6.17.12-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.17.12-rc1 review
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 12 Dec 2025 07:29:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.12-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.17.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.17.12-rc1
Navaneeth K <[email protected]>
staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
Navaneeth K <[email protected]>
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
Navaneeth K <[email protected]>
staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
Nikita Zhandarovich <[email protected]>
comedi: check device's attached status in compat ioctls
Nikita Zhandarovich <[email protected]>
comedi: multiq3: sanitize config options in multiq3_attach()
Ian Abbott <[email protected]>
comedi: c6xdigio: Fix invalid PNP driver unregistration
Antoniu Miclaus <[email protected]>
iio: adc: ad4080: fix chip identification
Zenm Chen <[email protected]>
wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
Zenm Chen <[email protected]>
wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
Marcos Vega <[email protected]>
platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile
Krishna Chomal <[email protected]>
platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support
Linus Torvalds <[email protected]>
samples: work around glibc redefining some of our defines wrong
Huacai Chen <[email protected]>
LoongArch: Mask all interrupts during kexec/kdump
Zqiang <[email protected]>
sched_ext: Use IRQ_WORK_INIT_HARD() to initialize rq->scx.kick_cpus_irq_work
Naoki Ueki <[email protected]>
HID: elecom: Add support for ELECOM M-XT3URBK (018F)
Srinivas Pandruvada <[email protected]>
platform/x86/intel/hid: Add Nova Lake support
Zqiang <[email protected]>
sched_ext: Fix possible deadlock in the deferred_irq_workfn()
Antheas Kapenekakis <[email protected]>
platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
Antheas Kapenekakis <[email protected]>
platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
Kuppuswamy Sathyanarayanan <[email protected]>
platform/x86: intel-uncore-freq: Add additional client processors
Jia Ston <[email protected]>
platform/x86: huawei-wmi: add keys for HONOR models
April Grimoire <[email protected]>
HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
Armin Wolf <[email protected]>
platform/x86: acer-wmi: Ignore backlight event
Praveen Talari <[email protected]>
pinctrl: qcom: msm: Fix deadlock in pinmux configuration
Keith Busch <[email protected]>
nvme: fix admin request_queue lifetime
Edip Hazuri <[email protected]>
platform/x86: hp-wmi: mark Victus 16-r0 and 16-s0 for victus_s fan and thermal profile support
Antheas Kapenekakis <[email protected]>
platform/x86/amd/pmc: Add support for Van Gogh SoC
Mario Limonciello (AMD) <[email protected]>
HID: hid-input: Extend Elan ignore battery quirk to USB
Tetsuo Handa <[email protected]>
bfs: Reconstruct file type when loading from disk
Lauri Tirkkonen <[email protected]>
HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc
Lushih Hsieh <[email protected]>
ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
Harish Kasiviswanathan <[email protected]>
drm/amdkfd: Fix GPU mappings for APU after prefetch
Yiqi Sun <[email protected]>
smb: fix invalid username check in smb3_fs_context_parse_param()
Niranjan H Y <[email protected]>
ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list
Max Chou <[email protected]>
Bluetooth: btrtl: Avoid loading the config file on security chips
Baojun Xu <[email protected]>
ALSA: hda/tas2781: Add new quirk for HP new projects
Adrian Barnaś <[email protected]>
arm64: Reject modules with internal alternative callbacks
Ian Forbes <[email protected]>
drm/vmwgfx: Use kref in vmw_bo_dirty
Kaushlendra Kumar <[email protected]>
ACPI: MRRM: Fix memory leaks and improve error handling
Robin Gong <[email protected]>
spi: imx: keep dma request disabled before dma transfer setup
Alvaro Gamez Machado <[email protected]>
spi: xilinx: increase number of retries before declaring stall
Song Liu <[email protected]>
ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
Johan Hovold <[email protected]>
USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
Johan Hovold <[email protected]>
USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
Biju Das <[email protected]>
serial: sh-sci: Fix deadlock during RSCI FIFO overrun error
Biju Das <[email protected]>
dt-bindings: serial: rsci: Drop "uart-has-rtscts: false"
Magne Bruno <[email protected]>
serial: add support of CPCI cards
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: match on interface number for jtag
Fabio Porcedda <[email protected]>
USB: serial: option: move Telit 0x10c7 composition in the right place
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE910C04 new compositions
Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W760
Omar Sandoval <[email protected]>
KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced
Nikita Zhandarovich <[email protected]>
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
Alexey Nepomnyashih <[email protected]>
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
Giovanni Cabiddu <[email protected]>
crypto: zstd - fix double-free in per-CPU stream cleanup
Alexander Sverdlin <[email protected]>
locking/spinlock/debug: Fix data-race in do_raw_write_lock
Qianchang Zhao <[email protected]>
ksmbd: ipc: fix use-after-free in ipc_msg_send_request
Deepanshu Kartikey <[email protected]>
ext4: refresh inline data size before write operations
Ye Bin <[email protected]>
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
Bagas Sanjaya <[email protected]>
Documentation: process: Also mention Sasha Levin as stable tree maintainer
-------------
Diffstat:
.../devicetree/bindings/serial/renesas,rsci.yaml | 2 - Documentation/process/2.Process.rst | 6 +- Makefile | 4 +- arch/arm64/include/asm/alternative.h | 7 ++- arch/arm64/kernel/alternative.c | 19 +++--- arch/arm64/kernel/module.c | 9 ++- arch/loongarch/kernel/machine_kexec.c | 2 + arch/x86/include/asm/kvm_host.h | 9 +++ arch/x86/kvm/svm/svm.c | 24 ++++---- arch/x86/kvm/x86.c | 21 +++++++ crypto/zstd.c | 7 +-- drivers/acpi/acpi_mrrm.c | 51 ++++++++++----- drivers/bluetooth/btrtl.c | 24 ++++---- drivers/comedi/comedi_fops.c | 42 +++++++++++-- drivers/comedi/drivers/c6xdigio.c | 46 ++++++++++---- drivers/comedi/drivers/multiq3.c | 9 +++ drivers/comedi/drivers/pcl818.c | 5 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 ++-- drivers/hid/hid-apple.c | 1 + drivers/hid/hid-elecom.c | 6 +- drivers/hid/hid-ids.h | 4 +- drivers/hid/hid-input.c | 5 +- drivers/hid/hid-lenovo.c | 17 +++++ drivers/hid/hid-quirks.c | 3 +- drivers/iio/adc/ad4080.c | 9 ++- drivers/net/wireless/realtek/rtl8xxxu/core.c | 3 + drivers/net/wireless/realtek/rtw88/rtw8822cu.c | 2 + drivers/nvme/host/core.c | 3 +- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- drivers/platform/x86/acer-wmi.c | 4 ++ drivers/platform/x86/amd/pmc/pmc-quirks.c | 25 ++++++++ drivers/platform/x86/amd/pmc/pmc.c | 3 + drivers/platform/x86/amd/pmc/pmc.h | 1 + drivers/platform/x86/hp/hp-wmi.c | 6 +- drivers/platform/x86/huawei-wmi.c | 4 ++ drivers/platform/x86/intel/hid.c | 1 + .../x86/intel/uncore-frequency/uncore-frequency.c | 4 ++ drivers/spi/spi-imx.c | 15 +++-- drivers/spi/spi-xilinx.c | 2 +- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 14 +++-- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 13 ++-- drivers/tty/serial/8250/8250_pci.c | 37 +++++++++++ drivers/tty/serial/sh-sci.c | 12 +++- drivers/usb/serial/belkin_sa.c | 28 +++++---- drivers/usb/serial/ftdi_sio.c | 72 ++++++++-------------- drivers/usb/serial/kobil_sct.c | 18 +++--- drivers/usb/serial/option.c | 22 ++++++- fs/bfs/inode.c | 19 +++++- fs/ext4/inline.c | 14 ++++- fs/jbd2/transaction.c | 19 ++++-- fs/smb/client/fs_context.c | 2 +- fs/smb/server/transport_ipc.c | 7 ++- kernel/locking/spinlock_debug.c | 4 +- kernel/sched/ext.c | 4 +- kernel/trace/ftrace.c | 40 +++++++++--- samples/vfs/test-statx.c | 6 ++ samples/watch_queue/watch_test.c | 6 ++ sound/hda/codecs/realtek/alc269.c | 9 +++ sound/soc/sdca/sdca_functions.c | 3 +- sound/usb/quirks.c | 6 ++ 61 files changed, 564 insertions(+), 212 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/60 Documentation: process: Also mention Sasha Levin as stable tree maintainer
6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <[email protected]>
commit ba2457109d5b47a90fe565b39524f7225fc23e60 upstream.
Sasha has also maintaining stable branch in conjunction with Greg since cb5d21946d2a2f ("MAINTAINERS: Add Sasha as a stable branch maintainer"). Mention him in 2.Process.rst.
Message-ID: <[email protected]>
--- Documentation/process/2.Process.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
Documentation/process/2.Process.rst +4 -2
@@ -104,8 +104,10 @@ kernels go out with a handful of known r of them are serious. Once a stable release is made, its ongoing maintenance is passed off to the -"stable team," currently Greg Kroah-Hartman. The stable team will release -occasional updates to the stable release using the 5.x.y numbering scheme. +"stable team," currently consists of Greg Kroah-Hartman and Sasha Levin. The +stable team will release occasional updates to the stable release using the +5.x.y numbering scheme. + To be considered for an update release, a patch must (1) fix a significant bug, and (2) already be merged into the mainline for the next development kernel. Kernels will typically receive stable updates for a little more
Greg Kroah-Hartman
maintainerPATCH 2/60 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
commit 986835bf4d11032bba4ab8414d18fce038c61bb4 upstream.
There's issue when file system corrupted:
------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1289! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0 RSP: 0018:ffff888117aafa30 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534 RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010 RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028 R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0 Call Trace: <TASK> __ext4_journal_get_create_access+0x42/0x170 ext4_getblk+0x319/0x6f0 ext4_bread+0x11/0x100 ext4_append+0x1e6/0x4a0 ext4_init_new_dir+0x145/0x1d0 ext4_mkdir+0x326/0x920 vfs_mkdir+0x45c/0x740 do_mkdirat+0x234/0x2f0 __x64_sys_mkdir+0xd6/0x120 do_syscall_64+0x5f/0xfa0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data.
