct esdhc_soc_data esdhc_imx25_data = {
@@ -309,10 +310,12 @@ static struct esdhc_soc_data usdhc_imx7ulp_data = { | ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200 | ESDHC_FLAG_PMQOS | ESDHC_FLAG_HS400 | ESDHC_FLAG_STATE_LOST_IN_LPMODE, + .quirks = SDHCI_QUIRK_NO_LED, };static struct esdhc_soc_data usdhc_imxrt1050_data = { .flags =ESDHC_FLAG_USDHC |ESDHC_FLAG_STD_TUNING |ESDHC_FLAG_HAVE_CAP1 |ESDHC_FLAG_HS200 , + .quirks =SDHCI_QUIRK_NO_LED , };static struct esdhc_soc_data usdhc_imx8qxp_data = {
@@ -321,6 +324,7 @@ static struct esdhc_soc_data usdhc_imx8qxp_data = { | ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES | ESDHC_FLAG_STATE_LOST_IN_LPMODE | ESDHC_FLAG_CLK_RATE_LOST_IN_PM_RUNTIME, + .quirks = SDHCI_QUIRK_NO_LED, };static struct esdhc_soc_data usdhc_imx8mm_data = {
@@ -328,6 +332,7 @@ static struct esdhc_soc_data usdhc_imx8mm_data = { | ESDHC_FLAG_HAVE_CAP1 | ESDHC_FLAG_HS200 | ESDHC_FLAG_HS400 | ESDHC_FLAG_HS400_ES | ESDHC_FLAG_STATE_LOST_IN_LPMODE, + .quirks = SDHCI_QUIRK_NO_LED, };struct pltfm_imx_data {
@@ -1687,6 +1692,7 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev) imx_data->socdata =device_get_match_data (&pdev->dev); + host->quirks |= imx_data->socdata->quirks;if (imx_data->socdata->flags &ESDHC_FLAG_PMQOS )cpu_latency_qos_add_request (&imx_data->pm_qos_req,0 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 247/466 firmware: qcom: scm: Allow QSEECOM on Dell XPS 13 9345
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrs Vinarskis <[email protected]>
[ Upstream commit 304c250ba121f5c505be3fc13dec984016f3c032 ]
Allow particular machine accessing eg. efivars.
--- drivers/firmware/qcom/qcom_scm.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/qcom/qcom_scm.c +1 -0
@@ -1742,6 +1742,7 @@ EXPORT_SYMBOL_GPL(qcom_scm_qseecom_app_send);+ any potential issues with this, only allow validated machines for now. */ static const struct of_device_id qcom_scm_qseecom_allowlist[]__maybe_unused = { + { .compatible ="dell,xps13-9345" }, { .compatible ="lenovo,flex-5g" }, { .compatible ="lenovo,thinkpad-t14s" }, { .compatible ="lenovo,thinkpad-x13s" , },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 248/466 soc: imx8m: Probe the SoC driver as platform driver
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 9cc832d37799dbea950c4c8a34721b02b8b5a8ff ]
With driver_async_probe=* on kernel command line, the following trace is produced because on i.MX8M Plus hardware because the soc-imx8m.c driver calls of_clk_get_by_name() which returns -EPROBE_DEFER because the clock driver is not yet probed. This was not detected during regular testing without driver_async_probe.
Convert the SoC code to platform driver and instantiate a platform device in its current device_initcall() to probe the platform driver. Rework .soc_revision callback to always return valid error code and return SoC revision via parameter. This way, if anything in the .soc_revision callback return -EPROBE_DEFER, it gets propagated to .probe and the .probe will get retried later.
"
------------[ cut here ]------------ WARNING: CPU: 1 PID: 1 at drivers/soc/imx/soc-imx8m.c:115 imx8mm_soc_revision+0xdc/0x180 CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-next-20240924-00002-g2062bb554dea #603 Hardware name: DH electronics i.MX8M Plus DHCOM Premium Developer Kit (3) (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : imx8mm_soc_revision+0xdc/0x180 lr : imx8mm_soc_revision+0xd0/0x180
sp : ffff8000821fbcc0
x29: ffff8000821fbce0 x28: 0000000000000000 x27: ffff800081810120
x26: ffff8000818a9970 x25: 0000000000000006 x24: 0000000000824311
x23: ffff8000817f42c8 x22: ffff0000df8be210 x21: fffffffffffffdfb
x20: ffff800082780000 x19: 0000000000000001 x18: ffffffffffffffff
x17: ffff800081fff418 x16: ffff8000823e1000 x15: ffff0000c03b65e8
x14: ffff0000c00051b0 x13: ffff800082790000 x12: 0000000000000801
x11: ffff80008278ffff x10: ffff80008209d3a6 x9 : ffff80008062e95c x8 : ffff8000821fb9a0 x7 : 0000000000000000 x6 : 00000000000080e3 x5 : ffff0000df8c03d8 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : fffffffffffffdfb x0 : fffffffffffffdfb
Call trace: imx8mm_soc_revision+0xdc/0x180 imx8_soc_init+0xb0/0x1e0 do_one_initcall+0x94/0x1a8 kernel_init_freeable+0x240/0x2a8 kernel_init+0x28/0x140 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]---
SoC: i.MX8MP revision 1.1
"
--- drivers/soc/imx/soc-imx8m.c | 107 ++++++++++++++++++++++++++++-------- 1 file changed, 85 insertions(+), 22 deletions(-)
drivers/soc/imx/soc-imx8m.c +85 -22
@@ -30,7 +30,7 @@struct imx8_soc_data {char *name; -u32 (*soc_revision)(void ); +int (*soc_revision)(u32 *socrev); };static u64 soc_uid;
@@ -51,24 +51,29 @@ static u32 imx8mq_soc_revision_from_atf(void)static inline u32 imx8mq_soc_revision_from_atf (void ) {return 0 ; };#endif -static u32 __init imx8mq_soc_revision (void ) +static int imx8mq_soc_revision (u32 *socrev) {struct device_node *np;void __iomem *ocotp_base;u32 magic;u32 rev;struct clk *clk; +int ret; np =of_find_compatible_node (NULL ,NULL ,"fsl,imx8mq-ocotp" );if (!np) -return 0 ; +return -EINVAL ; ocotp_base =of_iomap (np,0 ); -WARN_ON (!ocotp_base); +if (!ocotp_base) { + ret = -EINVAL ; + goto err_iomap; + } + clk =of_clk_get_by_name (np,NULL );if (IS_ERR (clk)) { -WARN_ON (IS_ERR (clk)); -return 0 ; + ret =PTR_ERR (clk); + goto err_clk; }clk_prepare_enable (clk);
@@ -88,32 +93,45 @@ static u32 __init imx8mq_soc_revision(void) soc_uid <<=32 ; soc_uid |=readl_relaxed (ocotp_base +OCOTP_UID_LOW ); + *socrev = rev; +clk_disable_unprepare (clk);clk_put (clk);iounmap (ocotp_base);of_node_put (np); -return rev; +return 0 ; + +err_clk: +iounmap (ocotp_base); +err_iomap: +of_node_put (np); +return ret; } -static void __init imx8mm_soc_uid (void ) +static int imx8mm_soc_uid (void ) {void __iomem *ocotp_base;struct device_node *np;struct clk *clk; +int ret =0 ;u32 offset =of_machine_is_compatible ("fsl,imx8mp" ) ?IMX8MP_OCOTP_UID_OFFSET :0 ; np =of_find_compatible_node (NULL ,NULL ,"fsl,imx8mm-ocotp" );if (!np) -return ; +return -EINVAL ; ocotp_base =of_iomap (np,0 ); -WARN_ON (!ocotp_base); +if (!ocotp_base) { + ret = -EINVAL ; + goto err_iomap; + } + clk =of_clk_get_by_name (np,NULL );if (IS_ERR (clk)) { -WARN_ON (IS_ERR (clk)); -return ; + ret =PTR_ERR (clk); + goto err_clk; }clk_prepare_enable (clk);
@@ -124,31 +142,41 @@ static void __init imx8mm_soc_uid(void)clk_disable_unprepare (clk);clk_put (clk); + +err_clk:iounmap (ocotp_base); +err_iomap:of_node_put (np); + +return ret; } -static u32 __init imx8mm_soc_revision (void ) +static int imx8mm_soc_revision (u32 *socrev) {struct device_node *np;void __iomem *anatop_base; -u32 rev; +int ret; np =of_find_compatible_node (NULL ,NULL ,"fsl,imx8mm-anatop" );if (!np) -return 0 ; +return -EINVAL ; anatop_base =of_iomap (np,0 ); -WARN_ON (!anatop_base); +if (!anatop_base) { + ret = -EINVAL ; + goto err_iomap; + } - rev =readl_relaxed (anatop_base +ANADIG_DIGPROG_IMX8MM ); + *socrev =readl_relaxed (anatop_base +ANADIG_DIGPROG_IMX8MM );iounmap (anatop_base);of_node_put (np); -imx8mm_soc_uid (); +return imx8mm_soc_uid (); -return rev; +err_iomap: +of_node_put (np); +return ret; }static const struct imx8_soc_data imx8mq_soc_data = {
@@ -184,7 +212,7 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \ "unknown" -static int __init imx8_soc_init(void) +static int imx8m_soc_probe(struct platform_device *pdev) {struct soc_device_attribute *soc_dev_attr;struct soc_device *soc_dev;
@@ -212,8 +240,11 @@ static int __init imx8_soc_init(void) data = id->data;if (data) { soc_dev_attr->soc_id = data->name; -if (data->soc_revision) - soc_rev = data->soc_revision (); +if (data->soc_revision) { + ret = data->soc_revision (&soc_rev); +if (ret) + goto free_soc; + } } soc_dev_attr->revision =imx8_revision (soc_rev);
@@ -251,6 +282,38 @@ static int __init imx8_soc_init(void)kfree (soc_dev_attr);return ret; } + +static struct platform_driver imx8m_soc_driver = { + .probe = imx8m_soc_probe, + .driver = { + .name ="imx8m-soc" , + }, +}; + +static int __init imx8_soc_init (void ) +{ +struct platform_device *pdev; +int ret; + +/* No match means this is non-i.MX8M hardware, do nothing. */ +if (!of_match_node (imx8_soc_match, of_root)) +return 0 ; + + ret =platform_driver_register (&imx8m_soc_driver); +if (ret) { +pr_err ("Failed to register imx8m-soc platform driver: %d\n" , ret); +return ret; + } + + pdev =platform_device_register_simple ("imx8m-soc" ,-1 ,NULL ,0 ); +if (IS_ERR (pdev)) { +pr_err ("Failed to register imx8m-soc platform device: %ld\n" ,PTR_ERR (pdev)); +platform_driver_unregister (&imx8m_soc_driver); +return PTR_ERR (pdev); + } + +return 0 ; +}device_initcall (imx8_soc_init);MODULE_DESCRIPTION ("NXP i.MX8M SoC driver" );MODULE_LICENSE ("GPL" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 249/466 regmap: maple: Provide lockdep (sub)class for maple trees internal lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <[email protected]>
[ Upstream commit 1ed9b927e7dd8b8cff13052efe212a8ff72ec51d ]
In some cases when using the maple tree register cache, the lockdep validator might complain about invalid deadlocks:
[7.131886] Possible interrupt unsafe locking scenario:
[7.131890] CPU0 CPU1
[7.131893] ---- ----
[7.131896] lock(&mt->ma_lock);
[7.131904] local_irq_disable();
[7.131907] lock(rockchip_drm_vop2:3114:(&vop2_regmap_config)->lock);
[7.131916] lock(&mt->ma_lock);
[7.131925] <Interrupt>
[7.131928] lock(rockchip_drm_vop2:3114:(&vop2_regmap_config)->lock);
[7.131936]
*** DEADLOCK ***[7.131939] no locks held by swapper/0/0.
[7.131944]
the shortest dependencies between 2nd lock and 1st lock:
[7.131950] -> (&mt->ma_lock){+.+.}-{2:2} {
[7.131966] HARDIRQ-ON-W at:
[7.131973] lock_acquire+0x200/0x330
[7.131986] _raw_spin_lock+0x50/0x70
[7.131998] regcache_maple_write+0x68/0xe0
[7.132010] regcache_write+0x6c/0x90
[7.132019] _regmap_read+0x19c/0x1d0
[7.132029] _regmap_update_bits+0xc0/0x148
[7.132038] regmap_update_bits_base+0x6c/0xa8
[7.132048] rk8xx_probe+0x22c/0x3d8
[7.132057] rk8xx_spi_probe+0x74/0x88
[7.132065] spi_probe+0xa8/0xe0[...]
[7.132675] } [7.132678] ... key at: [<ffff800082943c20>] __key.0+0x0/0x10 [7.132691] ... acquired at: [7.132695] _raw_spin_lock+0x50/0x70 [7.132704] regcache_maple_write+0x68/0xe0 [7.132714] regcache_write+0x6c/0x90 [7.132724] _regmap_read+0x19c/0x1d0 [7.132732] _regmap_update_bits+0xc0/0x148 [7.132741] regmap_field_update_bits_base+0x74/0xb8 [7.132751] vop2_plane_atomic_update+0x480/0x14d8 [rockchipdrm] [7.132820] drm_atomic_helper_commit_planes+0x1a0/0x320 [drm_kms_helper]
[...]
[7.135112] -> (rockchip_drm_vop2:3114:(&vop2_regmap_config)->lock){-...}-{2:2} {
[7.135130] IN-HARDIRQ-W at:
[7.135136] lock_acquire+0x200/0x330
[7.135147] _raw_spin_lock_irqsave+0x6c/0x98
[7.135157] regmap_lock_spinlock+0x20/0x40
[7.135166] regmap_read+0x44/0x90
[7.135175] vop2_isr+0x90/0x290 [rockchipdrm]
[7.135225] __handle_irq_event_percpu+0x124/0x2d0In the example above, the validator seems to get the scope of dependencies wrong, since the regmap instance used in rk8xx-spi driver has nothing to do with the instance from vop2.
Improve validation by sharing the regmap's lockdep class with the maple tree's internal lock, while also providing a subclass for the latter.
--- drivers/base/regmap/internal.h | 1 + drivers/base/regmap/regcache-maple.c | 3 +++ drivers/base/regmap/regmap.c | 1 + 3 files changed, 5 insertions(+)
drivers/base/regmap/internal.h +1 -0
@@ -59,6 +59,7 @@ struct regmap {unsigned long raw_spinlock_flags; }; }; +struct lock_class_key *lock_key;regmap_lock lock;regmap_unlock unlock;void *lock_arg;/* This is passed to lock/unlock functions */
drivers/base/regmap/regcache-maple.c +3 -0
@@ -355,6 +355,9 @@ static int regcache_maple_init(struct regmap *map)mt_init (mt); +if (!mt_external_lock (mt) && map->lock_key) +lockdep_set_class_and_subclass (&mt->ma_lock, map->lock_key,1 ); +if (!map->num_reg_defaults)return 0 ;
drivers/base/regmap/regmap.c +1 -0
@@ -756,6 +756,7 @@ struct regmap *__regmap_init(struct device *dev, lock_key, lock_name); } map->lock_arg = map; + map->lock_key = lock_key; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 250/466 selftests/resctrl: Protect against array overflow when reading strings
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reinette Chatre <[email protected]>
[ Upstream commit 46058430fc5d39c114f7e1b9c6ff14c9f41bd531 ]
resctrl selftests discover system properties via a variety of sysfs files. The MBM and MBA tests need to discover the event and umask with which to configure the performance event used to measure read memory bandwidth. This is done by parsing the contents of /sys/bus/event_source/devices/uncore_imc_<imc instance>/events/cas_count_read Similarly, the resctrl selftests discover the cache size via /sys/bus/cpu/devices/cpu<id>/cache/index<index>/size.
Take care to do bounds checking when using fscanf() to read the contents of files into a string buffer because by default fscanf() assumes arbitrarily long strings. If the file contains more bytes than the array can accommodate then an overflow will occur.
Provide a maximum field width to the conversion specifier to protect against array overflow. The maximum is one less than the array size because string input stores a terminating null byte that is not covered by the maximum field width.
--- tools/testing/selftests/resctrl/resctrl_val.c | 4 ++-- tools/testing/selftests/resctrl/resctrlfs.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/resctrl/resctrl_val.c +2 -2
@@ -159,7 +159,7 @@ static int read_from_imc_dir(char *imc_dir, int count)return -1 ; } -if (fscanf (fp,"%s" , cas_count_cfg) <=0 ) { +if (fscanf (fp,"%1023s" , cas_count_cfg) <=0 ) {ksft_perror ("Could not get iMC cas count read" );fclose (fp);
@@ -177,7 +177,7 @@ static int read_from_imc_dir(char *imc_dir, int count)return -1 ; } -if (fscanf (fp,"%s" , cas_count_cfg) <=0 ) { +if (fscanf (fp,"%1023s" , cas_count_cfg) <=0 ) {ksft_perror ("Could not get iMC cas count write" );fclose (fp);
tools/testing/selftests/resctrl/resctrlfs.c +1 -1
@@ -182,7 +182,7 @@ int get_cache_size(int cpu_no, const char *cache_type, unsigned long *cache_sizereturn -1 ; } -if (fscanf (fp,"%s" , cache_str) <=0 ) { +if (fscanf (fp,"%63s" , cache_str) <=0 ) {ksft_perror ("Could not get cache_size" );fclose (fp);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 251/466 sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Changwoo Min <[email protected]>
[ Upstream commit f39489fea677ad78ca4ce1ab2d204a6639b868dc ]
When getting an LLC CPU mask in the default CPU selection policy, scx_select_cpu_dfl(), a pointer to the sched_domain is dereferenced using rcu_read_lock() without holding rcu_read_lock(). Such an unprotected dereference often causes the following warning and can cause an invalid memory access in the worst case.
Therefore, protect dereference of a sched_domain pointer using a pair of rcu_read_lock() and unlock().
[ 20.996135] =============================
[ 20.996345] WARNING: suspicious RCU usage
[ 20.996563] 6.11.0-virtme #17 Tainted: G W
[ 20.996576] -----------------------------
[ 20.996576] kernel/sched/ext.c:3323 suspicious rcu_dereference_check() usage!
[ 20.996576]
[ 20.996576] other info that might help us debug this:
[ 20.996576]
[ 20.996576]
[ 20.996576] rcu_scheduler_active = 2, debug_locks = 1
[ 20.996576] 4 locks held by kworker/8:1/140:
[ 20.996576] #0: ffff8b18c00dd348 ((wq_completion)pm){+.+.}-{0:0}, at: process_one_work+0x4a0/0x590
[ 20.996576] #1: ffffb3da01f67e58 ((work_completion)(&dev->power.work)){+.+.}-{0:0}, at: process_one_work+0x1ba/0x590
[ 20.996576] #2: ffffffffa316f9f0 (&rcu_state.gp_wq){..-.}-{2:2}, at: swake_up_one+0x15/0x60
[ 20.996576] #3: ffff8b1880398a60 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0x59/0x7d0
[ 20.996576]
[ 20.996576] stack backtrace:
[ 20.996576] CPU: 8 UID: 0 PID: 140 Comm: kworker/8:1 Tainted: G W 6.11.0-virtme #17
[ 20.996576] Tainted: [W]=WARN
[ 20.996576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
[ 20.996576] Workqueue: pm pm_runtime_work
[ 20.996576] Sched_ext: simple (disabling+all), task: runnable_at=-6ms
[ 20.996576] Call Trace:
[ 20.996576] <IRQ>
[ 20.996576] dump_stack_lvl+0x6f/0xb0
[ 20.996576] lockdep_rcu_suspicious.cold+0x4e/0x96
[ 20.996576] scx_select_cpu_dfl+0x234/0x260
[ 20.996576] select_task_rq_scx+0xfb/0x190
[ 20.996576] select_task_rq+0x47/0x110
[ 20.996576] try_to_wake_up+0x110/0x7d0
[ 20.996576] swake_up_one+0x39/0x60
[ 20.996576] rcu_core+0xb08/0xe50
[ 20.996576] ? srso_alias_return_thunk+0x5/0xfbef5
[ 20.996576] ? mark_held_locks+0x40/0x70
[ 20.996576] handle_softirqs+0xd3/0x410
[ 20.996576] irq_exit_rcu+0x78/0xa0
[ 20.996576] sysvec_apic_timer_interrupt+0x73/0x80
[ 20.996576] </IRQ>
[ 20.996576] <TASK>
[ 20.996576] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 20.996576] RIP: 0010:_raw_spin_unlock_irqrestore+0x36/0x70
[ 20.996576] Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 11 b4 36 ff 48 89 df e8 99 0d 37 ff f7 c5 00 02 00 00 75 17 9c 58 f6 c4 02 75 2b <65> ff 0d 5b 55 3c 5e 74 16 5b 5d e9 95 8e 28 00 e8 a5 ee 44 ff 9c
[ 20.996576] RSP: 0018:ffffb3da01f67d20 EFLAGS: 00000246
[ 20.996576] RAX: 0000000000000002 RBX: ffffffffa4640220 RCX: 0000000000000040
[ 20.996576] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffa1c7b27b
[ 20.996576] RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000
[ 20.996576] R10: 0000000000000001 R11: 000000000000021c R12: 0000000000000246
[ 20.996576] R13: ffff8b1881363958 R14: 0000000000000000 R15: ffff8b1881363800
[ 20.996576] ? _raw_spin_unlock_irqrestore+0x4b/0x70
[ 20.996576] serial_port_runtime_resume+0xd4/0x1a0
[ 20.996576] ? __pfx_serial_port_runtime_resume+0x10/0x10
[ 20.996576] __rpm_callback+0x44/0x170
[ 20.996576] ? __pfx_serial_port_runtime_resume+0x10/0x10
[ 20.996576] rpm_callback+0x55/0x60
[ 20.996576] ? __pfx_serial_port_runtime_resume+0x10/0x10
[ 20.996576] rpm_resume+0x582/0x7b0
[ 20.996576] pm_runtime_work+0x7c/0xb0
[ 20.996576] process_one_work+0x1fb/0x590
[ 20.996576] worker_thread+0x18e/0x350
[ 20.996576] ? __pfx_worker_thread+0x10/0x10
[ 20.996576] kthread+0xe2/0x110
[ 20.996576] ? __pfx_kthread+0x10/0x10
[ 20.996576] ret_from_fork+0x34/0x50
[ 20.996576] ? __pfx_kthread+0x10/0x10
[ 20.996576] ret_from_fork_asm+0x1a/0x30
[ 20.996576] </TASK>
[ 21.056592] sched_ext: BPF scheduler "simple" disabled (unregistered from user space)--- kernel/sched/ext.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/sched/ext.c +9 -0
@@ -3105,6 +3105,12 @@ static s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu, *found = false; + +/* +* This is necessary to protect llc_cpus. +*/ +rcu_read_lock (); +/* * If WAKE_SYNC, the waker's local DSQ is empty, and the system is * under utilized, wake up @p to the local DSQ of the waker. Checking
@@ -3147,9 +3153,12 @@ static s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu,if (cpu >=0 ) goto cpu_found; +rcu_read_unlock ();return prev_cpu; cpu_found: +rcu_read_unlock (); + *found = true;return cpu; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 252/466 HID: magicmouse: Apple Magic Trackpad 2 USB-C driver support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Callahan Kovacs <[email protected]>
[ Upstream commit 87a2f10395c82c2b4687bb8611a6c5663a12f9e7 ]
Adds driver support for the USB-C model of Apple's Magic Trackpad 2.
The 2024 USB-C model is compatible with the existing Magic Trackpad 2 driver but has a different hardware ID.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-magicmouse.c | 56 ++++++++++++++++++++++++++---------- 2 files changed, 42 insertions(+), 15 deletions(-)
drivers/hid/hid-ids.h +1 -0
@@ -94,6 +94,7 @@#define USB_DEVICE_ID_APPLE_MAGICMOUSE2 0x0269#define USB_DEVICE_ID_APPLE_MAGICTRACKPAD 0x030e#define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2 0x0265 +#define USB_DEVICE_ID_APPLE_MAGICTRACKPAD2_USBC 0x0324#define USB_DEVICE_ID_APPLE_FOUNTAIN_ANSI 0x020e#define USB_DEVICE_ID_APPLE_FOUNTAIN_ISO 0x020f#define USB_DEVICE_ID_APPLE_GEYSER_ANSI 0x0214
drivers/hid/hid-magicmouse.c +41 -15
146 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 253/466 drm/xe/pciids: separate RPL-U and RPL-P PCI IDs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit d454902a690db47f1880f963514bbf0fc7a129a8 ]
Avoid including PCI IDs for one platform to the PCI IDs of another. It's more clear to deal with them completely separately at the PCI ID macro level.
--- drivers/gpu/drm/xe/xe_pci.c | 1 + include/drm/intel/xe_pciids.h | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/xe/xe_pci.c +1 -0
@@ -383,6 +383,7 @@ static const struct pci_device_id pciidlist[] = {XE_ADLS_IDS (INTEL_VGA_DEVICE , &adl_s_desc),XE_ADLP_IDS (INTEL_VGA_DEVICE , &adl_p_desc),XE_ADLN_IDS (INTEL_VGA_DEVICE , &adl_n_desc), +XE_RPLU_IDS (INTEL_VGA_DEVICE , &adl_p_desc),XE_RPLP_IDS (INTEL_VGA_DEVICE , &adl_p_desc),XE_RPLS_IDS (INTEL_VGA_DEVICE , &adl_s_desc), XE_DG1_IDS(INTEL_VGA_DEVICE, &dg1_desc),
include/drm/intel/xe_pciids.h +0 -1
@@ -120,7 +120,6 @@/* RPL-P */ #define XE_RPLP_IDS (MACRO__ , ...) \ - XE_RPLU_IDS(MACRO__, ## __VA_ARGS__), \ MACRO__(0xA720, ## __VA_ARGS__), \ MACRO__(0xA7A0, ## __VA_ARGS__), \ MACRO__(0xA7A8, ## __VA_ARGS__), \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 254/466 drm/xe/pciids: separate ARL and MTL PCI IDs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit cdb56a63f7eef34e89b045fc8bcae8d326bbdb19 ]
Avoid including PCI IDs for one platform to the PCI IDs of another. It's more clear to deal with them completely separately at the PCI ID macro level.
--- drivers/gpu/drm/xe/xe_pci.c | 1 + include/drm/intel/xe_pciids.h | 13 ++++++++----- 2 files changed, 9 insertions(+), 5 deletions(-)
drivers/gpu/drm/xe/xe_pci.c +1 -0
@@ -388,6 +388,7 @@ static const struct pci_device_id pciidlist[] = {XE_RPLS_IDS (INTEL_VGA_DEVICE , &adl_s_desc),XE_DG1_IDS (INTEL_VGA_DEVICE , &dg1_desc),XE_ATS_M_IDS (INTEL_VGA_DEVICE , &ats_m_desc), +XE_ARL_IDS (INTEL_VGA_DEVICE , &mtl_desc),XE_DG2_IDS (INTEL_VGA_DEVICE , &dg2_desc),XE_MTL_IDS (INTEL_VGA_DEVICE , &mtl_desc), XE_LNL_IDS(INTEL_VGA_DEVICE, &lnl_desc),
include/drm/intel/xe_pciids.h +8 -5
@@ -174,16 +174,19 @@ XE_ATS_M150_IDS(MACRO__, ## __VA_ARGS__),\ XE_ATS_M75_IDS(MACRO__, ## __VA_ARGS__) -/* MTL / ARL */ +/* ARL */ +#define XE_ARL_IDS (MACRO__ , ...) \ + MACRO__(0x7D41, ## __VA_ARGS__), \ + MACRO__(0x7D51, ## __VA_ARGS__), \ + MACRO__(0x7D67, ## __VA_ARGS__), \ + MACRO__(0x7DD1, ## __VA_ARGS__) + +/* MTL */ #define XE_MTL_IDS (MACRO__ , ...) \ MACRO__(0x7D40, ## __VA_ARGS__), \ - MACRO__(0x7D41, ## __VA_ARGS__), \ MACRO__(0x7D45, ## __VA_ARGS__), \ - MACRO__(0x7D51, ## __VA_ARGS__), \ MACRO__(0x7D55, ## __VA_ARGS__), \ MACRO__(0x7D60, ## __VA_ARGS__), \ - MACRO__(0x7D67, ## __VA_ARGS__), \ - MACRO__(0x7DD1, ## __VA_ARGS__), \ MACRO__(0x7DD5, ## __VA_ARGS__)#define XE_LNL_IDS (MACRO__ , ...) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 255/466 drm/vc4: hdmi: Avoid log spam for audio start failure
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dom Cobley <[email protected]>
[ Upstream commit b4e5646178e86665f5caef2894578600f597098a ]
We regularly get dmesg error reports of:
[ 18.184066] hdmi-audio-codec hdmi-audio-codec.3.auto: ASoC: error at snd_soc_dai_startup on i2s-hifi: -19 [ 18.184098] MAI: soc_pcm_open() failed (-19)
These are generated for any disconnected hdmi interface when pulseaudio attempts to open the associated ALSA device (numerous times). Each open generates a kernel error message, generating general log spam.
The error messages all come from _soc_pcm_ret in sound/soc/soc-pcm.c#L39 which suggests returning ENOTSUPP, rather that ENODEV will be quiet. And indeed it is.
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vc4/vc4_hdmi.c +1 -1
@@ -1924,7 +1924,7 @@ static int vc4_hdmi_audio_startup(struct device *dev, void *data) }if (!vc4_hdmi_audio_can_stream (vc4_hdmi)) { - ret = -ENODEV ; + ret = -ENOTSUPP ; goto out_dev_exit; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 256/466 drm/vc4: hvs: Set AXI panic modes for the HVS
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Stevenson <[email protected]>
[ Upstream commit 014eccc9da7bfc76a3107fceea37dd60f1d63630 ]
The HVS can change AXI request mode based on how full the COB FIFOs are.
Until now the vc4 driver has been relying on the firmware to have set these to sensible values.
With HVS channel 2 now being used for live video, change the panic mode for all channels to be explicitly set by the driver, and the same for all channels.
--- drivers/gpu/drm/vc4/vc4_hvs.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/gpu/drm/vc4/vc4_hvs.c +11 -0
@@ -963,6 +963,17 @@ static int vc4_hvs_bind(struct device *dev, struct device *master, void *data) SCALER_DISPCTRL_SCLEIRQ); +/* Set AXI panic mode. +* VC4 panics when < 2 lines in FIFO. +* VC5 panics when less than 1 line in the FIFO. +*/ + dispctrl &= ~(SCALER_DISPCTRL_PANIC0_MASK | +SCALER_DISPCTRL_PANIC1_MASK | +SCALER_DISPCTRL_PANIC2_MASK ); + dispctrl |=VC4_SET_FIELD (2 ,SCALER_DISPCTRL_PANIC0 ); + dispctrl |=VC4_SET_FIELD (2 ,SCALER_DISPCTRL_PANIC1 ); + dispctrl |=VC4_SET_FIELD (2 ,SCALER_DISPCTRL_PANIC2 ); +/* Set AXI panic mode. * VC4 panics when < 2 lines in FIFO. * VC5 panics when less than 1 line in the FIFO.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 257/466 drm/xe/pciids: Add PVCs PCI device ID macros
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Vivi <[email protected]>
[ Upstream commit 5b40191152282e1f25d7b9826bcda41be927b39f ]
Add PVC PCI IDs to the xe_pciids.h header. They're not yet used in the driver.
--- include/drm/intel/xe_pciids.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
include/drm/intel/xe_pciids.h +16 -0
@@ -189,6 +189,22 @@ MACRO__(0x7D60, ## __VA_ARGS__), \ MACRO__(0x7DD5, ## __VA_ARGS__) +/* PVC */ +#define XE_PVC_IDS (MACRO__ , ...) \ + MACRO__(0x0B69, ## __VA_ARGS__), \ + MACRO__(0x0B6E, ## __VA_ARGS__), \ + MACRO__(0x0BD4, ## __VA_ARGS__), \ + MACRO__(0x0BD5, ## __VA_ARGS__), \ + MACRO__(0x0BD6, ## __VA_ARGS__), \ + MACRO__(0x0BD7, ## __VA_ARGS__), \ + MACRO__(0x0BD8, ## __VA_ARGS__), \ + MACRO__(0x0BD9, ## __VA_ARGS__), \ + MACRO__(0x0BDA, ## __VA_ARGS__), \ + MACRO__(0x0BDB, ## __VA_ARGS__), \ + MACRO__(0x0BE0, ## __VA_ARGS__), \ + MACRO__(0x0BE1, ## __VA_ARGS__), \ + MACRO__(0x0BE5, ## __VA_ARGS__) +#define XE_LNL_IDS (MACRO__ , ...) \ MACRO__(0x6420, ## __VA_ARGS__), \ MACRO__(0x64A0, ## __VA_ARGS__), \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 258/466 wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 3e5e4a801aaf4283390cc34959c6c48f910ca5ea ]
When removing kernel modules by:
rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core
Driver uses skb_queue_purge() to purge TX skb, but not report tx status causing "Have pending ack frames!" warning. Use ieee80211_purge_tx_queue() to correct this.
Since ieee80211_purge_tx_queue() doesn't take locks, to prevent racing between TX work and purge TX queue, flush and destroy TX work in advance.
wlan0: deauthenticating from aa:f5:fd:60:4c:a8 by local
choice (Reason: 3=DEAUTH_LEAVING)
------------[ cut here ]------------
Have pending ack frames!
WARNING: CPU: 3 PID: 9232 at net/mac80211/main.c:1691
ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
CPU: 3 PID: 9232 Comm: rmmod Tainted: G C
6.10.1-200.fc40.aarch64 #1
Hardware name: pine64 Pine64 PinePhone Braveheart
(1.1)/Pine64 PinePhone Braveheart (1.1), BIOS 2024.01 01/01/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
lr : ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
sp : ffff80008c1b37b0
x29: ffff80008c1b37b0 x28: ffff000003be8000 x27: 0000000000000000
x26: 0000000000000000 x25: ffff000003dc14b8 x24: ffff80008c1b37d0
x23: ffff000000ff9f80 x22: 0000000000000000 x21: 000000007fffffff
x20: ffff80007c7e93d8 x19: ffff00006e66f400 x18: 0000000000000000
x17: ffff7ffffd2b3000 x16: ffff800083fc0000 x15: 0000000000000000
x14: 0000000000000000 x13: 2173656d61726620 x12: 6b636120676e6964
x11: 0000000000000000 x10: 000000000000005d x9 : ffff8000802af2b0
x8 : ffff80008c1b3430 x7 : 0000000000000001 x6 : 0000000000000001
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000003be8000
Call trace:
ieee80211_free_ack_frame+0x5c/0x90 [mac80211]
idr_for_each+0x74/0x110
ieee80211_free_hw+0x44/0xe8 [mac80211]
rtw_sdio_remove+0x9c/0xc0 [rtw88_sdio]
sdio_bus_remove+0x44/0x180
device_remove+0x54/0x90
device_release_driver_internal+0x1d4/0x238
driver_detach+0x54/0xc0
bus_remove_driver+0x78/0x108
driver_unregister+0x38/0x78
sdio_unregister_driver+0x2c/0x40
rtw_8723cs_driver_exit+0x18/0x1000 [rtw88_8723cs]
__do_sys_delete_module.isra.0+0x190/0x338
__arm64_sys_delete_module+0x1c/0x30
invoke_syscall+0x74/0x100
el0_svc_common.constprop.0+0x48/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x3c/0x158
el0t_64_sync_handler+0x120/0x138
el0t_64_sync+0x194/0x198
---[ end trace 0000000000000000 ]------ drivers/net/wireless/realtek/rtw88/sdio.c | 6 +++--- drivers/net/wireless/realtek/rtw88/usb.c | 5 +++-- 2 files changed, 6 insertions(+), 5 deletions(-)
drivers/net/wireless/realtek/rtw88/sdio.c +3 -3
@@ -1297,12 +1297,12 @@ static void rtw_sdio_deinit_tx(struct rtw_dev *rtwdev)struct rtw_sdio *rtwsdio = (struct rtw_sdio *)rtwdev->priv;int i; -for (i =0 ; i <RTK_MAX_TX_QUEUE_NUM ; i++) -skb_queue_purge (&rtwsdio->tx_queue[i]); -flush_workqueue (rtwsdio->txwq);destroy_workqueue (rtwsdio->txwq);kfree (rtwsdio->tx_handler_data); + +for (i =0 ; i <RTK_MAX_TX_QUEUE_NUM ; i++) +ieee80211_purge_tx_queue (rtwdev->hw, &rtwsdio->tx_queue[i]); } int rtw_sdio_probe(struct sdio_func *sdio_func,
drivers/net/wireless/realtek/rtw88/usb.c +3 -2
@@ -423,10 +423,11 @@ static void rtw_usb_tx_handler(struct work_struct *work)static void rtw_usb_tx_queue_purge (struct rtw_usb *rtwusb) { +struct rtw_dev *rtwdev = rtwusb->rtwdev;int i;for (i =0 ; i <ARRAY_SIZE (rtwusb->tx_queue); i++) -skb_queue_purge (&rtwusb->tx_queue[i]); +ieee80211_purge_tx_queue (rtwdev->hw, &rtwusb->tx_queue[i]); }static void rtw_usb_write_port_complete (struct urb *urb)
@@ -888,9 +889,9 @@ static void rtw_usb_deinit_tx(struct rtw_dev *rtwdev) {struct rtw_usb *rtwusb =rtw_get_usb_priv (rtwdev); -rtw_usb_tx_queue_purge (rtwusb);flush_workqueue (rtwusb->txwq);destroy_workqueue (rtwusb->txwq); +rtw_usb_tx_queue_purge (rtwusb); } static int rtw_usb_intf_init(struct rtw_dev *rtwdev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 259/466 drm/xe/pciid: Add new PCI id for ARL
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dnyaneshwar Bhadane <[email protected]>
[ Upstream commit 35667a0330612bb25a689e4d3a687d47cede1d7a ]
Add new PCI id for ARL platform.
v2: Fix typo in PCI id (SaiTeja)
--- include/drm/intel/xe_pciids.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/drm/intel/xe_pciids.h +2 -1
@@ -179,7 +179,8 @@ MACRO__(0x7D41, ## __VA_ARGS__), \ MACRO__(0x7D51, ## __VA_ARGS__), \ MACRO__(0x7D67, ## __VA_ARGS__), \ - MACRO__(0x7DD1, ## __VA_ARGS__) + MACRO__(0x7DD1, ## __VA_ARGS__), \ + MACRO__(0xB640, ## __VA_ARGS__)/* MTL */ #define XE_MTL_IDS (MACRO__ , ...) \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 260/466 drm: panel-orientation-quirks: Add quirk for AYA NEO 2 model
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joaquín Ignacio Aramendía <[email protected]>
[ Upstream commit 361ebf5ef843b0aa1704c72eb26b91cf76c3c5b7 ]
Add quirk orientation for AYA NEO 2. The name appears without spaces in DMI strings. That made it difficult to reuse the 2021 match. Also the display is larger in resolution.
Tested by the JELOS team that has been patching their own kernel for a while now and confirmed by users in the AYA NEO and ChimeraOS discord servers.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -184,6 +184,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* AYA NEO AYANEO 2 */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"AYANEO" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "AYANEO 2"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, }, { /* AYA NEO 2021 */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "AYADEVICE"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 261/466 drm: panel-orientation-quirks: Add quirk for AYA NEO Founder edition
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joaquín Ignacio Aramendía <[email protected]>
[ Upstream commit d7972d735ca80a40a571bf753c138263981a5698 ]
Add quirk orientation for AYA NEO Founder. The name appears with spaces in DMI strings as other devices of the brand. The panel is the same as the NEXT and 2021 models. Those could not be reused as the former has VENDOR name as "AYANEO" without spaces and the latter has "AYADEVICE".
Tested by the JELOS team that has been patching their own kernel for a while now and confirmed by users in the AYA NEO and ChimeraOS discord servers.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -202,6 +202,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_MATCH(DMI_PRODUCT_NAME, "AIR"), }, .driver_data = (void *)&lcd1080x1920_leftside_up, + }, { /* AYA NEO Founder */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"AYA NEO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "AYA NEO Founder"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, }, { /* AYA NEO NEXT */ .matches = { DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 262/466 drm: panel-orientation-quirks: Add quirk for AYA NEO GEEK
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joaquín Ignacio Aramendía <[email protected]>
[ Upstream commit 428656feb972ca99200fc127b5aecb574efd9d3d ]
Add quirk orientation for AYA NEO GEEK. The name appears without spaces in DMI strings. The board name is completely different to the previous models making it difficult to reuse their quirks despite being the same resolution and using the same orientation.
Tested by the JELOS team that has been patching their own kernel for a while now and confirmed by users in the AYA NEO and ChimeraOS discord servers.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -208,6 +208,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_MATCH(DMI_PRODUCT_NAME, "AYA NEO Founder"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* AYA NEO GEEK */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"AYANEO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "GEEK"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, }, { /* AYA NEO NEXT */ .matches = { DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AYANEO"),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 263/466 drm/bridge: it6505: Enable module autoloading
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 1e2ab24cd708b1c864ff983ee1504c0a409d2f8e ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/gpu/drm/bridge/ite-it6505.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/bridge/ite-it6505.c +1 -0
@@ -3507,6 +3507,7 @@ static const struct of_device_id it6505_of_match[] = { { .compatible = "ite,it6505" }, { } }; +MODULE_DEVICE_TABLE (of, it6505_of_match);static struct i2c_driver it6505_i2c_driver = { .driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 264/466 drm/mcde: Enable module autoloading
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 8a16b5cdae26207ff4c22834559384ad3d7bc970 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/gpu/drm/mcde/mcde_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/mcde/mcde_drv.c +1 -0
@@ -473,6 +473,7 @@ static const struct of_device_id mcde_of_match[] = { }, {}, }; +MODULE_DEVICE_TABLE (of, mcde_of_match);static struct platform_driver mcde_driver = { .driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 265/466 wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit 630d5d8f2bf6b340202b6bc2c05d794bbd8e4c1c ]
The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access.
Addresses-Coverity-ID: 1529805 ("Dereference null return value")
--- drivers/net/wireless/realtek/rtw89/fw.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/realtek/rtw89/fw.c +3 -0
@@ -6074,6 +6074,9 @@ static int rtw89_update_6ghz_rnr_chan(struct rtw89_dev *rtwdev, skb =ieee80211_probereq_get (rtwdev->hw, rtwvif_link->mac_addr,NULL ,0 , req->ie_len); +if (!skb) +return -ENOMEM ; +skb_put_data (skb, ies->ies[NL80211_BAND_6GHZ ], ies->len[NL80211_BAND_6GHZ ]);skb_put_data (skb, ies->common_ies, ies->common_ie_len); hdr = (struct ieee80211_hdr *)skb->data;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 266/466 drm/amd/display: Fix out-of-bounds access in dcn21_link_encoder_create
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 63de35a8fcfca59ae8750d469a7eb220c7557baf ]
An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed size and the index was not being checked against the array's bounds before accessing it.
This fix adds a conditional check to ensure that the hpd_source index is within the valid range of the link_enc_hpd_regs array. If the index is out of bounds, the function now returns NULL to prevent undefined behavior.
References:
[ 65.920507] ------------[ cut here ]------------ [ 65.920510] UBSAN: array-index-out-of-bounds in drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn21/dcn21_resource.c:1312:29 [ 65.920519] index 7 is out of range for type 'dcn10_link_enc_hpd_registers [5]' [ 65.920523] CPU: 3 PID: 1178 Comm: modprobe Tainted: G OE 6.8.0-cleanershaderfeatureresetasdntipmi200nv2132 #13 [ 65.920525] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS WMJ0429N_Weekly_20_04_2 04/29/2020 [ 65.920527] Call Trace: [ 65.920529] <TASK> [ 65.920532] dump_stack_lvl+0x48/0x70 [ 65.920541] dump_stack+0x10/0x20 [ 65.920543] __ubsan_handle_out_of_bounds+0xa2/0xe0 [ 65.920549] dcn21_link_encoder_create+0xd9/0x140 [amdgpu] [ 65.921009] link_create+0x6d3/0xed0 [amdgpu] [ 65.921355] create_links+0x18a/0x4e0 [amdgpu] [ 65.921679] dc_create+0x360/0x720 [amdgpu] [ 65.921999] ? dmi_matches+0xa0/0x220 [ 65.922004] amdgpu_dm_init+0x2b6/0x2c90 [amdgpu] [ 65.922342] ? console_unlock+0x77/0x120 [ 65.922348] ? dev_printk_emit+0x86/0xb0 [ 65.922354] dm_hw_init+0x15/0x40 [amdgpu] [ 65.922686] amdgpu_device_init+0x26a8/0x33a0 [amdgpu] [ 65.922921] amdgpu_driver_load_kms+0x1b/0xa0 [amdgpu] [ 65.923087] amdgpu_pci_probe+0x1b7/0x630 [amdgpu] [ 65.923087] local_pci_probe+0x4b/0xb0 [ 65.923087] pci_device_probe+0xc8/0x280 [ 65.923087] really_probe+0x187/0x300 [ 65.923087] __driver_probe_device+0x85/0x130 [ 65.923087] driver_probe_device+0x24/0x110 [ 65.923087] __driver_attach+0xac/0x1d0 [ 65.923087] ? __pfx___driver_attach+0x10/0x10 [ 65.923087] bus_for_each_dev+0x7d/0xd0 [ 65.923087] driver_attach+0x1e/0x30 [ 65.923087] bus_add_driver+0xf2/0x200 [ 65.923087] driver_register+0x64/0x130 [ 65.923087] ? __pfx_amdgpu_init+0x10/0x10 [amdgpu] [ 65.923087] __pci_register_driver+0x61/0x70 [ 65.923087] amdgpu_init+0x7d/0xff0 [amdgpu] [ 65.923087] do_one_initcall+0x49/0x310 [ 65.923087] ? kmalloc_trace+0x136/0x360 [ 65.923087] do_init_module+0x6a/0x270 [ 65.923087] load_module+0x1fce/0x23a0 [ 65.923087] init_module_from_file+0x9c/0xe0 [ 65.923087] ? init_module_from_file+0x9c/0xe0 [ 65.923087] idempotent_init_module+0x179/0x230 [ 65.923087] __x64_sys_finit_module+0x5d/0xa0 [ 65.923087] do_syscall_64+0x76/0x120 [ 65.923087] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 65.923087] RIP: 0033:0x7f2d80f1e88d [ 65.923087] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 b5 0f 00 f7 d8 64 89 01 48 [ 65.923087] RSP: 002b:00007ffc7bc1aa78 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 65.923087] RAX: ffffffffffffffda RBX: 0000564c9c1db130 RCX: 00007f2d80f1e88d [ 65.923087] RDX: 0000000000000000 RSI: 0000564c9c1e5480 RDI: 000000000000000f [ 65.923087] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000002 [ 65.923087] R10: 000000000000000f R11: 0000000000000246 R12: 0000564c9c1e5480 [ 65.923087] R13: 0000564c9c1db260 R14: 0000000000000000 R15: 0000564c9c1e54b0 [ 65.923087] </TASK> [ 65.923927] ---[ end trace ]---
--- drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/resource/dcn21/dcn21_resource.c +1 -1
@@ -1298,7 +1298,7 @@ static struct link_encoder *dcn21_link_encoder_create(kzalloc (sizeof (struct dcn21_link_encoder ),GFP_KERNEL );int link_regs_id; -if (!enc21) +if (!enc21 || enc_init_data->hpd_source >=ARRAY_SIZE (link_enc_hpd_regs))return NULL ; link_regs_id =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 267/466 drm/radeon/r600_cs: Fix possible int overflow in r600_packet3_check()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Artemiev <[email protected]>
[ Upstream commit a1e2da6a5072f8abe5b0feaa91a5bcd9dc544a04 ]
It is possible, although unlikely, that an integer overflow will occur when the result of radeon_get_ib_value() is shifted to the left.
Avoid it by casting one of the operands to larger data type (u64).
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/r600_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/radeon/r600_cs.c +1 -1
@@ -2104,7 +2104,7 @@ static int r600_packet3_check(struct radeon_cs_parser *p,return -EINVAL ; } - offset =radeon_get_ib_value (p, idx+1 ) <<8 ; + offset = (u64 )radeon_get_ib_value (p, idx+1 ) <<8 ;if (offset != track->vgt_strmout_bo_offset[idx_value]) {DRM_ERROR ("bad STRMOUT_BASE_UPDATE, bo offset does not match: 0x%llx, 0x%x\n" , offset, track->vgt_strmout_bo_offset[idx_value]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 268/466 ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for MTL.
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balamurugan C <[email protected]>
[ Upstream commit 0f5d2228a99a4733b2a6652e16255be9caf2616a ]
Added match table entry on mtl machines to support HDMI-In capture with rt5682 I2S audio codec. also added the respective quirk configuration in rt5682 machine driver.
--- sound/soc/intel/boards/sof_rt5682.c | 7 +++++++ sound/soc/intel/common/soc-acpi-intel-mtl-match.c | 7 +++++++ 2 files changed, 14 insertions(+)
sound/soc/intel/boards/sof_rt5682.c +7 -0
@@ -870,6 +870,13 @@ static const struct platform_device_id board_ids[] = {SOF_SSP_PORT_BT_OFFLOAD (2 ) | SOF_BT_OFFLOAD_PRESENT), }, + { + .name = "mtl_rt5682_c1_h02", + .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN | +SOF_SSP_PORT_CODEC (1 ) | +/* SSP 0 and SSP 2 are used for HDMI IN */ + SOF_SSP_MASK_HDMI_CAPTURE(0x5)), + }, { .name = "arl_rt5682_c1_h02", .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN |
sound/soc/intel/common/soc-acpi-intel-mtl-match.c +7 -0
@@ -42,6 +42,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_mtl_machines[] = {SND_SOC_ACPI_TPLG_INTEL_SSP_MSB | SND_SOC_ACPI_TPLG_INTEL_DMIC_NUMBER, }, + { + .comp_ids = &mtl_rt5682_rt5682s_hp, + .drv_name = "mtl_rt5682_c1_h02", + .machine_quirk = snd_soc_acpi_codec_list, + .quirk_data = &mtl_lt6911_hdmi, + .sof_tplg_filename = "sof-mtl-rt5682-ssp1-hdmi-ssp02.tplg", + },/* place boards for each headphone codec: sof driver will complete the * tplg name and machine driver will detect the amp type */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 269/466 dlm: fix possible lkb_resource null dereference
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit b98333c67daf887c724cd692e88e2db9418c0861 ]
This patch fixes a possible null pointer dereference when this function is called from request_lock() as lkb->lkb_resource is not assigned yet, only after validate_lock_args() by calling attach_lkb(). Another issue is that a resource name could be a non printable bytearray and we cannot assume to be ASCII coded.
The log functionality is probably never being hit when DLM is used in normal way and no debug logging is enabled. The null pointer dereference can only occur on a new created lkb that does not have the resource assigned yet, it probably never hits the null pointer dereference but we should be sure that other changes might not change this behaviour and we actually can hit the mentioned null pointer dereference.
In this patch we just drop the printout of the resource name, the lkb id is enough to make a possible connection to a resource name if this exists.
--- fs/dlm/lock.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
fs/dlm/lock.c +4 -6
@@ -2861,16 +2861,14 @@ static int validate_lock_args(struct dlm_ls *ls, struct dlm_lkb *lkb,case -EINVAL :/* annoy the user because dlm usage is wrong */ WARN_ON (1 ); -log_error (ls,"%s %d %x %x %x %d %d %s" , __func__, +log_error (ls,"%s %d %x %x %x %d %d" , __func__, rv, lkb->lkb_id,dlm_iflags_val (lkb), args->flags, - lkb->lkb_status, lkb->lkb_wait_type, - lkb->lkb_resource->res_name); + lkb->lkb_status, lkb->lkb_wait_type);break ;default : -log_debug (ls,"%s %d %x %x %x %d %d %s" , __func__, +log_debug (ls,"%s %d %x %x %x %d %d" , __func__, rv, lkb->lkb_id,dlm_iflags_val (lkb), args->flags, - lkb->lkb_status, lkb->lkb_wait_type, - lkb->lkb_resource->res_name); + lkb->lkb_status, lkb->lkb_wait_type);break ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 270/466 drm/amd/display: skip disable CRTC in seemless bootup case
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fudongwang <[email protected]>
[ Upstream commit 0e37e4b9afbd08df1f00a70bbb4d1ec273d18c9e ]
Resync FIFO is a workaround to write the same value to DENTIST_DISPCLK_CNTL register after programming OTG_PIXEL_RATE_DIV register, in case seemless boot, there is no OTG_PIXEL_RATE_DIV register update, so skip CRTC disable when resync FIFO to avoid random FIFO error and garbage.
--- drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +3 -1
@@ -371,7 +371,9 @@ void dcn314_resync_fifo_dccg_dio(struct dce_hwseq *hws, struct dc *dc, struct dcif (pipe->top_pipe || pipe->prev_odm_pipe)continue ; -if (pipe->stream && (pipe->stream->dpms_off ||dc_is_virtual_signal (pipe->stream->signal))) { +if (pipe->stream && (pipe->stream->dpms_off ||dc_is_virtual_signal (pipe->stream->signal)) && + !pipe->stream->apply_seamless_boot_optimization && + !pipe->stream->apply_edp_fast_boot_optimization) { pipe->stream_res.tg->funcs->disable_crtc (pipe->stream_res.tg);reset_sync_context_for_pipe (dc, context, i); otg_disabled[i] = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 271/466 drm/amd/display: Fix garbage or black screen when resetting otg
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhongwei <[email protected]>
[ Upstream commit ffa1e31f70d2e97c121709b44a8960f5d7becb10 ]
[Why]
For some EDP to MIPI panel, disabling OTG when link is alive like boot case, the converter might output garbage or show no display because our GPU is not sending required pixel data.
Alos Dig fifo underflow was found which might cause garbage, when resetting otg for other types of EDP panels.
[How]
Skipping resetting OTG if the dig fifo is on. Make sure that the otg for the pipe is the one that the dig fifo is selecting via the FE mask.
--- .../dc/dio/dcn314/dcn314_dio_stream_encoder.c | 10 ++++++++++ .../amd/display/dc/hwss/dcn314/dcn314_hwseq.c | 16 ++++++++++++++++ 2 files changed, 26 insertions(+)
drivers/gpu/drm/amd/display/dc/dio/dcn314/dcn314_dio_stream_encoder.c +10 -0
@@ -83,6 +83,15 @@ void enc314_disable_fifo(struct stream_encoder *enc)REG_UPDATE (DIG_FIFO_CTRL0 ,DIG_FIFO_ENABLE ,0 ); } +static bool enc314_is_fifo_enabled (struct stream_encoder *enc) +{ +struct dcn10_stream_encoder *enc1 =DCN10STRENC_FROM_STRENC (enc); +uint32_t reset_val; + +REG_GET (DIG_FIFO_CTRL0 ,DIG_FIFO_ENABLE , &reset_val); +return (reset_val !=0 ); +} +void enc314_dp_set_odm_combine (struct stream_encoder *enc,bool odm_combine)
@@ -468,6 +477,7 @@ static const struct stream_encoder_funcs dcn314_str_enc_funcs = { .enable_fifo = enc314_enable_fifo, .disable_fifo = enc314_disable_fifo, + .is_fifo_enabled = enc314_is_fifo_enabled, .set_input_mode = enc314_set_dig_input_mode, };
drivers/gpu/drm/amd/display/dc/hwss/dcn314/dcn314_hwseq.c +16 -0
@@ -355,6 +355,20 @@ void dcn314_calculate_pix_rate_divider( } } +static bool dcn314_is_pipe_dig_fifo_on (struct pipe_ctx *pipe) +{ +return pipe && pipe->stream +// Check dig's otg instance. + && pipe->stream_res.stream_enc + && pipe->stream_res.stream_enc->funcs->dig_source_otg + && pipe->stream_res.tg->inst == pipe->stream_res.stream_enc->funcs->dig_source_otg (pipe->stream_res.stream_enc) + && pipe->stream->link && pipe->stream->link->link_enc + && pipe->stream->link->link_enc->funcs->is_dig_enabled + && pipe->stream->link->link_enc->funcs->is_dig_enabled (pipe->stream->link->link_enc) + && pipe->stream_res.stream_enc->funcs->is_fifo_enabled + && pipe->stream_res.stream_enc->funcs->is_fifo_enabled (pipe->stream_res.stream_enc); +} +void dcn314_resync_fifo_dccg_dio (struct dce_hwseq *hws,struct dc *dc,struct dc_state *context,unsigned int current_pipe_idx) {unsigned int i;
@@ -374,6 +388,8 @@ void dcn314_resync_fifo_dccg_dio(struct dce_hwseq *hws, struct dc *dc, struct dcif (pipe->stream && (pipe->stream->dpms_off ||dc_is_virtual_signal (pipe->stream->signal)) && !pipe->stream->apply_seamless_boot_optimization && !pipe->stream->apply_edp_fast_boot_optimization) { +if (dcn314_is_pipe_dig_fifo_on (pipe)) +continue ; pipe->stream_res.tg->funcs->disable_crtc (pipe->stream_res.tg);reset_sync_context_for_pipe (dc, context, i); otg_disabled[i] = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 272/466 drm/amd/display: disable SG displays on cyan skillfish
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 66369db7fdd7d58d78673bf83d2b87ea623efb63 ]
These parts were mainly for compute workloads, but they have a display that was available for the console. These chips should support SG display, but I don't know that the support was ever validated on Linux so disable it by default. It can still be enabled by setting sg_display=1 for those that want to play with it. These systems also generally had large carve outs so SG display was less of a factor.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +5 -1
@@ -1910,7 +1910,11 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)else init_data.flags.gpu_vm_support = (amdgpu_sg_display !=0 ); }else { - init_data.flags.gpu_vm_support = (amdgpu_sg_display !=0 ) && (adev->flags &AMD_IS_APU ); +if (amdgpu_ip_version (adev,DCE_HWIP ,0 ) ==IP_VERSION (2 ,0 ,3 )) + init_data.flags.gpu_vm_support = (amdgpu_sg_display ==1 ); +else + init_data.flags.gpu_vm_support = + (amdgpu_sg_display !=0 ) && (adev->flags &AMD_IS_APU ); } adev->mode_info.gpu_vm_support = init_data.flags.gpu_vm_support;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 273/466 drm/xe/ptl: L3bank mask is not available on the media GT
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shekhar Chauhan <[email protected]>
[ Upstream commit 9ab440a9d0426cf7842240891cc457155db1a97e ]
On PTL platforms with media version 30.00, the fuse registers for reporting L3 bank availability to the GT just read out as ~0 and do not provide proper values. Xe does not use the L3 bank mask for anything internally; it only passes the mask through to userspace via the GT topology query.
Since we don't have any way to get the real L3 bank mask, we don't want to pass garbage to userspace. Passing a zeroed mask or a copy of the primary GT's L3 bank mask would also be inaccurate and likely to cause confusion for userspace. The best approach is to simply not include L3 in the list of masks returned by the topology query in cases where we aren't able to provide a meaningful value. This won't change the behavior for any existing platforms (where we can always obtain L3 masks successfully for all GTs), it will only prevent us from mis-reporting bad information on upcoming platform(s).
There's a good chance this will become a formal workaround in the future, but for now we don't have a lineage number so "no_media_l3" is used in place of a lineage as the OOB workaround descriptor.
v2:
- Re-calculate query size to properly match data returned. (Gustavo)
- Update kerneldoc to clarify that the L3bank mask may not be included in the query results if the hardware doesn't make it available. (Gustavo)
--- drivers/gpu/drm/xe/xe_gt_topology.c | 14 ++++++++++ drivers/gpu/drm/xe/xe_query.c | 42 +++++++++++++++++++++-------- drivers/gpu/drm/xe/xe_wa_oob.rules | 1 + include/uapi/drm/xe_drm.h | 4 ++- 4 files changed, 49 insertions(+), 12 deletions(-)
drivers/gpu/drm/xe/xe_gt_topology.c +14 -0
@@ -5,6 +5,7 @@#include "xe_gt_topology.h" +#include <generated/xe_wa_oob.h> #include <linux/bitmap.h> #include <linux/compiler.h>
@@ -12,6 +13,7 @@#include "xe_assert.h" #include "xe_gt.h" #include "xe_mmio.h" +#include "xe_wa.h" static void load_dss_mask (struct xe_gt *gt,xe_dss_mask_t mask,int numregs, ...)
@@ -129,6 +131,18 @@ load_l3_bank_mask(struct xe_gt *gt, xe_l3_bank_mask_t l3_bank_mask)struct xe_device *xe =gt_to_xe (gt);u32 fuse3 =xe_mmio_read32 (gt,MIRROR_FUSE3 ); +/* +* PTL platforms with media version 30.00 do not provide proper values +* for the media GT's L3 bank registers. Skip the readout since we +* don't have any way to obtain real values. +* +* This may get re-described as an official workaround in the future, +* but there's no tracking number assigned yet so we use a custom +* OOB workaround descriptor. +*/ +if (XE_WA (gt, no_media_l3)) +return ; +if (GRAPHICS_VER (xe) >=20 ) {xe_l3_bank_mask_t per_node = {};u32 meml3_en =REG_FIELD_GET (XE2_NODE_ENABLE_MASK , fuse3);
drivers/gpu/drm/xe/xe_query.c +31 -11
66 lines not on this page · raw message
drivers/gpu/drm/xe/xe_wa_oob.rules +1 -0
@@ -37,3 +37,4 @@ 16023588340 GRAPHICS_VERSION(2001) 14019789679 GRAPHICS_VERSION(1255) GRAPHICS_VERSION_RANGE(1270, 2004) +no_media_l3 MEDIA_VERSION(3000)
include/uapi/drm/xe_drm.h +3 -1
@@ -512,7 +512,9 @@ struct drm_xe_query_gt_list {* containing the following in mask: * ``DSS_COMPUTE ff ff ff ff 00 00 00 00`` * means 32 DSS are available for compute. -* - %DRM_XE_TOPO_L3_BANK - To query the mask of enabled L3 banks +* - %DRM_XE_TOPO_L3_BANK - To query the mask of enabled L3 banks. This type +* may be omitted if the driver is unable to query the mask from the +* hardware. * - %DRM_XE_TOPO_EU_PER_DSS - To query the mask of Execution Units (EU) * available per Dual Sub Slices (DSS). For example a query response * containing the following in mask:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 274/466 drm/xe/xe3: Add initial set of workarounds
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Sousa <[email protected]>
[ Upstream commit 081cb8948cfe322076cd23f22f85ba68f73e2c4b ]
Implement the initial set of workarounds for Xe3 IPs.
--- drivers/gpu/drm/xe/regs/xe_engine_regs.h | 1 + drivers/gpu/drm/xe/regs/xe_gt_regs.h | 3 ++ drivers/gpu/drm/xe/xe_wa.c | 47 ++++++++++++++++++++++++ drivers/gpu/drm/xe/xe_wa_oob.rules | 1 + 4 files changed, 52 insertions(+)
drivers/gpu/drm/xe/regs/xe_engine_regs.h +1 -0
@@ -186,6 +186,7 @@#define VDBOX_CGCTL3F10 (base) XE_REG((base) + 0x3f10)#define IECPUNIT_CLKGATE_DIS REG_BIT(22) +#define RAMDFTUNIT_CLKGATE_DIS REG_BIT(9)#define VDBOX_CGCTL3F18 (base) XE_REG((base) + 0x3f18)#define ALNUNIT_CLKGATE_DIS REG_BIT(13)
drivers/gpu/drm/xe/regs/xe_gt_regs.h +3 -0
@@ -286,6 +286,9 @@#define GAMTLBVEBOX0_CLKGATE_DIS REG_BIT(16)#define LTCDD_CLKGATE_DIS REG_BIT(10) +#define UNSLCGCTL9454 XE_REG(0x9454) +#define LSCFE_CLKGATE_DIS REG_BIT(4) +#define XEHP_SLICE_UNIT_LEVEL_CLKGATE XE_REG_MCR(0x94d4)#define L3_CR2X_CLKGATE_DIS REG_BIT(17)#define L3_CLKGATE_DIS REG_BIT(16)
drivers/gpu/drm/xe/xe_wa.c +47 -0
65 lines not on this page · raw message
drivers/gpu/drm/xe/xe_wa_oob.rules +1 -0
@@ -33,6 +33,7 @@ GRAPHICS_VERSION(2004) 22019338487 MEDIA_VERSION(2000) GRAPHICS_VERSION(2001) + MEDIA_VERSION(3000), MEDIA_STEP(A0, B0) 22019338487_display PLATFORM(LUNARLAKE) 16023588340 GRAPHICS_VERSION(2001) 14019789679 GRAPHICS_VERSION(1255)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 275/466 drm/display: Fix building with GCC 15
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <[email protected]>
[ Upstream commit a500f3751d3c861be7e4463c933cf467240cca5d ]
GCC 15 enables -Werror=unterminated-string-initialization by default. This results in the following build error
drivers/gpu/drm/display/drm_dp_dual_mode_helper.c: In function ‘is_hdmi_adaptor’:drivers/gpu/drm/display/drm_dp_dual_mode_helper.c:164:17: error: initializer-string for array of
‘char’ is too long [-Werror=unterminated-string-initialization]
164 | "DP-HDMI ADAPTOR\x04";
| ^~~~~~~~~~~~~~~~~~~~~After discussion with Ville, the fix was to increase the size of dp_dual_mode_hdmi_id array by one, so that it can accommodate the NULL line character. This should let us build the kernel with GCC 15.
--- drivers/gpu/drm/display/drm_dp_dual_mode_helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/display/drm_dp_dual_mode_helper.c +2 -2
@@ -160,11 +160,11 @@ EXPORT_SYMBOL(drm_dp_dual_mode_write);static bool is_hdmi_adaptor (const char hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN ]) { -static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN ] = +static const char dp_dual_mode_hdmi_id[DP_DUAL_MODE_HDMI_ID_LEN +1 ] ="DP-HDMI ADAPTOR\x04" ;return memcmp (hdmi_id, dp_dual_mode_hdmi_id, -sizeof (dp_dual_mode_hdmi_id)) ==0 ; +DP_DUAL_MODE_HDMI_ID_LEN ) ==0 ; }static bool is_type1_adaptor (uint8_t adaptor_id)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 276/466 ALSA: hda: Use own quirk lookup helper
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 5b1913a79c3e0518d9c5db343fa9fc4edcea041f ]
For allowing the primary codec SSID matching (that works around the conflicting PCI SSID problems), introduce a new struct hda_quirk, which is compatible with the existing struct snd_pci_quirk along with new helper functions and macros.
The existing snd_pci_quirk tables are replaced with hda_quirk tables accordingly, while keeping SND_PCI_QUIRK() entry definitions as is.
This patch shouldn't bring any behavior change, just some renaming and shifting the code. The actual change for the codec SSID matching will follow after this.
--- sound/pci/hda/hda_auto_parser.c | 61 +++++++++++++++++++++++------ sound/pci/hda/hda_local.h | 22 ++++++++++- sound/pci/hda/patch_analog.c | 6 +-- sound/pci/hda/patch_cirrus.c | 8 ++-- sound/pci/hda/patch_conexant.c | 8 ++-- sound/pci/hda/patch_cs8409-tables.c | 2 +- sound/pci/hda/patch_cs8409.h | 2 +- sound/pci/hda/patch_realtek.c | 20 +++++----- sound/pci/hda/patch_sigmatel.c | 22 +++++------ sound/pci/hda/patch_via.c | 2 +- 10 files changed, 106 insertions(+), 47 deletions(-)
sound/pci/hda/hda_auto_parser.c +50 -11
@@ -956,6 +956,28 @@ void snd_hda_pick_pin_fixup(struct hda_codec *codec, }EXPORT_SYMBOL_GPL (snd_hda_pick_pin_fixup); +/* check whether the given quirk entry matches with vendor/device pair */ +static bool hda_quirk_match (u16 vendor,u16 device,const struct hda_quirk *q) +{ +if (q->subvendor != vendor) +return false; +return !q->subdevice || + (device & q->subdevice_mask) == q->subdevice; +} + +/* look through the quirk list and return the matching entry */ +static const struct hda_quirk * +hda_quirk_lookup_id (u16 vendor,u16 device,const struct hda_quirk *list) +{ +const struct hda_quirk *q; + +for (q = list; q->subvendor || q->subdevice; q++) { +if (hda_quirk_match (vendor, device, q)) +return q; + } +return NULL ; +} +/** * snd_hda_pick_fixup - Pick up a fixup matching with PCI/codec SSID or model string * @codec: the HDA codec
@@ -975,14 +997,16 @@ EXPORT_SYMBOL_GPL(snd_hda_pick_pin_fixup);*/ void snd_hda_pick_fixup (struct hda_codec *codec,const struct hda_model_fixup *models, -const struct snd_pci_quirk *quirk, +const struct hda_quirk *quirk,const struct hda_fixup *fixlist) { -const struct snd_pci_quirk *q; +const struct hda_quirk *q;int id =HDA_FIXUP_ID_NOT_SET ;const char *name =NULL ;const char *type =NULL ;unsigned int vendor, device; +u16 pci_vendor, pci_device; +u16 codec_vendor, codec_device;if (codec->fixup_id !=HDA_FIXUP_ID_NOT_SET )return ;
@@ -1013,27 +1037,42 @@ void snd_hda_pick_fixup(struct hda_codec *codec,if (!quirk)return ; +if (codec->bus->pci) { + pci_vendor = codec->bus->pci->subsystem_vendor; + pci_device = codec->bus->pci->subsystem_device; + } + + codec_vendor = codec->core.subsystem_id >>16 ; + codec_device = codec->core.subsystem_id &0xffff ; +/* match with the SSID alias given by the model string "XXXX:YYYY" */ if (codec->modelname &&sscanf (codec->modelname,"%04x:%04x" , &vendor, &device) ==2 ) { - q =snd_pci_quirk_lookup_id (vendor, device, quirk); + q =hda_quirk_lookup_id (vendor, device, quirk);if (q) { type ="alias SSID" ; goto found_device; } } -/* match with the PCI SSID */ - q =snd_pci_quirk_lookup (codec->bus->pci, quirk); -if (q) { - type ="PCI SSID" ; - goto found_device; +/* match primarily with the PCI SSID */ +for (q = quirk; q->subvendor || q->subdevice; q++) { +/* if the entry is specific to codec SSID, check with it */ +if (!codec->bus->pci || q->match_codec_ssid) { +if (hda_quirk_match (codec_vendor, codec_device, q)) { + type ="codec SSID" ; + goto found_device; + } + }else { +if (hda_quirk_match (pci_vendor, pci_device, q)) { + type ="PCI SSID" ; + goto found_device; + } + } }/* match with the codec SSID */ - q =snd_pci_quirk_lookup_id (codec->core.subsystem_id >>16 , - codec->core.subsystem_id &0xffff , - quirk); + q =hda_quirk_lookup_id (codec_vendor, codec_device, quirk);if (q) { type ="codec SSID" ; goto found_device;
sound/pci/hda/hda_local.h +21 -1
@@ -292,6 +292,26 @@ struct hda_fixup { } v; }; +/* +* extended form of snd_pci_quirk: +* for PCI SSID matching, use SND_PCI_QUIRK() like before; +* for codec SSID matching, use the new HDA_CODEC_QUIRK() instead +*/ +struct hda_quirk { +unsigned short subvendor;/* PCI subvendor ID */ +unsigned short subdevice;/* PCI subdevice ID */ +unsigned short subdevice_mask;/* bitmask to match */ +bool match_codec_ssid;/* match only with codec SSID */ +int value;/* value */ +#ifdef CONFIG_SND_DEBUG_VERBOSE +const char *name;/* name of the device (optional) */ +#endif +}; + +#define HDA_CODEC_QUIRK (vend, dev, xname, val) \ + { _SND_PCI_QUIRK_ID(vend, dev), .value = (val), .name = (xname),\ + .match_codec_ssid = true } +struct snd_hda_pin_quirk {unsigned int codec;/* Codec vendor/device ID */ unsigned short subvendor;/* PCI subvendor ID */
@@ -351,7 +371,7 @@ void snd_hda_apply_fixup(struct hda_codec *codec, int action);void __snd_hda_apply_fixup (struct hda_codec *codec,int id,int action,int depth);void snd_hda_pick_fixup (struct hda_codec *codec,const struct hda_model_fixup *models, -const struct snd_pci_quirk *quirk, +const struct hda_quirk *quirk,const struct hda_fixup *fixlist); void snd_hda_pick_pin_fixup(struct hda_codec *codec, const struct snd_hda_pin_quirk *pin_quirk,
sound/pci/hda/patch_analog.c +3 -3
@@ -345,7 +345,7 @@ static const struct hda_fixup ad1986a_fixups[] = { }, }; -static const struct snd_pci_quirk ad1986a_fixup_tbl[] = { +static const struct hda_quirk ad1986a_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x30af ,"HP B2800" ,AD1986A_FIXUP_LAPTOP_IMIC ),SND_PCI_QUIRK (0x1043 ,0x1153 ,"ASUS M9V" ,AD1986A_FIXUP_LAPTOP_IMIC ),SND_PCI_QUIRK (0x1043 ,0x1443 ,"ASUS Z99He" ,AD1986A_FIXUP_EAPD ),
@@ -588,7 +588,7 @@ static const struct hda_fixup ad1981_fixups[] = { }, }; -static const struct snd_pci_quirk ad1981_fixup_tbl[] = { +static const struct hda_quirk ad1981_fixup_tbl[] = {SND_PCI_QUIRK_VENDOR (0x1014 ,"Lenovo" ,AD1981_FIXUP_AMP_OVERRIDE ),SND_PCI_QUIRK_VENDOR (0x103c ,"HP" ,AD1981_FIXUP_HP_EAPD ),SND_PCI_QUIRK_VENDOR (0x17aa ,"Lenovo" ,AD1981_FIXUP_AMP_OVERRIDE ),
@@ -1061,7 +1061,7 @@ static const struct hda_fixup ad1884_fixups[] = { }, }; -static const struct snd_pci_quirk ad1884_fixup_tbl[] = { +static const struct hda_quirk ad1884_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x2a82 ,"HP Touchsmart" ,AD1884_FIXUP_HP_TOUCHSMART ),SND_PCI_QUIRK_VENDOR (0x103c ,"HP" ,AD1884_FIXUP_HP_EAPD ),SND_PCI_QUIRK_VENDOR (0x17aa ,"Lenovo Thinkpad" ,AD1884_FIXUP_THINKPAD ),
sound/pci/hda/patch_cirrus.c +4 -4
@@ -385,7 +385,7 @@ static const struct hda_model_fixup cs420x_models[] = { {} }; -static const struct snd_pci_quirk cs420x_fixup_tbl[] = { +static const struct hda_quirk cs420x_fixup_tbl[] = {SND_PCI_QUIRK (0x10de ,0x0ac0 ,"MacBookPro 5,3" ,CS420X_MBP53 ),SND_PCI_QUIRK (0x10de ,0x0d94 ,"MacBookAir 3,1(2)" ,CS420X_MBP55 ),SND_PCI_QUIRK (0x10de ,0xcb79 ,"MacBookPro 5,5" ,CS420X_MBP55 ),
@@ -634,13 +634,13 @@ static const struct hda_model_fixup cs4208_models[] = { {} }; -static const struct snd_pci_quirk cs4208_fixup_tbl[] = { +static const struct hda_quirk cs4208_fixup_tbl[] = {SND_PCI_QUIRK_VENDOR (0x106b ,"Apple" ,CS4208_MAC_AUTO ), {}/* terminator */ };/* codec SSID matching */ -static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = { +static const struct hda_quirk cs4208_mac_fixup_tbl[] = {SND_PCI_QUIRK (0x106b ,0x5e00 ,"MacBookPro 11,2" ,CS4208_MBP11 ),SND_PCI_QUIRK (0x106b ,0x6c00 ,"MacMini 7,1" ,CS4208_MACMINI ),SND_PCI_QUIRK (0x106b ,0x7100 ,"MacBookAir 6,1" ,CS4208_MBA6 ),
@@ -818,7 +818,7 @@ static const struct hda_model_fixup cs421x_models[] = { {} }; -static const struct snd_pci_quirk cs421x_fixup_tbl[] = { +static const struct hda_quirk cs421x_fixup_tbl[] = {/* Test Intel board + CDB2410 */ SND_PCI_QUIRK (0x8086 ,0x5001 ,"DP45SG/CDB4210" ,CS421X_CDB4210 ), {}/* terminator */
sound/pci/hda/patch_conexant.c +4 -4
@@ -1014,7 +1014,7 @@ static const struct hda_fixup cxt_fixups[] = { }, }; -static const struct snd_pci_quirk cxt5045_fixups[] = { +static const struct hda_quirk cxt5045_fixups[] = {SND_PCI_QUIRK (0x103c ,0x30d5 ,"HP 530" ,CXT_FIXUP_HP_530 ),SND_PCI_QUIRK (0x1179 ,0xff31 ,"Toshiba P105" ,CXT_FIXUP_TOSHIBA_P105 ),/* HP, Packard Bell, Fujitsu-Siemens & Lenovo laptops have
@@ -1034,7 +1034,7 @@ static const struct hda_model_fixup cxt5045_fixup_models[] = { {} }; -static const struct snd_pci_quirk cxt5047_fixups[] = { +static const struct hda_quirk cxt5047_fixups[] = {/* HP laptops have really bad sound over 0 dB on NID 0x10. */ SND_PCI_QUIRK_VENDOR (0x103c ,"HP" ,CXT_FIXUP_CAP_MIX_AMP_5047 ),
@@ -1046,7 +1046,7 @@ static const struct hda_model_fixup cxt5047_fixup_models[] = { {} }; -static const struct snd_pci_quirk cxt5051_fixups[] = { +static const struct hda_quirk cxt5051_fixups[] = {SND_PCI_QUIRK (0x103c ,0x360b ,"Compaq CQ60" ,CXT_PINCFG_COMPAQ_CQ60 ),SND_PCI_QUIRK (0x17aa ,0x20f2 ,"Lenovo X200" ,CXT_PINCFG_LENOVO_X200 ), {}
@@ -1057,7 +1057,7 @@ static const struct hda_model_fixup cxt5051_fixup_models[] = { {} }; -static const struct snd_pci_quirk cxt5066_fixups[] = { +static const struct hda_quirk cxt5066_fixups[] = {SND_PCI_QUIRK (0x1025 ,0x0543 ,"Acer Aspire One 522" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054f ,"Acer Aspire 4830T" ,CXT_FIXUP_ASPIRE_DMIC ),
sound/pci/hda/patch_cs8409-tables.c +1 -1
@@ -473,7 +473,7 @@ struct sub_codec dolphin_cs42l42_1 = {* Arrays Used for all projects using CS8409 ******************************************************************************/ -const struct snd_pci_quirk cs8409_fixup_tbl[] = { +const struct hda_quirk cs8409_fixup_tbl[] = {SND_PCI_QUIRK (0x1028 ,0x0A11 ,"Bullseye" ,CS8409_BULLSEYE ),SND_PCI_QUIRK (0x1028 ,0x0A12 ,"Bullseye" ,CS8409_BULLSEYE ),SND_PCI_QUIRK (0x1028 ,0x0A23 ,"Bullseye" ,CS8409_BULLSEYE ),
sound/pci/hda/patch_cs8409.h +1 -1
@@ -355,7 +355,7 @@ int cs42l42_volume_put(struct snd_kcontrol *kctrl, struct snd_ctl_elem_value *ucextern const struct hda_pcm_stream cs42l42_48k_pcm_analog_playback;extern const struct hda_pcm_stream cs42l42_48k_pcm_analog_capture; -extern const struct snd_pci_quirk cs8409_fixup_tbl[]; +extern const struct hda_quirk cs8409_fixup_tbl[];extern const struct hda_model_fixup cs8409_models[];extern const struct hda_fixup cs8409_fixups[];extern const struct hda_verb cs8409_cs42l42_init_verbs[];
sound/pci/hda/patch_realtek.c +10 -10
@@ -1567,7 +1567,7 @@ static const struct hda_fixup alc880_fixups[] = { }, }; -static const struct snd_pci_quirk alc880_fixup_tbl[] = { +static const struct hda_quirk alc880_fixup_tbl[] = {SND_PCI_QUIRK (0x1019 ,0x0f69 ,"Coeus G610P" ,ALC880_FIXUP_W810 ),SND_PCI_QUIRK (0x1043 ,0x10c3 ,"ASUS W5A" ,ALC880_FIXUP_ASUS_W5A ),SND_PCI_QUIRK (0x1043 ,0x1964 ,"ASUS Z71V" ,ALC880_FIXUP_Z71V ),
@@ -1876,7 +1876,7 @@ static const struct hda_fixup alc260_fixups[] = { }, }; -static const struct snd_pci_quirk alc260_fixup_tbl[] = { +static const struct hda_quirk alc260_fixup_tbl[] = {SND_PCI_QUIRK (0x1025 ,0x007b ,"Acer C20x" ,ALC260_FIXUP_GPIO1 ),SND_PCI_QUIRK (0x1025 ,0x007f ,"Acer Aspire 9500" ,ALC260_FIXUP_COEF ),SND_PCI_QUIRK (0x1025 ,0x008f ,"Acer" ,ALC260_FIXUP_GPIO1 ),
@@ -2568,7 +2568,7 @@ static const struct hda_fixup alc882_fixups[] = { }, }; -static const struct snd_pci_quirk alc882_fixup_tbl[] = { +static const struct hda_quirk alc882_fixup_tbl[] = {SND_PCI_QUIRK (0x1025 ,0x006c ,"Acer Aspire 9810" ,ALC883_FIXUP_ACER_EAPD ),SND_PCI_QUIRK (0x1025 ,0x0090 ,"Acer Aspire" ,ALC883_FIXUP_ACER_EAPD ),SND_PCI_QUIRK (0x1025 ,0x0107 ,"Acer Aspire" ,ALC883_FIXUP_ACER_EAPD ),
@@ -2912,7 +2912,7 @@ static const struct hda_fixup alc262_fixups[] = { }, }; -static const struct snd_pci_quirk alc262_fixup_tbl[] = { +static const struct hda_quirk alc262_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x170b ,"HP Z200" ,ALC262_FIXUP_HP_Z200 ),SND_PCI_QUIRK (0x10cf ,0x1397 ,"Fujitsu Lifebook S7110" ,ALC262_FIXUP_FSC_S7110 ),SND_PCI_QUIRK (0x10cf ,0x142d ,"Fujitsu Lifebook E8410" ,ALC262_FIXUP_BENQ ),
@@ -3073,7 +3073,7 @@ static const struct hda_model_fixup alc268_fixup_models[] = { {} }; -static const struct snd_pci_quirk alc268_fixup_tbl[] = { +static const struct hda_quirk alc268_fixup_tbl[] = {SND_PCI_QUIRK (0x1025 ,0x0139 ,"Acer TravelMate 6293" ,ALC268_FIXUP_SPDIF ),SND_PCI_QUIRK (0x1025 ,0x015b ,"Acer AOA 150 (ZG5)" ,ALC268_FIXUP_INV_DMIC ),/* below is codec SSID since multiple Toshiba laptops have the
@@ -10169,7 +10169,7 @@ static const struct hda_fixup alc269_fixups[] = { }, }; -static const struct snd_pci_quirk alc269_fixup_tbl[] = { +static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1025 ,0x0283 ,"Acer TravelMate 8371" ,ALC269_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x029b ,"Acer 1810TZ" ,ALC269_FIXUP_INV_DMIC ),SND_PCI_QUIRK (0x1025 ,0x0349 ,"Acer AOD260" ,ALC269_FIXUP_INV_DMIC ),
@@ -11104,7 +11104,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { {} }; -static const struct snd_pci_quirk alc269_fixup_vendor_tbl[] = { +static const struct hda_quirk alc269_fixup_vendor_tbl[] = {SND_PCI_QUIRK_VENDOR (0x1025 ,"Acer Aspire" ,ALC271_FIXUP_DMIC ),SND_PCI_QUIRK_VENDOR (0x103c ,"HP" ,ALC269_FIXUP_HP_MUTE_LED ),SND_PCI_QUIRK_VENDOR (0x104d ,"Sony VAIO" ,ALC269_FIXUP_SONY_VAIO ),
@@ -12040,7 +12040,7 @@ static const struct hda_fixup alc861_fixups[] = { } }; -static const struct snd_pci_quirk alc861_fixup_tbl[] = { +static const struct hda_quirk alc861_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1253 ,"ASUS W7J" ,ALC660_FIXUP_ASUS_W7J ),SND_PCI_QUIRK (0x1043 ,0x1263 ,"ASUS Z35HL" ,ALC660_FIXUP_ASUS_W7J ),SND_PCI_QUIRK (0x1043 ,0x1393 ,"ASUS A6Rp" ,ALC861_FIXUP_ASUS_A6RP ),
@@ -12144,7 +12144,7 @@ static const struct hda_fixup alc861vd_fixups[] = { }, }; -static const struct snd_pci_quirk alc861vd_fixup_tbl[] = { +static const struct hda_quirk alc861vd_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x30bf ,"HP TX1000" ,ALC861VD_FIX_DALLAS ),SND_PCI_QUIRK (0x1043 ,0x1339 ,"ASUS A7-K" ,ALC660VD_FIX_ASUS_GPIO1 ),SND_PCI_QUIRK (0x1179 ,0xff31 ,"Toshiba L30-149" ,ALC861VD_FIX_DALLAS ),
@@ -12945,7 +12945,7 @@ static const struct hda_fixup alc662_fixups[] = { }, }; -static const struct snd_pci_quirk alc662_fixup_tbl[] = { +static const struct hda_quirk alc662_fixup_tbl[] = {SND_PCI_QUIRK (0x1019 ,0x9087 ,"ECS" ,ALC662_FIXUP_ASUS_MODE2 ),SND_PCI_QUIRK (0x1019 ,0x9859 ,"JP-IK LEAP W502" ,ALC897_FIXUP_HEADSET_MIC_PIN3 ),SND_PCI_QUIRK (0x1025 ,0x022f ,"Acer Aspire One" ,ALC662_FIXUP_INV_DMIC ),
sound/pci/hda/patch_sigmatel.c +11 -11
@@ -1462,7 +1462,7 @@ static const struct hda_model_fixup stac9200_models[] = { {} }; -static const struct snd_pci_quirk stac9200_fixup_tbl[] = { +static const struct hda_quirk stac9200_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_REF ),
@@ -1683,7 +1683,7 @@ static const struct hda_model_fixup stac925x_models[] = { {} }; -static const struct snd_pci_quirk stac925x_fixup_tbl[] = { +static const struct hda_quirk stac925x_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_REF ),SND_PCI_QUIRK (PCI_VENDOR_ID_DFI ,0x3101 ,"DFI LanParty" ,STAC_REF ),
@@ -1957,7 +1957,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = { {} }; -static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = { +static const struct hda_quirk stac92hd73xx_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_92HD73XX_REF ),
@@ -2753,7 +2753,7 @@ static const struct hda_model_fixup stac92hd83xxx_models[] = { {} }; -static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = { +static const struct hda_quirk stac92hd83xxx_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_92HD83XXX_REF ),
@@ -3236,7 +3236,7 @@ static const struct hda_model_fixup stac92hd71bxx_models[] = { {} }; -static const struct snd_pci_quirk stac92hd71bxx_fixup_tbl[] = { +static const struct hda_quirk stac92hd71bxx_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_92HD71BXX_REF ),
@@ -3496,7 +3496,7 @@ static const struct hda_pintbl ecs202_pin_configs[] = { };/* codec SSIDs for Intel Mac sharing the same PCI SSID 8384:7680 */ -static const struct snd_pci_quirk stac922x_intel_mac_fixup_tbl[] = { +static const struct hda_quirk stac922x_intel_mac_fixup_tbl[] = {SND_PCI_QUIRK (0x0000 ,0x0100 ,"Mac Mini" ,STAC_INTEL_MAC_V3 ),SND_PCI_QUIRK (0x106b ,0x0800 ,"Mac" ,STAC_INTEL_MAC_V1 ),SND_PCI_QUIRK (0x106b ,0x0600 ,"Mac" ,STAC_INTEL_MAC_V2 ),
@@ -3640,7 +3640,7 @@ static const struct hda_model_fixup stac922x_models[] = { {} }; -static const struct snd_pci_quirk stac922x_fixup_tbl[] = { +static const struct hda_quirk stac922x_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_D945_REF ),
@@ -3968,7 +3968,7 @@ static const struct hda_model_fixup stac927x_models[] = { {} }; -static const struct snd_pci_quirk stac927x_fixup_tbl[] = { +static const struct hda_quirk stac927x_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_D965_REF ),
@@ -4178,7 +4178,7 @@ static const struct hda_model_fixup stac9205_models[] = { {} }; -static const struct snd_pci_quirk stac9205_fixup_tbl[] = { +static const struct hda_quirk stac9205_fixup_tbl[] = {/* SigmaTel reference board */ SND_PCI_QUIRK (PCI_VENDOR_ID_INTEL ,0x2668 ,"DFI LanParty" ,STAC_9205_REF ),
@@ -4255,7 +4255,7 @@ static const struct hda_fixup stac92hd95_fixups[] = { }, }; -static const struct snd_pci_quirk stac92hd95_fixup_tbl[] = { +static const struct hda_quirk stac92hd95_fixup_tbl[] = {SND_PCI_QUIRK (PCI_VENDOR_ID_HP ,0x1911 ,"HP Spectre 13" ,STAC_92HD95_HP_BASS ), {}/* terminator */ };
@@ -5002,7 +5002,7 @@ static const struct hda_fixup stac9872_fixups[] = { }, }; -static const struct snd_pci_quirk stac9872_fixup_tbl[] = { +static const struct hda_quirk stac9872_fixup_tbl[] = {SND_PCI_QUIRK_MASK (0x104d ,0xfff0 ,0x81e0 ,"Sony VAIO F/S" ,STAC_9872_VAIO ), {}/* terminator */
sound/pci/hda/patch_via.c +1 -1
@@ -1035,7 +1035,7 @@ static const struct hda_fixup via_fixups[] = { }, }; -static const struct snd_pci_quirk vt2002p_fixups[] = { +static const struct hda_quirk vt2002p_fixups[] = {SND_PCI_QUIRK (0x1043 ,0x13f7 ,"Asus B23E" ,VIA_FIXUP_POWER_SAVE ),SND_PCI_QUIRK (0x1043 ,0x1487 ,"Asus G75" ,VIA_FIXUP_ASUS_G75 ),SND_PCI_QUIRK (0x1043 ,0x8532 ,"Asus X202E" ,VIA_FIXUP_INTMIC_BOOST ),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 277/466 ALSA: hda/conexant: Use the new codec SSID matching
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1f55e3699fc9ced72400cdca39fe248bf2b288a2 ]
Now we can perform the codec ID matching primarily, and reduce the conditional application of the quirk for conflicting PCI SSID between System76 and Tuxedo devices.