In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue.
Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON.
Message-ID: <[email protected]>
--- fs/jbd2/transaction.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
fs/jbd2/transaction.c +14 -5
@@ -1284,14 +1284,23 @@ int jbd2_journal_get_create_access(handl* committing transaction's lists, but it HAS to be in Forget state in * that case: the transaction must have deleted the buffer for it to be * reused here. +* In the case of file system data inconsistency, for example, if the +* block bitmap of a referenced block is not set, it can lead to the +* situation where a block being committed is allocated and used again. +* As a result, the following condition will not be satisfied, so here +* we directly trigger a JBD abort instead of immediately invoking +* bugon. */ spin_lock (&jh->b_state_lock); -J_ASSERT_JH (jh, (jh->b_transaction == transaction || - jh->b_transaction ==NULL || - (jh->b_transaction == journal->j_committing_transaction && - jh->b_jlist == BJ_Forget))); +if (!(jh->b_transaction == transaction || jh->b_transaction ==NULL || + (jh->b_transaction == journal->j_committing_transaction && + jh->b_jlist == BJ_Forget)) || jh->b_next_transaction !=NULL ) { + err = -EROFS ; +spin_unlock (&jh->b_state_lock); +jbd2_journal_abort (journal, err); + goto out; + } -J_ASSERT_JH (jh, jh->b_next_transaction ==NULL );J_ASSERT_JH (jh,buffer_locked (jh2bh (jh)));if (jh->b_transaction ==NULL ) {
Greg Kroah-Hartman
maintainerPATCH 3/60 ext4: refresh inline data size before write operations
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <[email protected]>
commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b upstream.
The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired.
This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data():
kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);
The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers
Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications.
This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -418,7 +418,12 @@ static int ext4_prepare_inline_data(handreturn -ENOSPC ;ext4_write_lock_xattr (inode, &no_expand); - +/* +* ei->i_inline_size may have changed since the initial check +* if other xattrs were added. Recalculate to ensure +* ext4_update_inline_data() validates against current capacity. +*/ + (void )ext4_find_inline_data_nolock (inode);if (ei->i_inline_off) ret =ext4_update_inline_data (handle, inode, len);else
Greg Kroah-Hartman
maintainerPATCH 4/60 ksmbd: ipc: fix use-after-free in ipc_msg_send_request
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianchang Zhao <[email protected]>
commit 1fab1fa091f5aa97265648b53ea031deedd26235 upstream.
ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock.
Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event():
BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]
Write of size 12 at addr ffff888198ee6e20 by task pool/109349
...
Freed by task:
kvfree
ipc_msg_send_request [ksmbd]
ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]Fix by:
- Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table.
- Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock.
- Returning NULL in the error path, preserving the original API semantics.
This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.
--- fs/smb/server/transport_ipc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/smb/server/transport_ipc.c +5 -2
@@ -553,12 +553,16 @@ static void *ipc_msg_send_request(structup_write (&ipc_msg_table_lock); ret =ipc_msg_send (msg); -if (ret) +if (ret) { +down_write (&ipc_msg_table_lock); goto out; + } ret =wait_event_interruptible_timeout (entry.wait, entry.response !=NULL ,IPC_WAIT_TIMEOUT ); + +down_write (&ipc_msg_table_lock);if (entry.response) { ret =ipc_validate_msg (&entry);if (ret) {
@@ -567,7 +571,6 @@ static void *ipc_msg_send_request(struct } } out: -down_write (&ipc_msg_table_lock);hash_del (&entry.ipc_table_hlist);up_write (&ipc_msg_table_lock);return entry.response;
Greg Kroah-Hartman
maintainerPATCH 5/60 locking/spinlock/debug: Fix data-race in do_raw_write_lock
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <[email protected]>
commit c14ecb555c3ee80eeb030a4e46d00e679537f03a upstream.
KCSAN reports:
BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock
write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
do_raw_write_lock+0x120/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
do_raw_write_lock+0x88/0x204 _raw_write_lock_irq do_exit call_usermodehelper_exec_async ret_from_fork
value changed: 0xffffffff -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111
Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete.
Quoted 1 line
From
do_raw_write_lock()onlydebug_write_lock_after()part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now.
--- kernel/locking/spinlock_debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/locking/spinlock_debug.c +2 -2
@@ -184,8 +184,8 @@ void do_raw_read_unlock(rwlock_t *lock)static inline void debug_write_lock_before (rwlock_t *lock) {RWLOCK_BUG_ON (lock->magic !=RWLOCK_MAGIC , lock,"bad magic" ); -RWLOCK_BUG_ON (lock->owner == current, lock,"recursion" ); -RWLOCK_BUG_ON (lock->owner_cpu ==raw_smp_processor_id (), +RWLOCK_BUG_ON (READ_ONCE (lock->owner) == current, lock,"recursion" ); +RWLOCK_BUG_ON (READ_ONCE (lock->owner_cpu) ==raw_smp_processor_id (), lock,"cpu recursion" ); }
Greg Kroah-Hartman
maintainerPATCH 6/60 crypto: zstd - fix double-free in per-CPU stream cleanup
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <[email protected]>
commit 48bc9da3c97c15f1ea24934bcb3b736acd30163d upstream.
The crypto/zstd module has a double-free bug that occurs when multiple tfms are allocated and freed.
The issue happens because zstd_streams (per-CPU contexts) are freed in zstd_exit() during every tfm destruction, rather than being managed at the module level. When multiple tfms exist, each tfm exit attempts to free the same shared per-CPU streams, resulting in a double-free.
This leads to a stack trace similar to:
BUG: Bad page state in process kworker/u16:1 pfn:106fd93 page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106fd93 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: nonzero entire_mapcount Modules linked in: ... CPU: 3 UID: 0 PID: 2506 Comm: kworker/u16:1 Kdump: loaded Tainted: G B Hardware name: ... Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> dump_stack_lvl+0x5d/0x80 bad_page+0x71/0xd0 free_unref_page_prepare+0x24e/0x490 free_unref_page+0x60/0x170 crypto_acomp_free_streams+0x5d/0xc0 crypto_acomp_exit_tfm+0x23/0x50 crypto_destroy_tfm+0x60/0xc0 ...
Change the lifecycle management of zstd_streams to free the streams only once during module cleanup.
--- crypto/zstd.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
crypto/zstd.c +1 -6
@@ -75,11 +75,6 @@ static int zstd_init(struct crypto_acomp *acomp_tfm)return ret; } -static void zstd_exit (struct crypto_acomp *acomp_tfm) -{ -crypto_acomp_free_streams (&zstd_streams); -} -static int zstd_compress_one (struct acomp_req *req,struct zstd_ctx *ctx,const void *src,void *dst,unsigned int *dlen) {
@@ -297,7 +292,6 @@ static struct acomp_alg zstd_acomp = { .cra_module = THIS_MODULE, }, .init = zstd_init, - .exit = zstd_exit, .compress = zstd_compress, .decompress = zstd_decompress, };
@@ -310,6 +304,7 @@ static int __init zstd_mod_init(void) static void __exit zstd_mod_fini(void) {crypto_unregister_acomp (&zstd_acomp); +crypto_acomp_free_streams (&zstd_streams); }module_init (zstd_mod_init);
Signature · 1 line
2.52.0
Greg Kroah-Hartman
maintainerPATCH 7/60 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Nepomnyashih <[email protected]>
commit 0cd8feea8777f8d9b9a862b89c688b049a5c8475 upstream.
Fix a race between inline data destruction and block mapping.
The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks().
Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert.
kernel BUG at fs/ext4/indirect.c:546!
EXT4-fs (loop2): unmounting filesystem.
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546 Call Trace: <TASK> ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679 call_write_iter include/linux/fs.h:2271 [inline] do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735 do_iter_write+0x186/0x710 fs/read_write.c:861 vfs_iter_write+0x70/0xa0 fs/read_write.c:902 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685 do_splice_from fs/splice.c:763 [inline] direct_splice_actor+0x10f/0x170 fs/splice.c:950 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896 do_splice_direct+0x1a9/0x280 fs/splice.c:1002 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Message-ID: <[email protected]>
--- fs/ext4/inline.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inline.c +6 -1
@@ -451,9 +451,13 @@ static int ext4_destroy_inline_data_noloif (!ei->i_inline_off)return 0 ; +down_write (&ei->i_data_sem); + error =ext4_get_inode_loc (inode, &is.iloc); -if (error) +if (error) { +up_write (&ei->i_data_sem);return error; + } error =ext4_xattr_ibody_find (inode, &i, &is);if (error)
@@ -492,6 +496,7 @@ out:brelse (is.iloc.bh);if (error == -ENODATA ) error =0 ; +up_write (&ei->i_data_sem);return error; }
Greg Kroah-Hartman
maintainerPATCH 8/60 comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit a51f025b5038abd3d22eed2ede4cd46793d89565 upstream.
Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its pointer to &struct comedi_async as intended. Thus, any such dereferencing of &s->async->cmd will lead to general protection fault and kernel crash.
Mitigate this problem by removing a call to pcl818_ai_cancel() from pcl818_detach() altogether. This way, if the subdevice setups its support for async commands, everything async-related will be handled via subdevice's own ->cancel() function in comedi_device_detach_locked() even before pcl818_detach(). If no support for asynchronous commands is provided, there is no need to cancel anything either.
[1] Syzbot crash:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762 ... Call Trace: <TASK> pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline] comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline]
...
--- drivers/comedi/drivers/pcl818.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/comedi/drivers/pcl818.c +2 -3
@@ -1111,10 +1111,9 @@ static void pcl818_detach(struct comedi_ {struct pcl818_private *devpriv = dev->private; -if (devpriv) { -pcl818_ai_cancel (dev, dev->read_subdev); +if (devpriv)pcl818_reset (dev); - } +pcl818_free_dma (dev);comedi_legacy_detach (dev); }
Greg Kroah-Hartman
maintainerPATCH 9/60 KVM: SVM: Dont skip unrelated instruction if INT3/INTO is replaced
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <[email protected]>
commit 4da3768e1820cf15cced390242d8789aed34f54d upstream.