--- sound/pci/hda/patch_conexant.c | 28 +++++++--------------------- 1 file changed, 7 insertions(+), 21 deletions(-)
sound/pci/hda/patch_conexant.c +7 -21
@@ -828,23 +828,6 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {} }; -/* pincfg quirk for Tuxedo Sirius; -* unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14, -* which has incompatible pin setup, so we check the codec SSID (luckily -* different one!) and conditionally apply the quirk here -*/ -static void cxt_fixup_sirius_top_speaker (struct hda_codec *codec, -const struct hda_fixup *fix, -int action) -{ -/* ignore for incorrectly picked-up pang14 */ -if (codec->core.subsystem_id ==0x278212b3 ) -return ; -/* set up the top speaker pin */ -if (action ==HDA_FIXUP_ACT_PRE_PROBE ) -snd_hda_codec_set_pincfg (codec,0x1d ,0x82170111 ); -} -static const struct hda_fixup cxt_fixups[] = { [CXT_PINCFG_LENOVO_X200 ] = { .type =HDA_FIXUP_PINS ,
@@ -1009,8 +992,11 @@ static const struct hda_fixup cxt_fixups[] = { .v.pins = cxt_pincfg_sws_js201d, }, [CXT_PINCFG_TOP_SPEAKER] = { - .type = HDA_FIXUP_FUNC, - .v.func = cxt_fixup_sirius_top_speaker, + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x1d ,0x82170111 }, + { } + }, }, };
@@ -1109,8 +1095,8 @@ static const struct hda_quirk cxt5066_fixups[] = {SND_PCI_QUIRK_VENDOR (0x17aa ,"Thinkpad" ,CXT_FIXUP_THINKPAD_ACPI ),SND_PCI_QUIRK (0x1c06 ,0x2011 ,"Lemote A1004" ,CXT_PINCFG_LEMOTE_A1004 ),SND_PCI_QUIRK (0x1c06 ,0x2012 ,"Lemote A1205" ,CXT_PINCFG_LEMOTE_A1205 ), -SND_PCI_QUIRK (0x2782 ,0x12c3 ,"Sirius Gen1" ,CXT_PINCFG_TOP_SPEAKER ), - SND_PCI_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER), +HDA_CODEC_QUIRK (0x2782 ,0x12c3 ,"Sirius Gen1" ,CXT_PINCFG_TOP_SPEAKER ), + HDA_CODEC_QUIRK(0x2782, 0x12c5, "Sirius Gen2", CXT_PINCFG_TOP_SPEAKER), {} };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 278/466 ALSA: hda/realtek: Use codec SSID matching for Lenovo devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 504f052aa3435ab2f15af8b20bc4f4de8ff259c7 ]
Now we can perform the codec ID matching primarily, and reduce the conditional application of the quirk for conflicting PCI SSIDs in various Lenovo devices.
Here, HDA_CODEC_QUIRK() is applied at first so that the device with the codec SSID matching is picked up, followed by SND_PCI_QUIRK() for PCI SSID matching with the same ID number.
--- sound/pci/hda/patch_realtek.c | 98 +++-------------------------------- 1 file changed, 8 insertions(+), 90 deletions(-)
sound/pci/hda/patch_realtek.c +8 -90
@@ -7726,8 +7726,6 @@ enum {ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ,ALC298_FIXUP_LENOVO_C940_DUET7 , -ALC287_FIXUP_LENOVO_14IRP8_DUETITL , -ALC287_FIXUP_LENOVO_LEGION_7 ,ALC287_FIXUP_13S_GEN2_SPEAKERS ,ALC256_FIXUP_SET_COEF_DEFAULTS , ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE,
@@ -7772,8 +7770,6 @@ enum {ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1 ,ALC287_FIXUP_LENOVO_THKPAD_WH_ALC1318 ,ALC256_FIXUP_CHROME_BOOK , -ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7 , -ALC287_FIXUP_LENOVO_SSID_17AA3820 ,ALC245_FIXUP_CLEVO_NOISY_MIC ,ALC269_FIXUP_VAIO_VJFH52_MIC_NO_PRESENCE , ALC233_FIXUP_MEDION_MTL_SPK,
@@ -7796,72 +7792,6 @@ static void alc298_fixup_lenovo_c940_duet7(struct hda_codec *codec,__snd_hda_apply_fixup (codec, id, action,0 ); } -/* A special fixup for Lenovo Slim/Yoga Pro 9 14IRP8 and Yoga DuetITL 2021; -* 14IRP8 PCI SSID will mistakenly be matched with the DuetITL codec SSID, -* so we need to apply a different fixup in this case. The only DuetITL codec -* SSID reported so far is the 17aa:3802 while the 14IRP8 has the 17aa:38be -* and 17aa:38bf. If it weren't for the PCI SSID, the 14IRP8 models would -* have matched correctly by their codecs. -*/ -static void alc287_fixup_lenovo_14irp8_duetitl (struct hda_codec *codec, -const struct hda_fixup *fix, -int action) -{ -int id; - -if (codec->core.subsystem_id ==0x17aa3802 ) - id =ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ;/* DuetITL */ -else - id =ALC287_FIXUP_TAS2781_I2C ;/* 14IRP8 */ -__snd_hda_apply_fixup (codec, id, action,0 ); -} - -/* Similar to above the Lenovo Yoga Pro 7 14ARP8 PCI SSID matches the codec SSID of the -Legion Y9000X 2022 IAH7.*/ -static void alc287_fixup_lenovo_14arp8_legion_iah7 (struct hda_codec *codec, -const struct hda_fixup *fix, -int action) -{ -int id; - -if (codec->core.subsystem_id ==0x17aa386e ) - id =ALC287_FIXUP_CS35L41_I2C_2 ;/* Legion Y9000X 2022 IAH7 */ -else - id =ALC285_FIXUP_SPEAKER2_TO_DAC1 ;/* Yoga Pro 7 14ARP8 */ -__snd_hda_apply_fixup (codec, id, action,0 ); -} - -/* Another hilarious PCI SSID conflict with Lenovo Legion Pro 7 16ARX8H (with -* TAS2781 codec) and Legion 7i 16IAX7 (with CS35L41 codec); -* we apply a corresponding fixup depending on the codec SSID instead -*/ -static void alc287_fixup_lenovo_legion_7 (struct hda_codec *codec, -const struct hda_fixup *fix, -int action) -{ -int id; - -if (codec->core.subsystem_id ==0x17aa38a8 ) - id =ALC287_FIXUP_TAS2781_I2C ;/* Legion Pro 7 16ARX8H */ -else - id =ALC287_FIXUP_CS35L41_I2C_2 ;/* Legion 7i 16IAX7 */ -__snd_hda_apply_fixup (codec, id, action,0 ); -} - -/* Yet more conflicting PCI SSID (17aa:3820) on two Lenovo models */ -static void alc287_fixup_lenovo_ssid_17aa3820 (struct hda_codec *codec, -const struct hda_fixup *fix, -int action) -{ -int id; - -if (codec->core.subsystem_id ==0x17aa3820 ) - id =ALC269_FIXUP_ASPIRE_HEADSET_MIC ;/* IdeaPad 330-17IKB 81DM */ -else /* 0x17aa3802 */ - id =ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ;/* "Yoga Duet 7 13ITL6 */ -__snd_hda_apply_fixup (codec, id, action,0 ); -} -static const struct hda_fixup alc269_fixups[] = { [ALC269_FIXUP_GPIO2 ] = { .type =HDA_FIXUP_FUNC ,
@@ -9810,14 +9740,6 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc298_fixup_lenovo_c940_duet7, }, - [ALC287_FIXUP_LENOVO_14IRP8_DUETITL] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc287_fixup_lenovo_14irp8_duetitl, - }, - [ALC287_FIXUP_LENOVO_LEGION_7] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc287_fixup_lenovo_legion_7, - }, [ALC287_FIXUP_13S_GEN2_SPEAKERS] = { .type = HDA_FIXUP_VERBS, .v.verbs = (const struct hda_verb[]) {
@@ -10002,10 +9924,6 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id = ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK, }, - [ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc287_fixup_lenovo_14arp8_legion_iah7, - }, [ALC287_FIXUP_YOGA9_14IMH9_BASS_SPK_PIN] = { .type = HDA_FIXUP_FUNC, .v.func = alc287_fixup_yoga9_14iap7_bass_spk_pin,
@@ -10140,10 +10058,6 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC225_FIXUP_HEADSET_JACK }, - [ALC287_FIXUP_LENOVO_SSID_17AA3820] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc287_fixup_lenovo_ssid_17aa3820, - }, [ALC245_FIXUP_CLEVO_NOISY_MIC] = { .type = HDA_FIXUP_FUNC, .v.func = alc269_fixup_limit_int_mic_boost,
@@ -10911,11 +10825,13 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x31af ,"ThinkCentre Station" ,ALC623_FIXUP_LENOVO_THINKSTATION_P340 ),SND_PCI_QUIRK (0x17aa ,0x334b ,"Lenovo ThinkCentre M70 Gen5" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x17aa ,0x3801 ,"Lenovo Yoga9 14IAP7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ), -SND_PCI_QUIRK (0x17aa ,0x3802 ,"Lenovo Yoga Pro 9 14IRP8 / DuetITL 2021" ,ALC287_FIXUP_LENOVO_14IRP8_DUETITL ), +HDA_CODEC_QUIRK (0x17aa ,0x3802 ,"DuetITL 2021" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3802 ,"Lenovo Yoga Pro 9 14IRP8" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x17aa ,0x3813 ,"Legion 7i 15IMHG05" ,ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940 / Yoga Duet 7" ,ALC298_FIXUP_LENOVO_C940_DUET7 ),SND_PCI_QUIRK (0x17aa ,0x3819 ,"Lenovo 13s Gen2 ITL" ,ALC287_FIXUP_13S_GEN2_SPEAKERS ), -SND_PCI_QUIRK (0x17aa ,0x3820 ,"IdeaPad 330 / Yoga Duet 7" ,ALC287_FIXUP_LENOVO_SSID_17AA3820 ), +HDA_CODEC_QUIRK (0x17aa ,0x3820 ,"IdeaPad 330-17IKB 81DM" ,ALC269_FIXUP_ASPIRE_HEADSET_MIC ), +SND_PCI_QUIRK (0x17aa ,0x3820 ,"Yoga Duet 7 13ITL6" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3824 ,"Legion Y9000X 2020" ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ), SND_PCI_QUIRK(0x17aa, 0x3834, "Lenovo IdeaPad Slim 9i 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
@@ -10929,8 +10845,10 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x17aa ,0x3865 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3866 ,"Lenovo 13X" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3869 ,"Lenovo Yoga7 14IAL7" ,ALC287_FIXUP_YOGA9_14IAP7_BASS_SPK_PIN ), -SND_PCI_QUIRK (0x17aa ,0x386e ,"Legion Y9000X 2022 IAH7 / Yoga Pro 7 14ARP8" ,ALC287_FIXUP_LENOVO_14ARP8_LEGION_IAH7 ), -SND_PCI_QUIRK (0x17aa ,0x386f ,"Legion Pro 7/7i" ,ALC287_FIXUP_LENOVO_LEGION_7 ), +HDA_CODEC_QUIRK (0x17aa ,0x386e ,"Legion Y9000X 2022 IAH7" ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x17aa ,0x386e ,"Yoga Pro 7 14ARP8" ,ALC285_FIXUP_SPEAKER2_TO_DAC1 ), +HDA_CODEC_QUIRK (0x17aa ,0x386f ,"Legion Pro 7 16ARX8H" ,ALC287_FIXUP_TAS2781_I2C ), +SND_PCI_QUIRK (0x17aa ,0x386f ,"Legion Pro 7i 16IAX7" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x17aa ,0x3870 ,"Lenovo Yoga 7 14ARB7" ,ALC287_FIXUP_YOGA7_14ARB7_I2C ),SND_PCI_QUIRK (0x17aa ,0x3877 ,"Lenovo Legion 7 Slim 16ARHA7" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x17aa, 0x3878, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 279/466 r8169: dont apply UDP padding quirk on RTL8126A
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <[email protected]>
[ Upstream commit 87e26448dbda4523b73a894d96f0f788506d3795 ]
Vendor drivers r8125/r8126 indicate that this quirk isn't needed any longer for RTL8126A. Mimic this in r8169.
--- drivers/net/ethernet/realtek/r8169_main.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +10 -4
@@ -4233,8 +4233,8 @@ static unsigned int rtl8125_quirk_udp_padto(struct rtl8169_private *tp, {unsigned int padto =0 , len = skb->len; -if (rtl_is_8125 (tp) && len <128 +RTL_MIN_PATCH_LEN && -rtl_skb_is_udp (skb) &&skb_transport_header_was_set (skb)) { +if (len <128 +RTL_MIN_PATCH_LEN &&rtl_skb_is_udp (skb) && +skb_transport_header_was_set (skb)) {unsigned int trans_data_len =skb_tail_pointer (skb) -skb_transport_header (skb);
@@ -4258,9 +4258,15 @@ static unsigned int rtl8125_quirk_udp_padto(struct rtl8169_private *tp,static unsigned int rtl_quirk_packet_padto (struct rtl8169_private *tp,struct sk_buff *skb) { -unsigned int padto; +unsigned int padto =0 ; - padto =rtl8125_quirk_udp_padto (tp, skb); +switch (tp->mac_version) { + case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_63: + padto =rtl8125_quirk_udp_padto (tp, skb); +break ; +default : +break ; + }switch (tp->mac_version) {case RTL_GIGA_MAC_VER_34 :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 280/466 samples/bpf: Fix a resource leak
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Jun <[email protected]>
[ Upstream commit f3ef53174b23246fe9bc2bbc2542f3a3856fa1e2 ]
The opened file should be closed in show_sockopts(), otherwise resource leak will occur that this problem was discovered by reading code
--- samples/bpf/test_cgrp2_sock.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
samples/bpf/test_cgrp2_sock.c +3 -1
@@ -178,8 +178,10 @@ static int show_sockopts(int family)return 1 ; } -if (get_bind_to_device (sd, name,sizeof (name)) <0 ) +if (get_bind_to_device (sd, name,sizeof (name)) <0 ) { +close (sd);return 1 ; + } mark =get_somark (sd); prio =get_priority (sd);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 281/466 wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalle Valo <[email protected]>
[ Upstream commit 8fac3266c68a8e647240b8ac8d0b82f1821edf85 ]
When I try to manually set bitrates:
iw wlan0 set bitrates legacy-2.4 1
I get sleeping from invalid context error, see below. Fix that by switching to use recently introduced ieee80211_iterate_stations_mtx().
Do note that WCN6855 firmware is still crashing, I'm not sure if that firmware even supports bitrate WMI commands and should we consider disabling ath12k_mac_op_set_bitrate_mask() for WCN6855? But that's for another patch.
BUG: sleeping function called from invalid context at drivers/net/wireless/ath/ath12k/wmi.c:420
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 2236, name: iwpreempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
3 locks held by iw/2236:
#0: ffffffffabc6f1d8 (cb_lock){++++}-{3:3}, at: genl_rcv+0x14/0x40
#1: ffff888138410810 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_pre_doit+0x54d/0x800 [cfg80211] #2: ffffffffab2cfaa0 (rcu_read_lock){....}-{1:2}, at: ieee80211_iterate_stations_atomic+0x2f/0x200 [mac80211]
CPU: 3 UID: 0 PID: 2236 Comm: iw Not tainted 6.11.0-rc7-wt-ath+ #1772 Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 Call Trace: <TASK> dump_stack_lvl+0xa4/0xe0 dump_stack+0x10/0x20 __might_resched+0x363/0x5a0 ? __alloc_skb+0x165/0x340 __might_sleep+0xad/0x160 ath12k_wmi_cmd_send+0xb1/0x3d0 [ath12k] ? ath12k_wmi_init_wcn7850+0xa40/0xa40 [ath12k] ? __netdev_alloc_skb+0x45/0x7b0 ? __asan_memset+0x39/0x40 ? ath12k_wmi_alloc_skb+0xf0/0x150 [ath12k] ? reacquire_held_locks+0x4d0/0x4d0 ath12k_wmi_set_peer_param+0x340/0x5b0 [ath12k] ath12k_mac_disable_peer_fixed_rate+0xa3/0x110 [ath12k] ? ath12k_mac_vdev_stop+0x4f0/0x4f0 [ath12k] ieee80211_iterate_stations_atomic+0xd4/0x200 [mac80211] ath12k_mac_op_set_bitrate_mask+0x5d2/0x1080 [ath12k] ? ath12k_mac_vif_chan+0x320/0x320 [ath12k] drv_set_bitrate_mask+0x267/0x470 [mac80211] ieee80211_set_bitrate_mask+0x4cc/0x8a0 [mac80211] ? __this_cpu_preempt_check+0x13/0x20 nl80211_set_tx_bitrate_mask+0x2bc/0x530 [cfg80211] ? nl80211_parse_tx_bitrate_mask+0x2320/0x2320 [cfg80211] ? trace_contention_end+0xef/0x140 ? rtnl_unlock+0x9/0x10 ? nl80211_pre_doit+0x557/0x800 [cfg80211] genl_family_rcv_msg_doit+0x1f0/0x2e0 ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 ? ns_capable+0x57/0xd0 genl_family_rcv_msg+0x34c/0x600 ? genl_family_rcv_msg_dumpit+0x310/0x310 ? __lock_acquire+0xc62/0x1de0 ? he_set_mcs_mask.isra.0+0x8d0/0x8d0 [cfg80211] ? nl80211_parse_tx_bitrate_mask+0x2320/0x2320 [cfg80211] ? cfg80211_external_auth_request+0x690/0x690 [cfg80211] genl_rcv_msg+0xa0/0x130 netlink_rcv_skb+0x14c/0x400 ? genl_family_rcv_msg+0x600/0x600 ? netlink_ack+0xd70/0xd70 ? rwsem_optimistic_spin+0x4f0/0x4f0 ? genl_rcv+0x14/0x40 ? down_read_killable+0x580/0x580 ? netlink_deliver_tap+0x13e/0x350 ? __this_cpu_preempt_check+0x13/0x20 genl_rcv+0x23/0x40 netlink_unicast+0x45e/0x790 ? netlink_attachskb+0x7f0/0x7f0 netlink_sendmsg+0x7eb/0xdb0 ? netlink_unicast+0x790/0x790 ? __this_cpu_preempt_check+0x13/0x20 ? selinux_socket_sendmsg+0x31/0x40 ? netlink_unicast+0x790/0x790 __sock_sendmsg+0xc9/0x160 ____sys_sendmsg+0x620/0x990 ? kernel_sendmsg+0x30/0x30 ? __copy_msghdr+0x410/0x410 ? __kasan_check_read+0x11/0x20 ? mark_lock+0xe6/0x1470 ___sys_sendmsg+0xe9/0x170 ? copy_msghdr_from_user+0x120/0x120 ? __lock_acquire+0xc62/0x1de0 ? do_fault_around+0x2c6/0x4e0 ? do_user_addr_fault+0x8c1/0xde0 ? reacquire_held_locks+0x220/0x4d0 ? do_user_addr_fault+0x8c1/0xde0 ? __kasan_check_read+0x11/0x20 ? __fdget+0x4e/0x1d0 ? sockfd_lookup_light+0x1a/0x170 __sys_sendmsg+0xd2/0x180 ? __sys_sendmsg_sock+0x20/0x20 ? reacquire_held_locks+0x4d0/0x4d0 ? debug_smp_processor_id+0x17/0x20 __x64_sys_sendmsg+0x72/0xb0 ? lockdep_hardirqs_on+0x7d/0x100 x64_sys_call+0x894/0x9f0 do_syscall_64+0x64/0x130 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f230fe04807 Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RSP: 002b:00007ffe996a7ea8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000556f9f9c3390 RCX: 00007f230fe04807 RDX: 0000000000000000 RSI: 00007ffe996a7ee0 RDI: 0000000000000003 RBP: 0000556f9f9c88c0 R08: 0000000000000002 R09: 0000000000000000 R10: 0000556f965ca190 R11: 0000000000000246 R12: 0000556f9f9c8780 R13: 00007ffe996a7ee0 R14: 0000556f9f9c87d0 R15: 0000556f9f9c88c0 </TASK>
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3
--- drivers/net/wireless/ath/ath12k/mac.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +9 -9
@@ -8186,9 +8186,9 @@ ath12k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw, arvif->vdev_id, ret); goto out; } -ieee80211_iterate_stations_atomic (hw, - ath12k_mac_disable_peer_fixed_rate, - arvif); +ieee80211_iterate_stations_mtx (hw, + ath12k_mac_disable_peer_fixed_rate, + arvif); }else if (ath12k_mac_bitrate_mask_get_single_nss (ar, band, mask, &single_nss)) { rate =WMI_FIXED_RATE_NONE ;
@@ -8233,16 +8233,16 @@ ath12k_mac_op_set_bitrate_mask(struct ieee80211_hw *hw, goto out; } -ieee80211_iterate_stations_atomic (hw, - ath12k_mac_disable_peer_fixed_rate, - arvif); +ieee80211_iterate_stations_mtx (hw, + ath12k_mac_disable_peer_fixed_rate, + arvif);mutex_lock (&ar->conf_mutex); arvif->bitrate_mask = *mask; -ieee80211_iterate_stations_atomic (hw, - ath12k_mac_set_bitrate_mask_iter, - arvif); +ieee80211_iterate_stations_mtx (hw, + ath12k_mac_set_bitrate_mask_iter, + arvif);mutex_unlock (&ar->conf_mutex); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 282/466 accel/qaic: Add AIC080 support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffrey Hugo <[email protected]>
[ Upstream commit b8128f7815ff135f0333c1b46dcdf1543c41b860 ]
Add basic support for the new AIC080 product. The PCIe Device ID is 0xa080. AIC080 is a lower cost, lower performance SKU variant of AIC100.
Quoted 1 line
From the qaic perspective, it is the same as AIC100.
--- Documentation/accel/qaic/aic080.rst | 14 ++++++++++++++ Documentation/accel/qaic/index.rst | 1 + drivers/accel/qaic/qaic_drv.c | 4 +++- 3 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 Documentation/accel/qaic/aic080.rst
Documentation/accel/qaic/aic080.rst new file +14 -0
@@ -0,0 +1,14 @@ +.. SPDX-License-Identifier: GPL-2.0-only + +=============================== + Qualcomm Cloud AI 80 (AIC080) +=============================== + +Overview +======== + +The Qualcomm Cloud AI 80/AIC080 family of products are a derivative of AIC100. +The number of NSPs and clock rates are reduced to fit within resource +constrained solutions. The PCIe Product ID is 0xa080. + +As a derivative product, all AIC100 documentation applies.
Documentation/accel/qaic/index.rst +1 -0
@@ -10,4 +10,5 @@ accelerator cards. .. toctree:: qaic + aic080 aic100
drivers/accel/qaic/qaic_drv.c +3 -1
@@ -34,6 +34,7 @@MODULE_IMPORT_NS (DMA_BUF ); +#define PCI_DEV_AIC080 0xa080#define PCI_DEV_AIC100 0xa100#define QAIC_NAME "qaic"#define QAIC_DESC "Qualcomm Cloud AI Accelerators"
@@ -365,7 +366,7 @@ static struct qaic_device *create_qdev(struct pci_dev *pdev, const struct pci_dereturn NULL ; qdev->dev_state =QAIC_OFFLINE ; -if (id->device ==PCI_DEV_AIC100 ) { +if (id->device ==PCI_DEV_AIC080 || id->device ==PCI_DEV_AIC100 ) { qdev->num_dbc =16 ; qdev->dbc =devm_kcalloc (dev, qdev->num_dbc,sizeof (*qdev->dbc),GFP_KERNEL );if (!qdev->dbc)
@@ -607,6 +608,7 @@ static struct mhi_driver qaic_mhi_driver = { };static const struct pci_device_id qaic_ids[] = { + {PCI_DEVICE (PCI_VENDOR_ID_QCOM ,PCI_DEV_AIC080 ), }, {PCI_DEVICE (PCI_VENDOR_ID_QCOM ,PCI_DEV_AIC100 ), }, { } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 283/466 drm/amd/display: Full exit out of IPS2 when all allow signals have been cleared
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Chen <[email protected]>
[ Upstream commit 0fe33e115fec305c35c66b78ad26e3755ab54b9c ]
[Why]
A race condition occurs between cursor movement and vertical interrupt control thread from OS, with both threads trying to exit IPS2.
Vertical interrupt control thread clears the prev driver allow signal while not fully finishing the IPS2 exit process.
[How]
We want to detect all the allow signals have been cleared before we perform the full exit.
--- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 6 ++++-- drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h | 3 ++- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +4 -2
@@ -1294,6 +1294,8 @@ static void dc_dmub_srv_notify_idle(const struct dc *dc, bool allow_idle)memset (&new_signals,0 ,sizeof (new_signals)); + new_signals.bits.allow_idle =1 ;/* always set */ +if (dc->config.disable_ips ==DMUB_IPS_ENABLE || dc->config.disable_ips ==DMUB_IPS_DISABLE_DYNAMIC ) { new_signals.bits.allow_pg =1 ;
@@ -1389,7 +1391,7 @@ static void dc_dmub_srv_exit_low_power_state(const struct dc *dc)*/ dc_dmub_srv->needs_idle_wake = false; -if (prev_driver_signals.bits.allow_ips2 && +if ((prev_driver_signals.bits.allow_ips2 || prev_driver_signals.all ==0 ) && (!dc->debug.optimize_ips_handshake || ips_fw->signals.bits.ips2_commit || !ips_fw->signals.bits.in_idle)) { DC_LOG_IPS(
@@ -1450,7 +1452,7 @@ static void dc_dmub_srv_exit_low_power_state(const struct dc *dc) }dc_dmub_srv_notify_idle (dc, false); -if (prev_driver_signals.bits.allow_ips1) { +if (prev_driver_signals.bits.allow_ips1 || prev_driver_signals.all ==0 ) { DC_LOG_IPS( "wait for IPS1 commit clear (ips1_commit=%u ips2_commit=%u)", ips_fw->signals.bits.ips1_commit,
drivers/gpu/drm/amd/display/dmub/inc/dmub_cmd.h +2 -1
@@ -747,7 +747,8 @@ union dmub_shared_state_ips_driver_signals { uint32_t allow_ips1 : 1; /**< 1 is IPS1 is allowed */ uint32_t allow_ips2 : 1; /**< 1 is IPS1 is allowed */ uint32_t allow_z10 : 1; /**< 1 if Z10 is allowed */ - uint32_t reserved_bits : 28; /**< Reversed bits */ + uint32_t allow_idle : 1; /**< 1 if driver is allowing idle */ + uint32_t reserved_bits : 27; /**< Reversed bits */ } bits;uint32_t all; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 284/466 net: fec_mpc52xx_phy: Use %pa to format resource_size_t
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 020bfdc4ed94be472138c891bde4d14241cf00fd ]
The correct format string for resource_size_t is %pa which acts on the address of the variable to be formatted [1].
[1] https://elixir.bootlin.com/linux/v6.11.3/source/Documentation/core-api/printk-formats.rst#L229
Introduced by commit 9d9326d3bc0e ("phy: Change mii_bus id field to a string")
Flagged by gcc-14 as:
drivers/net/ethernet/freescale/fec_mpc52xx_phy.c: In function 'mpc52xx_fec_mdio_probe':drivers/net/ethernet/freescale/fec_mpc52xx_phy.c:97:46: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Wformat=]
97 | snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
| ~^ ~~~~~~~~~
| | |
| | resource_size_t {aka long long unsigned int}
| unsigned int
| %llxNo functional change intended.
Compile tested only.
--- drivers/net/ethernet/freescale/fec_mpc52xx_phy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/fec_mpc52xx_phy.c +1 -1
@@ -94,7 +94,7 @@ static int mpc52xx_fec_mdio_probe(struct platform_device *of) goto out_free; } -snprintf (bus->id,MII_BUS_ID_SIZE ,"%x" , res.start); +snprintf (bus->id,MII_BUS_ID_SIZE ,"%pa" , &res.start); bus->priv = priv; bus->parent = dev;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 285/466 net: ethernet: fs_enet: Use %pa to format resource_size_t
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit 45fe45fada261e1e83fce2a07fa22835aec1cf0a ]
The correct format string for resource_size_t is %pa which acts on the address of the variable to be formatted [1].
[1] https://elixir.bootlin.com/linux/v6.11.3/source/Documentation/core-api/printk-formats.rst#L229
Introduced by commit 9d9326d3bc0e ("phy: Change mii_bus id field to a string")
Flagged by gcc-14 as:
drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c: In function 'fs_mii_bitbang_init':drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c:126:46: warning: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Wformat=]
126 | snprintf(bus->id, MII_BUS_ID_SIZE, "%x", res.start);
| ~^ ~~~~~~~~~
| | |
| | resource_size_t {aka long long unsigned int}
| unsigned int
| %llxNo functional change intended.
Compile tested only.
--- drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/fs_enet/mii-bitbang.c +1 -1
@@ -123,7 +123,7 @@ static int fs_mii_bitbang_init(struct mii_bus *bus, struct device_node *np)* we get is an int, and the odds of multiple bitbang mdio buses * is low enough that it's not worth going too crazy. */ -snprintf (bus->id,MII_BUS_ID_SIZE ,"%x" , res.start); +snprintf (bus->id,MII_BUS_ID_SIZE ,"%pa" , &res.start); data =of_get_property (np,"fsl,mdio-pin" , &len);if (!data || len !=4 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 286/466 net/sched: cbs: Fix integer overflow in cbs_set_port_rate()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Elena Salomatkina <[email protected]>
[ Upstream commit 397006ba5d918f9b74e734867e8fddbc36dc2282 ]
The subsequent calculation of port_rate = speed * 1000 * BYTES_PER_KBIT, where the BYTES_PER_KBIT is of type LL, may cause an overflow. At least when speed = SPEED_20000, the expression to the left of port_rate will be greater than INT_MAX.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- net/sched/sch_cbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_cbs.c +1 -1
@@ -310,7 +310,7 @@ static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q) {struct ethtool_link_ksettings ecmd;int speed =SPEED_10 ; -int port_rate; +s64 port_rate;int err; err =__ethtool_get_link_ksettings (dev, &ecmd);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 287/466 af_packet: avoid erroring out after sock_init_data() in packet_create()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
[ Upstream commit 46f2a11cb82b657fd15bab1c47821b635e03838b ]
After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free.
--- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/packet/af_packet.c +6 -6
@@ -3421,17 +3421,17 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,if (sock->type ==SOCK_PACKET ) sock->ops = &packet_ops_spkt; + po =pkt_sk (sk); + err =packet_alloc_pending (po); +if (err) + goto out_sk_free; +sock_init_data (sock, sk); - po =pkt_sk (sk);init_completion (&po->skb_completion); sk->sk_family =PF_PACKET ; po->num = proto; - err =packet_alloc_pending (po); -if (err) - goto out2; -packet_cached_dev_reset (po); sk->sk_destruct = packet_sock_destruct;
@@ -3463,7 +3463,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,sock_prot_inuse_add (net, &packet_proto,1 );return 0 ; -out2: +out_sk_free:sk_free (sk); out:return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 288/466 Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
[ Upstream commit 7c4f78cdb8e7501e9f92d291a7d956591bf73be9 ]
bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_alloc() frees the sk object, but the dangling pointer is still attached to the sock object, which may create use-after-free in other code.
--- net/bluetooth/l2cap_sock.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/l2cap_sock.c +1 -0
@@ -1886,6 +1886,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan =l2cap_chan_create ();if (!chan) {sk_free (sk); + sock->sk =NULL ;return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 289/466 Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
[ Upstream commit 3945c799f12b8d1f49a3b48369ca494d981ac465 ]
bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release the sk object, but leave the dangling pointer in the sock object, which may cause use-after-free.
Fix this by swapping calls to bt_sock_alloc() and rfcomm_dlc_alloc().
--- net/bluetooth/rfcomm/sock.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/bluetooth/rfcomm/sock.c +5 -5
@@ -274,13 +274,13 @@ static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock,struct rfcomm_dlc *d;struct sock *sk; - sk =bt_sock_alloc (net, sock, &rfcomm_proto, proto, prio, kern); -if (!sk) + d =rfcomm_dlc_alloc (prio); +if (!d)return NULL ; - d =rfcomm_dlc_alloc (prio); -if (!d) { -sk_free (sk); + sk =bt_sock_alloc (net, sock, &rfcomm_proto, proto, prio, kern); +if (!sk) { +rfcomm_dlc_free (d);return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 290/466 net: af_can: do not leave a dangling sk pointer in can_create()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
[ Upstream commit 811a7ca7320c062e15d0f5b171fe6ad8592d1434 ]
On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later.
--- net/can/af_can.c | 1 + 1 file changed, 1 insertion(+)
net/can/af_can.c +1 -0
@@ -171,6 +171,7 @@ static int can_create(struct net *net, struct socket *sock, int protocol,/* release sk on errors */ sock_orphan (sk);sock_put (sk); + sock->sk =NULL ; } errout:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 291/466 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
[ Upstream commit b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d ]
sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, which may allow use-after-free.
Clear the sk pointer in the sock object on error.
--- net/ieee802154/socket.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/ieee802154/socket.c +7 -5
@@ -1043,19 +1043,21 @@ static int ieee802154_create(struct net *net, struct socket *sock,if (sk->sk_prot->hash) { rc = sk->sk_prot->hash (sk); -if (rc) { -sk_common_release (sk); - goto out; - } +if (rc) + goto out_sk_release; }if (sk->sk_prot->init) { rc = sk->sk_prot->init (sk);if (rc) -sk_common_release (sk); + goto out_sk_release; } out:return rc; +out_sk_release: +sk_common_release (sk); + sock->sk =NULL ; + goto out; }static const struct net_proto_family ieee802154_family_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 292/466 net: inet: do not leave a dangling sk pointer in inet_create()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
[ Upstream commit 9365fa510c6f82e3aa550a09d0c5c6b44dbc78ff ]
sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later.
Clear the sk pointer in the sock object on error.
--- net/ipv4/af_inet.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
net/ipv4/af_inet.c +10 -12
@@ -376,32 +376,30 @@ static int inet_create(struct net *net, struct socket *sock, int protocol, inet->inet_sport =htons (inet->inet_num);/* Add to protocol hash chains. */ err = sk->sk_prot->hash (sk); -if (err) { -sk_common_release (sk); - goto out; - } +if (err) + goto out_sk_release; }if (sk->sk_prot->init) { err = sk->sk_prot->init (sk); -if (err) { -sk_common_release (sk); - goto out; - } +if (err) + goto out_sk_release; }if (!kern) { err =BPF_CGROUP_RUN_PROG_INET_SOCK (sk); -if (err) { -sk_common_release (sk); - goto out; - } +if (err) + goto out_sk_release; } out:return err; out_rcu_unlock:rcu_read_unlock (); goto out; +out_sk_release: +sk_common_release (sk); + sock->sk =NULL ; + goto out; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 293/466 net: inet6: do not leave a dangling sk pointer in inet6_create()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <[email protected]>
[ Upstream commit 9df99c395d0f55fb444ef39f4d6f194ca437d884 ]
sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later.
Clear the sock sk pointer on error.
--- net/ipv6/af_inet6.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-)
net/ipv6/af_inet6.c +10 -12
@@ -252,31 +252,29 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,*/ inet->inet_sport =htons (inet->inet_num); err = sk->sk_prot->hash (sk); -if (err) { -sk_common_release (sk); - goto out; - } +if (err) + goto out_sk_release; }if (sk->sk_prot->init) { err = sk->sk_prot->init (sk); -if (err) { -sk_common_release (sk); - goto out; - } +if (err) + goto out_sk_release; }if (!kern) { err =BPF_CGROUP_RUN_PROG_INET_SOCK (sk); -if (err) { -sk_common_release (sk); - goto out; - } +if (err) + goto out_sk_release; } out:return err; out_rcu_unlock:rcu_read_unlock (); goto out; +out_sk_release: +sk_common_release (sk); + sock->sk =NULL ; + goto out; } static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 294/466 wifi: ath10k: avoid NULL pointer error during sdio remove
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kang Yang <[email protected]>
[ Upstream commit 95c38953cb1ecf40399a676a1f85dfe2b5780a9a ]
When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT_ON is set to yes, kernel panic will happen:
Call trace: destroy_workqueue+0x1c/0x258 ath10k_sdio_remove+0x84/0x94 sdio_bus_remove+0x50/0x16c device_release_driver_internal+0x188/0x25c device_driver_detach+0x20/0x2c
This is because during 'rmmod ath10k', ath10k_sdio_remove() will call ath10k_core_destroy() before destroy_workqueue(). wiphy_dev_release() will finally be called in ath10k_core_destroy(). This function will free struct cfg80211_registered_device *rdev and all its members, including wiphy, dev and the pointer of sdio workqueue. Then the pointer of sdio workqueue will be set to NULL due to CONFIG_INIT_ON_FREE_DEFAULT_ON.
After device release, destroy_workqueue() will use NULL pointer then the kernel panic happen.
Call trace:
ath10k_sdio_remove
->ath10k_core_unregister
……
->ath10k_core_stop
->ath10k_hif_stop
->ath10k_sdio_irq_disable
->ath10k_hif_power_down
->del_timer_sync(&ar_sdio->sleep_timer)
->ath10k_core_destroy
->ath10k_mac_destroy
->ieee80211_free_hw
->wiphy_free
……
->wiphy_dev_release->destroy_workqueue
Need to call destroy_workqueue() before ath10k_core_destroy(), free the work queue buffer first and then free pointer of work queue by ath10k_core_destroy(). This order matches the error path order in ath10k_sdio_probe().
No work will be queued on sdio workqueue between it is destroyed and ath10k_core_destroy() is called. Based on the call_stack above, the reason is:
Only ath10k_sdio_sleep_timer_handler(), ath10k_sdio_hif_tx_sg() and ath10k_sdio_irq_disable() will queue work on sdio workqueue. Sleep timer will be deleted before ath10k_core_destroy() in ath10k_hif_power_down().ath10k_sdio_irq_disable() only be called in ath10k_hif_stop(). ath10k_core_unregister() will call ath10k_hif_power_down() to stop hif bus, so ath10k_sdio_hif_tx_sg() won't be called anymore.
Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00189
--- drivers/net/wireless/ath/ath10k/sdio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath10k/sdio.c +3 -3
@@ -3,7 +3,7 @@* Copyright (c) 2004-2011 Atheros Communications Inc. * Copyright (c) 2011-2012,2017 Qualcomm Atheros, Inc. * Copyright (c) 2016-2017 Erik Stromdahl <[email protected]> -* Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved. +* Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved. */ #include <linux/module.h>
@@ -2648,9 +2648,9 @@ static void ath10k_sdio_remove(struct sdio_func *func)netif_napi_del (&ar->napi); -ath10k_core_destroy (ar); -destroy_workqueue (ar_sdio->workqueue); + +ath10k_core_destroy (ar); }static const struct sdio_device_id ath10k_sdio_devices[] = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 295/466 wifi: ath5k: add PCI ID for SX76X
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit da0474012402d4729b98799d71a54c35dc5c5de3 ]
This is in two devices made by Gigaset, SX762 and SX763.
--- drivers/net/wireless/ath/ath5k/pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath5k/pci.c +1 -0
@@ -46,6 +46,7 @@ static const struct pci_device_id ath5k_pci_id_table[] = { { PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */ { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */ { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */ + { PCI_VDEVICE(ATHEROS, 0xff16) }, /* Gigaset SX76[23] AR241[34]A */ { PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */ { 0 } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 296/466 wifi: ath5k: add PCI ID for Arcadyan devices
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <[email protected]>
[ Upstream commit f3ced9bb90b0a287a1fa6184d16b0f104a78fa90 ]
Arcadyan made routers with this PCI ID containing an AR2417.
--- drivers/net/wireless/ath/ath5k/pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath5k/pci.c +1 -0
@@ -47,6 +47,7 @@ static const struct pci_device_id ath5k_pci_id_table[] = { { PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */ { PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */ { PCI_VDEVICE(ATHEROS, 0xff16) }, /* Gigaset SX76[23] AR241[34]A */ + { PCI_VDEVICE(ATHEROS, 0xff1a) }, /* Arcadyan ARV45XX AR2417 */ { PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */ { 0 } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 297/466 fanotify: allow reporting errors on failure to open fd
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
[ Upstream commit 522249f05c5551aec9ec0ba9b6438f1ec19c138d ]
When working in "fd mode", fanotify_read() needs to open an fd from a dentry to report event->fd to userspace.
Opening an fd from dentry can fail for several reasons. For example, when tasks are gone and we try to open their /proc files or we try to open a WRONLY file like in sysfs or when trying to open a file that was deleted on the remote network server.
Add a new flag FAN_REPORT_FD_ERROR for fanotify_init(). For a group with FAN_REPORT_FD_ERROR, we will send the event with the error instead of the open fd, otherwise userspace may not get the error at all.
For an overflow event, we report -EBADF to avoid confusing FAN_NOFD with -EPERM. Similarly for pidfd open errors we report either -ESRCH or the open error instead of FAN_NOPIDFD and FAN_EPIDFD.
In any case, userspace will not know which file failed to open, so add a debug print for further investigation.
--- fs/notify/fanotify/fanotify_user.c | 85 +++++++++++++++++------------- include/linux/fanotify.h | 1 + include/uapi/linux/fanotify.h | 1 + 3 files changed, 50 insertions(+), 37 deletions(-)
fs/notify/fanotify/fanotify_user.c +48 -37
@@ -266,13 +266,6 @@ static int create_fd(struct fsnotify_group *group, const struct path *path, group->fanotify_data.f_flags | __FMODE_NONOTIFY, current_cred());if (IS_ERR (new_file)) { -/* -* we still send an event even if we can't open the file. this -* can happen when say tasks are gone and we try to open their -* /proc files or we try to open a WRONLY file like in sysfs -* we just send the errno to userspace since there isn't much -* else we can do. -*/ put_unused_fd (client_fd); client_fd =PTR_ERR (new_file); }else {
@@ -663,7 +656,7 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,unsigned int info_mode =FAN_GROUP_FLAG (group,FANOTIFY_INFO_MODES );unsigned int pidfd_mode = info_mode &FAN_REPORT_PIDFD ;struct file *f =NULL , *pidfd_file =NULL ; -int ret, pidfd =FAN_NOPIDFD , fd =FAN_NOFD ; +int ret, pidfd = -ESRCH , fd = -EBADF ;pr_debug ("%s: group=%p event=%p\n" , __func__, group, event);
@@ -691,10 +684,39 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,if (!FAN_GROUP_FLAG (group,FANOTIFY_UNPRIV ) && path && path->mnt && path->dentry) { fd =create_fd (group, path, &f); -if (fd <0 ) -return fd; +/* +* Opening an fd from dentry can fail for several reasons. +* For example, when tasks are gone and we try to open their +* /proc files or we try to open a WRONLY file like in sysfs +* or when trying to open a file that was deleted on the +* remote network server. +* +* For a group with FAN_REPORT_FD_ERROR, we will send the +* event with the error instead of the open fd, otherwise +* Userspace may not get the error at all. +* In any case, userspace will not know which file failed to +* open, so add a debug print for further investigation. +*/ +if (fd <0 ) { +pr_debug ("fanotify: create_fd(%pd2) failed err=%d\n" , + path->dentry, fd); +if (!FAN_GROUP_FLAG (group,FAN_REPORT_FD_ERROR )) { +/* +* Historically, we've handled EOPENSTALE in a +* special way and silently dropped such +* events. Now we have to keep it to maintain +* backward compatibility... +*/ +if (fd == -EOPENSTALE ) + fd =0 ; +return fd; + } + } } - metadata.fd = fd; +if (FAN_GROUP_FLAG (group,FAN_REPORT_FD_ERROR )) + metadata.fd = fd; +else + metadata.fd = fd >=0 ? fd :FAN_NOFD ;if (pidfd_mode) {/*
@@ -709,18 +731,16 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,* The PIDTYPE_TGID check for an event->pid is performed * preemptively in an attempt to catch out cases where the event * listener reads events after the event generating process has -* already terminated. Report FAN_NOPIDFD to the event listener -* in those cases, with all other pidfd creation errors being -* reported as FAN_EPIDFD. +* already terminated. Depending on flag FAN_REPORT_FD_ERROR, +* report either -ESRCH or FAN_NOPIDFD to the event listener in +* those cases with all other pidfd creation errors reported as +* the error code itself or as FAN_EPIDFD. */ -if (metadata.pid ==0 || - !pid_has_task (event->pid,PIDTYPE_TGID )) { - pidfd =FAN_NOPIDFD ; - }else { +if (metadata.pid &&pid_has_task (event->pid,PIDTYPE_TGID )) pidfd =pidfd_prepare (event->pid,0 , &pidfd_file); -if (pidfd <0 ) - pidfd =FAN_EPIDFD ; - } + +if (!FAN_GROUP_FLAG (group,FAN_REPORT_FD_ERROR ) && pidfd <0 ) + pidfd = pidfd == -ESRCH ?FAN_NOPIDFD :FAN_EPIDFD ; } ret = -EFAULT ;
@@ -737,9 +757,6 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, buf +=FAN_EVENT_METADATA_LEN ; count -=FAN_EVENT_METADATA_LEN ; -if (fanotify_is_perm_event (event->mask)) -FANOTIFY_PERM (event)->fd = fd; -if (info_mode) { ret =copy_info_records_to_user (event, info, info_mode, pidfd, buf, count);
@@ -753,15 +770,18 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,if (pidfd_file)fd_install (pidfd, pidfd_file); +if (fanotify_is_perm_event (event->mask)) +FANOTIFY_PERM (event)->fd = fd; +return metadata.event_len; out_close_fd: -if (fd !=FAN_NOFD ) { +if (f) {put_unused_fd (fd);fput (f); } -if (pidfd >=0 ) { +if (pidfd_file) {put_unused_fd (pidfd);fput (pidfd_file); }
@@ -828,15 +848,6 @@ static ssize_t fanotify_read(struct file *file, char __user *buf, } ret =copy_event_to_user (group, event, buf, count); -if (unlikely (ret == -EOPENSTALE )) { -/* -* We cannot report events with stale fd so drop it. -* Setting ret to 0 will continue the event loop and -* do the right thing if there are no more events to -* read (i.e. return bytes read, -EAGAIN or wait). -*/ - ret =0 ; - }/* * Permission events get queued to wait for response. Other
@@ -845,7 +856,7 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,if (!fanotify_is_perm_event (event->mask)) {fsnotify_destroy_event (group, &event->fse); }else { -if (ret <=0 ) { +if (ret <=0 ||FANOTIFY_PERM (event)->fd <0 ) {spin_lock (&group->notification_lock);finish_permission_event (group,FANOTIFY_PERM (event),FAN_DENY ,NULL );
@@ -1954,7 +1965,7 @@ static int __init fanotify_user_setup(void) FANOTIFY_DEFAULT_MAX_USER_MARKS);BUILD_BUG_ON (FANOTIFY_INIT_FLAGS &FANOTIFY_INTERNAL_GROUP_FLAGS ); -BUILD_BUG_ON (HWEIGHT32 (FANOTIFY_INIT_FLAGS ) !=12 ); +BUILD_BUG_ON (HWEIGHT32 (FANOTIFY_INIT_FLAGS ) !=13 );BUILD_BUG_ON (HWEIGHT32 (FANOTIFY_MARK_FLAGS ) !=11 ); fanotify_mark_cache = KMEM_CACHE(fanotify_mark,
include/linux/fanotify.h +1 -0
@@ -36,6 +36,7 @@#define FANOTIFY_ADMIN_INIT_FLAGS (FANOTIFY_PERM_CLASSES | \ FAN_REPORT_TID | \ FAN_REPORT_PIDFD | \ + FAN_REPORT_FD_ERROR | \ FAN_UNLIMITED_QUEUE | \ FAN_UNLIMITED_MARKS)
include/uapi/linux/fanotify.h +1 -0
@@ -60,6 +60,7 @@#define FAN_REPORT_DIR_FID 0x00000400/* Report unique directory id */ #define FAN_REPORT_NAME 0x00000800/* Report events with name */ #define FAN_REPORT_TARGET_FID 0x00001000/* Report dirent target id */ +#define FAN_REPORT_FD_ERROR 0x00002000/* event->fd can report error */ /* Convenience macro - FAN_REPORT_NAME requires FAN_REPORT_DIR_FID */ #define FAN_REPORT_DFID_NAME (FAN_REPORT_DIR_FID | FAN_REPORT_NAME)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 298/466 bpf: Prevent tailcall infinite loop caused by freplace
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <[email protected]>
[ Upstream commit d6083f040d5d8f8d748462c77e90547097df936e ]
There is a potential infinite loop issue that can occur when using a combination of tail calls and freplace.
In an upcoming selftest, the attach target for entry_freplace of tailcall_freplace.c is subprog_tc of tc_bpf2bpf.c, while the tail call in entry_freplace leads to entry_tc. This results in an infinite loop:
entry_tc -> subprog_tc -> entry_freplace --tailcall-> entry_tc.
The problem arises because the tail_call_cnt in entry_freplace resets to zero each time entry_freplace is executed, causing the tail call mechanism to never terminate, eventually leading to a kernel panic.
To fix this issue, the solution is twofold:
1. Prevent updating a program extended by an freplace program to a prog_array map.
2. Prevent extending a program that is already part of a prog_array map with an freplace program.
This ensures that:
* If a program or its subprogram has been extended by an freplace program, it can no longer be updated to a prog_array map.
* If a program has been added to a prog_array map, neither it nor its subprograms can be extended by an freplace program.
Moreover, an extension program should not be tailcalled. As such, return -EINVAL if the program has a type of BPF_PROG_TYPE_EXT when adding it to a prog_array map.
Additionally, fix a minor code style issue by replacing eight spaces with a tab for proper formatting.
--- include/linux/bpf.h | 17 +++++++++++---- kernel/bpf/arraymap.c | 26 +++++++++++++++++++++-- kernel/bpf/core.c | 1 + kernel/bpf/syscall.c | 7 +++--- kernel/bpf/trampoline.c | 47 ++++++++++++++++++++++++++++++++++------- 5 files changed, 81 insertions(+), 17 deletions(-)
include/linux/bpf.h +13 -4
@@ -1300,8 +1300,12 @@ void *__bpf_dynptr_data_rw(const struct bpf_dynptr_kern *ptr, u32 len);bool __bpf_dynptr_is_rdonly (const struct bpf_dynptr_kern *ptr);#ifdef CONFIG_BPF_JIT -int bpf_trampoline_link_prog (struct bpf_tramp_link *link,struct bpf_trampoline *tr); -int bpf_trampoline_unlink_prog (struct bpf_tramp_link *link,struct bpf_trampoline *tr); +int bpf_trampoline_link_prog (struct bpf_tramp_link *link, +struct bpf_trampoline *tr, +struct bpf_prog *tgt_prog); +int bpf_trampoline_unlink_prog (struct bpf_tramp_link *link, +struct bpf_trampoline *tr, +struct bpf_prog *tgt_prog);struct bpf_trampoline *bpf_trampoline_get (u64 key,struct bpf_attach_target_info *tgt_info);void bpf_trampoline_put (struct bpf_trampoline *tr);
@@ -1383,12 +1387,14 @@ void bpf_jit_uncharge_modmem(u32 size);bool bpf_prog_has_trampoline (const struct bpf_prog *prog);#else static inline int bpf_trampoline_link_prog (struct bpf_tramp_link *link, -struct bpf_trampoline *tr) +struct bpf_trampoline *tr, +struct bpf_prog *tgt_prog) {return -ENOTSUPP ; }static inline int bpf_trampoline_unlink_prog (struct bpf_tramp_link *link, -struct bpf_trampoline *tr) +struct bpf_trampoline *tr, +struct bpf_prog *tgt_prog) {return -ENOTSUPP ; }
@@ -1492,6 +1498,9 @@ struct bpf_prog_aux {bool xdp_has_frags;bool exception_cb;bool exception_boundary; +bool is_extended;/* true if extended by freplace program */ +u64 prog_array_member_cnt;/* counts how many times as member of prog_array */ +struct mutex ext_mutex;/* mutex for is_extended and prog_array_member_cnt */ struct bpf_arena *arena;/* BTF_KIND_FUNC_PROTO for valid attach_btf_id */ const struct btf_type *attach_func_proto;
kernel/bpf/arraymap.c +24 -2
@@ -947,22 +947,44 @@ static void *prog_fd_array_get_ptr(struct bpf_map *map, struct file *map_file, int fd) {struct bpf_prog *prog =bpf_prog_get (fd); +bool is_extended;if (IS_ERR (prog))return prog; -if (!bpf_prog_map_compatible (map, prog)) { +if (prog->type ==BPF_PROG_TYPE_EXT || + !bpf_prog_map_compatible (map, prog)) {bpf_prog_put (prog);return ERR_PTR (-EINVAL ); } +mutex_lock (&prog->aux->ext_mutex); + is_extended = prog->aux->is_extended; +if (!is_extended) + prog->aux->prog_array_member_cnt++; +mutex_unlock (&prog->aux->ext_mutex); +if (is_extended) { +/* Extended prog can not be tail callee. It's to prevent a +* potential infinite loop like: +* tail callee prog entry -> tail callee prog subprog -> +* freplace prog entry --tailcall-> tail callee prog entry. +*/ +bpf_prog_put (prog); +return ERR_PTR (-EBUSY ); + } +return prog; }static void prog_fd_array_put_ptr (struct bpf_map *map,void *ptr,bool need_defer) { +struct bpf_prog *prog = ptr; + +mutex_lock (&prog->aux->ext_mutex); + prog->aux->prog_array_member_cnt--; +mutex_unlock (&prog->aux->ext_mutex);/* bpf_prog is freed after one RCU or tasks trace grace period */ -bpf_prog_put (ptr); +bpf_prog_put (prog); }static u32 prog_fd_array_sys_lookup_elem (void *ptr)
kernel/bpf/core.c +1 -0
@@ -131,6 +131,7 @@ struct bpf_prog *bpf_prog_alloc_no_stats(unsigned int size, gfp_t gfp_extra_flagINIT_LIST_HEAD_RCU (&fp->aux->ksym_prefix.lnode);#endif mutex_init (&fp->aux->used_maps_mutex); +mutex_init (&fp->aux->ext_mutex);mutex_init (&fp->aux->dst_mutex);return fp;
kernel/bpf/syscall.c +4 -3
@@ -3218,7 +3218,8 @@ static void bpf_tracing_link_release(struct bpf_link *link) container_of(link, struct bpf_tracing_link, link.link);WARN_ON_ONCE (bpf_trampoline_unlink_prog (&tr_link->link, - tr_link->trampoline)); + tr_link->trampoline, + tr_link->tgt_prog));bpf_trampoline_put (tr_link->trampoline);
@@ -3358,7 +3359,7 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,* in prog->aux * * - if prog->aux->dst_trampoline is NULL, the program has already been -* attached to a target and its initial target was cleared (below) +* attached to a target and its initial target was cleared (below) * * - if tgt_prog != NULL, the caller specified tgt_prog_fd + * target_btf_id using the link_create API.
@@ -3433,7 +3434,7 @@ static int bpf_tracing_prog_attach(struct bpf_prog *prog,if (err) goto out_unlock; - err =bpf_trampoline_link_prog (&link->link, tr); + err =bpf_trampoline_link_prog (&link->link, tr, tgt_prog);if (err) {bpf_link_cleanup (&link_primer); link =NULL ;
kernel/bpf/trampoline.c +39 -8
101 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 299/466 ASoC: sdw_utils: Add support for exclusion DAI quirks
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 3d9b44d0972be1298400e449cfbcc436df2e988e ]
The system contains a mechanism for certain DAI links to be included based on a quirk. Add support for certain DAI links to excluded based on a quirk, this is useful in situations where the vast majority of SKUs utilise a feature so it is easier to quirk on those that don't.
--- include/sound/soc_sdw_utils.h | 1 + sound/soc/sdw_utils/soc_sdw_utils.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
include/sound/soc_sdw_utils.h +1 -0
@@ -59,6 +59,7 @@ struct asoc_sdw_dai_info {int (*rtd_init)(struct snd_soc_pcm_runtime *rtd,struct snd_soc_dai *dai);bool rtd_init_done;/* Indicate that the rtd_init callback is done */ unsigned long quirk; +bool quirk_exclude; };struct asoc_sdw_codec_info {
sound/soc/sdw_utils/soc_sdw_utils.c +2 -1
@@ -1112,7 +1112,8 @@ int asoc_sdw_parse_sdw_endpoints(struct snd_soc_card *card, dai_info = &codec_info->dais[adr_end->num]; soc_dai =asoc_sdw_find_dailink (soc_dais, adr_end); -if (dai_info->quirk && !(dai_info->quirk & ctx->mc_quirk)) +if (dai_info->quirk && + !(dai_info->quirk_exclude ^ !!(dai_info->quirk & ctx->mc_quirk)))continue ; dev_dbg(dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 300/466 ASoC: sdw_utils: Add a quirk to allow the cs42l43 mic DAI to be ignored
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit a6f7afb39362ef70d08d23e5bfc0a14d69fafea1 ]
To support some systems using host microphones add a quirk to allow the cs42l43 microphone DAI link to be ignored.
--- include/sound/soc_sdw_utils.h | 1 + sound/soc/sdw_utils/soc_sdw_utils.c | 2 ++ 2 files changed, 3 insertions(+)
include/sound/soc_sdw_utils.h +1 -0
@@ -28,6 +28,7 @@* - SOC_SDW_CODEC_SPKR | SOF_SIDECAR_AMPS - Not currently supported */ #define SOC_SDW_SIDECAR_AMPS BIT(16) +#define SOC_SDW_CODEC_MIC BIT(17)#define SOC_SDW_UNUSED_DAI_ID -1#define SOC_SDW_JACK_OUT_DAI_ID 0
sound/soc/sdw_utils/soc_sdw_utils.c +2 -0
@@ -487,6 +487,8 @@ struct asoc_sdw_codec_info codec_info_list[] = { .rtd_init = asoc_sdw_cs42l43_dmic_rtd_init, .widgets = generic_dmic_widgets, .num_widgets = ARRAY_SIZE(generic_dmic_widgets), + .quirk = SOC_SDW_CODEC_MIC, + .quirk_exclude = true, }, { .direction = {false, true},
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 301/466 ASoC: Intel: sof_sdw: Add quirk for cs42l43 system using host DMICs
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit ea657f6b24e11651a39292082be84ad81a89e525 ]
Add quirk to inform the machine driver to not bind in the cs42l43 microphone DAI link.
--- sound/soc/intel/boards/sof_sdw.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/intel/boards/sof_sdw.c +9 -0
@@ -580,6 +580,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { }, .driver_data = (void *)(SOC_SDW_CODEC_SPKR), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"233C" ) + }, +/* Note this quirk excludes the CODEC mic */ + .driver_data = (void *)(SOC_SDW_CODEC_MIC), + }, /* ArrowLake devices */ {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 302/466 ASoC: Intel: sof_sdw: Add quirks for some new Lenovo laptops
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 83c062ae81e89f73e3ab85953111a8b3daaaf98e ]
Add some more sidecar amplifier quirks.
--- sound/soc/intel/boards/sof_sdw.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
sound/soc/intel/boards/sof_sdw.c +32 -0
@@ -580,6 +580,30 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { }, .driver_data = (void *)(SOC_SDW_CODEC_SPKR), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"3838" ) + }, + .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), + }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"3832" ) + }, + .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), + }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"380E" ) + }, + .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), + }, { .callback = sof_sdw_quirk_cb, .matches = {
@@ -589,6 +613,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {/* Note this quirk excludes the CODEC mic */ .driver_data = (void *)(SOC_SDW_CODEC_MIC), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"233B" ) + }, + .driver_data = (void *)(SOC_SDW_SIDECAR_AMPS), + }, /* ArrowLake devices */ {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 303/466 drm/xe/guc/ct: Flush g2h worker in case of g2h response timeout
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Badal Nilawar <[email protected]>
[ Upstream commit e5152723380404acb8175e0777b1cea57f319a01 ]
In case if g2h worker doesn't get opportunity to within specified timeout delay then flush the g2h worker explicitly.
v2:
- Describe change in the comment and add TODO (Matt B/John H)
- Add xe_gt_warn on fence done after G2H flush (John H)
v3:
- Updated the comment with root cause
- Clean up xe_gt_warn message (John H)
--- drivers/gpu/drm/xe/xe_guc_ct.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/gpu/drm/xe/xe_guc_ct.c +18 -0
@@ -906,6 +906,24 @@ static int guc_ct_send_recv(struct xe_guc_ct *ct, const u32 *action, u32 len, } } +/* +* Occasionally it is seen that the G2H worker starts running after a delay of more than +* a second even after being queued and activated by the Linux workqueue subsystem. This +* leads to G2H timeout error. The root cause of issue lies with scheduling latency of +* Lunarlake Hybrid CPU. Issue dissappears if we disable Lunarlake atom cores from BIOS +* and this is beyond xe kmd. +* +* TODO: Drop this change once workqueue scheduling delay issue is fixed on LNL Hybrid CPU. +*/ +if (!ret) { +flush_work (&ct->g2h_worker); +if (g2h_fence.done) { +xe_gt_warn (gt,"G2H fence %u, action %04x, done\n" , + g2h_fence.seqno, action[0 ]); + ret =1 ; + } + } +/* * Ensure we serialize with completion side to prevent UAF with fence going out of scope on * the stack, since we have no clue if it will fire after the timeout before we can erase
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 304/466 drm/panel: simple: Add Microchip AC69T88A LVDS Display panel
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manikandan Muralidharan <[email protected]>
[ Upstream commit 40da1463cd6879f542238b36c1148f517927c595 ]
Add support for Microchip AC69T88A 5 inch TFT LCD 800x480 Display module with LVDS interface.The panel uses the Sitronix ST7262 800x480 Display driver
--- drivers/gpu/drm/panel/panel-simple.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
drivers/gpu/drm/panel/panel-simple.c +28 -0
@@ -4565,6 +4565,31 @@ static const struct panel_desc yes_optoelectronics_ytc700tlag_05_201c = { .connector_type = DRM_MODE_CONNECTOR_LVDS, }; +static const struct drm_display_mode mchp_ac69t88a_mode = { + .clock =25000 , + .hdisplay =800 , + .hsync_start =800 +88 , + .hsync_end =800 +88 +5 , + .htotal =800 +88 +5 +40 , + .vdisplay =480 , + .vsync_start =480 +23 , + .vsync_end =480 +23 +5 , + .vtotal =480 +23 +5 +1 , +}; + +static const struct panel_desc mchp_ac69t88a = { + .modes = &mchp_ac69t88a_mode, + .num_modes =1 , + .bpc =8 , + .size = { + .width =108 , + .height =65 , + }, + .bus_flags =DRM_BUS_FLAG_DE_HIGH , + .bus_format =MEDIA_BUS_FMT_RGB888_1X7X4_JEIDA , + .connector_type =DRM_MODE_CONNECTOR_LVDS , +}; +static const struct drm_display_mode arm_rtsm_mode[] = { { .clock =65000 ,
@@ -5048,6 +5073,9 @@ static const struct of_device_id platform_of_match[] = { }, { .compatible = "yes-optoelectronics,ytc700tlag-05-201c", .data = &yes_optoelectronics_ytc700tlag_05_201c, + }, { + .compatible = "microchip,ac69t88a", + .data = &mchp_ac69t88a, }, { /* Must be the last entry */ .compatible = "panel-dpi",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 305/466 net: sfp: change quirks for Alcatel Lucent G-010S-P
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengyu Qu <[email protected]>
[ Upstream commit 90cb5f1776ba371478e2b08fbf7018c7bd781a8d ]
Seems Alcatel Lucent G-010S-P also have the same problem that it uses TX_FAULT pin for SOC uart. So apply sfp_fixup_ignore_tx_fault to it.
--- drivers/net/phy/sfp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/phy/sfp.c +2 -1
@@ -466,7 +466,8 @@ static void sfp_quirk_ubnt_uf_instant(const struct sfp_eeprom_id *id,static const struct sfp_quirk sfp_quirks[] = {// Alcatel Lucent G-010S-P can operate at 2500base-X, but incorrectly // report 2500MBd NRZ in their EEPROM -SFP_QUIRK_M ("ALCATELLUCENT" ,"G010SP" , sfp_quirk_2500basex), +SFP_QUIRK ("ALCATELLUCENT" ,"G010SP" , sfp_quirk_2500basex, + sfp_fixup_ignore_tx_fault),// Alcatel Lucent G-010S-A can operate at 2500base-X, but report 3.2GBd // NRZ in their EEPROM
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 306/466 net: stmmac: Programming sequence for VLAN packets with split header
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Chauhan <[email protected]>
[ Upstream commit d10f1a4e44c3bf874701f86f8cc43490e1956acf ]
Currently reset state configuration of split header works fine for non-tagged packets and we see no corruption in payload of any size
We need additional programming sequence with reset configuration to handle VLAN tagged packets to avoid corruption in payload for packets of size greater than 256 bytes.
Without this change ping application complains about corruption in payload when the size of the VLAN packet exceeds 256 bytes.
With this change tagged and non-tagged packets of any size works fine and there is no corruption seen.
Current configuration which has the issue for VLAN packet
----------------------------------------------------------
Split happens at the position at Layer 3 header
|MAC-DA|MAC-SA|Vlan Tag|Ether type|IP header|IP data|Rest of the payload|
2 bytes ^
|With the fix we are making sure that the split happens now at Layer 2 which is end of ethernet header and start of IP payload
Ip traffic split
-----------------
Bits which take care of this are SPLM and SPLOFST
SPLM = Split mode is set to Layer 2
SPLOFST = These bits indicate the value of offset from the beginning of Length/Type field at which header split should take place when the appropriate SPLM is selected. Reset value is 2bytes.
Un-tagged data (without VLAN)
|MAC-DA|MAC-SA|Ether type|IP header|IP data|Rest of the payload|
2bytes ^ |
Tagged data (with VLAN)
|MAC-DA|MAC-SA|VLAN Tag|Ether type|IP header|IP data|Rest of the payload|
2bytes ^
|Non-IP traffic split such AV packet
------------------------------------
Bits which take care of this are
SAVE = Split AV Enable
SAVO = Split AV Offset, similar to SPLOFST but this is for AVTP packets.
|Preamble|MAC-DA|MAC-SA|VLAN tag|Ether type|IEEE 1722 payload|CRC|
2bytes ^ |
--- drivers/net/ethernet/stmicro/stmmac/dwmac4.h | 5 +++++ drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c | 5 +++++ 2 files changed, 10 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac4.h +5 -0
@@ -44,6 +44,7 @@#define GMAC_MDIO_DATA 0x00000204#define GMAC_GPIO_STATUS 0x0000020C#define GMAC_ARP_ADDR 0x00000210 +#define GMAC_EXT_CFG1 0x00000238#define GMAC_ADDR_HIGH (reg) (0x300 + reg * 8)#define GMAC_ADDR_LOW (reg) (0x304 + reg * 8)#define GMAC_L3L4_CTRL (reg) (0x900 + (reg) * 0x30)
@@ -284,6 +285,10 @@ enum power_event {#define GMAC_HW_FEAT_DVLAN BIT(5)#define GMAC_HW_FEAT_NRVF GENMASK(2, 0) +/* MAC extended config 1 */ +#define GMAC_CONFIG1_SAVE_EN BIT(24) +#define GMAC_CONFIG1_SPLM (v) FIELD_PREP(GENMASK(9, 8), v) +/* GMAC GPIO Status reg */ #define GMAC_GPO0 BIT(16)#define GMAC_GPO1 BIT(17)
drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c +5 -0
@@ -534,6 +534,11 @@ static void dwmac4_enable_sph(struct stmmac_priv *priv, void __iomem *ioaddr, value |=GMAC_CONFIG_HDSMS_256 ;/* Segment max 256 bytes */ writel (value, ioaddr +GMAC_EXT_CONFIG ); + value =readl (ioaddr +GMAC_EXT_CFG1 ); + value |=GMAC_CONFIG1_SPLM (1 );/* Split mode set to L2OFST */ + value |=GMAC_CONFIG1_SAVE_EN ;/* Enable Split AV mode */ +writel (value, ioaddr +GMAC_EXT_CFG1 ); + value =readl (ioaddr +DMA_CHAN_CONTROL (dwmac4_addrs, chan));if (en) value |=DMA_CONTROL_SPH ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 307/466 drm/sched: memset() job in drm_sched_job_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit 2320c9e6a768d135c7b0039995182bb1a4e4fd22 ]
drm_sched_job_init() has no control over how users allocate struct drm_sched_job. Unfortunately, the function can also not set some struct members such as job->sched.
This could theoretically lead to UB by users dereferencing the struct's pointer members too early.
It is easier to debug such issues if these pointers are initialized to NULL, so dereferencing them causes a NULL pointer exception. Accordingly, drm_sched_entity_init() does precisely that and initializes its struct with memset().
Initialize parameter "job" to 0 in drm_sched_job_init().
--- drivers/gpu/drm/scheduler/sched_main.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/scheduler/sched_main.c +8 -0
@@ -803,6 +803,14 @@ int drm_sched_job_init(struct drm_sched_job *job,return -EINVAL ; } +/* +* We don't know for sure how the user has allocated. Thus, zero the +* struct so that unallowed (i.e., too early) usage of pointers that +* this function does not set is guaranteed to lead to a NULL pointer +* exception instead of UB. +*/ +memset (job,0 ,sizeof (*job)); + job->entity = entity; job->credits = credits; job->s_fence =drm_sched_fence_alloc (entity, owner);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 308/466 drm/amd/display: Adding array index check to prevent memory corruption
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Chen <[email protected]>
[ Upstream commit 2c437d9a0b496168e1a1defd17b531f0a526dbe9 ]
[Why & How]
Array indices out of bound caused memory corruption. Adding checks to ensure that array index stays in bound.
--- .../gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +4 -2
@@ -257,11 +257,11 @@ static void dcn35_notify_host_router_bw(struct clk_mgr *clk_mgr_base, struct dc_struct clk_mgr_internal *clk_mgr =TO_CLK_MGR_INTERNAL (clk_mgr_base);uint32_t host_router_bw_kbps[MAX_HOST_ROUTERS_NUM ] = {0 };int i; -for (i =0 ; i < context->stream_count; ++i) {const struct dc_stream_state *stream = context->streams[i];const struct dc_link *link = stream->link; -uint8_t lowest_dpia_index =0 , hr_index =0 ; +uint8_t lowest_dpia_index =0 ; +unsigned int hr_index =0 ;if (!link)continue ;
@@ -271,6 +271,8 @@ static void dcn35_notify_host_router_bw(struct clk_mgr *clk_mgr_base, struct dc_continue ; hr_index = (link->link_index - lowest_dpia_index) /2 ; +if (hr_index >=MAX_HOST_ROUTERS_NUM ) +continue ; host_router_bw_kbps[hr_index] +=dc_bandwidth_in_kbps_from_timing ( &stream->timing,dc_link_get_highest_encoding_format (link)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 309/466 drm/amdgpu/gfx9: Add cleaner shader for GFX9.4.2
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <[email protected]>
[ Upstream commit 9343b904e7198e4804685133327dece7fe709bc1 ]
This commit adds the cleaner shader microcode for GFX9.4.2 GPUs. The cleaner shader is a piece of GPU code that is used to clear or initialize certain GPU resources, such as Local Data Share (LDS), Vector General Purpose Registers (VGPRs), and Scalar General Purpose Registers (SGPRs).
Clearing these resources is important for ensuring data isolation between different workloads running on the GPU. Without the cleaner shader, residual data from a previous workload could potentially be accessed by a subsequent workload, leading to data leaks and incorrect computation results.
The cleaner shader microcode is represented as an array of 32-bit words (gfx_9_4_2_cleaner_shader_hex). This array is the binary representation of the cleaner shader code, which is written in a low-level GPU instruction set.
Also, this patch updates the gfx_v9_0_sw_init function to initialize the cleaner shader if the MEC firmware version is 88 or higher. It sets the cleaner_shader_ptr and cleaner_shader_size to the appropriate values and attempts to initialize the cleaner shader.
When the cleaner shader feature is enabled, the AMDGPU driver loads this array into a specific location in the GPU memory. The GPU then reads this memory location to fetch and execute the cleaner shader instructions.
The cleaner shader is executed automatically by the GPU at the end of each workload, before the next workload starts. This ensures that all GPU resources are in a clean state before the start of each workload.
This change ensures that the GPU memory is properly cleared between different processes, preventing data leakage and enhancing security. It also aligns with the serialization mechanism between KGD and KFD, ensuring that the GPU state is consistent across different workloads.
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 12 ++ .../drm/amd/amdgpu/gfx_v9_0_cleaner_shader.h | 44 ++++- .../amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm | 153 ++++++++++++++++++ 3 files changed, 208 insertions(+), 1 deletion(-) create mode 100644 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +12 -0
@@ -2223,6 +2223,18 @@ static int gfx_v9_0_sw_init(void *handle) }switch (amdgpu_ip_version (adev,GC_HWIP ,0 )) { +case IP_VERSION (9 ,4 ,2 ): + adev->gfx.cleaner_shader_ptr = gfx_9_4_2_cleaner_shader_hex; + adev->gfx.cleaner_shader_size =sizeof (gfx_9_4_2_cleaner_shader_hex); +if (adev->gfx.mec_fw_version >=88 ) { + adev->gfx.enable_cleaner_shader = true; + r =amdgpu_gfx_cleaner_shader_sw_init (adev, adev->gfx.cleaner_shader_size); +if (r) { + adev->gfx.enable_cleaner_shader = false; +dev_err (adev->dev,"Failed to initialize cleaner shader\n" ); + } + } +break ;default : adev->gfx.enable_cleaner_shader = false;break ;
drivers/gpu/drm/amd/amdgpu/gfx_v9_0_cleaner_shader.h +43 -1
52 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/gfx_v9_4_2_cleaner_shader.asm new file +153 -0
153 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 310/466 drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts for vega20_ih
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Lu <[email protected]>
[ Upstream commit 8b22f048331dfd45fdfbf0efdfb1d43deff7518d ]
Port this change to vega20_ih.c:
commit afbf7955ff01 ("drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts")
Original commit message:
"Why:
Setting IH_RB_WPTR register to 0 will not clear the RB_OVERFLOW bit if RB_ENABLE is not set.
How to fix:
Set WPTR_OVERFLOW_CLEAR bit after RB_ENABLE bit is set. The RB_ENABLE bit is required to be set, together with WPTR_OVERFLOW_ENABLE bit so that setting WPTR_OVERFLOW_CLEAR bit would clear the RB_OVERFLOW."
--- drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 27 ++++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/gpu/drm/amd/amdgpu/vega20_ih.c +27 -0
@@ -114,6 +114,33 @@ static int vega20_ih_toggle_ring_interrupts(struct amdgpu_device *adev, tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,RB_ENABLE , (enable ?1 :0 )); tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,RB_GPU_TS_ENABLE ,1 ); +if (enable) { +/* Unset the CLEAR_OVERFLOW bit to make sure the next step +* is switching the bit from 0 to 1 +*/ + tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,WPTR_OVERFLOW_CLEAR ,0 ); +if (amdgpu_sriov_vf (adev) &&amdgpu_sriov_reg_indirect_ih (adev)) { +if (psp_reg_program (&adev->psp, ih_regs->psp_reg_id, tmp)) +return -ETIMEDOUT ; + }else { +WREG32_NO_KIQ (ih_regs->ih_rb_cntl, tmp); + } + +/* Clear RB_OVERFLOW bit */ + tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,WPTR_OVERFLOW_CLEAR ,1 ); +if (amdgpu_sriov_vf (adev) &&amdgpu_sriov_reg_indirect_ih (adev)) { +if (psp_reg_program (&adev->psp, ih_regs->psp_reg_id, tmp)) +return -ETIMEDOUT ; + }else { +WREG32_NO_KIQ (ih_regs->ih_rb_cntl, tmp); + } + +/* Unset the CLEAR_OVERFLOW bit immediately so new overflows +* can be detected. +*/ + tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,WPTR_OVERFLOW_CLEAR ,0 ); + } +/* enable_intr field is only valid in ring0 */ if (ih == &adev->irq.ih) tmp =REG_SET_FIELD (tmp,IH_RB_CNTL ,ENABLE_INTR , (enable ?1 :0 ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 311/466 drm/amdgpu: Dereference the ATCS ACPI buffer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <[email protected]>
[ Upstream commit 32e7ee293ff476c67b51be006e986021967bc525 ]
Need to dereference the atcs acpi buffer after the method is executed, otherwise it will result in a memory leak.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +1 -0
@@ -800,6 +800,7 @@ int amdgpu_acpi_power_shift_control(struct amdgpu_device *adev,return -EIO ; } +kfree (info);return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 312/466 netlink: specs: Add missing bitset attrs to ethtool spec
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Donald Hunter <[email protected]>
[ Upstream commit b0b3683419b45e2971b6d413c506cb818b268d35 ]
There are a couple of attributes missing from the 'bitset' attribute-set in the ethtool netlink spec. Add them to the spec.
--- Documentation/netlink/specs/ethtool.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
Documentation/netlink/specs/ethtool.yaml +6 -1
@@ -96,7 +96,12 @@ attribute-sets: name: bits type: nest nested-attributes: bitset-bits - + - + name: value + type: binary + - + name: mask + type: binary - name: string attributes:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 313/466 drm/amdgpu: refine error handling in amdgpu_ttm_tt_pin_userptr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lang Yu <[email protected]>
[ Upstream commit 46186667f98fb7158c98f4ff5da62c427761ffcd ]
Free sg table when dma_map_sgtable() failed to avoid memory leak.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +3 -1
@@ -812,7 +812,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_device *bdev,/* Map SG to device */ r =dma_map_sgtable (adev->dev, ttm->sg, direction,0 );if (r) - goto release_sg; + goto release_sg_table;/* convert SG to linear array of pages and dma addresses */ drm_prime_sg_to_dma_addr_array(ttm->sg, gtt->ttm.dma_address,
@@ -820,6 +820,8 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_device *bdev,return 0 ; +release_sg_table: +sg_free_table (ttm->sg); release_sg:kfree (ttm->sg); ttm->sg =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 314/466 ASoC: sdw_utils: Add quirk to exclude amplifier function
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mac Chiang <[email protected]>
[ Upstream commit 358ee2c1493e5d2c59820ffd8087eb0e367be4c6 ]
When SKUs use the multi-function codec, which integrates Headset, Amplifier and DMIC. The corresponding quirks provide options to support internal amplifier/DMIC or not.
In the case of RT722, this SKU excludes the internal amplifier and use an additional amplifier instead.
--- sound/soc/sdw_utils/soc_sdw_utils.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sdw_utils/soc_sdw_utils.c +2 -0
@@ -363,6 +363,8 @@ struct asoc_sdw_codec_info codec_info_list[] = { .num_controls = ARRAY_SIZE(generic_spk_controls), .widgets = generic_spk_widgets, .num_widgets = ARRAY_SIZE(generic_spk_widgets), + .quirk = SOC_SDW_CODEC_SPKR, + .quirk_exclude = true, }, { .direction = {false, true},
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 315/466 ASoC: Intel: soc-acpi-intel-arl-match: Add rt722 and rt1320 support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mac Chiang <[email protected]>
[ Upstream commit f193fb888d1da45365daa7d0ff7a964c8305d407 ]
This patch adds support for the rt722 multi-function codec and the rt1320 amplifier in the ARL board configuration.
Link 0: RT722 codec with three endpoints: Headset, Speaker, and DMIC. Link 2: RT1320 amplifier.
Note:
The Speaker endpoint on the RT722 codec is not used.