When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the instruction if the code stream is changed (e.g. by a different vCPU) between when the CPU executes the instruction and when KVM decodes the instruction to get the next RIP.
As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction"), failure to verify that the correct INTn instruction was decoded can effectively clobber guest state due to decoding the wrong instruction and thus specifying the wrong next RIP.
The bug most often manifests as "Oops: int3" panics on static branch checks in Linux guests. Enabling or disabling a static branch in Linux uses the kernel's "text poke" code patching mechanism. To modify code while other CPUs may be executing that code, Linux (temporarily) replaces the first byte of the original instruction with an int3 (opcode 0xcc), then patches in the new code stream except for the first byte, and finally replaces the int3 with the first byte of the new code stream. If a CPU hits the int3, i.e. executes the code while it's being modified, then the guest kernel must look up the RIP to determine how to handle the #BP, e.g. by emulating the new instruction. If the RIP is incorrect, then this lookup fails and the guest kernel panics.
The bug reproduces almost instantly by hacking the guest kernel to repeatedly check a static branch[1] while running a drgn script[2] on the host to constantly swap out the memory containing the guest's TSS.
[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b
--- arch/x86/include/asm/kvm_host.h | 9 +++++++++ arch/x86/kvm/svm/svm.c | 24 +++++++++++++----------- arch/x86/kvm/x86.c | 21 +++++++++++++++++++++ 3 files changed, 43 insertions(+), 11 deletions(-)
arch/x86/include/asm/kvm_host.h +9 -0
@@ -2123,6 +2123,11 @@ u64 vcpu_tsc_khz(struct kvm_vcpu *vcpu);* the gfn, i.e. retrying the instruction will hit a * !PRESENT fault, which results in a new shadow page * and sends KVM back to square one. +* +* EMULTYPE_SKIP_SOFT_INT - Set in combination with EMULTYPE_SKIP to only skip +* an instruction if it could generate a given software +* interrupt, which must be encoded via +* EMULTYPE_SET_SOFT_INT_VECTOR(). */ #define EMULTYPE_NO_DECODE (1 << 0)#define EMULTYPE_TRAP_UD (1 << 1)
@@ -2133,6 +2138,10 @@ u64 vcpu_tsc_khz(struct kvm_vcpu *vcpu);#define EMULTYPE_PF (1 << 6)#define EMULTYPE_COMPLETE_USER_EXIT (1 << 7)#define EMULTYPE_WRITE_PF_TO_SP (1 << 8) +#define EMULTYPE_SKIP_SOFT_INT (1 << 9) + +#define EMULTYPE_SET_SOFT_INT_VECTOR (v) ((u32)((v) & 0xff) << 16) +#define EMULTYPE_GET_SOFT_INT_VECTOR (e) (((e) >> 16) & 0xff)static inline bool kvm_can_emulate_event_vectoring (int emul_type) {
arch/x86/kvm/svm/svm.c +13 -11
@@ -280,6 +280,7 @@ static void svm_set_interrupt_shadow(str }static int __svm_skip_emulated_instruction (struct kvm_vcpu *vcpu, +int emul_type,bool commit_side_effects) {struct vcpu_svm *svm =to_svm (vcpu);
@@ -301,7 +302,7 @@ static int __svm_skip_emulated_instructiif (unlikely (!commit_side_effects)) old_rflags = svm->vmcb->save.rflags; -if (!kvm_emulate_instruction (vcpu,EMULTYPE_SKIP )) +if (!kvm_emulate_instruction (vcpu, emul_type))return 0 ;if (unlikely (!commit_side_effects))
@@ -319,11 +320,13 @@ done:static int svm_skip_emulated_instruction (struct kvm_vcpu *vcpu) { -return __svm_skip_emulated_instruction (vcpu, true); +return __svm_skip_emulated_instruction (vcpu,EMULTYPE_SKIP , true); } -static int svm_update_soft_interrupt_rip (struct kvm_vcpu *vcpu) +static int svm_update_soft_interrupt_rip (struct kvm_vcpu *vcpu,u8 vector) { +const int emul_type =EMULTYPE_SKIP |EMULTYPE_SKIP_SOFT_INT | +EMULTYPE_SET_SOFT_INT_VECTOR (vector);unsigned long rip, old_rip =kvm_rip_read (vcpu);struct vcpu_svm *svm =to_svm (vcpu);
@@ -339,7 +342,7 @@ static int svm_update_soft_interrupt_rip* in use, the skip must not commit any side effects such as clearing * the interrupt shadow or RFLAGS.RF. */ -if (!__svm_skip_emulated_instruction (vcpu, !nrips)) +if (!__svm_skip_emulated_instruction (vcpu, emul_type, !nrips))return -EIO ; rip =kvm_rip_read (vcpu);
@@ -375,7 +378,7 @@ static void svm_inject_exception(structkvm_deliver_exception_payload (vcpu, ex);if (kvm_exception_is_soft (ex->vector) && -svm_update_soft_interrupt_rip (vcpu)) +svm_update_soft_interrupt_rip (vcpu, ex->vector))return ; svm->vmcb->control.event_inj = ex->vector
@@ -3662,11 +3665,12 @@ static bool svm_set_vnmi_pending(structstatic void svm_inject_irq (struct kvm_vcpu *vcpu,bool reinjected) { +struct kvm_queued_interrupt *intr = &vcpu->arch.interrupt;struct vcpu_svm *svm =to_svm (vcpu);u32 type; -if (vcpu->arch.interrupt.soft) { -if (svm_update_soft_interrupt_rip (vcpu)) +if (intr->soft) { +if (svm_update_soft_interrupt_rip (vcpu, intr->nr))return ; type =SVM_EVTINJ_TYPE_SOFT ;
@@ -3674,12 +3678,10 @@ static void svm_inject_irq(struct kvm_vc type =SVM_EVTINJ_TYPE_INTR ; } -trace_kvm_inj_virq (vcpu->arch.interrupt.nr, - vcpu->arch.interrupt.soft, reinjected); +trace_kvm_inj_virq (intr->nr, intr->soft, reinjected); ++vcpu->stat.irq_injections; - svm->vmcb->control.event_inj = vcpu->arch.interrupt.nr | -SVM_EVTINJ_VALID | type; + svm->vmcb->control.event_inj = intr->nr |SVM_EVTINJ_VALID | type; } void svm_complete_interrupt_delivery(struct kvm_vcpu *vcpu, int delivery_mode,
arch/x86/kvm/x86.c +21 -0
@@ -9021,6 +9021,23 @@ static bool is_vmware_backdoor_opcode(streturn false; } +static bool is_soft_int_instruction (struct x86_emulate_ctxt *ctxt, +int emulation_type) +{ +u8 vector =EMULTYPE_GET_SOFT_INT_VECTOR (emulation_type); + +switch (ctxt->b) { +case 0xcc : +return vector ==BP_VECTOR ; +case 0xcd : +return vector == ctxt->src.val; +case 0xce : +return vector ==OF_VECTOR ; +default : +return false; + } +} +/* * Decode an instruction for emulation. The caller is responsible for handling * code breakpoints. Note, manually detecting code breakpoints is unnecessary
@@ -9131,6 +9148,10 @@ int x86_emulate_instruction(struct kvm_v* injecting single-step #DBs. */ if (emulation_type &EMULTYPE_SKIP ) { +if (emulation_type &EMULTYPE_SKIP_SOFT_INT && + !is_soft_int_instruction (ctxt, emulation_type)) +return 0 ; +if (ctxt->mode !=X86EMUL_MODE_PROT64 ) ctxt->eip = (u32 )ctxt->_eip;else
Greg Kroah-Hartman
maintainerPATCH 10/60 USB: serial: option: add Foxconn T99W760
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <[email protected]>
commit 7970b4969c4c99bcdaf105f9f39c6d2021f6d244 upstream.
T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are three serial ports to be enumerated: Modem, NMEA and Diag.
test evidence as below:
T: Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e123 Rev=05.15 S: Manufacturer=QCOM S: Product=SDXBAAGHA-IDP _SN:39A8D3E4 S: SerialNumber=39a8d3e4 C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2376,6 +2376,8 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */ .driver_info = RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe123, 0xff), /* Foxconn T99W760 MBIM */ + .driver_info = RSVD(3) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff), /* Foxconn T99W651 RNDIS */ .driver_info = RSVD(5) | RSVD(6) }, { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe15f, 0xff), /* Foxconn T99W709 */
Greg Kroah-Hartman
maintainerPATCH 11/60 USB: serial: option: add Telit Cinterion FE910C04 new compositions
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit c908039a29aa70870871f4848125b3d743f929bf upstream.
Add the following Telit Cinterion new compositions:
0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c2 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c3 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c5 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10c9 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10cb Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FE910 S: SerialNumber=f71b8b32 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/serial/option.c +14 -0
@@ -1433,10 +1433,24 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c1, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c2, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c3, 0xff), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c5, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10cb, 0xff), /* Telit FE910C04 (RNDIS) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30), /* Telit FN990B (rmnet) */ .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 12/60 USB: serial: option: move Telit 0x10c7 composition in the right place
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 072f2c49572547f4b0776fe2da6b8f61e4b34699 upstream.
Move Telit 0x10c7 composition right after 0x10c6 composition and before 0x10c8 composition.
--- drivers/usb/serial/option.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/serial/option.c +3 -3
@@ -1445,6 +1445,9 @@ static const struct usb_device_id option .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff), /* Telit FE910C04 (MBIM) */ .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ + .driver_info = NCTRL(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff), /* Telit FE910C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff), /* Telit FE910C04 (MBIM) */
@@ -1455,9 +1458,6 @@ static const struct usb_device_id option .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30), /* Telit FE910C04 (ECM) */ - .driver_info = NCTRL(4) }, - { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30), /* Telit FN990B (MBIM) */ .driver_info = NCTRL(6) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 13/60 USB: serial: ftdi_sio: match on interface number for jtag
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 4e31a5d0a9ee672f708fc993c1d5520643f769fd upstream.