--- .../intel/common/soc-acpi-intel-arl-match.c | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+)
sound/soc/intel/common/soc-acpi-intel-arl-match.c +63 -0
@@ -44,6 +44,31 @@ static const struct snd_soc_acpi_endpoint spk_3_endpoint = { .group_id = 1, }; +/* +* RT722 is a multi-function codec, three endpoints are created for +* its headset, amp and dmic functions. +*/ +static const struct snd_soc_acpi_endpoint rt722_endpoints[] = { + { + .num =0 , + .aggregated =0 , + .group_position =0 , + .group_id =0 , + }, + { + .num =1 , + .aggregated =0 , + .group_position =0 , + .group_id =0 , + }, + { + .num =2 , + .aggregated =0 , + .group_position =0 , + .group_id =0 , + }, +}; +static const struct snd_soc_acpi_adr_device cs35l56_2_lr_adr[] = { { .adr =0x00023001FA355601ull ,
@@ -185,6 +210,24 @@ static const struct snd_soc_acpi_adr_device rt711_sdca_0_adr[] = { } }; +static const struct snd_soc_acpi_adr_device rt722_0_single_adr[] = { + { + .adr =0x000030025D072201ull , + .num_endpoints =ARRAY_SIZE (rt722_endpoints), + .endpoints = rt722_endpoints, + .name_prefix ="rt722" + } +}; + +static const struct snd_soc_acpi_adr_device rt1320_2_single_adr[] = { + { + .adr =0x000230025D132001ull , + .num_endpoints =1 , + .endpoints = &single_endpoint, + .name_prefix ="rt1320-1" + } +}; +static const struct snd_soc_acpi_link_adr arl_cs42l43_l0[] = { { .mask =BIT (0 ),
@@ -287,6 +330,20 @@ static const struct snd_soc_acpi_link_adr arl_sdca_rvp[] = { {} }; +static const struct snd_soc_acpi_link_adr arl_rt722_l0_rt1320_l2[] = { + { + .mask =BIT (0 ), + .num_adr =ARRAY_SIZE (rt722_0_single_adr), + .adr_d = rt722_0_single_adr, + }, + { + .mask =BIT (2 ), + .num_adr =ARRAY_SIZE (rt1320_2_single_adr), + .adr_d = rt1320_2_single_adr, + }, + {} +}; +static const struct snd_soc_acpi_codecs arl_essx_83x6 = { .num_codecs =3 , .codecs = {"ESSX8316" ,"ESSX8326" ,"ESSX8336" },
@@ -385,6 +442,12 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_arl_sdw_machines[] = { .drv_name = "sof_sdw", .sof_tplg_filename = "sof-arl-rt711-l0.tplg", }, + { + .link_mask = BIT(0) | BIT(2), + .links = arl_rt722_l0_rt1320_l2, + .drv_name = "sof_sdw", + .sof_tplg_filename = "sof-arl-rt722-l0_rt1320-l2.tplg", + }, {}, };EXPORT_SYMBOL_GPL (snd_soc_acpi_intel_arl_sdw_machines);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 316/466 drm/amd/display: Fix underflow when playing 8K video in full screen mode
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Ma <[email protected]>
[ Upstream commit 4007f07a47de4a277f4760cac3aed1b31d973eea ]
[Why&How]
Flickering observed while playing 8k HEVC-10 bit video in full screen mode with black border. We didn't support this case for subvp. Make change to the existing check to disable subvp for this corner case.
--- .../drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml2/dml21/dml21_translation_helper.c +1 -1
@@ -882,7 +882,7 @@ static void populate_dml21_plane_config_from_plane_state(struct dml2_context *dm plane->immediate_flip = plane_state->flip_immediate; plane->composition.rect_out_height_spans_vactive = - plane_state->dst_rect.height >= stream->timing.v_addressable && + plane_state->dst_rect.height >= stream->src.height && stream->dst.height >= stream->timing.v_addressable; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 317/466 mptcp: annotate data-races around subflow->fully_established
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gang Yan <[email protected]>
[ Upstream commit 581c8cbfa934aaa555daa4e843242fcecc160f05 ]
We introduce the same handling for potential data races with the 'fully_established' flag in subflow as previously done for msk->fully_established.
Additionally, we make a crucial change: convert the subflow's 'fully_established' from 'bit_field' to 'bool' type. This is necessary because methods for avoiding data races don't work well with 'bit_field'. Specifically, the 'READ_ONCE' needs to know the size of the variable being accessed, which is not supported in 'bit_field'. Also, 'test_bit' expect the address of 'bit_field'.
--- net/mptcp/diag.c | 2 +- net/mptcp/options.c | 4 ++-- net/mptcp/protocol.c | 2 +- net/mptcp/protocol.h | 6 +++--- net/mptcp/subflow.c | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-)
net/mptcp/diag.c +1 -1
@@ -47,7 +47,7 @@ static int subflow_get_info(struct sock *sk, struct sk_buff *skb) flags |=MPTCP_SUBFLOW_FLAG_BKUP_REM ;if (sf->request_bkup) flags |=MPTCP_SUBFLOW_FLAG_BKUP_LOC ; -if (sf->fully_established) +if (READ_ONCE (sf->fully_established)) flags |=MPTCP_SUBFLOW_FLAG_FULLY_ESTABLISHED ;if (sf->conn_finished) flags |=MPTCP_SUBFLOW_FLAG_CONNECTED ;
net/mptcp/options.c +2 -2
@@ -461,7 +461,7 @@ static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb,return false;/* MPC/MPJ needed only on 3rd ack packet, DATA_FIN and TCP shutdown take precedence */ -if (subflow->fully_established || snd_data_fin_enable || +if (READ_ONCE (subflow->fully_established) || snd_data_fin_enable || subflow->snd_isn !=TCP_SKB_CB (skb)->seq || sk->sk_state !=TCP_ESTABLISHED )return false;
@@ -930,7 +930,7 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk,/* here we can process OoO, in-window pkts, only in-sequence 4th ack * will make the subflow fully established */ -if (likely (subflow->fully_established)) { +if (likely (READ_ONCE (subflow->fully_established))) {/* on passive sockets, check for 3rd ack retransmission * note that msk is always set by subflow_syn_recv_sock() * for mp_join subflows
net/mptcp/protocol.c +1 -1
@@ -3519,7 +3519,7 @@ static void schedule_3rdack_retransmission(struct sock *ssk)struct tcp_sock *tp =tcp_sk (ssk);unsigned long timeout; -if (mptcp_subflow_ctx (ssk)->fully_established) +if (READ_ONCE (mptcp_subflow_ctx (ssk)->fully_established))return ;/* reschedule with a timeout above RTT, as we must look only for drop */
net/mptcp/protocol.h +3 -3
@@ -513,7 +513,6 @@ struct mptcp_subflow_context { request_bkup : 1, mp_capable : 1, /* remote is MPTCP capable */ mp_join : 1, /* remote is JOINing */ - fully_established : 1, /* path validated */ pm_notified : 1, /* PM hook called for established status */ conn_finished : 1, map_valid : 1,
@@ -532,10 +531,11 @@ struct mptcp_subflow_context { is_mptfo : 1, /* subflow is doing TFO */ close_event_done : 1, /* has done the post-closed part */ mpc_drop : 1, /* the MPC option has been dropped in a rtx */ - __unused : 8; + __unused : 9;bool data_avail;bool scheduled;bool pm_listener;/* a listener managed by the kernel PM? */ +bool fully_established;/* path validated */ u32 remote_nonce;u64 thmac;u32 local_nonce;
@@ -780,7 +780,7 @@ static inline bool __tcp_can_send(const struct sock *ssk)static inline bool __mptcp_subflow_active (struct mptcp_subflow_context *subflow) {/* can't send if JOIN hasn't completed yet (i.e. is usable for mptcp) */ -if (subflow->request_join && !subflow->fully_established) +if (subflow->request_join && !READ_ONCE (subflow->fully_established))return false;return __tcp_can_send (mptcp_subflow_tcp_sock (subflow));
net/mptcp/subflow.c +2 -2
@@ -800,7 +800,7 @@ void __mptcp_subflow_fully_established(struct mptcp_sock *msk, const struct mptcp_options_received *mp_opt) {subflow_set_remote_key (msk, subflow, mp_opt); - subflow->fully_established =1 ; +WRITE_ONCE (subflow->fully_established, true);WRITE_ONCE (msk->fully_established, true);if (subflow->is_mptfo)
@@ -2062,7 +2062,7 @@ static void subflow_ulp_clone(const struct request_sock *req, }else if (subflow_req->mp_join) { new_ctx->ssn_offset = subflow_req->ssn_offset; new_ctx->mp_join =1 ; - new_ctx->fully_established =1 ; +WRITE_ONCE (new_ctx->fully_established, true); new_ctx->remote_key_valid =1 ; new_ctx->backup = subflow_req->backup; new_ctx->request_bkup = subflow_req->request_bkup;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 318/466 dma-debug: fix a possible deadlock on radix_lock
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Levi Yun <[email protected]>
[ Upstream commit 7543c3e3b9b88212fcd0aaf5cab5588797bdc7de ]
radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock otherwise, there's a possible deadlock scenario when
dma debug API is called holding rq_lock():
CPU0 CPU1 CPU2dma_free_attrs()check_unmap() add_dma_entry() __schedule() //out
(A) rq_lock()
get_hash_bucket()
(A) dma_entry_hash
check_sync()
(A) radix_lock() (W) dma_entry_hashdma_entry_free()
(W) radix_lock()
// CPU2's one
(W) rq_lock()CPU1 situation can happen when it extending radix tree and it tries to wake up kswapd via wake_all_kswapd().
CPU2 situation can happen while perf_event_task_sched_out() (i.e. dma sync operation is called while deleting perf_event using
etm and etr tmc which are Arm Coresight hwtracing driver backends).
To remove this possible situation, call dma_entry_free() after put_hash_bucket() in check_unmap().
--- kernel/dma/debug.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/dma/debug.c +6 -2
@@ -1052,9 +1052,13 @@ static void check_unmap(struct dma_debug_entry *ref) }hash_bucket_del (entry); -dma_entry_free (entry); -put_hash_bucket (bucket, flags); + +/* +* Free the entry outside of bucket_lock to avoid ABBA deadlocks +* between that and radix_lock. +*/ +dma_entry_free (entry); } static void check_for_stack(struct device *dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 319/466 jfs: array-index-out-of-bounds fix in dtReadFirst
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ghanshyam Agrawal <[email protected]>
[ Upstream commit ca84a2c9be482836b86d780244f0357e5a778c46 ]
The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case.
--- fs/jfs/jfs_dtree.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/jfs/jfs_dtree.c +7 -0
@@ -3086,6 +3086,13 @@ static int dtReadFirst(struct inode *ip, struct btstack * btstack)/* get the leftmost entry */ stbl =DT_GETSTBL (p); + +if (stbl[0 ] <0 || stbl[0 ] >127 ) { +DT_PUTPAGE (mp); +jfs_error (ip->i_sb,"stbl[0] out of bound\n" ); +return -EIO ; + } + xd = (pxd_t *) & p->slot[stbl[0 ]];/* get the child page block address */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 320/466 jfs: fix shift-out-of-bounds in dbSplit
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ghanshyam Agrawal <[email protected]>
[ Upstream commit a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ]
When dmt_budmin is less than zero, it causes errors
in the later stages. Added a check to return an error beforehand in dbAllocCtl itself.
--- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_dmap.c +3 -0
@@ -1820,6 +1820,9 @@ dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, s64 * results)return -EIO ; dp = (struct dmap *) mp->data; +if (dp->tree.budmin <0 ) +return -EIO ; +/* try to allocate the blocks. */ rc =dbAllocDmapLev (bmp, dp, (int ) nblocks, l2nb, results);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 321/466 jfs: fix array-index-out-of-bounds in jfs_readdir
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ghanshyam Agrawal <[email protected]>
[ Upstream commit 839f102efb168f02dfdd46717b7c6dddb26b015e ]
The stbl might contain some invalid values. Added a check to return error code in that case.
--- fs/jfs/jfs_dtree.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/jfs/jfs_dtree.c +8 -0
@@ -2891,6 +2891,14 @@ int jfs_readdir(struct file *file, struct dir_context *ctx) stbl =DT_GETSTBL (p);for (i = index; i < p->header.nextindex; i++) { +if (stbl[i] <0 || stbl[i] >127 ) { +jfs_err ("JFS: Invalid stbl[%d] = %d for inode %ld, block = %lld" , + i, stbl[i], (long )ip->i_ino, (long long )bn); +free_page (dirent_buf); +DT_PUTPAGE (mp); +return -EIO ; + } + d = (struct ldtentry *) & p->slot[stbl[i]]; if (((long) jfs_dirent + d->namlen + 1) >
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 322/466 jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nihar Chaithanya <[email protected]>
[ Upstream commit a174706ba4dad895c40b1d2277bade16dfacdcd9 ]
When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bail out.
--- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_dmap.c +3 -0
@@ -2891,6 +2891,9 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)/* bubble the new value up the tree as required. */ for (k =0 ; k <le32_to_cpu (tp->dmt_height); k++) { +if (lp ==0 ) +break ; +/* get the index of the first leaf of the 4 leaf * group containing the specified leaf (leafno). */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 323/466 fsl/fman: Validate cell-index value obtained from Device Tree
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit bd50c4125c98bd1a86f8e514872159700a9c678c ]
Cell-index value is obtained from Device Tree and then used to calculate the index for accessing arrays port_mfl[], mac_mfl[] and intr_mng[]. In case of broken DT due to any error cell-index can contain any value and it is possible to go beyond the array boundaries which can lead at least to memory corruption.
Validate cell-index value obtained from Device Tree.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/freescale/fman/fman.c | 1 - drivers/net/ethernet/freescale/fman/fman.h | 3 +++ drivers/net/ethernet/freescale/fman/mac.c | 5 +++++ 3 files changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/fman/fman.c +0 -1
@@ -24,7 +24,6 @@/* General defines */ #define FMAN_LIODN_TBL 64/* size of LIODN table */ -#define MAX_NUM_OF_MACS 10#define FM_NUM_OF_FMAN_CTRL_EVENT_REGS 4#define BASE_RX_PORTID 0x08#define BASE_TX_PORTID 0x28
drivers/net/ethernet/freescale/fman/fman.h +3 -0
@@ -74,6 +74,9 @@#define BM_MAX_NUM_OF_POOLS 64/* Buffers pools */ #define FMAN_PORT_MAX_EXT_POOLS_NUM 8/* External BM pools per Rx port */ +/* General defines */ +#define MAX_NUM_OF_MACS 10 +struct fman ;/* FMan data */ /* Enum for defining port types */
drivers/net/ethernet/freescale/fman/mac.c +5 -0
@@ -259,6 +259,11 @@ static int mac_probe(struct platform_device *_of_dev) err = -EINVAL ; goto _return_dev_put; } +if (val >=MAX_NUM_OF_MACS ) { +dev_err (dev,"cell-index value is too big for %pOF\n" , mac_node); + err = -EINVAL ; + goto _return_dev_put; + } priv->cell_index = (u8 )val;/* Get the MAC address */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 324/466 net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Safonov <[email protected]>
[ Upstream commit 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 ]
Under CONFIG_PROVE_RCU_LIST + CONFIG_RCU_EXPERT hlist_for_each_entry_rcu() provides very helpful splats, which help to find possible issues. I missed CONFIG_RCU_EXPERT=y in my testing config the same as described ina3e4bf7f9675 ("configs/debug: make sure PROVE_RCU_LIST=y takes effect").
The fix itself is trivial: add the very same lockdep annotations as were used to dereference ao_info from the socket.
--- include/net/tcp_ao.h | 3 ++- net/ipv4/tcp_ao.c | 42 +++++++++++++++++++++++------------------- net/ipv4/tcp_ipv4.c | 3 ++- net/ipv6/tcp_ipv6.c | 4 ++-- 4 files changed, 29 insertions(+), 23 deletions(-)
include/net/tcp_ao.h +2 -1
@@ -183,7 +183,8 @@ int tcp_ao_hash_skb(unsigned short int family, const u8 *tkey, int hash_offset, u32 sne);int tcp_parse_ao (struct sock *sk,int cmd,unsigned short int family,sockptr_t optval,int optlen); -struct tcp_ao_key *tcp_ao_established_key (struct tcp_ao_info *ao, +struct tcp_ao_key *tcp_ao_established_key (const struct sock *sk, +struct tcp_ao_info *ao,int sndid,int rcvid); int tcp_ao_copy_all_matching(const struct sock *sk, struct sock *newsk, struct request_sock *req, struct sk_buff *skb,
net/ipv4/tcp_ao.c +23 -19
152 lines not on this page · raw message
net/ipv4/tcp_ipv4.c +2 -1
@@ -1053,7 +1053,8 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb) }if (aoh) - key.ao_key =tcp_ao_established_key (ao_info, aoh->rnext_keyid,-1 ); + key.ao_key =tcp_ao_established_key (sk, ao_info, + aoh->rnext_keyid,-1 ); } }if (key.ao_key) {
net/ipv6/tcp_ipv6.c +2 -2
@@ -1169,8 +1169,8 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)if (tcp_parse_auth_options (tcp_hdr (skb),NULL , &aoh)) goto out;if (aoh) - key.ao_key =tcp_ao_established_key (ao_info, - aoh->rnext_keyid,-1 ); + key.ao_key =tcp_ao_established_key (sk, ao_info, + aoh->rnext_keyid,-1 ); } }if (key.ao_key) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 325/466 drm/panic: Add ABGR2101010 support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jocelyn Falempe <[email protected]>
[ Upstream commit 04596969eea9e73b64d63be52aabfddb382e9ce6 ]
Add support for ABGR2101010, used by the nouveau driver.
--- drivers/gpu/drm/drm_panic.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/drm_panic.c +10 -0
@@ -209,6 +209,14 @@ static u32 convert_xrgb8888_to_argb2101010(u32 pix)return GENMASK (31 ,30 )/* set alpha bits */ | pix | ((pix >>8 ) &0x00300C03 ); } +static u32 convert_xrgb8888_to_abgr2101010 (u32 pix) +{ + pix = ((pix &0x00FF0000 ) >>14 ) | + ((pix &0x0000FF00 ) <<4 ) | + ((pix &0x000000FF ) <<22 ); +return GENMASK (31 ,30 )/* set alpha bits */ | pix | ((pix >>8 ) &0x00300C03 ); +} +/* * convert_from_xrgb8888 - convert one pixel from xrgb8888 to the desired format * @color: input color, in xrgb8888 format
@@ -242,6 +250,8 @@ static u32 convert_from_xrgb8888(u32 color, u32 format)return convert_xrgb8888_to_xrgb2101010 (color);case DRM_FORMAT_ARGB2101010 :return convert_xrgb8888_to_argb2101010 (color); +case DRM_FORMAT_ABGR2101010 : +return convert_xrgb8888_to_abgr2101010 (color);default :WARN_ONCE (1 ,"Can't convert to %p4cc\n" , &format);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 326/466 drm/amd/display: Remove hw w/a toggle if on DP2/HPO
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ausef Yousof <[email protected]>
[ Upstream commit b4c804628485af2b46f0d24a87190735cac37d61 ]
[why&how]
Applying a hw w/a only relevant to DIG FIFO causing corruption using HPO, do not apply the w/a if on DP2/HPO
--- .../drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c +9 -2
@@ -132,6 +132,8 @@ static void dcn35_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state *for (i =0 ; i < dc->res_pool->pipe_count; ++i) {struct pipe_ctx *old_pipe = &dc->current_state->res_ctx.pipe_ctx[i];struct pipe_ctx *new_pipe = &context->res_ctx.pipe_ctx[i]; +struct clk_mgr_internal *clk_mgr_internal =TO_CLK_MGR_INTERNAL (clk_mgr_base); +struct dccg *dccg = clk_mgr_internal->dccg;struct pipe_ctx *pipe = safe_to_lower ? &context->res_ctx.pipe_ctx[i] : &dc->current_state->res_ctx.pipe_ctx[i];
@@ -148,8 +150,13 @@ static void dcn35_disable_otg_wa(struct clk_mgr *clk_mgr_base, struct dc_state * new_pipe->stream_res.stream_enc && new_pipe->stream_res.stream_enc->funcs->is_fifo_enabled && new_pipe->stream_res.stream_enc->funcs->is_fifo_enabled (new_pipe->stream_res.stream_enc); -if (pipe->stream && (pipe->stream->dpms_off ||dc_is_virtual_signal (pipe->stream->signal) || - !pipe->stream->link_enc) && !stream_changed_otg_dig_on) { +bool has_active_hpo = dccg->ctx->dc->link_srv->dp_is_128b_132b_signal (old_pipe) && dccg->ctx->dc->link_srv->dp_is_128b_132b_signal (new_pipe); + +if (!has_active_hpo && !dccg->ctx->dc->link_srv->dp_is_128b_132b_signal (pipe) && + (pipe->stream && (pipe->stream->dpms_off ||dc_is_virtual_signal (pipe->stream->signal) || + !pipe->stream->link_enc) && !stream_changed_otg_dig_on)) { + +/* This w/a should not trigger when we have a dig active */ if (disable) {if (pipe->stream_res.tg && pipe->stream_res.tg->funcs->immediate_disable_crtc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 327/466 drm/amd/display: parse umc_info or vram_info based on ASIC
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurabindo Pillai <[email protected]>
[ Upstream commit 2551b4a321a68134360b860113dd460133e856e5 ]
An upstream bug report suggests that there are production dGPUs that are older than DCN401 but still have a umc_info in VBIOS tables with the same version as expected for a DCN401 product. Hence, reading this tables should be guarded with a version check.
--- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c +3 -1
@@ -3127,7 +3127,9 @@ static enum bp_result bios_parser_get_vram_info(struct atom_data_revision revision;// vram info moved to umc_info for DCN4x -if (info &&DATA_TABLES (umc_info)) { +if (dcb->ctx->dce_version >=DCN_VERSION_4_01 && + dcb->ctx->dce_version <DCN_VERSION_MAX && + info &&DATA_TABLES (umc_info)) { header = GET_IMAGE(struct atom_common_table_header,DATA_TABLES (umc_info));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 328/466 drm/amd/display: Prune Invalid Modes For HDMI Output
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fangzhi Zuo <[email protected]>
[ Upstream commit abdd2768d7630bc8ec3403aea24f4197bada3c1f ]
[Why]
1. HDMI does not have 6 bpc support. Having 6 bpc pass validation does not comply with spec.
2. Validate 420 only for native HDMI, but not apply to pcon use case.
3. Current mode validation log is not readable.
[how]
1. Cap 8 bpc for dp-hdmi converter.
2. Validate yuv420 for pcon use case as well,
if rgb/yuv444 8bpc cannot fit into pcon bw limitation of the link from the converter to HDMI sink.
3. Add readable pixel_format and color_depth into debug log.
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 ++++++--- .../gpu/drm/amd/display/dc/core/dc_debug.c | 40 +++++++++++++++++++ .../gpu/drm/amd/display/dc/core/dc_stream.c | 6 +-- .../gpu/drm/amd/display/dc/inc/core_status.h | 2 + 4 files changed, 59 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +14 -5
@@ -7341,10 +7341,15 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector,const struct drm_connector_state *drm_state = dm_state ? &dm_state->base :NULL ;int requested_bpc = drm_state ? drm_state->max_requested_bpc :8 ;enum dc_status dc_result =DC_OK ; +uint8_t bpc_limit =6 ;if (!dm_state)return NULL ; +if (aconnector->dc_link->connector_signal ==SIGNAL_TYPE_HDMI_TYPE_A || + aconnector->dc_link->dpcd_caps.dongle_type ==DISPLAY_DONGLE_DP_HDMI_CONVERTER ) + bpc_limit =8 ; + do { stream = create_stream_for_sink(connector, drm_mode, dm_state, old_stream,
@@ -7365,11 +7370,12 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector, dc_result =dm_validate_stream_and_context (adev->dm.dc, stream);if (dc_result !=DC_OK ) { -DRM_DEBUG_KMS ("Mode %dx%d (clk %d) failed DC validation with error %d (%s)\n" , +DRM_DEBUG_KMS ("Mode %dx%d (clk %d) pixel_encoding:%s color_depth:%s failed validation -- %s\n" , drm_mode->hdisplay, drm_mode->vdisplay, drm_mode->clock, - dc_result, +dc_pixel_encoding_to_str (stream->timing.pixel_encoding), +dc_color_depth_to_str (stream->timing.display_color_depth),dc_status_to_str (dc_result));dc_stream_release (stream);
@@ -7377,10 +7383,13 @@ create_validate_stream_for_sink(struct amdgpu_dm_connector *aconnector, requested_bpc -=2 ;/* lower bpc to retry validation */ } - }while (stream ==NULL && requested_bpc >=6 ); + }while (stream ==NULL && requested_bpc >= bpc_limit); -if (dc_result ==DC_FAIL_ENC_VALIDATE && !aconnector->force_yuv420_output) { -DRM_DEBUG_KMS ("Retry forcing YCbCr420 encoding\n" ); +if ((dc_result ==DC_FAIL_ENC_VALIDATE || + dc_result ==DC_EXCEED_DONGLE_CAP ) && + !aconnector->force_yuv420_output) { +DRM_DEBUG_KMS ("%s:%d Retry forcing yuv420 encoding\n" , + __func__, __LINE__); aconnector->force_yuv420_output = true; stream = create_validate_stream_for_sink(aconnector, drm_mode,
drivers/gpu/drm/amd/display/dc/core/dc_debug.c +40 -0
@@ -434,3 +434,43 @@ char *dc_status_to_str(enum dc_status status)return "Unexpected status error" ; } + +char *dc_pixel_encoding_to_str (enum dc_pixel_encoding pixel_encoding) +{ +switch (pixel_encoding) { +case PIXEL_ENCODING_RGB : +return "RGB" ; +case PIXEL_ENCODING_YCBCR422 : +return "YUV422" ; +case PIXEL_ENCODING_YCBCR444 : +return "YUV444" ; +case PIXEL_ENCODING_YCBCR420 : +return "YUV420" ; +default : +return "Unknown" ; + } +} + +char *dc_color_depth_to_str (enum dc_color_depth color_depth) +{ +switch (color_depth) { +case COLOR_DEPTH_666 : +return "6-bpc" ; +case COLOR_DEPTH_888 : +return "8-bpc" ; +case COLOR_DEPTH_101010 : +return "10-bpc" ; +case COLOR_DEPTH_121212 : +return "12-bpc" ; +case COLOR_DEPTH_141414 : +return "14-bpc" ; +case COLOR_DEPTH_161616 : +return "16-bpc" ; +case COLOR_DEPTH_999 : +return "9-bpc" ; +case COLOR_DEPTH_111111 : +return "11-bpc" ; +default : +return "Unknown" ; + } +}
drivers/gpu/drm/amd/display/dc/core/dc_stream.c +3 -3
@@ -819,12 +819,12 @@ void dc_stream_log(const struct dc *dc, const struct dc_stream_state *stream) stream->dst.height, stream->output_color_space);DC_LOG_DC ( -"\tpix_clk_khz: %d, h_total: %d, v_total: %d, pixelencoder:%d, displaycolorDepth:%d\n" , +"\tpix_clk_khz: %d, h_total: %d, v_total: %d, pixel_encoding:%s, color_depth:%s\n" , stream->timing.pix_clk_100hz /10 , stream->timing.h_total, stream->timing.v_total, - stream->timing.pixel_encoding, - stream->timing.display_color_depth); +dc_pixel_encoding_to_str (stream->timing.pixel_encoding), +dc_color_depth_to_str (stream->timing.display_color_depth));DC_LOG_DC ("\tlink: %d\n" , stream->link->link_index);
drivers/gpu/drm/amd/display/dc/inc/core_status.h +2 -0
@@ -60,5 +60,7 @@ enum dc_status { };char *dc_status_to_str (enum dc_status status); +char *dc_pixel_encoding_to_str (enum dc_pixel_encoding pixel_encoding); +char *dc_color_depth_to_str (enum dc_color_depth color_depth);#endif /* _CORE_STATUS_H_ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 329/466 drm/amdgpu: skip amdgpu_device_cache_pci_state under sriov
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Zhao <[email protected]>
[ Upstream commit afe260df55ac280cd56306248cb6d8a6b0db095c ]
Under sriov, host driver will save and restore vf pci cfg space during reset. And during device init, under sriov, pci_restore_state happens after fullaccess released, and it can have race condition with mmio protection enable from host side leading to missing interrupts.
So skip amdgpu_device_cache_pci_state for sriov.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +3 -0
@@ -6344,6 +6344,9 @@ bool amdgpu_device_cache_pci_state(struct pci_dev *pdev)struct amdgpu_device *adev =drm_to_adev (dev);int r; +if (amdgpu_sriov_vf (adev)) +return false; + r =pci_save_state (pdev);if (!r) {kfree (adev->pci_state);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 330/466 virtio-net: fix overflow inside virtnet_rq_alloc
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuan Zhuo <[email protected]>
[ Upstream commit 6aacd1484468361d1d04badfe75f264fa5314864 ]
When the frag just got a page, then may lead to regression on VM. Specially if the sysctl net.core.high_order_alloc_disable value is 1, then the frag always get a page when do refill.
Which could see reliable crashes or scp failure (scp a file 100M in size to VM).
The issue is that the virtnet_rq_dma takes up 16 bytes at the beginning of a new frag. When the frag size is larger than PAGE_SIZE, everything is fine. However, if the frag is only one page and the total size of the buffer and virtnet_rq_dma is larger than one page, an overflow may occur.
The commit f9dac92ba908 ("virtio_ring: enable premapped mode whatever use_dma_api") introduced this problem. And we reverted some commits to fix this in last linux version. Now we try to enable it and fix this bug directly.
Here, when the frag size is not enough, we reduce the buffer len to fix this problem.
--- drivers/net/virtio_net.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/net/virtio_net.c +9 -3
@@ -946,9 +946,6 @@ static void *virtnet_rq_alloc(struct receive_queue *rq, u32 size, gfp_t gfp)void *buf, *head;dma_addr_t addr; -if (unlikely (!skb_page_frag_refill (size, alloc_frag, gfp))) -return NULL ; - head =page_address (alloc_frag->page);if (rq->do_dma) {
@@ -2443,6 +2440,9 @@ static int add_recvbuf_small(struct virtnet_info *vi, struct receive_queue *rq, len =SKB_DATA_ALIGN (len) +SKB_DATA_ALIGN (sizeof (struct skb_shared_info )); +if (unlikely (!skb_page_frag_refill (len, &rq->alloc_frag, gfp))) +return -ENOMEM ; + buf =virtnet_rq_alloc (rq, len, gfp);if (unlikely (!buf))return -ENOMEM ;
@@ -2545,6 +2545,12 @@ static int add_recvbuf_mergeable(struct virtnet_info *vi,*/ len =get_mergeable_buf_len (rq, &rq->mrg_avg_pkt_len, room); +if (unlikely (!skb_page_frag_refill (len + room, alloc_frag, gfp))) +return -ENOMEM ; + +if (!alloc_frag->offset && len + room +sizeof (struct virtnet_rq_dma ) > alloc_frag->size) + len -=sizeof (struct virtnet_rq_dma ); + buf =virtnet_rq_alloc (rq, len + room, gfp);if (unlikely (!buf))return -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 331/466 ALSA: usb-audio: Make mic volume workarounds globally applicable
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit d6e6b9218ced5249b9136833ef5ec3f554ec7fde ]
It seems that many webcams have buggy firmware and don't expose the mic capture volume with the proper resolution. We have workarounds in mixer.c, but judging from the numbers, those can be better managed as global quirk flags.
--- sound/usb/mixer.c | 58 ++++++++++++-------------------------------- sound/usb/quirks.c | 31 +++++++++++++++++++---- sound/usb/usbaudio.h | 4 +++ 3 files changed, 45 insertions(+), 48 deletions(-)
sound/usb/mixer.c +15 -43
@@ -1084,6 +1084,21 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, struct snd_kcontrol *kctl) {struct snd_usb_audio *chip = cval->head.mixer->chip; + +if (chip->quirk_flags &QUIRK_FLAG_MIC_RES_384 ) { +if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { +usb_audio_info (chip, +"set resolution quirk: cval->res = 384\n" ); + cval->res =384 ; + } + }else if (chip->quirk_flags &QUIRK_FLAG_MIC_RES_16 ) { +if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { +usb_audio_info (chip, +"set resolution quirk: cval->res = 16\n" ); + cval->res =16 ; + } + } +switch (chip->usb_id) {case USB_ID (0x0763 ,0x2030 ):/* M-Audio Fast Track C400 */ case USB_ID (0x0763 ,0x2031 ):/* M-Audio Fast Track C600 */
@@ -1168,27 +1183,6 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, }break ; -case USB_ID (0x046d ,0x0807 ):/* Logitech Webcam C500 */ -case USB_ID (0x046d ,0x0808 ): -case USB_ID (0x046d ,0x0809 ): -case USB_ID (0x046d ,0x0819 ):/* Logitech Webcam C210 */ -case USB_ID (0x046d ,0x081b ):/* HD Webcam c310 */ -case USB_ID (0x046d ,0x081d ):/* HD Webcam c510 */ -case USB_ID (0x046d ,0x0825 ):/* HD Webcam c270 */ -case USB_ID (0x046d ,0x0826 ):/* HD Webcam c525 */ -case USB_ID (0x046d ,0x08ca ):/* Logitech Quickcam Fusion */ -case USB_ID (0x046d ,0x0991 ): -case USB_ID (0x046d ,0x09a2 ):/* QuickCam Communicate Deluxe/S7500 */ -/* Most audio usb devices lie about volume resolution. -* Most Logitech webcams have res = 384. -* Probably there is some logitech magic behind this number --fishor -*/ -if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { -usb_audio_info (chip, -"set resolution quirk: cval->res = 384\n" ); - cval->res =384 ; - } -break ;case USB_ID (0x0495 ,0x3042 ):/* ESS Technology Asus USB DAC */ if ((strstr (kctl->id.name,"Playback Volume" ) !=NULL ) ||strstr (kctl->id.name,"Capture Volume" ) !=NULL ) {
@@ -1197,28 +1191,6 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, cval->res =1 ; }break ; -case USB_ID (0x1224 ,0x2a25 ):/* Jieli Technology USB PHY 2.0 */ -if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { -usb_audio_info (chip, -"set resolution quirk: cval->res = 16\n" ); - cval->res =16 ; - } -break ; -case USB_ID (0x1bcf ,0x2283 ):/* NexiGo N930AF FHD Webcam */ -case USB_ID (0x03f0 ,0x654a ):/* HP 320 FHD Webcam */ -if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { -usb_audio_info (chip, -"set resolution quirk: cval->res = 16\n" ); - cval->res =16 ; - } -break ; -case USB_ID (0x1bcf ,0x2281 ):/* HD Webcam */ -if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { -usb_audio_info (chip, -"set resolution quirk: cval->res = 16\n" ); - cval->res =16 ; - } -break ; } }
sound/usb/quirks.c +26 -5
@@ -2144,7 +2144,7 @@ struct usb_audio_quirk_flags_table {static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {/* Device matches */ DEVICE_FLG (0x03f0 ,0x654a ,/* HP 320 FHD Webcam */ -QUIRK_FLAG_GET_SAMPLE_RATE ), +QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_MIC_RES_16 ),DEVICE_FLG (0x041e ,0x3000 ,/* Creative SB Extigy */ QUIRK_FLAG_IGNORE_CTL_ERROR ), DEVICE_FLG(0x041e, 0x4080, /* Creative Live Cam VF0610 */
@@ -2152,10 +2152,31 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {DEVICE_FLG (0x045e ,0x083c ,/* MS USB Link headset */ QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_CTL_MSG_DELAY |QUIRK_FLAG_DISABLE_AUTOSUSPEND ), +DEVICE_FLG (0x046d ,0x0807 ,/* Logitech Webcam C500 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x0808 ,/* Logitech Webcam C600 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x0809 , +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x0819 ,/* Logitech Webcam C210 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x081b ,/* HD Webcam c310 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x081d ,/* HD Webcam c510 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x0825 ,/* HD Webcam c270 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x0826 ,/* HD Webcam c525 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ),DEVICE_FLG (0x046d ,0x084c ,/* Logitech ConferenceCam Connect */ QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_CTL_MSG_DELAY_1M ), +DEVICE_FLG (0x046d ,0x08ca ,/* Logitech Quickcam Fusion */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ),DEVICE_FLG (0x046d ,0x0991 ,/* Logitech QuickCam Pro */ -QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_IGNORE_CTL_ERROR ), +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_IGNORE_CTL_ERROR | +QUIRK_FLAG_MIC_RES_384 ), +DEVICE_FLG (0x046d ,0x09a2 ,/* QuickCam Communicate Deluxe/S7500 */ +QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_MIC_RES_384 ),DEVICE_FLG (0x046d ,0x09a4 ,/* Logitech QuickCam E 3500 */ QUIRK_FLAG_CTL_MSG_DELAY_1M |QUIRK_FLAG_IGNORE_CTL_ERROR ), DEVICE_FLG(0x0499, 0x1509, /* Steinberg UR22 */
@@ -2223,7 +2244,7 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {DEVICE_FLG (0x0fd9 ,0x0008 ,/* Hauppauge HVR-950Q */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ),DEVICE_FLG (0x1224 ,0x2a25 ,/* Jieli Technology USB PHY 2.0 */ -QUIRK_FLAG_GET_SAMPLE_RATE ), +QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_MIC_RES_16 ),DEVICE_FLG (0x1395 ,0x740a ,/* Sennheiser DECT */ QUIRK_FLAG_GET_SAMPLE_RATE ), DEVICE_FLG(0x1397, 0x0507, /* Behringer UMC202HD */
@@ -2261,9 +2282,9 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {DEVICE_FLG (0x19f7 ,0x0035 ,/* RODE NT-USB+ */ QUIRK_FLAG_GET_SAMPLE_RATE ),DEVICE_FLG (0x1bcf ,0x2281 ,/* HD Webcam */ -QUIRK_FLAG_GET_SAMPLE_RATE ), +QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_MIC_RES_16 ),DEVICE_FLG (0x1bcf ,0x2283 ,/* NexiGo N930AF FHD Webcam */ -QUIRK_FLAG_GET_SAMPLE_RATE ), +QUIRK_FLAG_GET_SAMPLE_RATE |QUIRK_FLAG_MIC_RES_16 ),DEVICE_FLG (0x2040 ,0x7200 ,/* Hauppauge HVR-950Q */ QUIRK_FLAG_SHARE_MEDIA_DEVICE |QUIRK_FLAG_ALIGN_TRANSFER ), DEVICE_FLG(0x2040, 0x7201, /* Hauppauge HVR-950Q-MXL */
sound/usb/usbaudio.h +4 -0
@@ -194,6 +194,8 @@ extern bool snd_usb_skip_validation;* QUIRK_FLAG_FIXED_RATE * Do not set PCM rate (frequency) when only one rate is available * for the given endpoint. +* QUIRK_FLAG_MIC_RES_16 and QUIRK_FLAG_MIC_RES_384 +* Set the fixed resolution for Mic Capture Volume (mostly for webcams) */ #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0)
@@ -218,5 +220,7 @@ extern bool snd_usb_skip_validation;#define QUIRK_FLAG_IFACE_SKIP_CLOSE (1U << 19)#define QUIRK_FLAG_FORCE_IFACE_RESET (1U << 20)#define QUIRK_FLAG_FIXED_RATE (1U << 21) +#define QUIRK_FLAG_MIC_RES_16 (1U << 22) +#define QUIRK_FLAG_MIC_RES_384 (1U << 23)#endif /* __USBAUDIO_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 332/466 drm/amdgpu: set the right AMDGPU sg segment limitation
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <[email protected]>
[ Upstream commit e2e97435783979124ba92d6870415c57ecfef6a5 ]
The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg length as following:
WARNING: CPU: 6 PID: 1964 at kernel/dma/debug.c:1178 debug_dma_map_sg+0x2dc/0x370 [ 364.049444] Modules linked in: veth amdgpu(OE) amdxcp drm_exec gpu_sched drm_buddy drm_ttm_helper ttm(OE) drm_suballoc_helper drm_display_helper drm_kms_helper i2c_algo_bit rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace netfs xt_conntrack xt_MASQUERADE nf_conntrack_netlink xfrm_user xfrm_algo iptable_nat xt_addrtype iptable_filter br_netfilter nvme_fabrics overlay nfnetlink_cttimeout nfnetlink openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c bridge stp llc amd_atl intel_rapl_msr intel_rapl_common sunrpc sch_fq_codel snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg edac_mce_amd binfmt_misc snd_hda_codec snd_pci_acp6x snd_hda_core snd_acp_config snd_hwdep snd_soc_acpi kvm_amd snd_pcm kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul ghash_clmulni_intel sha512_ssse3 snd_rawmidi sha256_ssse3 sha1_ssse3 aesni_intel snd_seq nls_iso8859_1 crypto_simd snd_seq_device cryptd snd_timer rapl input_leds snd [ 364.049532] ipmi_devintf wmi_bmof ccp serio_raw k10temp sp5100_tco soundcore ipmi_msghandler cm32181 industrialio mac_hid msr parport_pc ppdev lp parport drm efi_pstore ip_tables x_tables pci_stub crc32_pclmul nvme ahci libahci i2c_piix4 r8169 nvme_core i2c_designware_pci realtek i2c_ccgx_ucsi video wmi hid_generic cdc_ether usbnet usbhid hid r8152 mii [ 364.049576] CPU: 6 PID: 1964 Comm: rocminfo Tainted: G OE 6.10.0-custom #492 [ 364.049579] Hardware name: AMD Majolica-RN/Majolica-RN, BIOS RMJ1009A 06/13/2021 [ 364.049582] RIP: 0010:debug_dma_map_sg+0x2dc/0x370 [ 364.049585] Code: 89 4d b8 e8 36 b1 86 00 8b 4d b8 48 8b 55 b0 44 8b 45 a8 4c 8b 4d a0 48 89 c6 48 c7 c7 00 4b 74 bc 4c 89 4d b8 e8 b4 73 f3 ff <0f> 0b 4c 8b 4d b8 8b 15 c8 2c b8 01 85 d2 0f 85 ee fd ff ff 8b 05 [ 364.049588] RSP: 0018:ffff9ca600b57ac0 EFLAGS: 00010286 [ 364.049590] RAX: 0000000000000000 RBX: ffff88b7c132b0c8 RCX: 0000000000000027 [ 364.049592] RDX: ffff88bb0f521688 RSI: 0000000000000001 RDI: ffff88bb0f521680 [ 364.049594] RBP: ffff9ca600b57b20 R08: 000000000000006f R09: ffff9ca600b57930 [ 364.049596] R10: ffff9ca600b57928 R11: ffffffffbcb46328 R12: 0000000000000000 [ 364.049597] R13: 0000000000000001 R14: ffff88b7c19c0700 R15: ffff88b7c9059800 [ 364.049599] FS: 00007fb2d3516e80(0000) GS:ffff88bb0f500000(0000) knlGS:0000000000000000 [ 364.049601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 364.049603] CR2: 000055610bd03598 CR3: 00000001049f6000 CR4: 0000000000350ef0 [ 364.049605] Call Trace: [ 364.049607] <TASK> [ 364.049609] ? show_regs+0x6d/0x80 [ 364.049614] ? __warn+0x8c/0x140 [ 364.049618] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049621] ? report_bug+0x193/0x1a0 [ 364.049627] ? handle_bug+0x46/0x80 [ 364.049631] ? exc_invalid_op+0x1d/0x80 [ 364.049635] ? asm_exc_invalid_op+0x1f/0x30 [ 364.049642] ? debug_dma_map_sg+0x2dc/0x370 [ 364.049647] __dma_map_sg_attrs+0x90/0xe0 [ 364.049651] dma_map_sgtable+0x25/0x40 [ 364.049654] amdgpu_bo_move+0x59a/0x850 [amdgpu] [ 364.049935] ? srso_return_thunk+0x5/0x5f [ 364.049939] ? amdgpu_ttm_tt_populate+0x5d/0xc0 [amdgpu] [ 364.050095] ttm_bo_handle_move_mem+0xc3/0x180 [ttm] [ 364.050103] ttm_bo_validate+0xc1/0x160 [ttm] [ 364.050108] ? amdgpu_ttm_tt_get_user_pages+0xe5/0x1b0 [amdgpu] [ 364.050263] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0xa12/0xc90 [amdgpu] [ 364.050473] kfd_ioctl_alloc_memory_of_gpu+0x16b/0x3b0 [amdgpu] [ 364.050680] kfd_ioctl+0x3c2/0x530 [amdgpu] [ 364.050866] ? __pfx_kfd_ioctl_alloc_memory_of_gpu+0x10/0x10 [amdgpu] [ 364.051054] ? srso_return_thunk+0x5/0x5f [ 364.051057] ? tomoyo_file_ioctl+0x20/0x30 [ 364.051063] __x64_sys_ioctl+0x9c/0xd0 [ 364.051068] x64_sys_call+0x1219/0x20d0 [ 364.051073] do_syscall_64+0x51/0x120 [ 364.051077] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 364.051081] RIP: 0033:0x7fb2d2f1a94f
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +1 -0
@@ -1851,6 +1851,7 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)mutex_init (&adev->mman.gtt_window_lock); +dma_set_max_seg_size (adev->dev,UINT_MAX );/* No others user of address space so set it to 0 */ r = ttm_device_init(&adev->mman.bdev, &amdgpu_bo_driver, adev->dev, adev_to_drm(adev)->anon_inode->i_mapping,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 333/466 wifi: ipw2x00: libipw_rx_any(): fix bad alignment
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiapeng Chong <[email protected]>
[ Upstream commit 4fa4f049dc0d9741b16c96bcbf0108c85368a2b9 ]
This patch fixes incorrect code alignment.
./drivers/net/wireless/intel/ipw2x00/libipw_rx.c:871:2-3: code aligned with following code on line 882. ./drivers/net/wireless/intel/ipw2x00/libipw_rx.c:886:2-3: code aligned with following code on line 900.
--- drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/ipw2x00/libipw_rx.c +4 -4
@@ -870,8 +870,8 @@ void libipw_rx_any(struct libipw_device *ieee,switch (ieee->iw_mode) {case IW_MODE_ADHOC :/* our BSS and not from/to DS */ -if (ether_addr_equal (hdr->addr3, ieee->bssid)) -if ((fc & (IEEE80211_FCTL_TODS +IEEE80211_FCTL_FROMDS )) ==0 ) { +if (ether_addr_equal (hdr->addr3, ieee->bssid) && + ((fc & (IEEE80211_FCTL_TODS +IEEE80211_FCTL_FROMDS )) ==0 )) {/* promisc: get all */ if (ieee->dev->flags &IFF_PROMISC ) is_packet_for_us =1 ;
@@ -885,8 +885,8 @@ void libipw_rx_any(struct libipw_device *ieee,break ;case IW_MODE_INFRA :/* our BSS (== from our AP) and from DS */ -if (ether_addr_equal (hdr->addr2, ieee->bssid)) -if ((fc & (IEEE80211_FCTL_TODS +IEEE80211_FCTL_FROMDS )) ==IEEE80211_FCTL_FROMDS ) { +if (ether_addr_equal (hdr->addr2, ieee->bssid) && + ((fc & (IEEE80211_FCTL_TODS +IEEE80211_FCTL_FROMDS )) ==IEEE80211_FCTL_FROMDS )) {/* promisc: get all */ if (ieee->dev->flags &IFF_PROMISC ) is_packet_for_us =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 334/466 wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert van Bolhuis <[email protected]>
[ Upstream commit 857282b819cbaa0675aaab1e7542e2c0579f52d7 ]
This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue.
The problem is the number of entries in the pre-allocated sgtable, it is nents = max(rxglom_size, txglom_size) + max(rxglom_size, txglom_size) >> 4 + 1. Given the default [rt]xglom_size=32 it's actually 35 which is too small. Worst case, the pkt queue can end up with 64 SKBs. This occurs when a new SKB is added for each original SKB if tailroom isn't enough to hold tail_pad. At least one sg entry is needed for each SKB. So, eventually the "skb_queue_walk loop" in brcmf_sdiod_sglist_rw may run out of sg entries. This makes sg_next return NULL and this causes the oops.
The patch sets nents to max(rxglom_size, txglom_size) * 2 to be able handle the worst-case.
Btw. this requires only 64-35=29 * 16 (or 20 if CONFIG_NEED_SG_DMA_LENGTH) = 464 additional bytes of memory.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +1 -1
@@ -770,7 +770,7 @@ void brcmf_sdiod_sgtable_alloc(struct brcmf_sdio_dev *sdiodev) nents =max_t (uint,BRCMF_DEFAULT_RXGLOM_SIZE , sdiodev->settings->bus.sdio.txglomsz); - nents += (nents >>4 ) +1 ; + nents *=2 ;WARN_ON (nents > sdiodev->max_segment_count);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 335/466 bpf: Call free_htab_elem() after htab_unlock_bucket()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
[ Upstream commit b9e9ed90b10c82a4e9d4d70a2890f06bfcdd3b78 ]
For htab of maps, when the map is removed from the htab, it may hold the last reference of the map. bpf_map_fd_put_ptr() will invoke bpf_map_free_id() to free the id of the removed map element. However, bpf_map_fd_put_ptr() is invoked while holding a bucket lock (raw_spin_lock_t), and bpf_map_free_id() attempts to acquire map_idr_lock (spinlock_t), triggering the following lockdep warning:
=============================
[ BUG: Invalid wait context ]
6.11.0-rc4+ #49 Not tainted
-----------------------------
test_maps/4881 is trying to lock:
ffffffff84884578 (map_idr_lock){+...}-{3:3}, at: bpf_map_free_id.part.0+0x21/0x70 other info that might help us debug this:
context-{5:5}
2 locks held by test_maps/4881:
#0: ffffffff846caf60 (rcu_read_lock){....}-{1:3}, at: bpf_fd_htab_map_update_elem+0xf9/0x270 #1: ffff888149ced148 (&htab->lockdep_key#2){....}-{2:2}, at: htab_map_update_elem+0x178/0xa80
stack backtrace: CPU: 0 UID: 0 PID: 4881 Comm: test_maps Not tainted 6.11.0-rc4+ #49 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... Call Trace: <TASK> dump_stack_lvl+0x6e/0xb0 dump_stack+0x10/0x20 __lock_acquire+0x73e/0x36c0 lock_acquire+0x182/0x450 _raw_spin_lock_irqsave+0x43/0x70 bpf_map_free_id.part.0+0x21/0x70 bpf_map_put+0xcf/0x110 bpf_map_fd_put_ptr+0x9a/0xb0 free_htab_elem+0x69/0xe0 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 htab_map_update_elem+0x50f/0xa80 bpf_fd_htab_map_update_elem+0x131/0x270 bpf_map_update_value+0x266/0x380 __sys_bpf+0x21bb/0x36b0 __x64_sys_bpf+0x45/0x60 x64_sys_call+0x1b2a/0x20d0 do_syscall_64+0x5d/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e
One way to fix the lockdep warning is using raw_spinlock_t for map_idr_lock as well. However, bpf_map_alloc_id() invokes idr_alloc_cyclic() after acquiring map_idr_lock, it will trigger a similar lockdep warning because the slab's lock (s->cpu_slab->lock) is still a spinlock.
Instead of changing map_idr_lock's type, fix the issue by invoking htab_put_fd_value() after htab_unlock_bucket(). However, only deferring the invocation of htab_put_fd_value() is not enough, because the old map pointers in htab of maps can not be saved during batched deletion. Therefore, also defer the invocation of free_htab_elem(), so these to-be-freed elements could be linked together similar to lru map.
There are four callers for ->map_fd_put_ptr:
(1) alloc_htab_elem() (through htab_put_fd_value())
It invokes ->map_fd_put_ptr() under a raw_spinlock_t. The invocation of htab_put_fd_value() can not simply move after htab_unlock_bucket(), because the old element has already been stashed in htab->extra_elems. It may be reused immediately after htab_unlock_bucket() and the invocation of htab_put_fd_value() after htab_unlock_bucket() may release the newly-added element incorrectly. Therefore, saving the map pointer of the old element for htab of maps before unlocking the bucket and releasing the map_ptr after unlock. Beside the map pointer in the old element, should do the same thing for the special fields in the old element as well.
(2) free_htab_elem() (through htab_put_fd_value())
Its caller includes __htab_map_lookup_and_delete_elem(), htab_map_delete_elem() and __htab_map_lookup_and_delete_batch().
For htab_map_delete_elem(), simply invoke free_htab_elem() after htab_unlock_bucket(). For __htab_map_lookup_and_delete_batch(), just like lru map, linking the to-be-freed element into node_to_free list and invoking free_htab_elem() for these element after unlock. It is safe to reuse batch_flink as the link for node_to_free, because these elements have been removed from the hash llist.
Because htab of maps doesn't support lookup_and_delete operation, __htab_map_lookup_and_delete_elem() doesn't have the problem, so kept it as is.
(3) fd_htab_map_free()
It invokes ->map_fd_put_ptr without raw_spinlock_t.
(4) bpf_fd_htab_map_update_elem()
It invokes ->map_fd_put_ptr without raw_spinlock_t.
After moving free_htab_elem() outside htab bucket lock scope, using pcpu_freelist_push() instead of __pcpu_freelist_push() to disable the irq before freeing elements, and protecting the invocations of bpf_mem_cache_free() with migrate_{disable|enable} pair.
--- kernel/bpf/hashtab.c | 56 ++++++++++++++++++++++++++++++-------------- 1 file changed, 39 insertions(+), 17 deletions(-)
kernel/bpf/hashtab.c +39 -17
@@ -896,9 +896,12 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)static void htab_elem_free (struct bpf_htab *htab,struct htab_elem *l) {check_and_free_fields (htab, l); + +migrate_disable ();if (htab->map.map_type ==BPF_MAP_TYPE_PERCPU_HASH )bpf_mem_cache_free (&htab->pcpu_ma, l->ptr_to_pptr);bpf_mem_cache_free (&htab->ma, l); +migrate_enable (); }static void htab_put_fd_value (struct bpf_htab *htab,struct htab_elem *l)
@@ -948,7 +951,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)if (htab_is_prealloc (htab)) {bpf_map_dec_elem_count (&htab->map);check_and_free_fields (htab, l); -__pcpu_freelist_push (&htab->freelist, &l->fnode); +pcpu_freelist_push (&htab->freelist, &l->fnode); }else {dec_elem_count (htab);htab_elem_free (htab, l);
@@ -1018,7 +1021,6 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,*/ pl_new =this_cpu_ptr (htab->extra_elems); l_new = *pl_new; -htab_put_fd_value (htab, old_elem); *pl_new = old_elem; }else {struct pcpu_freelist_node *l;
@@ -1105,6 +1107,7 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,struct htab_elem *l_new =NULL , *l_old;struct hlist_nulls_head *head;unsigned long flags; +void *old_map_ptr;struct bucket *b;u32 key_size, hash;int ret;
@@ -1183,12 +1186,27 @@ static long htab_map_update_elem(struct bpf_map *map, void *key, void *value,hlist_nulls_add_head_rcu (&l_new->hash_node, head);if (l_old) {hlist_nulls_del_rcu (&l_old->hash_node); + +/* l_old has already been stashed in htab->extra_elems, free +* its special fields before it is available for reuse. Also +* save the old map pointer in htab of maps before unlock +* and release it after unlock. +*/ + old_map_ptr =NULL ; +if (htab_is_prealloc (htab)) { +if (map->ops->map_fd_put_ptr) + old_map_ptr =fd_htab_map_get_ptr (map, l_old); +check_and_free_fields (htab, l_old); + } + } +htab_unlock_bucket (htab, b, hash, flags); +if (l_old) { +if (old_map_ptr) + map->ops->map_fd_put_ptr (map, old_map_ptr, true);if (!htab_is_prealloc (htab))free_htab_elem (htab, l_old); -else -check_and_free_fields (htab, l_old); } - ret =0 ; +return 0 ; err:htab_unlock_bucket (htab, b, hash, flags);return ret;
@@ -1432,15 +1450,15 @@ static long htab_map_delete_elem(struct bpf_map *map, void *key)return ret; l =lookup_elem_raw (head, hash, key, key_size); - -if (l) { +if (l)hlist_nulls_del_rcu (&l->hash_node); -free_htab_elem (htab, l); - }else { +else ret = -ENOENT ; - }htab_unlock_bucket (htab, b, hash, flags); + +if (l) +free_htab_elem (htab, l);return ret; }
@@ -1853,13 +1871,14 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,* may cause deadlock. See comments in function * prealloc_lru_pop(). Let us do bpf_lru_push_free() * after releasing the bucket lock. +* +* For htab of maps, htab_put_fd_value() in +* free_htab_elem() may acquire a spinlock with bucket +* lock being held and it violates the lock rule, so +* invoke free_htab_elem() after unlock as well. */ -if (is_lru_map) { - l->batch_flink = node_to_free; - node_to_free = l; - }else { -free_htab_elem (htab, l); - } + l->batch_flink = node_to_free; + node_to_free = l; } dst_key += key_size; dst_val += value_size;
@@ -1871,7 +1890,10 @@ __htab_map_lookup_and_delete_batch(struct bpf_map *map,while (node_to_free) { l = node_to_free; node_to_free = node_to_free->batch_flink; -htab_lru_push_free (htab, l); +if (is_lru_map) +htab_lru_push_free (htab, l); +else +free_htab_elem (htab, l); } next_batch:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 336/466 mptcp: fix possible integer overflow in mptcp_reset_tout_timer
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit b169e76ebad22cbd055101ee5aa1a7bed0e66606 ]
In 'mptcp_reset_tout_timer', promote 'probe_timestamp' to unsigned long to avoid possible integer overflow. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- net/mptcp/protocol.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mptcp/protocol.c +2 -2
@@ -2728,8 +2728,8 @@ void mptcp_reset_tout_timer(struct mptcp_sock *msk, unsigned long fail_tout)if (!fail_tout && !inet_csk (sk)->icsk_mtup.probe_timestamp)return ; - close_timeout =inet_csk (sk)->icsk_mtup.probe_timestamp - tcp_jiffies32 + jiffies + -mptcp_close_timeout (sk); + close_timeout = (unsigned long )inet_csk (sk)->icsk_mtup.probe_timestamp - + tcp_jiffies32 + jiffies +mptcp_close_timeout (sk);/* the close timeout takes precedence on the fail one, and here at least one of * them is active
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 337/466 dsa: qca8k: Use nested lock to avoid splat
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
[ Upstream commit 078e0d596f7b5952dad8662ace8f20ed2165e2ce ]
qca8k_phy_eth_command() is used to probe the child MDIO bus while the parent MDIO is locked. This causes lockdep splat, reporting a possible deadlock. It is not an actually deadlock, because different locks are used. By making use of mutex_lock_nested() we can avoid this false positive.
--- drivers/net/dsa/qca/qca8k-8xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/qca/qca8k-8xxx.c +1 -1
@@ -673,7 +673,7 @@ qca8k_phy_eth_command(struct qca8k_priv *priv, bool read, int phy,* We therefore need to lock the MDIO bus onto which the switch is * connected. */ -mutex_lock (&priv->bus->mdio_lock); +mutex_lock_nested (&priv->bus->mdio_lock,MDIO_MUTEX_NESTED );/* Actually start the request: * 1. Send mdio master packet
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 338/466 i2c: i801: Add support for Intel Panther Lake
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit bd492b58371295d3ae26162b9666be584abad68a ]
Add SMBus PCI IDs on Intel Panther Lake-P and -U.
--- Documentation/i2c/busses/i2c-i801.rst | 1 + drivers/i2c/busses/Kconfig | 1 + drivers/i2c/busses/i2c-i801.c | 6 ++++++ 3 files changed, 8 insertions(+)
Documentation/i2c/busses/i2c-i801.rst +1 -0
@@ -49,6 +49,7 @@ Supported adapters: * Intel Meteor Lake (SOC and PCH) * Intel Birch Stream (SOC) * Intel Arrow Lake (SOC) + * Intel Panther Lake (SOC) Datasheets: Publicly available at the Intel website
drivers/i2c/busses/Kconfig +1 -0
@@ -160,6 +160,7 @@ config I2C_I801 Meteor Lake (SOC and PCH) Birch Stream (SOC) Arrow Lake (SOC) + Panther Lake (SOC) This driver can also be built as a module. If so, the module will be called i2c-i801.
drivers/i2c/busses/i2c-i801.c +6 -0
@@ -81,6 +81,8 @@* Meteor Lake PCH-S (PCH) 0x7f23 32 hard yes yes yes * Birch Stream (SOC) 0x5796 32 hard yes yes yes * Arrow Lake-H (SOC) 0x7722 32 hard yes yes yes +* Panther Lake-H (SOC) 0xe322 32 hard yes yes yes +* Panther Lake-P (SOC) 0xe422 32 hard yes yes yes * * Features supported by this driver: * Software PEC no
@@ -261,6 +263,8 @@#define PCI_DEVICE_ID_INTEL_CANNONLAKE_H_SMBUS 0xa323#define PCI_DEVICE_ID_INTEL_COMETLAKE_V_SMBUS 0xa3a3#define PCI_DEVICE_ID_INTEL_METEOR_LAKE_SOC_S_SMBUS 0xae22 +#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_H_SMBUS 0xe322 +#define PCI_DEVICE_ID_INTEL_PANTHER_LAKE_P_SMBUS 0xe422struct i801_mux_config {char *gpio_chip;
@@ -1055,6 +1059,8 @@ static const struct pci_device_id i801_ids[] = { { PCI_DEVICE_DATA(INTEL, METEOR_LAKE_PCH_S_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, { PCI_DEVICE_DATA(INTEL, BIRCH_STREAM_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, { PCI_DEVICE_DATA(INTEL, ARROW_LAKE_H_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, + { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_H_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, + { PCI_DEVICE_DATA(INTEL, PANTHER_LAKE_P_SMBUS, FEATURES_ICH5 | FEATURE_TCO_CNL) }, { 0, } };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 339/466 Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markus Elfring <[email protected]>
[ Upstream commit d96b543c6f3b78b6440b68b5a5bbface553eff28 ]
An hci_conn_drop() call was immediately used after a null pointer check for an hci_conn_link() call in two function implementations. Thus call such a function only once instead directly before the checks.
This issue was transformed by using the Coccinelle software.
--- net/bluetooth/hci_conn.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
net/bluetooth/hci_conn.c +3 -10
@@ -2345,13 +2345,9 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, conn->iso_qos.bcast.big);if (parent && parent != conn) { link =hci_conn_link (parent, conn); -if (!link) { -hci_conn_drop (conn); -return ERR_PTR (-ENOLINK ); - } - -/* Link takes the refcount */ hci_conn_drop (conn); +if (!link) +return ERR_PTR (-ENOLINK ); }return conn;
@@ -2441,15 +2437,12 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst, } link =hci_conn_link (le, cis); +hci_conn_drop (cis);if (!link) {hci_conn_drop (le); -hci_conn_drop (cis);return ERR_PTR (-ENOLINK ); } -/* Link takes the refcount */ -hci_conn_drop (cis); - cis->state =BT_CONNECT ;hci_le_create_cis_pending (hdev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 340/466 Bluetooth: btusb: Add RTL8852BE device 0489:e123 to device tables
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hilda Wu <[email protected]>
[ Upstream commit 69b84ffce260ff13826dc10aeb3c3e5c2288a552 ]
Add the support ID 0489:e123 to usb_device_id table for Realtek RTL8852B chip.
The device info from /sys/kernel/debug/usb/devices as below.
T: Bus=01 Lev=01 Prnt=01 Port=07 Cnt=04 Dev#= 7 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e123 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -524,6 +524,8 @@ static const struct usb_device_id quirks_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe123), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK | BTUSB_WIDEBAND_SPEECH },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 341/466 Bluetooth: btusb: Add USB HW IDs for MT7920/MT7925
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiande Lu <[email protected]>
[ Upstream commit a94bc93a305bdcb20cc62978c334cace932b1be0 ]
Add HW IDs for wireless module. These HW IDs are extracted from Windows driver inf file and the test for card bring up successful. MT7920 HW IDs test with below patch.
https://patchwork.kernel.org/project/bluetooth/
patch/[email protected]/
Patch has been tested successfully and controller is recognized devices pair successfully.
MT7920 module bring up message as below.
Bluetooth: Core ver 2.22
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
Bluetooth: hci0: HW/SW Version: 0x008a008a, Build Time: 20240930111457
Bluetooth: hci0: Device setup in 143004 usecs
Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
Bluetooth: hci0: AOSP extensions version v1.00
Bluetooth: hci0: AOSP quality report is supported
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: MGMT ver 1.22
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
MT7925 module bring up message as below.
Bluetooth: Core ver 2.22
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time: 20240816133202
Bluetooth: hci0: Device setup in 286558 usecs
Bluetooth: hci0: HCI Enhanced Setup Synchronous
Connection command is advertised, but not supported.
Bluetooth: hci0: AOSP extensions version v1.00
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: MGMT ver 1.22
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
--- drivers/bluetooth/btusb.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/bluetooth/btusb.c +12 -0
@@ -565,6 +565,16 @@ static const struct usb_device_id quirks_table[] = { { USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, + /* Additional MediaTek MT7920 Bluetooth devices */ + { USB_DEVICE(0x0489, 0xe134), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3620), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3621), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, + /* Additional MediaTek MT7921 Bluetooth devices */ { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH },
@@ -638,6 +648,8 @@ static const struct usb_device_id quirks_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe11e), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3603), .driver_info = BTUSB_MEDIATEK |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 342/466 Bluetooth: hci_conn: Use disable_delayed_work_sync
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 2b0f2fc9ed62e73c95df1fa8ed2ba3dac54699df ]
This makes use of disable_delayed_work_sync instead cancel_delayed_work_sync as it not only cancel the ongoing work but also disables new submit which is disarable since the object holding the work is about to be freed.
--- net/bluetooth/hci_conn.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/bluetooth/hci_conn.c +3 -3
@@ -1128,9 +1128,9 @@ void hci_conn_del(struct hci_conn *conn)hci_conn_unlink (conn); -cancel_delayed_work_sync (&conn->disc_work); -cancel_delayed_work_sync (&conn->auto_accept_work); -cancel_delayed_work_sync (&conn->idle_work); +disable_delayed_work_sync (&conn->disc_work); +disable_delayed_work_sync (&conn->auto_accept_work); +disable_delayed_work_sync (&conn->idle_work);if (conn->type ==ACL_LINK ) {/* Unacked frames */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 343/466 Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 3fe288a8214e7dd784d1f9b7c9e448244d316b47 ]
This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/invalid memory past the valid skb->data.
--- net/bluetooth/hci_core.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
net/bluetooth/hci_core.c +9 -4
@@ -3771,18 +3771,22 @@ static void hci_tx_work(struct work_struct *work)/* ACL data packet */ static void hci_acldata_packet (struct hci_dev *hdev,struct sk_buff *skb) { -struct hci_acl_hdr *hdr = (void *) skb->data; +struct hci_acl_hdr *hdr;struct hci_conn *conn;__u16 handle, flags; -skb_pull (skb,HCI_ACL_HDR_SIZE ); + hdr =skb_pull_data (skb,sizeof (*hdr)); +if (!hdr) { +bt_dev_err (hdev,"ACL packet too small" ); + goto drop; + } handle =__le16_to_cpu (hdr->handle); flags =hci_flags (handle); handle =hci_handle (handle); -BT_DBG ("%s len %d handle 0x%4.4x flags 0x%4.4x" , hdev->name, skb->len, - handle, flags); +bt_dev_dbg (hdev,"len %d handle 0x%4.4x flags 0x%4.4x" , skb->len, + handle, flags); hdev->stat.acl_rx++;
@@ -3801,6 +3805,7 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) handle); } +drop:kfree_skb (skb); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 344/466 Bluetooth: Add new quirks for ATS2851
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danil Pylaev <[email protected]>
[ Upstream commit 94464a7b71634037b13d54021e0dfd0fb0d8c1f0 ]
This adds quirks for broken extended create connection, and write auth payload timeout.
--- include/net/bluetooth/hci.h | 14 ++++++++++++++ include/net/bluetooth/hci_core.h | 10 ++++++---- 2 files changed, 20 insertions(+), 4 deletions(-)
include/net/bluetooth/hci.h +14 -0
@@ -301,6 +301,20 @@ enum {*/ HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT , +/* +* When this quirk is set, the HCI_OP_LE_EXT_CREATE_CONN command is +* disabled. This is required for the Actions Semiconductor ATS2851 +* based controllers, which erroneously claims to support it. +*/ +HCI_QUIRK_BROKEN_EXT_CREATE_CONN , + +/* +* When this quirk is set, the command WRITE_AUTH_PAYLOAD_TIMEOUT is +* skipped. This is required for the Actions Semiconductor ATS2851 +* based controllers, due to a race condition in pairing process. +*/ +HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT , +/* When this quirk is set, MSFT extension monitor tracking by * address filter is supported. Since tracking quantity of each * pattern is limited, this feature supports tracking multiple
include/net/bluetooth/hci_core.h +6 -4
@@ -1934,8 +1934,8 @@ void hci_conn_del_sysfs(struct hci_conn *conn); !test_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &(dev)->quirks))/* Use ext create connection if command is supported */ -#define use_ext_conn (dev) ((dev)->commands[37] & 0x80) - +#define use_ext_conn (dev) (((dev)->commands[37] & 0x80) && \ + !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, &(dev)->quirks))/* Extended advertising support */ #define ext_adv_capable (dev) (((dev)->le_features[1] & HCI_LE_EXT_ADV))
@@ -1948,8 +1948,10 @@ void hci_conn_del_sysfs(struct hci_conn *conn);* C24: Mandatory if the LE Controller supports Connection State and either * LE Feature (LL Privacy) or LE Feature (Extended Advertising) is supported */ -#define use_enhanced_conn_complete (dev) (ll_privacy_capable(dev) || \ - ext_adv_capable(dev)) +#define use_enhanced_conn_complete (dev) ((ll_privacy_capable(dev) || \ + ext_adv_capable(dev)) && \ + !test_bit(HCI_QUIRK_BROKEN_EXT_CREATE_CONN, \ + &(dev)->quirks))/* Periodic advertising support */ #define per_adv_capable (dev) (((dev)->le_features[1] & HCI_LE_PERIODIC_ADV))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 345/466 Bluetooth: Support new quirks for ATS2851
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danil Pylaev <[email protected]>
[ Upstream commit 5bd3135924b4570dcecc8793f7771cb8d42d8b19 ]
This adds support for quirks for broken extended create connection, and write auth payload timeout.
--- net/bluetooth/hci_event.c | 7 +++++++ net/bluetooth/hci_sync.c | 9 ++++++++- 2 files changed, 15 insertions(+), 1 deletion(-)
net/bluetooth/hci_event.c +7 -0
@@ -3626,6 +3626,13 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data, goto unlock; } +/* We skip the WRITE_AUTH_PAYLOAD_TIMEOUT for ATS2851 based controllers +* to avoid unexpected SMP command errors when pairing. +*/ +if (test_bit (HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT , + &hdev->quirks)) + goto notify; +/* Set the default Authenticated Payload Timeout after * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
net/bluetooth/hci_sync.c +8 -1
@@ -4842,6 +4842,13 @@ static const struct {HCI_QUIRK_BROKEN (SET_RPA_TIMEOUT ,"HCI LE Set Random Private Address Timeout command is " "advertised, but not supported." ), +HCI_QUIRK_BROKEN (EXT_CREATE_CONN , +"HCI LE Extended Create Connection command is " +"advertised, but not supported." ), +HCI_QUIRK_BROKEN (WRITE_AUTH_PAYLOAD_TIMEOUT , +"HCI WRITE AUTH PAYLOAD TIMEOUT command leads " +"to unexpected SMP errors when pairing " +"and will not be used." ),HCI_QUIRK_BROKEN (LE_CODED ,"HCI LE Coded PHY feature bit is set, " "but its usage is not supported." )
@@ -6477,7 +6484,7 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) &own_addr_type);if (err) goto done; - +/* Send command LE Extended Create Connection if supported */ if (use_ext_conn (hdev)) { err =hci_le_ext_create_conn_sync (hdev, conn, own_addr_type); goto done;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 346/466 Bluetooth: Set quirks for ATS2851
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danil Pylaev <[email protected]>
[ Upstream commit 677a55ba11a82c2835550a82324cec5fcb2f9e2d ]
This adds quirks for broken ats2851 features.
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -3911,6 +3911,8 @@ static int btusb_probe(struct usb_interface *intf,set_bit (HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT , &hdev->quirks);set_bit (HCI_QUIRK_BROKEN_EXT_SCAN , &hdev->quirks);set_bit (HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE , &hdev->quirks); +set_bit (HCI_QUIRK_BROKEN_EXT_CREATE_CONN , &hdev->quirks); +set_bit (HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT , &hdev->quirks); }if (!reset)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 347/466 Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Qin <[email protected]>
[ Upstream commit faa5fd605d2081b6c9fa2355b59582d4ccd24b16 ]
Add VID 0489 & PID e111 for MediaTek MT7925 USB Bluetooth chip.
The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below.
T: Bus=02 Lev=02 Prnt=02 Port=04 Cnt=02 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e111 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -642,6 +642,8 @@ static const struct usb_device_id quirks_table[] = { BTUSB_WIDEBAND_SPEECH },/* Additional MediaTek MT7925 Bluetooth devices */ + { USB_DEVICE(0x0489, 0xe111), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe113), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe118), .driver_info = BTUSB_MEDIATEK |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 348/466 Bluetooth: btusb: Add new VID/PID 0489/e124 for MT7925
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan McCrohan <[email protected]>
[ Upstream commit 679cb60fd60774798719c3e449874a168642a8e6 ]
Add VID 0489 & PID e124 for MediaTek MT7925 USB Bluetooth chip.
The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below.
T: Bus=01 Lev=01 Prnt=01 Port=08 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e124 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
--- drivers/bluetooth/btusb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bluetooth/btusb.c +2 -0
@@ -650,6 +650,8 @@ static const struct usb_device_id quirks_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe11e), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe124), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 349/466 Bluetooth: btusb: Add 3 HWIDs for MT7925
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiande Lu <[email protected]>
[ Upstream commit de7dcf9d1df4b0009735756d0a2adff09c3f21d4 ]
Add below HWIDs for MediaTek MT7925 USB Bluetooth chip. VID 0x0489, PID 0xe14f
VID 0x0489, PID 0xe150
VID 0x0489, PID 0xe151
Patch has been tested successfully and controller is recognized device pair successfully.
MT7925 module bring up message as below.
Bluetooth: Core ver 2.22
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
Bluetooth: hci0: HW/SW Version: 0x00000000, Build Time: 20240816133202
Bluetooth: hci0: Device setup in 286558 usecs
Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
Bluetooth: hci0: AOSP extensions version v1.00
Bluetooth: BNEP (Ethernet Emulation) ver 1.3
Bluetooth: BNEP filters: protocol multicast
Bluetooth: BNEP socket layer initialized
Bluetooth: MGMT ver 1.22
Bluetooth: RFCOMM TTY layer initialized
Bluetooth: RFCOMM socket layer initialized
Bluetooth: RFCOMM ver 1.11
--- drivers/bluetooth/btusb.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/bluetooth/btusb.c +6 -0
@@ -654,6 +654,12 @@ static const struct usb_device_id quirks_table[] = { BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe14f), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe150), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, + { USB_DEVICE(0x0489, 0xe151), .driver_info = BTUSB_MEDIATEK | + BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK | BTUSB_WIDEBAND_SPEECH }, { USB_DEVICE(0x13d3, 0x3603), .driver_info = BTUSB_MEDIATEK |
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 350/466 ASoC: hdmi-codec: reorder channel allocation list
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 82ff5abc2edcfba0c0f1a1be807795e2876f46e9 ]
The ordering in hdmi_codec_get_ch_alloc_table_idx() results in wrong channel allocation for a number of cases, e.g. when ELD reports FL|FR|LFE|FC|RL|RR or FL|FR|LFE|FC|RL|RR|RC|RLC|RRC:
ca_id 0x01 with speaker mask FL|FR|LFE is selected instead of ca_id 0x03 with speaker mask FL|FR|LFE|FC for 4 channels
and
ca_id 0x04 with speaker mask FL|FR|RC gets selected instead of ca_id 0x0b with speaker mask FL|FR|LFE|FC|RL|RR for 6 channels
Fix this by reordering the channel allocation list with most specific speaker masks at the top.
--- sound/soc/codecs/hdmi-codec.c | 140 +++++++++++++++++++--------------- 1 file changed, 77 insertions(+), 63 deletions(-)
sound/soc/codecs/hdmi-codec.c +77 -63
@@ -185,84 +185,97 @@ static const struct snd_pcm_chmap_elem hdmi_codec_8ch_chmaps[] = {/* * hdmi_codec_channel_alloc: speaker configuration available for CEA * -* This is an ordered list that must match with hdmi_codec_8ch_chmaps struct +* This is an ordered list where ca_id must exist in hdmi_codec_8ch_chmaps * The preceding ones have better chances to be selected by * hdmi_codec_get_ch_alloc_table_idx(). */ static const struct hdmi_codec_cea_spk_alloc hdmi_codec_channel_alloc[] = { { .ca_id =0x00 , .n_ch =2 , - .mask =FL |FR }, -/* 2.1 */ - { .ca_id =0x01 , .n_ch =4 , - .mask =FL |FR |LFE }, -/* Dolby Surround */ + .mask =FL |FR }, + { .ca_id =0x03 , .n_ch =4 , + .mask =FL |FR |LFE |FC }, { .ca_id =0x02 , .n_ch =4 , .mask =FL |FR |FC }, -/* surround51 */ + { .ca_id =0x01 , .n_ch =4 , + .mask =FL |FR |LFE }, { .ca_id =0x0b , .n_ch =6 , - .mask =FL |FR |LFE |FC |RL |RR }, -/* surround40 */ - { .ca_id =0x08 , .n_ch =6 , - .mask =FL |FR |RL |RR }, -/* surround41 */ - { .ca_id =0x09 , .n_ch =6 , - .mask =FL |FR |LFE |RL |RR }, -/* surround50 */ + .mask =FL |FR |LFE |FC |RL |RR }, { .ca_id =0x0a , .n_ch =6 , .mask =FL |FR |FC |RL |RR }, -/* 6.1 */ - { .ca_id =0x0f , .n_ch =8 , - .mask =FL |FR |LFE |FC |RL |RR |RC }, -/* surround71 */ + { .ca_id =0x09 , .n_ch =6 , + .mask =FL |FR |LFE |RL |RR }, + { .ca_id =0x08 , .n_ch =6 , + .mask =FL |FR |RL |RR }, + { .ca_id =0x07 , .n_ch =6 , + .mask =FL |FR |LFE |FC |RC }, + { .ca_id =0x06 , .n_ch =6 , + .mask =FL |FR |FC |RC }, + { .ca_id =0x05 , .n_ch =6 , + .mask =FL |FR |LFE |RC }, + { .ca_id =0x04 , .n_ch =6 , + .mask =FL |FR |RC }, { .ca_id =0x13 , .n_ch =8 , .mask =FL |FR |LFE |FC |RL |RR |RLC |RRC }, -/* others */ - { .ca_id =0x03 , .n_ch =8 , - .mask =FL |FR |LFE |FC }, - { .ca_id =0x04 , .n_ch =8 , - .mask =FL |FR |RC }, - { .ca_id =0x05 , .n_ch =8 , - .mask =FL |FR |LFE |RC }, - { .ca_id =0x06 , .n_ch =8 , - .mask =FL |FR |FC |RC }, - { .ca_id =0x07 , .n_ch =8 , - .mask =FL |FR |LFE |FC |RC }, - { .ca_id =0x0c , .n_ch =8 , - .mask =FL |FR |RC |RL |RR }, - { .ca_id =0x0d , .n_ch =8 , - .mask =FL |FR |LFE |RL |RR |RC }, - { .ca_id =0x0e , .n_ch =8 , - .mask =FL |FR |FC |RL |RR |RC }, - { .ca_id =0x10 , .n_ch =8 , - .mask =FL |FR |RL |RR |RLC |RRC }, - { .ca_id =0x11 , .n_ch =8 , - .mask =FL |FR |LFE |RL |RR |RLC |RRC }, + { .ca_id =0x1f , .n_ch =8 , + .mask =FL |FR |LFE |FC |RL |RR |FLC |FRC }, { .ca_id =0x12 , .n_ch =8 , .mask =FL |FR |FC |RL |RR |RLC |RRC }, - { .ca_id =0x14 , .n_ch =8 , - .mask =FL |FR |FLC |FRC }, - { .ca_id =0x15 , .n_ch =8 , - .mask =FL |FR |LFE |FLC |FRC }, - { .ca_id =0x16 , .n_ch =8 , - .mask =FL |FR |FC |FLC |FRC }, - { .ca_id =0x17 , .n_ch =8 , - .mask =FL |FR |LFE |FC |FLC |FRC }, - { .ca_id =0x18 , .n_ch =8 , - .mask =FL |FR |RC |FLC |FRC }, - { .ca_id =0x19 , .n_ch =8 , - .mask =FL |FR |LFE |RC |FLC |FRC }, - { .ca_id =0x1a , .n_ch =8 , - .mask =FL |FR |RC |FC |FLC |FRC }, - { .ca_id =0x1b , .n_ch =8 , - .mask =FL |FR |LFE |RC |FC |FLC |FRC }, - { .ca_id =0x1c , .n_ch =8 , - .mask =FL |FR |RL |RR |FLC |FRC }, - { .ca_id =0x1d , .n_ch =8 , - .mask =FL |FR |LFE |RL |RR |FLC |FRC }, { .ca_id =0x1e , .n_ch =8 , .mask =FL |FR |FC |RL |RR |FLC |FRC }, - { .ca_id =0x1f , .n_ch =8 , - .mask =FL |FR |LFE |FC |RL |RR |FLC |FRC }, + { .ca_id =0x11 , .n_ch =8 , + .mask =FL |FR |LFE |RL |RR |RLC |RRC }, + { .ca_id =0x1d , .n_ch =8 , + .mask =FL |FR |LFE |RL |RR |FLC |FRC }, + { .ca_id =0x10 , .n_ch =8 , + .mask =FL |FR |RL |RR |RLC |RRC }, + { .ca_id =0x1c , .n_ch =8 , + .mask =FL |FR |RL |RR |FLC |FRC }, + { .ca_id =0x0f , .n_ch =8 , + .mask =FL |FR |LFE |FC |RL |RR |RC }, + { .ca_id =0x1b , .n_ch =8 , + .mask =FL |FR |LFE |RC |FC |FLC |FRC }, + { .ca_id =0x0e , .n_ch =8 , + .mask =FL |FR |FC |RL |RR |RC }, + { .ca_id =0x1a , .n_ch =8 , + .mask =FL |FR |RC |FC |FLC |FRC }, + { .ca_id =0x0d , .n_ch =8 , + .mask =FL |FR |LFE |RL |RR |RC }, + { .ca_id =0x19 , .n_ch =8 , + .mask =FL |FR |LFE |RC |FLC |FRC }, + { .ca_id =0x0c , .n_ch =8 , + .mask =FL |FR |RC |RL |RR }, + { .ca_id =0x18 , .n_ch =8 , + .mask =FL |FR |RC |FLC |FRC }, + { .ca_id =0x17 , .n_ch =8 , + .mask =FL |FR |LFE |FC |FLC |FRC }, + { .ca_id =0x16 , .n_ch =8 , + .mask =FL |FR |FC |FLC |FRC }, + { .ca_id =0x15 , .n_ch =8 , + .mask =FL |FR |LFE |FLC |FRC }, + { .ca_id =0x14 , .n_ch =8 , + .mask =FL |FR |FLC |FRC }, + { .ca_id =0x0b , .n_ch =8 , + .mask =FL |FR |LFE |FC |RL |RR }, + { .ca_id =0x0a , .n_ch =8 , + .mask =FL |FR |FC |RL |RR }, + { .ca_id =0x09 , .n_ch =8 , + .mask =FL |FR |LFE |RL |RR }, + { .ca_id =0x08 , .n_ch =8 , + .mask =FL |FR |RL |RR }, + { .ca_id =0x07 , .n_ch =8 , + .mask =FL |FR |LFE |FC |RC }, + { .ca_id =0x06 , .n_ch =8 , + .mask =FL |FR |FC |RC }, + { .ca_id =0x05 , .n_ch =8 , + .mask =FL |FR |LFE |RC }, + { .ca_id =0x04 , .n_ch =8 , + .mask =FL |FR |RC }, + { .ca_id =0x03 , .n_ch =8 , + .mask =FL |FR |LFE |FC }, + { .ca_id =0x02 , .n_ch =8 , + .mask =FL |FR |FC }, + { .ca_id =0x01 , .n_ch =8 , + .mask =FL |FR |LFE }, };struct hdmi_codec_priv {
@@ -371,7 +384,8 @@ static int hdmi_codec_chmap_ctl_get(struct snd_kcontrol *kcontrol,struct snd_pcm_chmap *info =snd_kcontrol_chip (kcontrol);struct hdmi_codec_priv *hcp = info->private_data; - map = info->chmap[hcp->chmap_idx].map; +if (hcp->chmap_idx !=HDMI_CODEC_CHMAP_IDX_UNKNOWN ) + map = info->chmap[hcp->chmap_idx].map;for (i =0 ; i < info->max_channels; i++) {if (hcp->chmap_idx ==HDMI_CODEC_CHMAP_IDX_UNKNOWN )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 351/466 rocker: fix link status detection in rocker_carrier_init()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit e64285ff41bb7a934bd815bd38f31119be62ac37 ]
Since '1 << rocker_port->pport' may be undefined for port >= 32, cast the left operand to 'unsigned long long' like it's done in 'rocker_port_set_enable()' above. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/rocker/rocker_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/rocker/rocker_main.c +1 -1
@@ -2502,7 +2502,7 @@ static void rocker_carrier_init(const struct rocker_port *rocker_port)u64 link_status =rocker_read64 (rocker,PORT_PHYS_LINK_STATUS );bool link_up; - link_up = link_status & (1 << rocker_port->pport); + link_up = link_status & (1ULL << rocker_port->pport);if (link_up)netif_carrier_on (rocker_port->dev);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 352/466 net/neighbor: clear error in case strict check is not set
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 0de6a472c3b38432b2f184bd64eb70d9ea36d107 ]
Commit 51183d233b5a ("net/neighbor: Update neigh_dump_info for strict data checking") added strict checking. The err variable is not cleared, so if we find no table to dump we will return the validation error even if user did not want strict checking.