Some FTDI devices have the first port reserved for JTAG and have been using a dedicated quirk to prevent binding to it.
As can be inferred directly or indirectly from the commit messages, almost all of these devices are dual port devices which means that the more recently added macro for matching on interface number can be used instead (and some such devices do so already).
This avoids probing interfaces that will never be bound and cleans up the match table somewhat.
Note that the JTAG quirk is kept for quad port devices, which would otherwise require three match entries.
--- drivers/usb/serial/ftdi_sio.c | 72 ++++++++++++++---------------------------- 1 file changed, 24 insertions(+), 48 deletions(-)
drivers/usb/serial/ftdi_sio.c +24 -48
@@ -628,10 +628,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) }, { USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) }, - { USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TIAO_UMPA_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_NT_ORIONLXM_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) }, { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },
@@ -842,24 +840,17 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) }, { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, - { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, CYBER_CORTEX_AV_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) }, { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) }, - { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FIC_VID, FIC_NEO1973_DEBUG_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_OOCDLINK_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) }, { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) }, { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
@@ -901,17 +892,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(ATMEL_VID, STK541_PID) }, { USB_DEVICE(DE_VID, STB_PID) }, { USB_DEVICE(DE_VID, WHT_PID) }, - { USB_DEVICE(ADI_VID, ADI_GNICE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICEPLUS_PID, 1) }, { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,USB_CLASS_VENDOR_SPEC , USB_SUBCLASS_VENDOR_SPEC, 0x00) }, { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) }, { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, - { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(MARVELL_VID, MARVELL_SHEEVAPLUG_PID, 1) }, { USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) }, { USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) }, { USB_DEVICE(FTDI_VID, PI_C865_PID) },
@@ -934,10 +922,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(PI_VID, PI_1016_PID) }, { USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) }, { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) }, - { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, TI_XDS100V2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, MARVELL_OPENRD_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, TI_XDS100V2_PID, 1) }, { USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) }, { USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
@@ -946,18 +932,14 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) }, { USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_ST_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID, 1) }, { USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, { USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) }, { USB_DEVICE(FTDI_VID, ACCESIO_COM4SM_PID) }, - { USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(IONICS_VID, IONICS_PLUGCOMPUTER_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_24_MASTER_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_PC_WING_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_USB_DMX_PID) },
@@ -972,15 +954,12 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, - { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(ST_VID, ST_STMCLT_2232_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(ST_VID, ST_STMCLT_2232_PID, 1) }, { USB_DEVICE(ST_VID, ST_STMCLT_4232_PID), .driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk }, { USB_DEVICE(FTDI_VID, FTDI_RF_R106) }, - { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID, 1) }, { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },/* Crucible Devices */ { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
@@ -1055,8 +1034,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) }, { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) }, { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, - { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(TI_VID, TI_CC3200_LAUNCHPAD_PID, 1) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },
@@ -1076,10 +1054,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },/* FreeCalypso USB adapters */ - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID, 1) }, + { USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID, 1) },/* GMC devices */ { USB_DEVICE(GMC_VID, GMC_Z216C_PID) },/* Altera USB Blaster 3 */
Greg Kroah-Hartman
maintainerPATCH 14/60 serial: add support of CPCI cards
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Magne Bruno <[email protected]>
commit 0e5a99e0e5f50353b86939ff6e424800d769c818 upstream.
Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI). Those cards are identified with different DeviceIds. Those cards integrating standard UARTs work the same way as PCI/PCIe models already supported in the serial driver.
--- drivers/tty/serial/8250/8250_pci.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
drivers/tty/serial/8250/8250_pci.c +37 -0
@@ -95,6 +95,11 @@#define PCI_DEVICE_ID_MOXA_CP138E_A 0x1381#define PCI_DEVICE_ID_MOXA_CP168EL_A 0x1683 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500 0x7003 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG 0x7024 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG 0x7025 +#define PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG 0x7026 +/* Unknown vendors/cards - this should not be in linux/pci_ids.h */ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584#define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -5996,6 +6001,38 @@ static const struct pci_device_id serial0 , pbn_ADDIDATA_PCIe_8_3906250 }, + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500 , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_4_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_2_115200 }, + + { PCI_VENDOR_ID_ADDIDATA, +PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG , +PCI_ANY_ID , +PCI_ANY_ID , +0 , +0 , + pbn_b0_1_115200 }, + { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,PCI_VENDOR_ID_IBM ,0x0299 , 0, 0, pbn_b0_bt_2_115200 },
Greg Kroah-Hartman
maintainerPATCH 15/60 dt-bindings: serial: rsci: Drop "uart-has-rtscts: false"
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit a6cdfd69ad38997108b862f9aafc547891506701 upstream.
Drop "uart-has-rtscts: false" from binding as the IP supports hardware flow control on all SoCs.
--- Documentation/devicetree/bindings/serial/renesas,rsci.yaml | 2 -- 1 file changed, 2 deletions(-)
Documentation/devicetree/bindings/serial/renesas,rsci.yaml +0 -2
@@ -54,8 +54,6 @@ properties: power-domains: maxItems: 1 - uart-has-rtscts: false - required: - compatible - reg
Greg Kroah-Hartman
maintainerPATCH 16/60 serial: sh-sci: Fix deadlock during RSCI FIFO overrun error
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
commit 75a9f4c54770f062f4b3813a83667452b326dda3 upstream.
On RSCI IP, a deadlock occurs during a FIFO overrun error, as it uses a different register to clear the FIFO overrun error status.
--- drivers/tty/serial/sh-sci.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/tty/serial/sh-sci.c +10 -2
@@ -1024,8 +1024,16 @@ static int sci_handle_fifo_overrun(struc status = s->ops->read_reg (port, s->params->overrun_reg);if (status & s->params->overrun_mask) { - status &= ~s->params->overrun_mask; - s->ops->write_reg (port, s->params->overrun_reg, status); +if (s->type ==SCI_PORT_RSCI ) { +/* +* All of the CFCLR_*C clearing bits match the corresponding +* CSR_*status bits. So, reuse the overrun mask for clearing. +*/ + s->ops->clear_SCxSR (port, s->params->overrun_mask); + }else { + status &= ~s->params->overrun_mask; + s->ops->write_reg (port, s->params->overrun_reg, status); + } port->icount.overrun++;
Greg Kroah-Hartman
maintainerPATCH 17/60 USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit b6e0b3016187446ddef9edac03cd9d544ac63f11 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing regression dating back to 2003 when the tiocmset() callback was introduced.
--- drivers/usb/serial/belkin_sa.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/usb/serial/belkin_sa.c +17 -11
@@ -435,7 +435,7 @@ static int belkin_sa_tiocmset(struct ttystruct belkin_sa_private *priv =usb_get_serial_port_data (port);unsigned long control_state;unsigned long flags; -int retval; +int retval =0 ;int rts =0 ;int dtr =0 ;
@@ -452,26 +452,32 @@ static int belkin_sa_tiocmset(struct tty }if (clear &TIOCM_RTS ) { control_state &= ~TIOCM_RTS ; - rts =0 ; + rts =1 ; }if (clear &TIOCM_DTR ) { control_state &= ~TIOCM_DTR ; - dtr =0 ; + dtr =1 ; } priv->control_state = control_state;spin_unlock_irqrestore (&priv->lock, flags); - retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , rts); -if (retval <0 ) { -dev_err (&port->dev,"Set RTS error %d\n" , retval); - goto exit; +if (rts) { + retval =BSA_USB_CMD (BELKIN_SA_SET_RTS_REQUEST , + !!(control_state &TIOCM_RTS )); +if (retval <0 ) { +dev_err (&port->dev,"Set RTS error %d\n" , retval); + goto exit; + } } - retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , dtr); -if (retval <0 ) { -dev_err (&port->dev,"Set DTR error %d\n" , retval); - goto exit; +if (dtr) { + retval =BSA_USB_CMD (BELKIN_SA_SET_DTR_REQUEST , + !!(control_state &TIOCM_DTR )); +if (retval <0 ) { +dev_err (&port->dev,"Set DTR error %d\n" , retval); + goto exit; + } } exit:return retval;
Greg Kroah-Hartman
maintainerPATCH 18/60 USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit d432df758f92c4c28aac409bc807fd1716167577 upstream.
Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.
Fix this long-standing issue dating back to 2003 when the support for these ioctls was added with the introduction of the tiocmset() callback.
--- drivers/usb/serial/kobil_sct.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/usb/serial/kobil_sct.c +9 -9
@@ -418,7 +418,7 @@ static int kobil_tiocmset(struct tty_strstruct usb_serial_port *port = tty->driver_data;struct device *dev = &port->dev;struct kobil_private *priv; -int result; +int result =0 ;int dtr =0 ;int rts =0 ;
@@ -435,12 +435,12 @@ static int kobil_tiocmset(struct tty_strif (set &TIOCM_DTR ) dtr =1 ;if (clear &TIOCM_RTS ) - rts =0 ; + rts =1 ;if (clear &TIOCM_DTR ) - dtr =0 ; + dtr =1 ; -if (priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { -if (dtr !=0 ) +if (dtr && priv->device_type ==KOBIL_ADAPTER_B_PRODUCT_ID ) { +if (set &TIOCM_DTR )dev_dbg (dev,"%s - Setting DTR\n" , __func__);else dev_dbg (dev,"%s - Clearing DTR\n" , __func__);
@@ -448,13 +448,13 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((dtr !=0 ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ), + ((set &TIOCM_DTR ) ?SUSBCR_SSL_SETDTR :SUSBCR_SSL_CLRDTR ),0 ,NULL ,0 , KOBIL_TIMEOUT); - }else { -if (rts !=0 ) + }else if (rts) { +if (set &TIOCM_RTS )dev_dbg (dev,"%s - Setting RTS\n" , __func__);else dev_dbg (dev,"%s - Clearing RTS\n" , __func__);
@@ -462,7 +462,7 @@ static int kobil_tiocmset(struct tty_strusb_sndctrlpipe (port->serial->dev,0 ), SUSBCRequest_SetStatusLinesOrQueues,USB_TYPE_VENDOR |USB_RECIP_ENDPOINT |USB_DIR_OUT , - ((rts !=0 ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ), + ((set &TIOCM_RTS ) ?SUSBCR_SSL_SETRTS :SUSBCR_SSL_CLRRTS ),0 ,NULL , 0,
Greg Kroah-Hartman
maintainerPATCH 19/60 ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Song Liu <[email protected]>
[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ]
ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on the same kernel function. When needed, ftrace_hash_ipmodify_enable() calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to share the same function as the IPMODIFY ftrace (livepatch).
ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, but not called in modify_ftrace_direct() path. As a result, the following operations will break livepatch:
1. Load livepatch to a kernel function;
2. Attach fentry program to the kernel function;
3. Attach fexit program to the kernel function.
After 3, the kernel function being used will not be the livepatched version, but the original version.
Fix this by adding __ftrace_hash_update_ipmodify() to __modify_ftrace_direct() and adjust some logic around the call.
--- kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-)
kernel/trace/ftrace.c +31 -9
@@ -1971,7 +1971,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops)*/ static int __ftrace_hash_update_ipmodify (struct ftrace_ops *ops,struct ftrace_hash *old_hash, -struct ftrace_hash *new_hash) +struct ftrace_hash *new_hash, +bool update_target) {struct ftrace_page *pg;struct dyn_ftrace *rec, *end =NULL ;
@@ -2006,10 +2007,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,if (rec->flags &FTRACE_FL_DISABLED )continue ; -/* We need to update only differences of filter_hash */ +/* +* Unless we are updating the target of a direct function, +* we only need to update differences of filter_hash +*/ in_old = !!ftrace_lookup_ip (old_hash, rec->ip); in_new = !!ftrace_lookup_ip (new_hash, rec->ip); -if (in_old == in_new) +if (!update_target && (in_old == in_new))continue ;if (in_new) {
@@ -2020,7 +2024,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,if (is_ipmodify) goto rollback; -FTRACE_WARN_ON (rec->flags &FTRACE_FL_DIRECT ); +/* +* If this is called by __modify_ftrace_direct() +* then it is only changing where the direct +* pointer is jumping to, and the record already +* points to a direct trampoline. If it isn't, +* then it is a bug to update ipmodify on a direct +* caller. +*/ +FTRACE_WARN_ON (!update_target && + (rec->flags &FTRACE_FL_DIRECT ));/* * Another ops with IPMODIFY is already
@@ -2076,7 +2089,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops)if (ftrace_hash_empty (hash)) hash =NULL ; -return __ftrace_hash_update_ipmodify (ops,EMPTY_HASH , hash); +return __ftrace_hash_update_ipmodify (ops,EMPTY_HASH , hash, false); }/* Disabling always succeeds */
@@ -2087,7 +2100,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops)if (ftrace_hash_empty (hash)) hash =NULL ; -__ftrace_hash_update_ipmodify (ops, hash,EMPTY_HASH ); +__ftrace_hash_update_ipmodify (ops, hash,EMPTY_HASH , false); } static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
@@ -2101,7 +2114,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,if (ftrace_hash_empty (new_hash)) new_hash =NULL ; -return __ftrace_hash_update_ipmodify (ops, old_hash, new_hash); +return __ftrace_hash_update_ipmodify (ops, old_hash, new_hash, false); }static void print_ip_ins (const char *fmt,const unsigned char *p)
@@ -6114,7 +6127,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct);static int __modify_ftrace_direct (struct ftrace_ops *ops,unsigned long addr) { -struct ftrace_hash *hash; +struct ftrace_hash *hash = ops->func_hash->filter_hash;struct ftrace_func_entry *entry, *iter;static struct ftrace_ops tmp_ops = { .func = ftrace_stub,
@@ -6134,13 +6147,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)if (err)return err; +/* +* Call __ftrace_hash_update_ipmodify() here, so that we can call +* ops->ops_func for the ops. This is needed because the above +* register_ftrace_function_nolock() worked on tmp_ops. +*/ + err =__ftrace_hash_update_ipmodify (ops, hash, hash, true); +if (err) + goto out; +/* * Now the ftrace_ops_list_func() is called to do the direct callers. * We can safely change the direct functions attached to each entry. */ mutex_lock (&ftrace_lock); - hash = ops->func_hash->filter_hash; size =1 << hash->size_bits;for (i =0 ; i < size; i++) {hlist_for_each_entry (iter, &hash->buckets[i], hlist) {
@@ -6155,6 +6176,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)mutex_unlock (&ftrace_lock); +out:/* Removing the tmp_ops will add the updated direct callers to the functions */ unregister_ftrace_function (&tmp_ops);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 20/60 spi: xilinx: increase number of retries before declaring stall
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvaro Gamez Machado <[email protected]>
[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]
SPI devices using a (relative) slow frequency need a larger time.
For instance, microblaze running at 83.25MHz and performing a 3 bytes transaction using a 10MHz/16 = 625kHz needed this stall value increased to at least 20. The SPI device is quite slow, but also is the microblaze, so set this value to 32 to give it even more margin.
--- drivers/spi/spi-xilinx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-xilinx.c +1 -1
@@ -300,7 +300,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)/* Read out all the data from the Rx FIFO */ rx_words = n_words; - stalled =10 ; + stalled =32 ;while (rx_words) { if (rx_words == n_words && !(stalled--) && !(sr & XSPI_SR_TX_EMPTY_MASK) &&
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 21/60 spi: imx: keep dma request disabled before dma transfer setup
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Gong <[email protected]>
[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]
Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below:
"It is thus essential for the Arm platform to program them before any DMA
request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started."
--- drivers/spi/spi-imx.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/spi/spi-imx.c +11 -4
@@ -519,9 +519,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx) {u32 reg; - reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); - reg |=MX51_ECSPI_CTRL_XCH ; -writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); +if (spi_imx->usedma) { + reg =readl (spi_imx->base +MX51_ECSPI_DMA ); + reg |=MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN ; +writel (reg, spi_imx->base +MX51_ECSPI_DMA ); + }else { + reg =readl (spi_imx->base +MX51_ECSPI_CTRL ); + reg |=MX51_ECSPI_CTRL_XCH ; +writel (reg, spi_imx->base +MX51_ECSPI_CTRL ); + } }static void mx51_ecspi_disable (struct spi_imx_data *spi_imx)
@@ -759,7 +765,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)writel (MX51_ECSPI_DMA_RX_WML (spi_imx->wml -1 ) |MX51_ECSPI_DMA_TX_WML (tx_wml) |MX51_ECSPI_DMA_RXT_WML (spi_imx->wml) | -MX51_ECSPI_DMA_TEDEN |MX51_ECSPI_DMA_RXDEN |MX51_ECSPI_DMA_RXTDEN , spi_imx->base +MX51_ECSPI_DMA ); }
@@ -1520,6 +1525,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,reinit_completion (&spi_imx->dma_tx_completion);dma_async_issue_pending (controller->dma_tx); + spi_imx->devtype_data->trigger (spi_imx); + transfer_timeout =spi_imx_calculate_timeout (spi_imx, transfer->len);/* Wait SDMA to finish the data transfer.*/
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 22/60 ACPI: MRRM: Fix memory leaks and improve error handling
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <[email protected]>
[ Upstream commit 4b93d211bbffd3dce76664d95f2306d23e7215ce ]
Add proper error handling and resource cleanup to prevent memory leaks in add_boot_memory_ranges(). The function now checks for NULL return from kobject_create_and_add(), uses local buffer for range names to avoid dynamic allocation, and implements a cleanup path that removes previously created sysfs groups and kobjects on failure.
This prevents resource leaks when kobject creation or sysfs group creation fails during boot memory range initialization.
--- drivers/acpi/acpi_mrrm.c | 43 ++++++++++++++++++++++++++++++---------- 1 file changed, 33 insertions(+), 10 deletions(-)
drivers/acpi/acpi_mrrm.c +33 -10
@@ -152,26 +152,49 @@ ATTRIBUTE_GROUPS(memory_range);static __init int add_boot_memory_ranges (void ) { -struct kobject *pkobj, *kobj; +struct kobject *pkobj, *kobj, **kobjs;int ret = -EINVAL ; -char *name; +char name[16 ]; +int i; pkobj =kobject_create_and_add ("memory_ranges" , acpi_kobj); +if (!pkobj) +return -ENOMEM ; -for (int i =0 ; i < mrrm_mem_entry_num; i++) { - name =kasprintf (GFP_KERNEL ,"range%d" , i); -if (!name) { - ret = -ENOMEM ; -break ; - } + kobjs =kcalloc (mrrm_mem_entry_num,sizeof (*kobjs),GFP_KERNEL ); +if (!kobjs) { +kobject_put (pkobj); +return -ENOMEM ; + } +for (i =0 ; i < mrrm_mem_entry_num; i++) { +scnprintf (name,sizeof (name),"range%d" , i); kobj =kobject_create_and_add (name, pkobj); +if (!kobj) { + ret = -ENOMEM ; + goto cleanup; + } ret =sysfs_create_groups (kobj, memory_range_groups); -if (ret) -return ret; +if (ret) { +kobject_put (kobj); + goto cleanup; + } + kobjs[i] = kobj; } +kfree (kobjs); +return 0 ; + +cleanup: +for (int j =0 ; j < i; j++) { +if (kobjs[j]) { +sysfs_remove_groups (kobjs[j], memory_range_groups); +kobject_put (kobjs[j]); + } + } +kfree (kobjs); +kobject_put (pkobj);return ret; }
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 23/60 drm/vmwgfx: Use kref in vmw_bo_dirty
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <[email protected]>
[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ]
Rather than using an ad hoc reference count use kref which is atomic and has underflow warnings.
--- drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c +5 -7
@@ -32,22 +32,22 @@ enum vmw_bo_dirty_method {/** * struct vmw_bo_dirty - Dirty information for buffer objects +* @ref_count: Reference count for this structure. Must be first member! * @start: First currently dirty bit * @end: Last currently dirty bit + 1 * @method: The currently used dirty method * @change_count: Number of consecutive method change triggers -* @ref_count: Reference count for this structure * @bitmap_size: The size of the bitmap in bits. Typically equal to the * nuber of pages in the bo. * @bitmap: A bitmap where each bit represents a page. A set bit means a * dirty page. */ struct vmw_bo_dirty { +struct kref ref_count;unsigned long start;unsigned long end;enum vmw_bo_dirty_method method;unsigned int change_count; -unsigned int ref_count;unsigned long bitmap_size;unsigned long bitmap[]; };
@@ -221,7 +221,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)int ret;if (dirty) { - dirty->ref_count++; +kref_get (&dirty->ref_count);return 0 ; }
@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo) dirty->bitmap_size = num_pages; dirty->start = dirty->bitmap_size; dirty->end =0 ; - dirty->ref_count =1 ; +kref_init (&dirty->ref_count);if (num_pages <PAGE_SIZE /sizeof (pte_t)) { dirty->method =VMW_BO_DIRTY_PAGETABLE ; }else {
@@ -274,10 +274,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo) {struct vmw_bo_dirty *dirty = vbo->dirty; -if (dirty && --dirty->ref_count ==0 ) { -kvfree (dirty); +if (dirty &&kref_put (&dirty->ref_count, (void *)kvfree)) vbo->dirty =NULL ; - } }/**
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 24/60 arm64: Reject modules with internal alternative callbacks
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Barnaś <[email protected]>
[ Upstream commit 8e8ae788964aa2573b4335026db4068540fa6a86 ]
During module loading, check if a callback function used by the alternatives specified in the '.altinstruction' ELF section (if present) is located in core kernel .text. If not fail module loading before callback is called.
--- arch/arm64/include/asm/alternative.h | 7 +++++-- arch/arm64/kernel/alternative.c | 19 ++++++++++++------- arch/arm64/kernel/module.c | 9 +++++++-- 3 files changed, 24 insertions(+), 11 deletions(-)
arch/arm64/include/asm/alternative.h +5 -2
@@ -26,9 +26,12 @@ void __init apply_alternatives_all(void);bool alternative_is_applied (u16 cpucap);#ifdef CONFIG_MODULES -void apply_alternatives_module (void *start,size_t length); +int apply_alternatives_module (void *start,size_t length);#else -static inline void apply_alternatives_module (void *start,size_t length) { } +static inline int apply_alternatives_module (void *start,size_t length) +{ +return 0 ; +}#endif void alt_cb_patch_nops(struct alt_instr *alt, __le32 *origptr,
arch/arm64/kernel/alternative.c +12 -7
@@ -139,9 +139,9 @@ static noinstr void clean_dcache_range_nopatch(u64 start, u64 end) }while (cur += d_size, cur < end); } -static void __apply_alternatives (const struct alt_region *region, -bool is_module, -unsigned long *cpucap_mask) +static int __apply_alternatives (const struct alt_region *region, +bool is_module, +unsigned long *cpucap_mask) {struct alt_instr *alt;__le32 *origptr, *updptr;
@@ -166,10 +166,13 @@ static void __apply_alternatives(const struct alt_region *region, updptr = is_module ? origptr :lm_alias (origptr); nr_inst = alt->orig_len /AARCH64_INSN_SIZE ; -if (ALT_HAS_CB (alt)) +if (ALT_HAS_CB (alt)) { alt_cb =ALT_REPL_PTR (alt); -else +if (is_module && !core_kernel_text ((unsigned long )alt_cb)) +return -ENOEXEC ; + }else { alt_cb = patch_alternative; + }alt_cb (alt, origptr, updptr, nr_inst);
@@ -193,6 +196,8 @@ static void __apply_alternatives(const struct alt_region *region,bitmap_and (applied_alternatives, applied_alternatives, system_cpucaps,ARM64_NCAPS ); } + +return 0 ; }static void __init apply_alternatives_vdso (void )
@@ -277,7 +282,7 @@ void __init apply_boot_alternatives(void) } #ifdef CONFIG_MODULES -void apply_alternatives_module(void *start, size_t length) +int apply_alternatives_module(void *start, size_t length) { struct alt_region region = { .begin = start,
@@ -287,7 +292,7 @@ void apply_alternatives_module(void *start, size_t length)bitmap_fill (all_capabilities,ARM64_NCAPS ); - __apply_alternatives(®ion, true, &all_capabilities[0]); + return __apply_alternatives(®ion, true, &all_capabilities[0]); }#endif
arch/arm64/kernel/module.c +7 -2
@@ -489,8 +489,13 @@ int module_finalize(const Elf_Ehdr *hdr,int ret; s =find_section (hdr, sechdrs,".altinstructions" ); -if (s) -apply_alternatives_module ((void *)s->sh_addr, s->sh_size); +if (s) { + ret =apply_alternatives_module ((void *)s->sh_addr, s->sh_size); +if (ret <0 ) { +pr_err ("module %s: error occurred when applying alternatives\n" , me->name); +return ret; + } + }if (scs_is_dynamic ()) { s =find_section (hdr, sechdrs,".init.eh_frame" );
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 25/60 ALSA: hda/tas2781: Add new quirk for HP new projects
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baojun Xu <[email protected]>
[ Upstream commit 7a39c723b7472b8aaa2e0a67d2b6c7cf1c45cafb ]
Add new vendor_id and subsystem_id in quirk for HP new projects.
--- sound/hda/codecs/realtek/alc269.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/hda/codecs/realtek/alc269.c +9 -0
@@ -6685,6 +6685,15 @@ static const struct hda_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x103c ,0x8e60 ,"HP Trekker " ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8e61 ,"HP Trekker " ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x103c ,0x8e62 ,"HP Trekker " ,ALC287_FIXUP_CS35L41_I2C_2 ), +SND_PCI_QUIRK (0x103c ,0x8ed5 ,"HP Merino13X" ,ALC245_FIXUP_TAS2781_SPI_2 ), +SND_PCI_QUIRK (0x103c ,0x8ed6 ,"HP Merino13" ,ALC245_FIXUP_TAS2781_SPI_2 ), +SND_PCI_QUIRK (0x103c ,0x8ed7 ,"HP Merino14" ,ALC245_FIXUP_TAS2781_SPI_2 ), +SND_PCI_QUIRK (0x103c ,0x8ed8 ,"HP Merino16" ,ALC245_FIXUP_TAS2781_SPI_2 ), +SND_PCI_QUIRK (0x103c ,0x8ed9 ,"HP Merino14W" ,ALC245_FIXUP_TAS2781_SPI_2 ), +SND_PCI_QUIRK (0x103c ,0x8eda ,"HP Merino16W" ,ALC245_FIXUP_TAS2781_SPI_2 ), +SND_PCI_QUIRK (0x103c ,0x8f40 ,"HP Lampas14" ,ALC287_FIXUP_TAS2781_I2C ), +SND_PCI_QUIRK (0x103c ,0x8f41 ,"HP Lampas16" ,ALC287_FIXUP_TAS2781_I2C ), +SND_PCI_QUIRK (0x103c ,0x8f42 ,"HP LampasW14" ,ALC287_FIXUP_TAS2781_I2C ),SND_PCI_QUIRK (0x1043 ,0x1032 ,"ASUS VivoBook X513EA" ,ALC256_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x1034 ,"ASUS GU605C" ,ALC285_FIXUP_ASUS_GU605_SPI_SPEAKER2_TO_DAC1 ), SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 26/60 Bluetooth: btrtl: Avoid loading the config file on security chips
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Chou <[email protected]>
[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ]
For chips with security enabled, it's only possible to load firmware with a valid signature pattern.
If key_id is not zero, it indicates a security chip, and the driver will not load the config file.
- Example log for a security chip.
Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301
Bluetooth: hci0: RTL: fw version 0x41c0c905
- Example log for a normal chip.
Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 0
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin
Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307
Bluetooth: hci0: RTL: fw version 0x41c0c905
--- drivers/bluetooth/btrtl.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/bluetooth/btrtl.c +13 -11
@@ -50,7 +50,7 @@#define RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})#define RTL_CHIP_REV (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}}) -#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}}) +#define RTL_SEC_PROJ (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})#define RTL_PATCH_SNIPPETS 0x01#define RTL_PATCH_DUMMY_HEADER 0x02
@@ -534,7 +534,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, {struct rtl_epatch_header_v2 *hdr;int rc; -u8 reg_val[2 ];u8 key_id;u32 num_sections;struct rtl_section *section;
@@ -549,14 +548,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev, .len = btrtl_dev->fw_len - 7, /* Cut the tail */ }; - rc =btrtl_vendor_read_reg16 (hdev,RTL_SEC_PROJ , reg_val); -if (rc <0 ) -return -EIO ; - key_id = reg_val[0 ]; - -rtl_dev_dbg (hdev,"%s: key id %u" , __func__, key_id); - - btrtl_dev->key_id = key_id; + key_id = btrtl_dev->key_id; hdr =rtl_iov_pull_data (&iov,sizeof (*hdr));if (!hdr)
@@ -1070,6 +1062,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,u16 hci_rev, lmp_subver;u8 hci_ver, lmp_ver, chip_type =0 ;int ret; +int rc; +u8 key_id;u8 reg_val[2 ]; btrtl_dev =kzalloc (sizeof (*btrtl_dev),GFP_KERNEL );
@@ -1180,6 +1174,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, goto err_free; } + rc =btrtl_vendor_read_reg16 (hdev,RTL_SEC_PROJ , reg_val); +if (rc <0 ) + goto err_free; + + key_id = reg_val[0 ]; + btrtl_dev->key_id = key_id; +rtl_dev_info (hdev,"%s: key id %u" , __func__, key_id); + btrtl_dev->fw_len = -EIO ;if (lmp_subver ==RTL_ROM_LMP_8852A && hci_rev ==0x000c ) { snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",
@@ -1202,7 +1204,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, goto err_free; } -if (btrtl_dev->ic_info->cfg_name) { +if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {if (postfix) {snprintf (cfg_name,sizeof (cfg_name),"%s-%s.bin" , btrtl_dev->ic_info->cfg_name, postfix);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 27/60 ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niranjan H Y <[email protected]>
[ Upstream commit eb2d6774cc0d9d6ab8f924825695a85c14b2e0c2 ]
"struct sdca_control" declares "values" field as integer array. But the memory allocated to it is of char array. This causes crash for sdca_parse_function API. This patch addresses the issue by allocating correct data size.
--- sound/soc/sdca/sdca_functions.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/sdca/sdca_functions.c +2 -1
@@ -894,7 +894,8 @@ static int find_sdca_entity_control(struct device *dev, struct sdca_entity *entireturn ret; } - control->values =devm_kzalloc (dev,hweight64 (control->cn_list),GFP_KERNEL ); + control->values =devm_kcalloc (dev,hweight64 (control->cn_list), +sizeof (int ),GFP_KERNEL );if (!control->values)return -ENOMEM ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 28/60 smb: fix invalid username check in smb3_fs_context_parse_param()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiqi Sun <[email protected]>
[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ]
Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() is always FALSE and invalid.
Fix the comparison in if statement.
--- fs/smb/client/fs_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/smb/client/fs_context.c +1 -1
@@ -1472,7 +1472,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,break ; } -if (strnlen (param->string,CIFS_MAX_USERNAME_LEN ) > +if (strnlen (param->string,CIFS_MAX_USERNAME_LEN ) ==CIFS_MAX_USERNAME_LEN ) {pr_warn ("username too long\n" ); goto cifs_parse_mount_err;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 29/60 drm/amdkfd: Fix GPU mappings for APU after prefetch
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harish Kasiviswanathan <[email protected]>
[ Upstream commit eac32ff42393efa6657efc821231b8d802c1d485 ]
Fix the following corner case:-
Consider a 2M huge page SVM allocation, followed by prefetch call for
the first 4K page. The whole range is initially mapped with single PTE. After the prefetch, this range gets split to first page + rest of the pages. Currently, the first page mapping is not updated on MI300A (APU) since page hasn't migrated. However, after range split PTE mapping it not valid.
Fix this by forcing page table update for the whole range when prefetch is called. Calling prefetch on APU doesn't improve performance. If all it deteriotes. However, functionality has to be supported.
v2: Use apu_prefer_gtt as this issue doesn't apply to APUs with carveout VRAM
v3: Simplify by setting the flag for all ASICs as it doesn't affect dGPU
v4: Remove v2 and v3 changes. Force update_mapping when range is split at a size that is not aligned to prange granularity
--- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdkfd/kfd_svm.c +2 -0
@@ -3688,6 +3688,8 @@ svm_range_set_attr(struct kfd_process *p, struct mm_struct *mm,svm_range_apply_attrs (p, prange, nattr, attrs, &update_mapping);/* TODO: unmap ranges from GPU that lost access */ } + update_mapping |= !p->xnack_enabled && !list_empty (&remap_list); +list_for_each_entry_safe (prange, next, &remove_list, update_list) { pr_debug("unlink old 0x%p prange 0x%p [0x%lx 0x%lx]\n", prange->svms, prange, prange->start,
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 31/60 HID: lenovo: fixup Lenovo Yoga Slim 7x Keyboard rdesc
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lauri Tirkkonen <[email protected]>
[ Upstream commit a45f15808fb753a14c6041fd1e5bef5d552bd2e3 ]
The keyboard of this device has the following in its report description for Usage (Keyboard) in Collection (Application):
# 0x15, 0x00, // Logical Minimum (0) 52 # 0x25, 0x65, // Logical Maximum (101) 54 # 0x05, 0x07, // Usage Page (Keyboard) 56 # 0x19, 0x00, // Usage Minimum (0) 58 # 0x29, 0xdd, // Usage Maximum (221) 60 # 0x81, 0x00, // Input (Data,Arr,Abs) 62
Since the Usage Min/Max range exceeds the Logical Min/Max range, keypresses outside the Logical range are not recognized. This includes, for example, the Japanese language keyboard variant's keys for |, _ and \.
Fixup the report description to make the Logical range match the Usage range, fixing the interpretation of keypresses above 101 on this device.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-lenovo.c | 17 +++++++++++++++++ 2 files changed, 18 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -718,6 +718,7 @@#define USB_DEVICE_ID_ITE_LENOVO_YOGA2 0x8350#define I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720 0x837a#define USB_DEVICE_ID_ITE_LENOVO_YOGA900 0x8396 +#define I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD 0x8987#define USB_DEVICE_ID_ITE8595 0x8595#define USB_DEVICE_ID_ITE_MEDION_E1239T 0xce50
drivers/hid/hid-lenovo.c +17 -0
@@ -148,6 +148,14 @@ static const __u8 lenovo_tpIIbtkbd_need_fixup_collection[] = { 0x81, 0x01, /* Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position) */ }; +static const __u8 lenovo_yoga7x_kbd_need_fixup_collection[] = { +0x15 ,0x00 ,// Logical Minimum (0) +0x25 ,0x65 ,// Logical Maximum (101) +0x05 ,0x07 ,// Usage Page (Keyboard) +0x19 ,0x00 ,// Usage Minimum (0) +0x29 ,0xDD ,// Usage Maximum (221) +}; +static const __u8 *lenovo_report_fixup (struct hid_device *hdev,__u8 *rdesc,unsigned int *rsize) {
@@ -177,6 +185,13 @@ static const __u8 *lenovo_report_fixup(struct hid_device *hdev, __u8 *rdesc, rdesc[260 ] =0x01 ;/* report count (2) = 0x01 */ }break ; +case I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD : +if (*rsize ==176 && +memcmp (&rdesc[52 ], lenovo_yoga7x_kbd_need_fixup_collection, +sizeof (lenovo_yoga7x_kbd_need_fixup_collection)) ==0 ) { + rdesc[55 ] = rdesc[61 ];// logical maximum = usage maximum + } +break ; }return rdesc; }
@@ -1538,6 +1553,8 @@ static const struct hid_device_id lenovo_devices[] = { USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB) }, { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X12_TAB2) }, + { HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC, + USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_YOGA_SLIM_7X_KEYBOARD) }, { } };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 32/60 bfs: Reconstruct file type when loading from disk
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]
syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted.
A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0.
Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).
--- fs/bfs/inode.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
fs/bfs/inode.c +18 -1
@@ -61,7 +61,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) off = (ino -BFS_ROOT_INO ) %BFS_INODES_PER_BLOCK ; di = (struct bfs_inode *)bh->b_data + off; - inode->i_mode =0x0000FFFF &le32_to_cpu (di->i_mode); +/* +* https://martin.hinner.info/fs/bfs/bfs-structure.html explains that +* BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode +* value. This means that, although bfs_write_inode() saves whole +* inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX} +* bits), middle 7 bits of di->i_mode value can be garbage when these +* bits were not saved by bfs_write_inode(). +* Since we can't tell whether middle 7 bits are garbage, use only +* lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being +* garbage) and reconstruct S_IFMT bits for Linux environment from +* di->i_vtype value. +*/ + inode->i_mode =0x00000FFF &le32_to_cpu (di->i_mode);if (le32_to_cpu (di->i_vtype) ==BFS_VDIR ) { inode->i_mode |=S_IFDIR ; inode->i_op = &bfs_dir_inops;
@@ -71,6 +83,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino) inode->i_op = &bfs_file_inops; inode->i_fop = &bfs_file_operations; inode->i_mapping->a_ops = &bfs_aops; + }else { +brelse (bh); +printf ("Unknown vtype=%u %s:%08lx\n" , +le32_to_cpu (di->i_vtype), inode->i_sb->s_id, ino); + goto error; }BFS_I (inode)->i_sblock =le32_to_cpu (di->i_sblock);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 33/60 HID: hid-input: Extend Elan ignore battery quirk to USB
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <[email protected]>
[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ]
USB Elan devices have the same problem as the I2C ones with a fake battery device showing up.
--- drivers/hid/hid-input.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hid/hid-input.c +3 -2
@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = { {HID_I2C_DEVICE (USB_VENDOR_ID_ELAN ,I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM ), HID_BATTERY_QUIRK_AVOID_QUERY },/* -* Elan I2C-HID touchscreens seem to all report a non present battery, -* set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices. +* Elan HID touchscreens seem to all report a non present battery, +* set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices. */ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE }, {} };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 34/60 platform/x86/amd/pmc: Add support for Van Gogh SoC
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit db4a3f0fbedb0398f77b9047e8b8bb2b49f355bb ]
The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend.
Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang.