I think the only way to hit this is to send an buggy request, and ask for a table which doesn't exist, so there's no point treating this as a real fix. I only noticed it because a syzbot repro depended on it to trigger another bug.
--- net/core/neighbour.c | 1 + 1 file changed, 1 insertion(+)
net/core/neighbour.c +1 -0
@@ -2876,6 +2876,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb) err =neigh_valid_dump_req (nlh, cb->strict_check, &filter, cb->extack);if (err <0 && cb->strict_check)return err; + err =0 ; s_t = cb->args[0 ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 353/466 netpoll: Use rcu_access_pointer() in __netpoll_setup
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <[email protected]>
[ Upstream commit c69c5e10adb903ae2438d4f9c16eccf43d1fcbc1 ]
The ndev->npinfo pointer in __netpoll_setup() is RCU-protected but is being accessed directly for a NULL check. While no RCU read lock is held in this context, we should still use proper RCU primitives for consistency and correctness.
Replace the direct NULL check with rcu_access_pointer(), which is the appropriate primitive when only checking for NULL without dereferencing the pointer. This function provides the necessary ordering guarantees without requiring RCU read-side protection.
--- net/core/netpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/netpoll.c +1 -1
@@ -626,7 +626,7 @@ int __netpoll_setup(struct netpoll *np, struct net_device *ndev) goto out; } -if (!ndev->npinfo) { +if (!rcu_access_pointer (ndev->npinfo)) { npinfo =kmalloc (sizeof (*npinfo),GFP_KERNEL );if (!npinfo) { err = -ENOMEM ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 354/466 pinctrl: freescale: fix COMPILE_TEST error with PINCTRL_IMX_SCU
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esben Haabendal <[email protected]>
[ Upstream commit 58414a31c5713afb5449fd74a26a843d34cc62e8 ]
When PINCTRL_IMX_SCU was selected by PINCTRL_IMX8DXL or PINCTRL_IMX8QM combined with COMPILE_TEST on a non-arm platforms, the IMX_SCU dependency could not be enabled.
--- drivers/pinctrl/freescale/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/freescale/Kconfig +1 -1
@@ -20,7 +20,7 @@ config PINCTRL_IMX_SCMI config PINCTRL_IMX_SCU tristate - depends on IMX_SCU + depends on IMX_SCU || COMPILE_TEST select PINCTRL_IMX config PINCTRL_IMX1_CORE
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 355/466 rtla: Fix consistency in getopt_long for timerlat_hist
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriele Monaco <[email protected]>
[ Upstream commit cfb1ea216c1656a4112becbc4bf757891933b902 ]
Commit e9a4062e1527 ("rtla: Add --trace-buffer-size option") adds a new long option to rtla utilities, but among all affected files, timerlat_hist misses a trailing : in the corresponding short option inside the getopt string (e.g. \3:). This patch propagates the :.
Although this change is not functionally required, it improves consistency and slightly reduces the likelihood a future change would introduce a problem.
--- tools/tracing/rtla/src/timerlat_hist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/tracing/rtla/src/timerlat_hist.c +1 -1
@@ -778,7 +778,7 @@ static struct timerlat_hist_params/* getopt_long stores the option index here. */ int option_index =0 ; - c =getopt_long (argc, argv,"a:c:C::b:d:e:E:DhH:i:knp:P:s:t::T:uU0123456:7:8:9\1\2:\3" , + c =getopt_long (argc, argv,"a:c:C::b:d:e:E:DhH:i:knp:P:s:t::T:uU0123456:7:8:9\1\2:\3:" , long_options, &option_index);/* detect the end of the options. */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 356/466 tracing/ftrace: disable preemption in syscall probe
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Desnoyers <[email protected]>
[ Upstream commit 13d750c2c03e9861e15268574ed2c239cca9c9d5 ]
In preparation for allowing system call enter/exit instrumentation to handle page faults, make sure that ftrace can handle this change by explicitly disabling preemption within the ftrace system call tracepoint probes to respect the current expectations within ftrace ring buffer code.
This change does not yet allow ftrace to take page faults per se within its probe, but allows its existing probes to adapt to the upcoming change.
--- include/trace/trace_events.h | 36 +++++++++++++++++++++++++++++++---- kernel/trace/trace_syscalls.c | 12 ++++++++++++ 2 files changed, 44 insertions(+), 4 deletions(-)
include/trace/trace_events.h +32 -4
@@ -244,6 +244,9 @@ static struct trace_event_fields trace_event_fields_##call[] = { \ tstruct \ {} }; +#undef DECLARE_EVENT_SYSCALL_CLASS +#define DECLARE_EVENT_SYSCALL_CLASS DECLARE_EVENT_CLASS +#undef DEFINE_EVENT_PRINT#define DEFINE_EVENT_PRINT (template, name, proto, args, print)
@@ -374,11 +377,11 @@ static inline notrace int trace_event_get_offsets_##call( \#include "stages/stage6_event_callback.h" -#undef DECLARE_EVENT_CLASS -#define DECLARE_EVENT_CLASS (call, proto, args, tstruct, assign, print) \ - \ + +#undef __DECLARE_EVENT_CLASS +#define __DECLARE_EVENT_CLASS (call, proto, args, tstruct, assign, print) \ static notrace void \ -trace_event_raw_event_##call(void *__data, proto) \ +do_trace_event_raw_event_##call(void *__data, proto) \ { \ struct trace_event_file *trace_file = __data; \ struct trace_event_data_offsets_##call __maybe_unused __data_offsets;\
@@ -403,6 +406,29 @@ trace_event_raw_event_##call(void *__data, proto) \ \trace_event_buffer_commit (&fbuffer); \ } + +#undef DECLARE_EVENT_CLASS +#define DECLARE_EVENT_CLASS (call, proto, args, tstruct, assign, print) \ +__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \ + PARAMS(assign), PARAMS(print)) \ +static notrace void \ +trace_event_raw_event_##call(void *__data, proto) \ +{ \ + do_trace_event_raw_event_##call(__data, args); \ +} + +#undef DECLARE_EVENT_SYSCALL_CLASS +#define DECLARE_EVENT_SYSCALL_CLASS (call, proto, args, tstruct, assign, print) \ +__DECLARE_EVENT_CLASS(call, PARAMS(proto), PARAMS(args), PARAMS(tstruct), \ + PARAMS(assign), PARAMS(print)) \ +static notrace void \ +trace_event_raw_event_##call(void *__data, proto) \ +{ \ + preempt_disable_notrace(); \ + do_trace_event_raw_event_##call(__data, args); \ + preempt_enable_notrace(); \ +} +/* * The ftrace_test_probe is compiled out, it is only here as a build time check * to make sure that if the tracepoint handling changes, the ftrace probe will
@@ -418,6 +444,8 @@ static inline void ftrace_test_probe_##call(void) \#include TRACE_INCLUDE (TRACE_INCLUDE_FILE ) +#undef __DECLARE_EVENT_CLASS +#include "stages/stage7_class_define.h" #undef DECLARE_EVENT_CLASS
kernel/trace/trace_syscalls.c +12 -0
@@ -299,6 +299,12 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)int syscall_nr;int size; +/* +* Syscall probe called with preemption enabled, but the ring +* buffer and per-cpu data require preemption to be disabled. +*/ +guard (preempt_notrace)(); + syscall_nr =trace_get_syscall_nr (current, regs);if (syscall_nr <0 || syscall_nr >= NR_syscalls)return ;
@@ -338,6 +344,12 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)struct trace_event_buffer fbuffer;int syscall_nr; +/* +* Syscall probe called with preemption enabled, but the ring +* buffer and per-cpu data require preemption to be disabled. +*/ +guard (preempt_notrace)(); + syscall_nr =trace_get_syscall_nr (current, regs);if (syscall_nr <0 || syscall_nr >= NR_syscalls)return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 357/466 tracing: Use atomic64_inc_return() in trace_clock_counter()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uros Bizjak <[email protected]>
[ Upstream commit eb887c4567d1b0e7684c026fe7df44afa96589e6 ]
Use atomic64_inc_return(&ref) instead of atomic64_add_return(1, &ref) to use optimized implementation and ease register pressure around the primitive for targets that implement optimized variant.
--- kernel/trace/trace_clock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_clock.c +1 -1
@@ -154,5 +154,5 @@ static atomic64_t trace_counter;*/ u64 notrace trace_clock_counter(void) { -return atomic64_add_return (1 , &trace_counter); +return atomic64_inc_return (&trace_counter); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 358/466 tools/rtla: fix collision with glibc sched_attr/sched_set_attr
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Stancek <[email protected]>
[ Upstream commit 0eecee340672c4b512f6f4a8c6add26df05d130c ]
glibc commit 21571ca0d703 ("Linux: Add the sched_setattr and sched_getattr functions") now also provides 'struct sched_attr' and sched_setattr() which collide with the ones from rtla.
In file included from src/trace.c:11:
src/utils.h:49:8: error: redefinition of ‘struct sched_attr’
49 | struct sched_attr {
| ^~~~~~~~~~
In file included from /usr/include/bits/sched.h:60,
from /usr/include/sched.h:43,
from /usr/include/tracefs/tracefs.h:10,
from src/trace.c:4:
/usr/include/linux/sched/types.h:98:8: note: originally defined here
98 | struct sched_attr {
| ^~~~~~~~~~Define 'struct sched_attr' conditionally, similar to what strace did:
https://lore.kernel.org/all/[email protected]/
and rename rtla's version of sched_setattr() to avoid collision.
--- tools/tracing/rtla/src/utils.c | 4 ++-- tools/tracing/rtla/src/utils.h | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-)
tools/tracing/rtla/src/utils.c +2 -2
@@ -233,7 +233,7 @@ long parse_ns_duration(char *val)#define SCHED_DEADLINE 6 -static inline int sched_setattr (pid_t pid,const struct sched_attr *attr, +static inline int syscall_sched_setattr (pid_t pid,const struct sched_attr *attr,unsigned int flags) {return syscall (__NR_sched_setattr, pid, attr, flags); }
@@ -243,7 +243,7 @@ int __set_sched_attr(int pid, struct sched_attr *attr)int flags =0 ;int retval; - retval =sched_setattr (pid, attr, flags); + retval =syscall_sched_setattr (pid, attr, flags);if (retval <0 ) {err_msg ("Failed to set sched attributes to the pid %d: %s\n" , pid,strerror (errno));
tools/tracing/rtla/src/utils.h +2 -0
@@ -46,6 +46,7 @@ update_sum(unsigned long long *a, unsigned long long *b) *a += *b; } +#ifndef SCHED_ATTR_SIZE_VER0 struct sched_attr { uint32_t size; uint32_t sched_policy;
@@ -56,6 +57,7 @@ struct sched_attr {uint64_t sched_deadline; uint64_t sched_period; }; +#endif /* SCHED_ATTR_SIZE_VER0 */ int parse_prio (char *arg,struct sched_attr *sched_param);int parse_cpu_set (char *cpu_list,cpu_set_t *set);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 359/466 rtla/timerlat: Make timerlat_top_cpu->*_count unsigned long long
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit 4eba4723c5254ba8251ecb7094a5078d5c300646 ]
Most fields of struct timerlat_top_cpu are unsigned long long, but the fields {irq,thread,user}_count are int (32-bit signed).
This leads to overflow when tracing on a large number of CPUs for a long enough time:
$ rtla timerlat top -a20 -c 1-127 -d 12h ... 0 12:00:00 | IRQ Timer Latency (us) | Thread Timer Latency (us) CPU COUNT | cur min avg max | cur min avg max 1 #43200096 | 0 0 1 2 | 3 2 6 12 ... 127 #43200096 | 0 0 1 2 | 3 2 5 11 ALL #119144 e4 | 0 5 4 | 2 28 16
The average latency should be 0-1 for IRQ and 5-6 for thread, but is reported as 5 and 28, about 4 to 5 times more, due to the count overflowing when summed over all CPUs: 43200096 * 127 = 5486412192, however, 1191444898 (= 5486412192 mod MAX_INT) is reported instead, as seen on the last line of the output, and the averages are thus ~4.6 times higher than they should be (5486412192 / 1191444898 = ~4.6).
Fix the issue by changing {irq,thread,user}_count fields to unsigned long long, similarly to other fields in struct timerlat_top_cpu and to the count variable in timerlat_top_print_sum.
--- tools/tracing/rtla/src/timerlat_top.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/tracing/rtla/src/timerlat_top.c +4 -4
@@ -54,9 +54,9 @@ struct timerlat_top_params { };struct timerlat_top_cpu { -int irq_count; -int thread_count; -int user_count; +unsigned long long irq_count; +unsigned long long thread_count; +unsigned long long user_count;unsigned long long cur_irq;unsigned long long min_irq;
@@ -280,7 +280,7 @@ static void timerlat_top_print(struct osnoise_tool *top, int cpu)/* * Unless trace is being lost, IRQ counter is always the max. */ -trace_seq_printf (s,"%3d #%-9d |" , cpu, cpu_data->irq_count); +trace_seq_printf (s,"%3d #%-9llu |" , cpu, cpu_data->irq_count);if (!cpu_data->irq_count) {trace_seq_printf (s,"%s %s %s %s |" , no_value, no_value, no_value, no_value);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 360/466 rtla/timerlat: Make timerlat_hist_cpu->*_count unsigned long long
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Glozar <[email protected]>
[ Upstream commit 76b3102148135945b013797fac9b206273f0f777 ]
Do the same fix as in previous commit also for timerlat-hist.
--- tools/tracing/rtla/src/timerlat_hist.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
tools/tracing/rtla/src/timerlat_hist.c +9 -9
@@ -62,9 +62,9 @@ struct timerlat_hist_cpu {int *thread;int *user; -int irq_count; -int thread_count; -int user_count; +unsigned long long irq_count; +unsigned long long thread_count; +unsigned long long user_count;unsigned long long min_irq;unsigned long long sum_irq;
@@ -304,15 +304,15 @@ timerlat_print_summary(struct timerlat_hist_params *params,continue ;if (!params->no_irq) -trace_seq_printf (trace->seq,"%9d " , +trace_seq_printf (trace->seq,"%9llu " , data->hist[cpu].irq_count);if (!params->no_thread) -trace_seq_printf (trace->seq,"%9d " , +trace_seq_printf (trace->seq,"%9llu " , data->hist[cpu].thread_count);if (params->user_hist) -trace_seq_printf (trace->seq,"%9d " , +trace_seq_printf (trace->seq,"%9llu " , data->hist[cpu].user_count); }trace_seq_printf (trace->seq,"\n" );
@@ -488,15 +488,15 @@ timerlat_print_stats_all(struct timerlat_hist_params *params,trace_seq_printf (trace->seq,"count:" );if (!params->no_irq) -trace_seq_printf (trace->seq,"%9d " , +trace_seq_printf (trace->seq,"%9llu " , sum.irq_count);if (!params->no_thread) -trace_seq_printf (trace->seq,"%9d " , +trace_seq_printf (trace->seq,"%9llu " , sum.thread_count);if (params->user_hist) -trace_seq_printf (trace->seq,"%9d " , +trace_seq_printf (trace->seq,"%9llu " , sum.user_count);trace_seq_printf (trace->seq,"\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 361/466 scsi: hisi_sas: Add cond_resched() for no forced preemption model
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit 2233c4a0b948211743659b24c13d6bd059fa75fc ]
For no forced preemption model kernel, in the scenario where the expander is connected to 12 high performance SAS SSDs, the following call trace may occur:
[ 214.409199][ C240] watchdog: BUG: soft lockup - CPU#240 stuck for 22s! [irq/149-hisi_sa:3211] [ 214.568533][ C240] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 214.575224][ C240] pc : fput_many+0x8c/0xdc [ 214.579480][ C240] lr : fput+0x1c/0xf0 [ 214.583302][ C240] sp : ffff80002de2b900 [ 214.587298][ C240] x29: ffff80002de2b900 x28: ffff1082aa412000 [ 214.593291][ C240] x27: ffff3062a0348c08 x26: ffff80003a9f6000 [ 214.599284][ C240] x25: ffff1062bbac5c40 x24: 0000000000001000 [ 214.605277][ C240] x23: 000000000000000a x22: 0000000000000001 [ 214.611270][ C240] x21: 0000000000001000 x20: 0000000000000000 [ 214.617262][ C240] x19: ffff3062a41ae580 x18: 0000000000010000 [ 214.623255][ C240] x17: 0000000000000001 x16: ffffdb3a6efe5fc0 [ 214.629248][ C240] x15: ffffffffffffffff x14: 0000000003ffffff [ 214.635241][ C240] x13: 000000000000ffff x12: 000000000000029c [ 214.641234][ C240] x11: 0000000000000006 x10: ffff80003a9f7fd0 [ 214.647226][ C240] x9 : ffffdb3a6f0482fc x8 : 0000000000000001 [ 214.653219][ C240] x7 : 0000000000000002 x6 : 0000000000000080 [ 214.659212][ C240] x5 : ffff55480ee9b000 x4 : fffffde7f94c6554 [ 214.665205][ C240] x3 : 0000000000000002 x2 : 0000000000000020 [ 214.671198][ C240] x1 : 0000000000000021 x0 : ffff3062a41ae5b8 [ 214.677191][ C240] Call trace: [ 214.680320][ C240] fput_many+0x8c/0xdc [ 214.684230][ C240] fput+0x1c/0xf0 [ 214.687707][ C240] aio_complete_rw+0xd8/0x1fc [ 214.692225][ C240] blkdev_bio_end_io+0x98/0x140 [ 214.696917][ C240] bio_endio+0x160/0x1bc [ 214.701001][ C240] blk_update_request+0x1c8/0x3bc [ 214.705867][ C240] scsi_end_request+0x3c/0x1f0 [ 214.710471][ C240] scsi_io_completion+0x7c/0x1a0 [ 214.715249][ C240] scsi_finish_command+0x104/0x140 [ 214.720200][ C240] scsi_softirq_done+0x90/0x180 [ 214.724892][ C240] blk_mq_complete_request+0x5c/0x70 [ 214.730016][ C240] scsi_mq_done+0x48/0xac [ 214.734194][ C240] sas_scsi_task_done+0xbc/0x16c [libsas] [ 214.739758][ C240] slot_complete_v3_hw+0x260/0x760 [hisi_sas_v3_hw] [ 214.746185][ C240] cq_thread_v3_hw+0xbc/0x190 [hisi_sas_v3_hw] [ 214.752179][ C240] irq_thread_fn+0x34/0xa4 [ 214.756435][ C240] irq_thread+0xc4/0x130 [ 214.760520][ C240] kthread+0x108/0x13c [ 214.764430][ C240] ret_from_fork+0x10/0x18
This is because in the hisi_sas driver, both the hardware interrupt handler and the interrupt thread are executed on the same CPU. In the performance test scenario, function irq_wait_for_interrupt() will always return 0 if lots of interrupts occurs and the CPU will be continuously consumed. As a result, the CPU cannot run the watchdog thread. When the watchdog time exceeds the specified time, call trace occurs.
To fix it, add cond_resched() to execute the watchdog thread.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -0
@@ -2493,6 +2493,7 @@ static int complete_v3_hw(struct hisi_sas_cq *cq)/* update rd_point */ cq->rd_point = rd_point;hisi_sas_write32 (hisi_hba,COMPL_Q_0_RD_PTR + (0x14 * queue), rd_point); +cond_resched ();return completed; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 362/466 scsi: hisi_sas: Create all dump files during debugfs initialization
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit 9f564f15f88490b484e02442dc4c4b11640ea172 ]
For the current debugfs of hisi_sas, after user triggers dump, the driver allocate memory space to save the register information and create debugfs files to display the saved information. In this process, the debugfs files created after each dump.
Therefore, when the dump is triggered while the driver is unbind, the following hang occurs:
[67840.853907] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [67840.862947] Mem abort info: [67840.865855] ESR = 0x0000000096000004 [67840.869713] EC = 0x25: DABT (current EL), IL = 32 bits [67840.875125] SET = 0, FnV = 0 [67840.878291] EA = 0, S1PTW = 0 [67840.881545] FSC = 0x04: level 0 translation fault [67840.886528] Data abort info: [67840.889524] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [67840.895117] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [67840.900284] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [67840.905709] user pgtable: 4k pages, 48-bit VAs, pgdp=0000002803a1f000 [67840.912263] [00000000000000a0] pgd=0000000000000000, p4d=0000000000000000 [67840.919177] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [67840.996435] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [67841.003628] pc : down_write+0x30/0x98 [67841.007546] lr : start_creating.part.0+0x60/0x198 [67841.012495] sp : ffff8000b979ba20 [67841.016046] x29: ffff8000b979ba20 x28: 0000000000000010 x27: 0000000000024b40 [67841.023412] x26: 0000000000000012 x25: ffff20202b355ae8 x24: ffff20202b35a8c8 [67841.030779] x23: ffffa36877928208 x22: ffffa368b4972240 x21: ffff8000b979bb18 [67841.038147] x20: ffff00281dc1e3c0 x19: fffffffffffffffe x18: 0000000000000020 [67841.045515] x17: 0000000000000000 x16: ffffa368b128a530 x15: ffffffffffffffff [67841.052888] x14: ffff8000b979bc18 x13: ffffffffffffffff x12: ffff8000b979bb18 [67841.060263] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa368b1289b18 [67841.067640] x8 : 0000000000000012 x7 : 0000000000000000 x6 : 00000000000003a9 [67841.075014] x5 : 0000000000000000 x4 : ffff002818c5cb00 x3 : 0000000000000001 [67841.082388] x2 : 0000000000000000 x1 : ffff002818c5cb00 x0 : 00000000000000a0 [67841.089759] Call trace: [67841.092456] down_write+0x30/0x98 [67841.096017] start_creating.part.0+0x60/0x198 [67841.100613] debugfs_create_dir+0x48/0x1f8 [67841.104950] debugfs_create_files_v3_hw+0x88/0x348 [hisi_sas_v3_hw] [67841.111447] debugfs_snapshot_regs_v3_hw+0x708/0x798 [hisi_sas_v3_hw] [67841.118111] debugfs_trigger_dump_v3_hw_write+0x9c/0x120 [hisi_sas_v3_hw] [67841.125115] full_proxy_write+0x68/0xc8 [67841.129175] vfs_write+0xd8/0x3f0 [67841.132708] ksys_write+0x70/0x108 [67841.136317] __arm64_sys_write+0x24/0x38 [67841.140440] invoke_syscall+0x50/0x128 [67841.144385] el0_svc_common.constprop.0+0xc8/0xf0 [67841.149273] do_el0_svc+0x24/0x38 [67841.152773] el0_svc+0x38/0xd8 [67841.156009] el0t_64_sync_handler+0xc0/0xc8 [67841.160361] el0t_64_sync+0x1a4/0x1a8 [67841.164189] Code: b9000882 d2800002 d2800023 f9800011 (c85ffc05) [67841.170443] ---[ end trace 0000000000000000 ]---
To fix this issue, create all directories and files during debugfs initialization. In this way, the driver only needs to allocate memory space to save information each time the user triggers dumping.
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 99 ++++++++++++++++++++------ 1 file changed, 77 insertions(+), 22 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +77 -22
@@ -3551,6 +3551,11 @@ debugfs_to_reg_name_v3_hw(int off, int base_off,return NULL ; } +static bool debugfs_dump_is_generated_v3_hw (void *p) +{ +return p ? true : false; +} +static void debugfs_print_reg_v3_hw (u32 *regs_val,struct seq_file *s,const struct hisi_sas_debugfs_reg *reg) {
@@ -3576,6 +3581,9 @@ static int debugfs_global_v3_hw_show(struct seq_file *s, void *p) {struct hisi_sas_debugfs_regs *global = s->private; +if (!debugfs_dump_is_generated_v3_hw (global->data)) +return -EPERM ; +debugfs_print_reg_v3_hw (global->data, s, &debugfs_global_reg);
@@ -3587,6 +3595,9 @@ static int debugfs_axi_v3_hw_show(struct seq_file *s, void *p) {struct hisi_sas_debugfs_regs *axi = s->private; +if (!debugfs_dump_is_generated_v3_hw (axi->data)) +return -EPERM ; +debugfs_print_reg_v3_hw (axi->data, s, &debugfs_axi_reg);
@@ -3598,6 +3609,9 @@ static int debugfs_ras_v3_hw_show(struct seq_file *s, void *p) {struct hisi_sas_debugfs_regs *ras = s->private; +if (!debugfs_dump_is_generated_v3_hw (ras->data)) +return -EPERM ; +debugfs_print_reg_v3_hw (ras->data, s, &debugfs_ras_reg);
@@ -3610,6 +3624,9 @@ static int debugfs_port_v3_hw_show(struct seq_file *s, void *p)struct hisi_sas_debugfs_port *port = s->private;const struct hisi_sas_debugfs_reg *reg_port = &debugfs_port_reg; +if (!debugfs_dump_is_generated_v3_hw (port->data)) +return -EPERM ; +debugfs_print_reg_v3_hw (port->data, s, reg_port);return 0 ;
@@ -3665,6 +3682,9 @@ static int debugfs_cq_v3_hw_show(struct seq_file *s, void *p)struct hisi_sas_debugfs_cq *debugfs_cq = s->private;int slot; +if (!debugfs_dump_is_generated_v3_hw (debugfs_cq->complete_hdr)) +return -EPERM ; +for (slot =0 ; slot <HISI_SAS_QUEUE_SLOTS ; slot++)debugfs_cq_show_slot_v3_hw (s, slot, debugfs_cq);
@@ -3686,8 +3706,12 @@ static void debugfs_dq_show_slot_v3_hw(struct seq_file *s, int slot,static int debugfs_dq_v3_hw_show (struct seq_file *s,void *p) { +struct hisi_sas_debugfs_dq *debugfs_dq = s->private;int slot; +if (!debugfs_dump_is_generated_v3_hw (debugfs_dq->hdr)) +return -EPERM ; +for (slot =0 ; slot <HISI_SAS_QUEUE_SLOTS ; slot++)debugfs_dq_show_slot_v3_hw (s, slot, s->private);
@@ -3701,6 +3725,9 @@ static int debugfs_iost_v3_hw_show(struct seq_file *s, void *p)struct hisi_sas_iost *iost = debugfs_iost->iost;int i, max_command_entries =HISI_SAS_MAX_COMMANDS ; +if (!debugfs_dump_is_generated_v3_hw (iost)) +return -EPERM ; +for (i =0 ; i < max_command_entries; i++, iost++) {__le64 *data = &iost->qw0;
@@ -3720,6 +3747,9 @@ static int debugfs_iost_cache_v3_hw_show(struct seq_file *s, void *p)int i, tab_idx;__le64 *iost; +if (!debugfs_dump_is_generated_v3_hw (iost_cache)) +return -EPERM ; +for (i =0 ; i <HISI_SAS_IOST_ITCT_CACHE_NUM ; i++, iost_cache++) {/* * Data struct of IOST cache:
@@ -3743,6 +3773,9 @@ static int debugfs_itct_v3_hw_show(struct seq_file *s, void *p)struct hisi_sas_debugfs_itct *debugfs_itct = s->private;struct hisi_sas_itct *itct = debugfs_itct->itct; +if (!debugfs_dump_is_generated_v3_hw (itct)) +return -EPERM ; +for (i =0 ; i <HISI_SAS_MAX_ITCT_ENTRIES ; i++, itct++) {__le64 *data = &itct->qw0;
@@ -3762,6 +3795,9 @@ static int debugfs_itct_cache_v3_hw_show(struct seq_file *s, void *p)int i, tab_idx;__le64 *itct; +if (!debugfs_dump_is_generated_v3_hw (itct_cache)) +return -EPERM ; +for (i =0 ; i <HISI_SAS_IOST_ITCT_CACHE_NUM ; i++, itct_cache++) {/* * Data struct of ITCT cache:
@@ -3779,10 +3815,9 @@ static int debugfs_itct_cache_v3_hw_show(struct seq_file *s, void *p) }DEFINE_SHOW_ATTRIBUTE (debugfs_itct_cache_v3_hw); -static void debugfs_create_files_v3_hw (struct hisi_hba *hisi_hba) +static void debugfs_create_files_v3_hw (struct hisi_hba *hisi_hba,int index) {u64 *debugfs_timestamp; -int dump_index = hisi_hba->debugfs_dump_index;struct dentry *dump_dentry;struct dentry *dentry;char name[256 ];
@@ -3790,17 +3825,17 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)int c;int d; -snprintf (name,256 ,"%d" , dump_index); +snprintf (name,256 ,"%d" , index); dump_dentry =debugfs_create_dir (name, hisi_hba->debugfs_dump_dentry); - debugfs_timestamp = &hisi_hba->debugfs_timestamp[dump_index]; + debugfs_timestamp = &hisi_hba->debugfs_timestamp[index];debugfs_create_u64 ("timestamp" ,0400 , dump_dentry, debugfs_timestamp);debugfs_create_file ("global" ,0400 , dump_dentry, - &hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL ], + &hisi_hba->debugfs_regs[index][DEBUGFS_GLOBAL ], &debugfs_global_v3_hw_fops);/* Create port dir and files */
@@ -3809,7 +3844,7 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)snprintf (name,256 ,"%d" , p);debugfs_create_file (name,0400 , dentry, - &hisi_hba->debugfs_port_reg[dump_index][p], + &hisi_hba->debugfs_port_reg[index][p], &debugfs_port_v3_hw_fops); }
@@ -3819,7 +3854,7 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)snprintf (name,256 ,"%d" , c);debugfs_create_file (name,0400 , dentry, - &hisi_hba->debugfs_cq[dump_index][c], + &hisi_hba->debugfs_cq[index][c], &debugfs_cq_v3_hw_fops); }
@@ -3829,32 +3864,32 @@ static void debugfs_create_files_v3_hw(struct hisi_hba *hisi_hba)snprintf (name,256 ,"%d" , d);debugfs_create_file (name,0400 , dentry, - &hisi_hba->debugfs_dq[dump_index][d], + &hisi_hba->debugfs_dq[index][d], &debugfs_dq_v3_hw_fops); }debugfs_create_file ("iost" ,0400 , dump_dentry, - &hisi_hba->debugfs_iost[dump_index], + &hisi_hba->debugfs_iost[index], &debugfs_iost_v3_hw_fops);debugfs_create_file ("iost_cache" ,0400 , dump_dentry, - &hisi_hba->debugfs_iost_cache[dump_index], + &hisi_hba->debugfs_iost_cache[index], &debugfs_iost_cache_v3_hw_fops);debugfs_create_file ("itct" ,0400 , dump_dentry, - &hisi_hba->debugfs_itct[dump_index], + &hisi_hba->debugfs_itct[index], &debugfs_itct_v3_hw_fops);debugfs_create_file ("itct_cache" ,0400 , dump_dentry, - &hisi_hba->debugfs_itct_cache[dump_index], + &hisi_hba->debugfs_itct_cache[index], &debugfs_itct_cache_v3_hw_fops);debugfs_create_file ("axi" ,0400 , dump_dentry, - &hisi_hba->debugfs_regs[dump_index][DEBUGFS_AXI ], + &hisi_hba->debugfs_regs[index][DEBUGFS_AXI ], &debugfs_axi_v3_hw_fops);debugfs_create_file ("ras" ,0400 , dump_dentry, - &hisi_hba->debugfs_regs[dump_index][DEBUGFS_RAS ], + &hisi_hba->debugfs_regs[index][DEBUGFS_RAS ], &debugfs_ras_v3_hw_fops); }
@@ -4517,22 +4552,34 @@ static void debugfs_release_v3_hw(struct hisi_hba *hisi_hba, int dump_index)int i;devm_kfree (dev, hisi_hba->debugfs_iost_cache[dump_index].cache); + hisi_hba->debugfs_iost_cache[dump_index].cache =NULL ;devm_kfree (dev, hisi_hba->debugfs_itct_cache[dump_index].cache); + hisi_hba->debugfs_itct_cache[dump_index].cache =NULL ;devm_kfree (dev, hisi_hba->debugfs_iost[dump_index].iost); + hisi_hba->debugfs_iost[dump_index].iost =NULL ;devm_kfree (dev, hisi_hba->debugfs_itct[dump_index].itct); + hisi_hba->debugfs_itct[dump_index].itct =NULL ; -for (i =0 ; i < hisi_hba->queue_count; i++) +for (i =0 ; i < hisi_hba->queue_count; i++) {devm_kfree (dev, hisi_hba->debugfs_dq[dump_index][i].hdr); + hisi_hba->debugfs_dq[dump_index][i].hdr =NULL ; + } -for (i =0 ; i < hisi_hba->queue_count; i++) +for (i =0 ; i < hisi_hba->queue_count; i++) {devm_kfree (dev, hisi_hba->debugfs_cq[dump_index][i].complete_hdr); + hisi_hba->debugfs_cq[dump_index][i].complete_hdr =NULL ; + } -for (i =0 ; i <DEBUGFS_REGS_NUM ; i++) +for (i =0 ; i <DEBUGFS_REGS_NUM ; i++) {devm_kfree (dev, hisi_hba->debugfs_regs[dump_index][i].data); + hisi_hba->debugfs_regs[dump_index][i].data =NULL ; + } -for (i =0 ; i < hisi_hba->n_phy; i++) +for (i =0 ; i < hisi_hba->n_phy; i++) {devm_kfree (dev, hisi_hba->debugfs_port_reg[dump_index][i].data); + hisi_hba->debugfs_port_reg[dump_index][i].data =NULL ; + } }static const struct hisi_sas_debugfs_reg *debugfs_reg_array_v3_hw[DEBUGFS_REGS_NUM ] = {
@@ -4659,8 +4706,6 @@ static int debugfs_snapshot_regs_v3_hw(struct hisi_hba *hisi_hba)debugfs_snapshot_itct_reg_v3_hw (hisi_hba);debugfs_snapshot_iost_reg_v3_hw (hisi_hba); -debugfs_create_files_v3_hw (hisi_hba); -debugfs_snapshot_restore_v3_hw (hisi_hba); hisi_hba->debugfs_dump_index++;
@@ -4744,6 +4789,17 @@ static void debugfs_bist_init_v3_hw(struct hisi_hba *hisi_hba) hisi_hba->debugfs_bist_linkrate =SAS_LINK_RATE_1_5_GBPS ; } +static void debugfs_dump_init_v3_hw (struct hisi_hba *hisi_hba) +{ +int i; + + hisi_hba->debugfs_dump_dentry = +debugfs_create_dir ("dump" , hisi_hba->debugfs_dir); + +for (i =0 ; i < hisi_sas_debugfs_dump_count; i++) +debugfs_create_files_v3_hw (hisi_hba, i); +} +static void debugfs_exit_v3_hw (struct hisi_hba *hisi_hba) {debugfs_remove_recursive (hisi_hba->debugfs_dir);
@@ -4764,8 +4820,7 @@ static void debugfs_init_v3_hw(struct hisi_hba *hisi_hba)/* create bist structures */ debugfs_bist_init_v3_hw (hisi_hba); - hisi_hba->debugfs_dump_dentry = -debugfs_create_dir ("dump" , hisi_hba->debugfs_dir); +debugfs_dump_init_v3_hw (hisi_hba);debugfs_phy_down_cnt_init_v3_hw (hisi_hba);debugfs_fifo_init_v3_hw (hisi_hba);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 363/466 ring-buffer: Limit time with disabled interrupts in rb_check_pages()
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Pavlu <[email protected]>
[ Upstream commit b237e1f7d2273fdcffac20100b72c002bdd770dd ]
The function rb_check_pages() validates the integrity of a specified per-CPU tracing ring buffer. It does so by traversing the underlying linked list and checking its next and prev links.
To guarantee that the list isn't modified during the check, a caller typically needs to take cpu_buffer->reader_lock. This prevents the check from running concurrently, for example, with a potential reader which can make the list temporarily inconsistent when swapping its old reader page into the buffer.
A problem with this approach is that the time when interrupts are disabled is non-deterministic, dependent on the ring buffer size. This particularly affects PREEMPT_RT because the reader_lock is a raw spinlock which doesn't become sleepable on PREEMPT_RT kernels.
Modify the check so it still attempts to traverse the entire list, but gives up the reader_lock between checking individual pages. Introduce for this purpose a new variable ring_buffer_per_cpu.cnt which is bumped any time the list is modified. The value is used by rb_check_pages() to detect such a change and restart the check.
--- kernel/trace/ring_buffer.c | 98 ++++++++++++++++++++++++++++---------- 1 file changed, 72 insertions(+), 26 deletions(-)
kernel/trace/ring_buffer.c +72 -26
@@ -482,6 +482,8 @@ struct ring_buffer_per_cpu {unsigned long nr_pages;unsigned int current_context;struct list_head *pages; +/* pages generation counter, incremented when the list changes */ +unsigned long cnt;struct buffer_page *head_page;/* read from head */ struct buffer_page *tail_page;/* write to tail */ struct buffer_page *commit_page;/* committed pages */
@@ -1475,40 +1477,87 @@ static void rb_check_bpage(struct ring_buffer_per_cpu *cpu_buffer,RB_WARN_ON (cpu_buffer, val &RB_FLAG_MASK ); } +static bool rb_check_links (struct ring_buffer_per_cpu *cpu_buffer, +struct list_head *list) +{ +if (RB_WARN_ON (cpu_buffer, +rb_list_head (rb_list_head (list->next)->prev) != list)) +return false; + +if (RB_WARN_ON (cpu_buffer, +rb_list_head (rb_list_head (list->prev)->next) != list)) +return false; + +return true; +} +/** * rb_check_pages - integrity check of buffer pages * @cpu_buffer: CPU buffer with pages to test * * As a safety measure we check to make sure the data pages have not * been corrupted. -* -* Callers of this function need to guarantee that the list of pages doesn't get -* modified during the check. In particular, if it's possible that the function -* is invoked with concurrent readers which can swap in a new reader page then -* the caller should take cpu_buffer->reader_lock. */ static void rb_check_pages (struct ring_buffer_per_cpu *cpu_buffer) { -struct list_head *head =rb_list_head (cpu_buffer->pages); -struct list_head *tmp; +struct list_head *head, *tmp; +unsigned long buffer_cnt; +unsigned long flags; +int nr_loops =0 ; -if (RB_WARN_ON (cpu_buffer, -rb_list_head (rb_list_head (head->next)->prev) != head)) +/* +* Walk the linked list underpinning the ring buffer and validate all +* its next and prev links. +* +* The check acquires the reader_lock to avoid concurrent processing +* with code that could be modifying the list. However, the lock cannot +* be held for the entire duration of the walk, as this would make the +* time when interrupts are disabled non-deterministic, dependent on the +* ring buffer size. Therefore, the code releases and re-acquires the +* lock after checking each page. The ring_buffer_per_cpu.cnt variable +* is then used to detect if the list was modified while the lock was +* not held, in which case the check needs to be restarted. +* +* The code attempts to perform the check at most three times before +* giving up. This is acceptable because this is only a self-validation +* to detect problems early on. In practice, the list modification +* operations are fairly spaced, and so this check typically succeeds at +* most on the second try. +*/ +again: +if (++nr_loops >3 )return ; -if (RB_WARN_ON (cpu_buffer, -rb_list_head (rb_list_head (head->prev)->next) != head)) -return ; +raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags); + head =rb_list_head (cpu_buffer->pages); +if (!rb_check_links (cpu_buffer, head)) + goto out_locked; + buffer_cnt = cpu_buffer->cnt; + tmp = head; +raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); -for (tmp =rb_list_head (head->next); tmp != head; tmp =rb_list_head (tmp->next)) { -if (RB_WARN_ON (cpu_buffer, -rb_list_head (rb_list_head (tmp->next)->prev) != tmp)) -return ; +while (true) { +raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags); -if (RB_WARN_ON (cpu_buffer, -rb_list_head (rb_list_head (tmp->prev)->next) != tmp)) -return ; +if (buffer_cnt != cpu_buffer->cnt) { +/* The list was updated, try again. */ +raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); + goto again; + } + + tmp =rb_list_head (tmp->next); +if (tmp == head) +/* The iteration circled back, all is done. */ + goto out_locked; + +if (!rb_check_links (cpu_buffer, tmp)) + goto out_locked; + +raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); } + +out_locked: +raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); }/*
@@ -2532,6 +2581,7 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)/* make sure pages points to a valid page in the ring buffer */ cpu_buffer->pages = next_page; + cpu_buffer->cnt++;/* update head page */ if (head_bit)
@@ -2638,6 +2688,7 @@ rb_insert_pages(struct ring_buffer_per_cpu *cpu_buffer)* pointer to point to end of list */ head_page->prev = last_page; + cpu_buffer->cnt++; success = true;break ; }
@@ -2873,12 +2924,8 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,*/ synchronize_rcu ();for_each_buffer_cpu (buffer, cpu) { -unsigned long flags; - cpu_buffer = buffer->buffers[cpu]; -raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags);rb_check_pages (cpu_buffer); -raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); }atomic_dec (&buffer->record_disabled); }
@@ -5296,6 +5343,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)rb_list_head (reader->list.next)->prev = &cpu_buffer->reader_page->list;rb_inc_page (&cpu_buffer->head_page); + cpu_buffer->cnt++;local_inc (&cpu_buffer->pages_read);/* Finally update the reader page to the new head */
@@ -5835,12 +5883,9 @@ void ring_buffer_read_finish(struct ring_buffer_iter *iter) {struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer; -unsigned long flags;/* Use this opportunity to check the integrity of the ring buffer. */ -raw_spin_lock_irqsave (&cpu_buffer->reader_lock, flags);rb_check_pages (cpu_buffer); -raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags);atomic_dec (&cpu_buffer->resize_disabled);kfree (iter->event);
@@ -6757,6 +6802,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)/* Install the new pages, remove the head from the list */ cpu_buffer->pages = cpu_buffer->new_pages.next;list_del_init (&cpu_buffer->new_pages); + cpu_buffer->cnt++; cpu_buffer->head_page = list_entry(cpu_buffer->pages, struct buffer_page, list);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 364/466 pinmux: Use sequential access to access desc->pinmux data
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit 5a3e85c3c397c781393ea5fb2f45b1f60f8a4e6e ]
When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while accessing desc->mux_owner.
Let's say two processes A, B executing in pin_request() for the same pin and process A updates the desc->mux_usecount but not yet updated the desc->mux_owner while process B see the desc->mux_usecount which got updated by A path and further executes strcmp and while accessing desc->mux_owner it crashes with NULL pointer.
Serialize the access to mux related setting with a mutex lock.
cpu0 (process A) cpu1(process B)
pinctrl_select_state() { pinctrl_select_state() {
pin_request() { pin_request() {
...
....
} else {
desc->mux_usecount++;
desc->mux_usecount && strcmp(desc->mux_owner, owner)) {
if (desc->mux_usecount > 1)
return 0;
desc->mux_owner = owner;} }
--- drivers/pinctrl/core.c | 3 + drivers/pinctrl/core.h | 1 + drivers/pinctrl/pinmux.c | 173 ++++++++++++++++++++++----------------- 3 files changed, 100 insertions(+), 77 deletions(-)
drivers/pinctrl/core.c +3 -0
@@ -220,6 +220,9 @@ static int pinctrl_register_one_pin(struct pinctrl_dev *pctldev,/* Set owner */ pindesc->pctldev = pctldev; +#ifdef CONFIG_PINMUX +mutex_init (&pindesc->mux_lock); +#endif /* Copy basic pin info */ if (pin->name) {
drivers/pinctrl/core.h +1 -0
@@ -177,6 +177,7 @@ struct pin_desc {const char *mux_owner;const struct pinctrl_setting_mux *mux_setting;const char *gpio_owner; +struct mutex mux_lock;#endif };
drivers/pinctrl/pinmux.c +96 -77
245 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 365/466 scsi: ufs: core: Make DMA mask configuration more flexible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
[ Upstream commit 78bc671bd1501e2f6c571e063301a4fdc5db53b2 ]
Replace UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS with ufs_hba_variant_ops::set_dma_mask. Update the Renesas driver accordingly. This patch enables supporting other configurations than 32-bit or 64-bit DMA addresses, e.g. 36-bit DMA addresses.
--- drivers/ufs/core/ufshcd.c | 4 ++-- drivers/ufs/host/ufs-renesas.c | 9 ++++++++- include/ufs/ufshcd.h | 9 +++------ 3 files changed, 13 insertions(+), 9 deletions(-)
drivers/ufs/core/ufshcd.c +2 -2
@@ -2411,8 +2411,6 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)int err; hba->capabilities =ufshcd_readl (hba,REG_CONTROLLER_CAPABILITIES ); -if (hba->quirks &UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS ) - hba->capabilities &= ~MASK_64_ADDRESSING_SUPPORT ;/* nutrs and nutmrs are 0 based values */ hba->nutrs = (hba->capabilities &MASK_TRANSFER_REQUESTS_SLOTS_SDB ) +1 ;
@@ -10344,6 +10342,8 @@ EXPORT_SYMBOL_GPL(ufshcd_dealloc_host);*/ static int ufshcd_set_dma_mask (struct ufs_hba *hba) { +if (hba->vops && hba->vops->set_dma_mask) +return hba->vops->set_dma_mask (hba);if (hba->capabilities &MASK_64_ADDRESSING_SUPPORT ) {if (!dma_set_mask_and_coherent (hba->dev,DMA_BIT_MASK (64 )))return 0 ;
drivers/ufs/host/ufs-renesas.c +8 -1
@@ -7,6 +7,7 @@#include <linux/clk.h> #include <linux/delay.h> +#include <linux/dma-mapping.h> #include <linux/err.h> #include <linux/iopoll.h> #include <linux/kernel.h>
@@ -364,14 +365,20 @@ static int ufs_renesas_init(struct ufs_hba *hba)return -ENOMEM ;ufshcd_set_variant (hba, priv); - hba->quirks |=UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS |UFSHCD_QUIRK_HIBERN_FASTAUTO ; + hba->quirks |=UFSHCD_QUIRK_HIBERN_FASTAUTO ;return 0 ; } +static int ufs_renesas_set_dma_mask (struct ufs_hba *hba) +{ +return dma_set_mask_and_coherent (hba->dev,DMA_BIT_MASK (32 )); +} +static const struct ufs_hba_variant_ops ufs_renesas_vops = { .name ="renesas" , .init = ufs_renesas_init, + .set_dma_mask = ufs_renesas_set_dma_mask, .setup_clocks = ufs_renesas_setup_clocks, .hce_enable_notify = ufs_renesas_hce_enable_notify, .dbg_register_dump = ufs_renesas_dbg_register_dump,
include/ufs/ufshcd.h +3 -6
@@ -299,6 +299,8 @@ struct ufs_pwr_mode_info {* @max_num_rtt: maximum RTT supported by the host * @init: called when the driver is initialized * @exit: called to cleanup everything done in init +* @set_dma_mask: For setting another DMA mask than indicated by the 64AS +* capability bit. * @get_ufs_hci_version: called to get UFS HCI version * @clk_scale_notify: notifies that clks are scaled up/down * @setup_clocks: called before touching any of the controller registers
@@ -343,6 +345,7 @@ struct ufs_hba_variant_ops {int (*init)(struct ufs_hba *);void (*exit)(struct ufs_hba *);u32 (*get_ufs_hci_version)(struct ufs_hba *); +int (*set_dma_mask)(struct ufs_hba *);int (*clk_scale_notify)(struct ufs_hba *,bool ,enum ufs_notify_change_status ); int (*setup_clocks)(struct ufs_hba *, bool,
@@ -625,12 +628,6 @@ enum ufshcd_quirks {*/ UFSHCD_QUIRK_SKIP_PH_CONFIGURATION = 1 << 16, -/* -* This quirk needs to be enabled if the host controller has -* 64-bit addressing supported capability but it doesn't work. -*/ - UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS = 1 << 17, -/* * This quirk needs to be enabled if the host controller has * auto-hibernate capability but it's FASTAUTO only.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 366/466 iommu/amd: Fix corruption when mapping large pages from 0
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
[ Upstream commit e3a682eaf2af51a83f5313145ef592ce50fa787f ]
If a page is mapped starting at 0 that is equal to or larger than can fit in the current mode (number of table levels) it results in corrupting the mapping as the following logic assumes the mode is correct for the page size being requested.
There are two issues here, the check if the address fits within the table uses the start address, it should use the last address to ensure that last byte of the mapping fits within the current table mode.
The second is if the mapping is exactly the size of the full page table it has to add another level to instead hold a single IOPTE for the large size.
Since both corner cases require a 0 IOVA to be hit and doesn't start until a page size of 2^48 it is unlikely to ever hit in a real system.
--- drivers/iommu/amd/io_pgtable.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/iommu/amd/io_pgtable.c +8 -3
@@ -118,6 +118,7 @@ static void free_sub_pt(u64 *root, int mode, struct list_head *freelist)*/ static bool increase_address_space (struct amd_io_pgtable *pgtable,unsigned long address, +unsigned int page_size_level,gfp_t gfp) {struct io_pgtable_cfg *cfg = &pgtable->pgtbl.cfg;
@@ -133,7 +134,8 @@ static bool increase_address_space(struct amd_io_pgtable *pgtable,spin_lock_irqsave (&domain->lock, flags); -if (address <=PM_LEVEL_SIZE (pgtable->mode)) +if (address <=PM_LEVEL_SIZE (pgtable->mode) && + pgtable->mode -1 >= page_size_level) goto out; ret = false;
@@ -163,18 +165,21 @@ static u64 *alloc_pte(struct amd_io_pgtable *pgtable,gfp_t gfp, bool *updated) { + unsigned long last_addr = address + (page_size - 1);struct io_pgtable_cfg *cfg = &pgtable->pgtbl.cfg;int level, end_lvl;u64 *pte, *page;BUG_ON (!is_power_of_2 (page_size)); -while (address >PM_LEVEL_SIZE (pgtable->mode)) { +while (last_addr >PM_LEVEL_SIZE (pgtable->mode) || + pgtable->mode -1 <PAGE_SIZE_LEVEL (page_size)) {/* * Return an error if there is no memory to update the * page-table. */ -if (!increase_address_space (pgtable, address, gfp)) +if (!increase_address_space (pgtable, last_addr, +PAGE_SIZE_LEVEL (page_size), gfp))return NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 367/466 bpf: put bpf_links program when link is safe to be deallocated
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit f44ec8733a8469143fde1984b5e6931b2e2f6f3f ]
In general, BPF link's underlying BPF program should be considered to be reachable through attach hook -> link -> prog chain, and, pessimistically, we have to assume that as long as link's memory is not safe to free, attach hook's code might hold a pointer to BPF program and use it.
As such, it's not (generally) correct to put link's program early before waiting for RCU GPs to go through. More eager bpf_prog_put() that we currently do is mostly correct due to BPF program's release code doing similar RCU GP waiting, but as will be shown in the following patches, BPF program can be non-sleepable (and, thus, reliant on only "classic" RCU GP), while BPF link's attach hook can have sleepable semantics and needs to be protected by RCU Tasks Trace, and for such cases BPF link has to go through RCU Tasks Trace + "classic" RCU GPs before being deallocated. And so, if we put BPF program early, we might free BPF program before we free BPF link, leading to use-after-free situation.
So, this patch defers bpf_prog_put() until we are ready to perform bpf_link's deallocation. At worst, this delays BPF program freeing by one extra RCU GP, but that seems completely acceptable. Alternatively, we'd need more elaborate ways to determine BPF hook, BPF link, and BPF program lifetimes, and how they relate to each other, which seems like an unnecessary complication.
Note, for most BPF links we still will perform eager bpf_prog_put() and link dealloc, so for those BPF links there are no observable changes whatsoever. Only BPF links that use deferred dealloc might notice slightly delayed freeing of BPF programs.
Also, to reduce code and logic duplication, extract program put + link dealloc logic into bpf_link_dealloc() helper.
--- kernel/bpf/syscall.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
kernel/bpf/syscall.c +17 -5
@@ -2976,12 +2976,24 @@ void bpf_link_inc(struct bpf_link *link)atomic64_inc (&link->refcnt); } +static void bpf_link_dealloc (struct bpf_link *link) +{ +/* now that we know that bpf_link itself can't be reached, put underlying BPF program */ +if (link->prog) +bpf_prog_put (link->prog); + +/* free bpf_link and its containing memory */ +if (link->ops->dealloc_deferred) + link->ops->dealloc_deferred (link); +else + link->ops->dealloc (link); +} +static void bpf_link_defer_dealloc_rcu_gp (struct rcu_head *rcu) { struct bpf_link *link = container_of(rcu, struct bpf_link, rcu); -/* free bpf_link and its containing memory */ - link->ops->dealloc_deferred (link); +bpf_link_dealloc (link); }static void bpf_link_defer_dealloc_mult_rcu_gp (struct rcu_head *rcu)
@@ -3003,7 +3015,6 @@ static void bpf_link_free(struct bpf_link *link) sleepable = link->prog->sleepable;/* detach BPF program, clean up used resources */ ops->release (link); -bpf_prog_put (link->prog); }if (ops->dealloc_deferred) {/* schedule BPF link deallocation; if underlying BPF program
@@ -3014,8 +3025,9 @@ static void bpf_link_free(struct bpf_link *link)call_rcu_tasks_trace (&link->rcu, bpf_link_defer_dealloc_mult_rcu_gp); else call_rcu(&link->rcu, bpf_link_defer_dealloc_rcu_gp); - }else if (ops->dealloc) - ops->dealloc (link); + }else if (ops->dealloc) { +bpf_link_dealloc (link); + } }static void bpf_link_put_deferred (struct work_struct *work)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 368/466 scsi: lpfc: Call lpfc_sli4_queue_unset() in restart and rmmod paths
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit d35f7672715d1ff3e3ad9bb4ae6ac6cb484200fe ]
During initialization, the driver allocates wq->pring in lpfc_wq_create and lpfc_sli4_queue_unset() is the only place where kfree(wq->pring) is called.
There is a possible memory leak in lpfc_sli_brdrestart_s4() (restart) and lpfc_pci_remove_one_s4() (rmmod) paths because there are no calls to lpfc_sli4_queue_unset() to kfree() the wq->pring.
Fix by inserting a call to lpfc_sli4_queue_unset() in lpfc_sli_brdrestart_s4() and lpfc_sli4_hba_unset() routines. Also, add a check for the SLI_ACTIVE flag before issuing the Q_DESTROY mailbox command. If not set, then the mailbox command will obviously fail. In such cases, skip issuing the mailbox command and only execute the driver resource clean up portions of the lpfc_*q_destroy routines.
--- drivers/scsi/lpfc/lpfc_init.c | 2 ++ drivers/scsi/lpfc/lpfc_sli.c | 41 ++++++++++++++++++++++++++++++----- 2 files changed, 38 insertions(+), 5 deletions(-)
drivers/scsi/lpfc/lpfc_init.c +2 -0
@@ -13518,6 +13518,8 @@ lpfc_sli4_hba_unset(struct lpfc_hba *phba)/* Disable FW logging to host memory */ lpfc_ras_stop_fwlog (phba); +lpfc_sli4_queue_unset (phba); +/* Reset SLI4 HBA FCoE function */ lpfc_pci_function_reset (phba);
drivers/scsi/lpfc/lpfc_sli.c +36 -5
120 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 369/466 scsi: lpfc: Check SLI_ACTIVE flag in FDMI cmpl before submitting follow up FDMI
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 98f8d3588097e321be70f83b844fa67d4828fe5c ]
The lpfc_cmpl_ct_disc_fdmi() routine has incorrect logic that treats an FDMI completion with error LOCAL_REJECT/SLI_ABORTED as a success status. Under the erroneous assumption of successful completion, the routine proceeds to issue follow up FDMI commands, which may never complete if the HBA is in an errata state as indicated by the errored completion status. Fix by freeing FDMI cmd resources and early return when the LPFC_SLI_ACTIVE flag is not set and a LOCAL_REJECT/SLI_ABORTED or SLI_DOWN status is received.
--- drivers/scsi/lpfc/lpfc_ct.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/scsi/lpfc/lpfc_ct.c +14 -7
@@ -2226,6 +2226,11 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, ulp_status, ulp_word4, latt);if (latt || ulp_status) { +lpfc_printf_vlog (vport,KERN_WARNING ,LOG_DISCOVERY , +"0229 FDMI cmd %04x failed, latt = %d " +"ulp_status: (x%x/x%x), sli_flag x%x\n" , +be16_to_cpu (fdmi_cmd), latt, ulp_status, + ulp_word4, phba->sli.sli_flag);/* Look for a retryable error */ if (ulp_status ==IOSTAT_LOCAL_REJECT ) {
@@ -2234,8 +2239,16 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,case IOERR_SLI_DOWN :/* Driver aborted this IO. No retry as error * is likely Offline->Online or some adapter -* error. Recovery will try again. +* error. Recovery will try again, but if port +* is not active there's no point to continue +* issuing follow up FDMI commands. */ +if (!(phba->sli.sli_flag &LPFC_SLI_ACTIVE )) { + free_ndlp = cmdiocb->ndlp; +lpfc_ct_free_iocb (phba, cmdiocb); +lpfc_nlp_put (free_ndlp); +return ; + }break ;case IOERR_ABORT_IN_PROGRESS :case IOERR_SEQUENCE_TIMEOUT :
@@ -2256,12 +2269,6 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,break ; } } - -lpfc_printf_vlog (vport,KERN_INFO ,LOG_DISCOVERY , -"0229 FDMI cmd %04x latt = %d " -"ulp_status: x%x, rid x%x\n" , -be16_to_cpu (fdmi_cmd), latt, ulp_status, - ulp_word4); } free_ndlp = cmdiocb->ndlp;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 370/466 scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 4281f44ea8bfedd25938a0031bebba1473ece9ad ]
Current dev_loss_tmo handling checks whether there has been a previous call to unregister with SCSI transport. If so, the NDLP kref count is decremented a second time in dev_loss_tmo as the final kref release. However, this can sometimes result in a reference count underflow if there is also a race to unregister with NVMe transport as well. Add a check for NVMe transport registration before decrementing the final kref. If NVMe transport is still registered, then the NVMe transport unregistration is designated as the final kref decrement.
--- drivers/scsi/lpfc/lpfc_hbadisc.c | 36 +++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 12 deletions(-)
drivers/scsi/lpfc/lpfc_hbadisc.c +24 -12
@@ -155,6 +155,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)struct lpfc_hba *phba;struct lpfc_work_evt *evtp;unsigned long iflags; +bool nvme_reg = false; ndlp = ((struct lpfc_rport_data *)rport->dd_data)->pnode;if (!ndlp)
@@ -177,38 +178,49 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport)/* Don't schedule a worker thread event if the vport is going down. */ if (test_bit (FC_UNLOADING , &vport->load_flag) || !test_bit (HBA_SETUP , &phba->hba_flag)) { +spin_lock_irqsave (&ndlp->lock, iflags); ndlp->rport =NULL ; +if (ndlp->fc4_xpt_flags &NVME_XPT_REGD ) + nvme_reg = true; +/* The scsi_transport is done with the rport so lpfc cannot -* call to unregister. Remove the scsi transport reference -* and clean up the SCSI transport node details. +* call to unregister. */ -if (ndlp->fc4_xpt_flags & (NLP_XPT_REGD |SCSI_XPT_REGD )) { +if (ndlp->fc4_xpt_flags &SCSI_XPT_REGD ) { ndlp->fc4_xpt_flags &= ~SCSI_XPT_REGD ; -/* NVME transport-registered rports need the -* NLP_XPT_REGD flag to complete an unregister. +/* If NLP_XPT_REGD was cleared in lpfc_nlp_unreg_node, +* unregister calls were made to the scsi and nvme +* transports and refcnt was already decremented. Clear +* the NLP_XPT_REGD flag only if the NVME Rport is +* confirmed unregistered. */ -if (!(ndlp->fc4_xpt_flags &NVME_XPT_REGD )) +if (!nvme_reg && ndlp->fc4_xpt_flags &NLP_XPT_REGD ) { ndlp->fc4_xpt_flags &= ~NLP_XPT_REGD ; +spin_unlock_irqrestore (&ndlp->lock, iflags); +lpfc_nlp_put (ndlp);/* may free ndlp */ + }else { +spin_unlock_irqrestore (&ndlp->lock, iflags); + } + }else {spin_unlock_irqrestore (&ndlp->lock, iflags); -lpfc_nlp_put (ndlp); -spin_lock_irqsave (&ndlp->lock, iflags); } +spin_lock_irqsave (&ndlp->lock, iflags); +/* Only 1 thread can drop the initial node reference. If * another thread has set NLP_DROPPED, this thread is done. */ -if (!(ndlp->fc4_xpt_flags &NVME_XPT_REGD ) && - !(ndlp->nlp_flag &NLP_DROPPED )) { - ndlp->nlp_flag |=NLP_DROPPED ; +if (nvme_reg || (ndlp->nlp_flag &NLP_DROPPED )) {spin_unlock_irqrestore (&ndlp->lock, iflags); -lpfc_nlp_put (ndlp);return ; } + ndlp->nlp_flag |=NLP_DROPPED ;spin_unlock_irqrestore (&ndlp->lock, iflags); +lpfc_nlp_put (ndlp);return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 371/466 clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit aec8c0e28ce4a1f89fd82fcc06a5cc73147e9817 ]
Generally SDCC clocks use clk_rcg2_floor_ops, however on SAR2130P platform it's recommended to use rcg2_shared_ops for all Root Clock Generators to park them instead of disabling. Implement a mix of those, clk_rcg2_shared_floor_ops.
--- drivers/clk/qcom/clk-rcg.h | 1 + drivers/clk/qcom/clk-rcg2.c | 48 +++++++++++++++++++++++++++++++++---- 2 files changed, 44 insertions(+), 5 deletions(-)
drivers/clk/qcom/clk-rcg.h +1 -0
@@ -198,6 +198,7 @@ extern const struct clk_ops clk_byte2_ops;extern const struct clk_ops clk_pixel_ops;extern const struct clk_ops clk_gfx3d_ops;extern const struct clk_ops clk_rcg2_shared_ops; +extern const struct clk_ops clk_rcg2_shared_floor_ops;extern const struct clk_ops clk_rcg2_shared_no_init_park_ops;extern const struct clk_ops clk_dp_ops;
drivers/clk/qcom/clk-rcg2.c +43 -5
74 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 372/466 clk: qcom: rpmh: add support for SAR2130P
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 2cc88de6261f01ebd4e2a3b4e29681fe87d0c089 ]
Define clocks as supported by the RPMh on the SAR2130P platform. The msm-5.10 kernel declares just the CXO clock, the RF_CLK1 clock was added following recommendation from Taniya Das.
--- drivers/clk/qcom/clk-rpmh.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/clk/qcom/clk-rpmh.c +13 -0
@@ -389,6 +389,18 @@ DEFINE_CLK_RPMH_BCM(ipa, "IP0");DEFINE_CLK_RPMH_BCM (pka,"PKA0" );DEFINE_CLK_RPMH_BCM (qpic_clk,"QP0" ); +static struct clk_hw *sar2130p_rpmh_clocks[] = { + [RPMH_CXO_CLK ] = &clk_rpmh_bi_tcxo_div1.hw, + [RPMH_CXO_CLK_A ] = &clk_rpmh_bi_tcxo_div1_ao.hw, + [RPMH_RF_CLK1 ] = &clk_rpmh_rf_clk1_a.hw, + [RPMH_RF_CLK1_A ] = &clk_rpmh_rf_clk1_a_ao.hw, +}; + +static const struct clk_rpmh_desc clk_rpmh_sar2130p = { + .clks = sar2130p_rpmh_clocks, + .num_clks =ARRAY_SIZE (sar2130p_rpmh_clocks), +}; +static struct clk_hw *sdm845_rpmh_clocks[] = { [RPMH_CXO_CLK ] = &clk_rpmh_bi_tcxo_div2.hw, [RPMH_CXO_CLK_A ] = &clk_rpmh_bi_tcxo_div2_ao.hw,
@@ -880,6 +892,7 @@ static int clk_rpmh_probe(struct platform_device *pdev)static const struct of_device_id clk_rpmh_match_table[] = { { .compatible ="qcom,qdu1000-rpmh-clk" , .data = &clk_rpmh_qdu1000}, { .compatible ="qcom,sa8775p-rpmh-clk" , .data = &clk_rpmh_sa8775p}, + { .compatible ="qcom,sar2130p-rpmh-clk" , .data = &clk_rpmh_sar2130p}, { .compatible ="qcom,sc7180-rpmh-clk" , .data = &clk_rpmh_sc7180}, { .compatible ="qcom,sc8180x-rpmh-clk" , .data = &clk_rpmh_sc8180x}, { .compatible ="qcom,sc8280xp-rpmh-clk" , .data = &clk_rpmh_sc8280xp},
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 373/466 clk: qcom: tcsrcc-sm8550: add SAR2130P support
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit d2e0a043530b9d6f37a8de8f05e0725667aba0a6 ]
The SAR2130P platform has the same TCSR Clock Controller as the SM8550, except for the lack of the UFS clocks. Extend the SM8550 TCSRCC driver to support SAR2130P.
--- drivers/clk/qcom/tcsrcc-sm8550.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/clk/qcom/tcsrcc-sm8550.c +16 -2
@@ -129,6 +129,13 @@ static struct clk_branch tcsr_usb3_clkref_en = { }, }; +static struct clk_regmap *tcsr_cc_sar2130p_clocks[] = { + [TCSR_PCIE_0_CLKREF_EN ] = &tcsr_pcie_0_clkref_en.clkr, + [TCSR_PCIE_1_CLKREF_EN ] = &tcsr_pcie_1_clkref_en.clkr, + [TCSR_USB2_CLKREF_EN ] = &tcsr_usb2_clkref_en.clkr, + [TCSR_USB3_CLKREF_EN ] = &tcsr_usb3_clkref_en.clkr, +}; +static struct clk_regmap *tcsr_cc_sm8550_clocks[] = { [TCSR_PCIE_0_CLKREF_EN ] = &tcsr_pcie_0_clkref_en.clkr, [TCSR_PCIE_1_CLKREF_EN ] = &tcsr_pcie_1_clkref_en.clkr,
@@ -146,6 +153,12 @@ static const struct regmap_config tcsr_cc_sm8550_regmap_config = { .fast_io = true, }; +static const struct qcom_cc_desc tcsr_cc_sar2130p_desc = { + .config = &tcsr_cc_sm8550_regmap_config, + .clks = tcsr_cc_sar2130p_clocks, + .num_clks =ARRAY_SIZE (tcsr_cc_sar2130p_clocks), +}; +static const struct qcom_cc_desc tcsr_cc_sm8550_desc = { .config = &tcsr_cc_sm8550_regmap_config, .clks = tcsr_cc_sm8550_clocks,
@@ -153,7 +166,8 @@ static const struct qcom_cc_desc tcsr_cc_sm8550_desc = { };static const struct of_device_id tcsr_cc_sm8550_match_table[] = { - { .compatible ="qcom,sm8550-tcsr" }, + { .compatible ="qcom,sar2130p-tcsr" , .data = &tcsr_cc_sar2130p_desc }, + { .compatible ="qcom,sm8550-tcsr" , .data = &tcsr_cc_sm8550_desc }, { } };MODULE_DEVICE_TABLE (of, tcsr_cc_sm8550_match_table);
@@ -162,7 +176,7 @@ static int tcsr_cc_sm8550_probe(struct platform_device *pdev) {struct regmap *regmap; - regmap =qcom_cc_map (pdev, &tcsr_cc_sm8550_desc); + regmap =qcom_cc_map (pdev,of_device_get_match_data (&pdev->dev));if (IS_ERR (regmap))return PTR_ERR (regmap);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 374/466 clk: qcom: dispcc-sm8550: enable support for SAR2130P
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 1335c7eb7012f23dc073b8ae4ffcfc1f6e69cfb3 ]
The display clock controller on SAR2130P is very close to the clock controller on SM8550 (and SM8650). Reuse existing driver to add support for the controller on SAR2130P.
--- drivers/clk/qcom/Kconfig | 4 ++-- drivers/clk/qcom/dispcc-sm8550.c | 18 ++++++++++++++++-- 2 files changed, 18 insertions(+), 4 deletions(-)
drivers/clk/qcom/Kconfig +2 -2
@@ -959,10 +959,10 @@ config SM_DISPCC_8450 config SM_DISPCC_8550 tristate "SM8550 Display Clock Controller" depends on ARM64 || COMPILE_TEST - depends on SM_GCC_8550 || SM_GCC_8650 + depends on SM_GCC_8550 || SM_GCC_8650 || SAR_GCC_2130P help Support for the display clock controller on Qualcomm Technologies, Inc - SM8550 or SM8650 devices. + SAR2130P, SM8550 or SM8650 devices. Say Y if you want to support display devices and functionality such as splash screen.
drivers/clk/qcom/dispcc-sm8550.c +16 -2
@@ -75,7 +75,7 @@ static struct pll_vco lucid_ole_vco[] = { { 249600000, 2000000000, 0 }, }; -static const struct alpha_pll_config disp_cc_pll0_config = { +static struct alpha_pll_config disp_cc_pll0_config = { .l =0xd , .alpha =0x6492 , .config_ctl_val = 0x20485699,
@@ -106,7 +106,7 @@ static struct clk_alpha_pll disp_cc_pll0 = { }, }; -static const struct alpha_pll_config disp_cc_pll1_config = { +static struct alpha_pll_config disp_cc_pll1_config = { .l =0x1f , .alpha =0x4000 , .config_ctl_val =0x20485699 ,
@@ -594,6 +594,13 @@ static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src[] = { { } }; +static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src_sar2130p[] = { +F (200000000 ,P_DISP_CC_PLL0_OUT_MAIN ,3 ,0 ,0 ), +F (325000000 ,P_DISP_CC_PLL0_OUT_MAIN ,3 ,0 ,0 ), +F (514000000 ,P_DISP_CC_PLL0_OUT_MAIN ,3 ,0 ,0 ), + { } +}; +static const struct freq_tbl ftbl_disp_cc_mdss_mdp_clk_src_sm8650[] = {F (19200000 ,P_BI_TCXO ,1 ,0 ,0 ),F (85714286 ,P_DISP_CC_PLL0_OUT_MAIN ,3 ,0 ,0 ),
@@ -1750,6 +1757,7 @@ static struct qcom_cc_desc disp_cc_sm8550_desc = { };static const struct of_device_id disp_cc_sm8550_match_table[] = { + { .compatible ="qcom,sar2130p-dispcc" }, { .compatible ="qcom,sm8550-dispcc" }, { .compatible ="qcom,sm8650-dispcc" }, { }
@@ -1780,6 +1788,12 @@ static int disp_cc_sm8550_probe(struct platform_device *pdev) disp_cc_mdss_mdp_clk_src.freq_tbl = ftbl_disp_cc_mdss_mdp_clk_src_sm8650; disp_cc_mdss_dptx1_usb_router_link_intf_clk.clkr.hw.init->parent_hws[0 ] = &disp_cc_mdss_dptx1_link_div_clk_src.clkr.hw; + }else if (of_device_is_compatible (pdev->dev.of_node,"qcom,sar2130p-dispcc" )) { + disp_cc_pll0_config.l =0x1f ; + disp_cc_pll0_config.alpha =0x4000 ; + disp_cc_pll0_config.user_ctl_val =0x1 ; + disp_cc_pll1_config.user_ctl_val =0x1 ; + disp_cc_mdss_mdp_clk_src.freq_tbl = ftbl_disp_cc_mdss_mdp_clk_src_sar2130p; }clk_lucid_ole_pll_configure (&disp_cc_pll0, regmap, &disp_cc_pll0_config);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 375/466 clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devi Priya <[email protected]>
[ Upstream commit 79dfed29aa3f714e0a94a39b2bfe9ac14ce19a6a ]
Add support for NSS Huayra alpha pll found on ipq9574 SoCs. Programming sequence is the same as that of Huayra type Alpha PLL, so we can re-use the same.
--- drivers/clk/qcom/clk-alpha-pll.c | 11 +++++++++++ drivers/clk/qcom/clk-alpha-pll.h | 1 + 2 files changed, 12 insertions(+)
drivers/clk/qcom/clk-alpha-pll.c +11 -0
@@ -267,6 +267,17 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { [PLL_OFF_OPMODE] = 0x30, [PLL_OFF_STATUS] = 0x3c, }, + [CLK_ALPHA_PLL_TYPE_NSS_HUAYRA] = { + [PLL_OFF_L_VAL] = 0x04, + [PLL_OFF_ALPHA_VAL] = 0x08, + [PLL_OFF_TEST_CTL] = 0x0c, + [PLL_OFF_TEST_CTL_U] = 0x10, + [PLL_OFF_USER_CTL] = 0x14, + [PLL_OFF_CONFIG_CTL] = 0x18, + [PLL_OFF_CONFIG_CTL_U] = 0x1c, + [PLL_OFF_STATUS] = 0x20, + }, + };EXPORT_SYMBOL_GPL (clk_alpha_pll_regs);
drivers/clk/qcom/clk-alpha-pll.h +1 -0
@@ -32,6 +32,7 @@ enum {CLK_ALPHA_PLL_TYPE_BRAMMO_EVO ,CLK_ALPHA_PLL_TYPE_STROMER ,CLK_ALPHA_PLL_TYPE_STROMER_PLUS , +CLK_ALPHA_PLL_TYPE_NSS_HUAYRA , CLK_ALPHA_PLL_TYPE_MAX, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 376/466 leds: class: Protect brightness_show() with led_cdev->led_access mutex
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mukesh Ojha <[email protected]>
[ Upstream commit 4ca7cd938725a4050dcd62ae9472e931d603118d ]
There is NULL pointer issue observed if from Process A where hid device being added which results in adding a led_cdev addition and later a another call to access of led_cdev attribute from Process B can result in NULL pointer issue.
Use mutex led_cdev->led_access to protect access to led->cdev and its attribute inside brightness_show() and max_brightness_show() and also update the comment for mutex that it should be used to protect the led class device fields.
Process A Process B
kthread+0x114
worker_thread+0x244
process_scheduled_works+0x248
uhid_device_add_worker+0x24
hid_add_device+0x120
device_add+0x268
bus_probe_device+0x94
device_initial_probe+0x14
__device_attach+0xfc
bus_for_each_drv+0x10c
__device_attach_driver+0x14c
driver_probe_device+0x3c
__driver_probe_device+0xa0
really_probe+0x190
hid_device_probe+0x130
ps_probe+0x990
ps_led_register+0x94
devm_led_classdev_register_ext+0x58
led_classdev_register_ext+0x1f8
device_create_with_groups+0x48
device_create_groups_vargs+0xc8
device_add+0x244
kobject_uevent+0x14
kobject_uevent_env[jt]+0x224
mutex_unlock[jt]+0xc4
__mutex_unlock_slowpath+0xd4
wake_up_q+0x70
try_to_wake_up[jt]+0x48c
preempt_schedule_common+0x28
__schedule+0x628
__switch_to+0x174
el0t_64_sync+0x1a8/0x1ac el0t_64_sync_handler+0x68/0xbc el0_svc+0x38/0x68 do_el0_svc+0x1c/0x28 el0_svc_common+0x80/0xe0 invoke_syscall+0x58/0x114 __arm64_sys_read+0x1c/0x2c ksys_read+0x78/0xe8 vfs_read+0x1e0/0x2c8 kernfs_fop_read_iter+0x68/0x1b4 seq_read_iter+0x158/0x4ec kernfs_seq_show+0x44/0x54 sysfs_kf_seq_show+0xb4/0x130 dev_attr_show+0x38/0x74 brightness_show+0x20/0x4c dualshock4_led_get_brightness+0xc/0x74
[ 3313.874295][ T4013] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 3313.874301][ T4013] Mem abort info: [ 3313.874303][ T4013] ESR = 0x0000000096000006 [ 3313.874305][ T4013] EC = 0x25: DABT (current EL), IL = 32 bits [ 3313.874307][ T4013] SET = 0, FnV = 0 [ 3313.874309][ T4013] EA = 0, S1PTW = 0 [ 3313.874311][ T4013] FSC = 0x06: level 2 translation fault [ 3313.874313][ T4013] Data abort info: [ 3313.874314][ T4013] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 3313.874316][ T4013] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 3313.874318][ T4013] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 3313.874320][ T4013] user pgtable: 4k pages, 39-bit VAs, pgdp=00000008f2b0a000
..
[ 3313.874332][ T4013] Dumping ftrace buffer: [ 3313.874334][ T4013] (ftrace buffer empty) .. .. [ dd3313.874639][ T4013] CPU: 6 PID: 4013 Comm: InputReader [ 3313.874648][ T4013] pc : dualshock4_led_get_brightness+0xc/0x74 [ 3313.874653][ T4013] lr : led_update_brightness+0x38/0x60 [ 3313.874656][ T4013] sp : ffffffc0b910bbd0 .. .. [ 3313.874685][ T4013] Call trace: [ 3313.874687][ T4013] dualshock4_led_get_brightness+0xc/0x74 [ 3313.874690][ T4013] brightness_show+0x20/0x4c [ 3313.874692][ T4013] dev_attr_show+0x38/0x74 [ 3313.874696][ T4013] sysfs_kf_seq_show+0xb4/0x130 [ 3313.874700][ T4013] kernfs_seq_show+0x44/0x54 [ 3313.874703][ T4013] seq_read_iter+0x158/0x4ec [ 3313.874705][ T4013] kernfs_fop_read_iter+0x68/0x1b4 [ 3313.874708][ T4013] vfs_read+0x1e0/0x2c8 [ 3313.874711][ T4013] ksys_read+0x78/0xe8 [ 3313.874714][ T4013] __arm64_sys_read+0x1c/0x2c [ 3313.874718][ T4013] invoke_syscall+0x58/0x114 [ 3313.874721][ T4013] el0_svc_common+0x80/0xe0 [ 3313.874724][ T4013] do_el0_svc+0x1c/0x28 [ 3313.874727][ T4013] el0_svc+0x38/0x68 [ 3313.874730][ T4013] el0t_64_sync_handler+0x68/0xbc [ 3313.874732][ T4013] el0t_64_sync+0x1a8/0x1ac
--- drivers/leds/led-class.c | 14 +++++++++++--- include/linux/leds.h | 2 +- 2 files changed, 12 insertions(+), 4 deletions(-)
drivers/leds/led-class.c +11 -3
@@ -29,11 +29,14 @@ static ssize_t brightness_show(struct device *dev, struct device_attribute *attr, char *buf) { struct led_classdev *led_cdev = dev_get_drvdata(dev); +unsigned int brightness; -/* no lock needed for this */ +mutex_lock (&led_cdev->led_access);led_update_brightness (led_cdev); + brightness = led_cdev->brightness; +mutex_unlock (&led_cdev->led_access); -return sprintf (buf,"%u\n" , led_cdev->brightness); +return sprintf (buf,"%u\n" , brightness); } static ssize_t brightness_store(struct device *dev,
@@ -70,8 +73,13 @@ static ssize_t max_brightness_show(struct device *dev, struct device_attribute *attr, char *buf) { struct led_classdev *led_cdev = dev_get_drvdata(dev); +unsigned int max_brightness; + +mutex_lock (&led_cdev->led_access); + max_brightness = led_cdev->max_brightness; +mutex_unlock (&led_cdev->led_access); -return sprintf (buf,"%u\n" , led_cdev->max_brightness); +return sprintf (buf,"%u\n" , max_brightness); }static DEVICE_ATTR_RO (max_brightness);
include/linux/leds.h +1 -1
@@ -238,7 +238,7 @@ struct led_classdev {struct kernfs_node *brightness_hw_changed_kn;#endif -/* Ensures consistent access to the LED Flash Class device */ +/* Ensures consistent access to the LED class device */ struct mutex led_access; };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 377/466 scsi: st: Dont modify unknown block number in MTIOCGET
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Mäkisara <[email protected]>
[ Upstream commit 5bb2d6179d1a8039236237e1e94cfbda3be1ed9e ]
Struct mtget field mt_blkno -1 means it is unknown. Don't add anything to it.
--- drivers/scsi/st.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/st.c +1 -1
@@ -3756,7 +3756,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) ((STp->density <<MT_ST_DENSITY_SHIFT ) &MT_ST_DENSITY_MASK ); mt_status.mt_blkno = STps->drv_block; mt_status.mt_fileno = STps->drv_file; -if (STp->block_size !=0 ) { +if (STp->block_size !=0 && mt_status.mt_blkno >=0 ) {if (STps->rw ==ST_WRITING ) mt_status.mt_blkno += (STp->buffer)->buffer_bytes / STp->block_size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 378/466 scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Mäkisara <[email protected]>
[ Upstream commit 0b120edb37dc9dd8ca82893d386922eb6b16f860 ]
Most drives rewind the tape when the device is reset. Reading and writing are not allowed until something is done to make the tape position match the user's expectation (e.g., rewind the tape). Add MTIOCGET and MTLOAD to operations allowed after reset. MTIOCGET is modified to not touch the tape if pos_unknown is non-zero. The tape location is known after MTLOAD.
--- drivers/scsi/st.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/scsi/st.c +21 -8
@@ -3506,6 +3506,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)int i, cmd_nr, cmd_type, bt;int retval =0 ;unsigned int blk; +bool cmd_mtiocget;struct scsi_tape *STp = file->private_data;struct st_modedef *STm;struct st_partstat *STps;
@@ -3619,6 +3620,7 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg)*/ if (mtc.mt_op != MTREW && mtc.mt_op != MTOFFL && + mtc.mt_op != MTLOAD && mtc.mt_op != MTRETEN && mtc.mt_op != MTERASE && mtc.mt_op != MTSEEK &&
@@ -3732,17 +3734,28 @@ static long st_ioctl(struct file *file, unsigned int cmd_in, unsigned long arg) goto out; } + cmd_mtiocget = cmd_type ==_IOC_TYPE (MTIOCGET ) && cmd_nr ==_IOC_NR (MTIOCGET ); +if ((i =flush_buffer (STp,0 )) <0 ) { - retval = i; - goto out; - } -if (STp->can_partitions && - (i =switch_partition (STp)) <0 ) { - retval = i; - goto out; +if (cmd_mtiocget && STp->pos_unknown) { +/* flush fails -> modify status accordingly */ +reset_state (STp); + STp->pos_unknown =1 ; + }else {/* return error */ + retval = i; + goto out; + } + }else {/* flush_buffer succeeds */ +if (STp->can_partitions) { + i =switch_partition (STp); +if (i <0 ) { + retval = i; + goto out; + } + } } -if (cmd_type ==_IOC_TYPE (MTIOCGET ) && cmd_nr ==_IOC_NR (MTIOCGET )) { +if (cmd_mtiocget) {struct mtget mt_status;if (_IOC_SIZE (cmd_in) !=sizeof (struct mtget )) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 379/466 pinctrl: qcom-pmic-gpio: add support for PM8937
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit 89265a58ff24e3885c2c9ca722bc3aaa47018be9 ]
PM8937 has 8 GPIO-s with holes on GPIO3, GPIO4 and GPIO6.
--- drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +2 -0
@@ -1226,6 +1226,8 @@ static const struct of_device_id pmic_gpio_of_match[] = { { .compatible = "qcom,pm8550ve-gpio", .data = (void *) 8 }, { .compatible = "qcom,pm8550vs-gpio", .data = (void *) 6 }, { .compatible = "qcom,pm8916-gpio", .data = (void *) 4 }, + /* pm8937 has 8 GPIOs with holes on 3, 4 and 6 */ + { .compatible = "qcom,pm8937-gpio", .data = (void *) 8 }, { .compatible = "qcom,pm8941-gpio", .data = (void *) 36 }, /* pm8950 has 8 GPIOs with holes on 3 */ { .compatible = "qcom,pm8950-gpio", .data = (void *) 8 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 380/466 pinctrl: qcom: spmi-mpp: Add PM8937 compatible
In reply to Greg Kroah-Hartman6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Barnabás Czémán <[email protected]>
[ Upstream commit f755261190e88f5d19fe0a3b762f0bbaff6bd438 ]
The PM8937 provides 4 MPPs.
Add a compatible to support them.
--- drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/qcom/pinctrl-spmi-mpp.c +1 -0
@@ -983,6 +983,7 @@ static const struct of_device_id pmic_mpp_of_match[] = { { .compatible = "qcom,pm8226-mpp", .data = (void *) 8 }, { .compatible = "qcom,pm8841-mpp", .data = (void *) 4 }, { .compatible = "qcom,pm8916-mpp", .data = (void *) 4 }, + { .compatible = "qcom,pm8937-mpp", .data = (void *) 4 }, { .compatible = "qcom,pm8941-mpp", .data = (void *) 8 }, { .compatible = "qcom,pm8950-mpp", .data = (void *) 4 }, { .compatible = "qcom,pmi8950-mpp", .data = (void *) 4 },
Signature · 1 line
2.43.0