--- drivers/platform/x86/amd/pmc/pmc.c | 3 +++ drivers/platform/x86/amd/pmc/pmc.h | 1 + 2 files changed, 4 insertions(+)
drivers/platform/x86/amd/pmc/pmc.c +3 -0
@@ -106,6 +106,7 @@ static void amd_pmc_get_ip_info(struct amd_pmc_dev *dev)switch (dev->cpu_id) {case AMD_CPU_ID_PCO :case AMD_CPU_ID_RN : +case AMD_CPU_ID_VG :case AMD_CPU_ID_YC :case AMD_CPU_ID_CB : dev->num_ips =12 ;
@@ -517,6 +518,7 @@ static int amd_pmc_get_os_hint(struct amd_pmc_dev *dev)case AMD_CPU_ID_PCO :return MSG_OS_HINT_PCO ;case AMD_CPU_ID_RN : +case AMD_CPU_ID_VG :case AMD_CPU_ID_YC :case AMD_CPU_ID_CB :case AMD_CPU_ID_PS :
@@ -717,6 +719,7 @@ static const struct pci_device_id pmc_pci_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_RV) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_SP) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_SHP) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, AMD_CPU_ID_VG) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M60H_ROOT) }, { }
drivers/platform/x86/amd/pmc/pmc.h +1 -0
@@ -156,6 +156,7 @@ void amd_mp2_stb_deinit(struct amd_pmc_dev *dev);#define AMD_CPU_ID_RN 0x1630#define AMD_CPU_ID_PCO AMD_CPU_ID_RV#define AMD_CPU_ID_CZN AMD_CPU_ID_RN +#define AMD_CPU_ID_VG 0x1645#define AMD_CPU_ID_YC 0x14B5#define AMD_CPU_ID_CB 0x14D8#define AMD_CPU_ID_PS 0x14E8
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 35/60 platform/x86: hp-wmi: mark Victus 16-r0 and 16-s0 for victus_s fan and thermal profile support
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edip Hazuri <[email protected]>
[ Upstream commit 54afb047cd7eb40149f3fc42d69fd4ddde2be9f0 ]
This patch adds Victus 16-r0 (8bbe) and Victus 16-s0(8bd4, 8bd5) laptop DMI board name into existing list
--- drivers/platform/x86/hp/hp-wmi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/platform/x86/hp/hp-wmi.c +2 -1
@@ -92,8 +92,9 @@ static const char * const victus_thermal_profile_boards[] = { "8A25" }; -/* DMI Board names of Victus 16-r1000 and Victus 16-s1000 laptops */ +/* DMI Board names of Victus 16-r and Victus 16-s laptops */ static const char *const victus_s_thermal_profile_boards[] = { +"8BBE" ,"8BD4" ,"8BD5" ,"8C99" ,"8C9C" };
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 36/60 nvme: fix admin request_queue lifetime
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ]
The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:
BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0 Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287 CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G E 6.13.2-ga1582f1a031e #15 Tainted: [E]=UNSIGNED_MODULE Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025 Call Trace: <TASK> dump_stack_lvl+0x4f/0x60 print_report+0xc4/0x620 ? _raw_spin_lock_irqsave+0x70/0xb0 ? _raw_read_unlock_irqrestore+0x30/0x30 ? blk_queue_enter+0x41c/0x4a0 kasan_report+0xab/0xe0 ? blk_queue_enter+0x41c/0x4a0 blk_queue_enter+0x41c/0x4a0 ? __irq_work_queue_local+0x75/0x1d0 ? blk_queue_start_drain+0x70/0x70 ? irq_work_queue+0x18/0x20 ? vprintk_emit.part.0+0x1cc/0x350 ? wake_up_klogd_work_func+0x60/0x60 blk_mq_alloc_request+0x2b7/0x6b0 ? __blk_mq_alloc_requests+0x1060/0x1060 ? __switch_to+0x5b7/0x1060 nvme_submit_user_cmd+0xa9/0x330 nvme_user_cmd.isra.0+0x240/0x3f0 ? force_sigsegv+0xe0/0xe0 ? nvme_user_cmd64+0x400/0x400 ? vfs_fileattr_set+0x9b0/0x9b0 ? cgroup_update_frozen_flag+0x24/0x1c0 ? cgroup_leave_frozen+0x204/0x330 ? nvme_ioctl+0x7c/0x2c0 blkdev_ioctl+0x1a8/0x4d0 ? blkdev_common_ioctl+0x1930/0x1930 ? fdget+0x54/0x380 __x64_sys_ioctl+0x129/0x190 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f765f703b0b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000 R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003 R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60 </TASK>
--- drivers/nvme/host/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +2 -1
@@ -4896,7 +4896,6 @@ void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)*/ nvme_stop_keep_alive (ctrl);blk_mq_destroy_queue (ctrl->admin_q); -blk_put_queue (ctrl->admin_q);if (ctrl->ops->flags &NVME_F_FABRICS ) {blk_mq_destroy_queue (ctrl->fabrics_q);blk_put_queue (ctrl->fabrics_q);
@@ -5040,6 +5039,8 @@ static void nvme_free_ctrl(struct device *dev) container_of(dev, struct nvme_ctrl, ctrl_device);struct nvme_subsystem *subsys = ctrl->subsys; +if (ctrl->admin_q) +blk_put_queue (ctrl->admin_q);if (!subsys || ctrl->instance != subsys->instance)ida_free (&nvme_instance_ida, ctrl->instance);nvme_free_cels (ctrl);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 37/60 pinctrl: qcom: msm: Fix deadlock in pinmux configuration
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Praveen Talari <[email protected]>
[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]
Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() to prevent deadlock when wakeup IRQ is triggered on the same GPIO being reconfigured.
The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ handler attempts to reconfigure the same GPIO's pinmux. In this scenario, msm_pinmux_set_mux() calls disable_irq() which waits for the currently running IRQ handler to complete, creating a circular dependency that results in deadlock.
Using disable_irq_nosync() avoids waiting for the IRQ handler to complete, preventing the deadlock condition while still properly disabling the interrupt during pinmux reconfiguration.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/qcom/pinctrl-msm.c +1 -1
@@ -215,7 +215,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,*/ if (d && i != gpio_func && !test_and_set_bit (d->hwirq, pctrl->disabled_for_mux)) -disable_irq (irq); +disable_irq_nosync (irq);raw_spin_lock_irqsave (&pctrl->lock, flags);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 38/60 platform/x86: acer-wmi: Ignore backlight event
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]
On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI firmware when the backlight up/down keys are pressed. Ignore this event to avoid spamming the kernel log with error messages, as the acpi-video driver already handles brightness up/down events.
--- drivers/platform/x86/acer-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/acer-wmi.c +4 -0
@@ -102,6 +102,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");enum acer_wmi_event_ids {WMID_HOTKEY_EVENT =0x1 , +WMID_BACKLIGHT_EVENT =0x4 ,WMID_ACCEL_OR_KBD_DOCK_EVENT =0x5 ,WMID_GAMING_TURBO_KEY_EVENT =0x7 ,WMID_AC_EVENT =0x8 ,
@@ -2369,6 +2370,9 @@ static void acer_wmi_notify(union acpi_object *obj, void *context)sparse_keymap_report_event (acer_wmi_input_dev, scancode,1 , true); }break ; +case WMID_BACKLIGHT_EVENT : +/* Already handled by acpi-video */ +break ;case WMID_ACCEL_OR_KBD_DOCK_EVENT :acer_gsensor_event ();acer_kbd_dock_event (&return_value);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 39/60 HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: April Grimoire <[email protected]>
[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ]
SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, rendering function keys not treated properly. Despite being a SONiX USB DEVICE, it uses a different name, so adding it to the list.
--- drivers/hid/hid-apple.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/hid-apple.c +1 -0
@@ -355,6 +355,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {static const struct apple_non_apple_keyboard non_apple_keyboards[] = { {"SONiX USB DEVICE" }, + {"SONiX AK870 PRO" }, {"Keychron" }, {"AONE" }, {"GANSS" },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 40/60 platform/x86: huawei-wmi: add keys for HONOR models
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Ston <[email protected]>
[ Upstream commit 5c72329716d0858621021193330594d5d26bf44d ]
HONOR MagicBook X16/X14 models produced in 2025 cannot use the Print Screen and YOYO keys properly, with the system reporting them as unknown key presses (codes: 0x028b and 0x028e).
To resolve this, a key_entry is added for both the HONOR Print Screen key and the HONOR YOYO key, ensuring they function correctly on these models.
--- drivers/platform/x86/huawei-wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/huawei-wmi.c +4 -0
@@ -81,6 +81,10 @@ static const struct key_entry huawei_wmi_keymap[] = { { KE_KEY, 0x289, { KEY_WLAN } },// Huawei |M| key { KE_KEY, 0x28a, { KEY_CONFIG } }, +// HONOR YOYO key + { KE_KEY, 0x28b, { KEY_NOTIFICATION_CENTER } }, +// HONOR print screen + { KE_KEY, 0x28e, { KEY_PRINT } },// Keyboard backlit { KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } }, { KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 41/60 platform/x86: intel-uncore-freq: Add additional client processors
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuppuswamy Sathyanarayanan <[email protected]>
[ Upstream commit a229809c18926e79aeca232d5b502157beb0dec3 ]
Add Intel uncore frequency driver support for Pantherlake, Wildcatlake and Novalake processors.
--- .../platform/x86/intel/uncore-frequency/uncore-frequency.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/platform/x86/intel/uncore-frequency/uncore-frequency.c +4 -0
@@ -256,6 +256,10 @@ static const struct x86_cpu_id intel_uncore_cpu_ids[] = {X86_MATCH_VFM (INTEL_ARROWLAKE ,NULL ),X86_MATCH_VFM (INTEL_ARROWLAKE_H ,NULL ),X86_MATCH_VFM (INTEL_LUNARLAKE_M ,NULL ), +X86_MATCH_VFM (INTEL_PANTHERLAKE_L ,NULL ), +X86_MATCH_VFM (INTEL_WILDCATLAKE_L ,NULL ), +X86_MATCH_VFM (INTEL_NOVALAKE ,NULL ), + X86_MATCH_VFM(INTEL_NOVALAKE_L, NULL), {} };MODULE_DEVICE_TABLE (x86cpu, intel_uncore_cpu_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 42/60 platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit f945afe01c6768dcfed7868c671a26e1164c2284 ]
The Lenovo Legion Go 2 takes a long time to resume from suspend. This is due to it having an nvme resume handler that interferes with IOMMU mappings. It is a common issue with older Lenovo laptops. Adding it to that quirk list fixes this issue.
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +17 -0
@@ -204,6 +204,23 @@ static const struct dmi_system_id fwbug_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82ND"), } }, +/* https://gitlab.freedesktop.org/drm/amd/-/issues/4618 */ + { + .ident = "Lenovo Legion Go 2", + .driver_data = &quirk_s2idle_bug, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "83N0"), + } + }, + { + .ident ="Lenovo Legion Go 2" , + .driver_data = &quirk_s2idle_bug, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "83N1"), + } + }, /* https://gitlab.freedesktop.org/drm/amd/-/issues/2684 */ { .ident = "HP Laptop 15s-eq2xxx",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 43/60 platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <[email protected]>
[ Upstream commit c0ddc54016636dd8dedfaf1a3b482a95058e1db2 ]
The Xbox Ally features a Van Gogh SoC that has spurious interrupts during resume. We get the following logs:
atkbd_receive_byte: 20 callbacks suppressed
atkbd serio0: Spurious ACK on isa0060/serio0. Some program might be trying to access hardware directly.
So, add the spurious_8042 quirk for it. It does not have a keyboard, so this does not result in any functional loss.
--- drivers/platform/x86/amd/pmc/pmc-quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/platform/x86/amd/pmc/pmc-quirks.c +8 -0
@@ -122,6 +122,14 @@ static const struct dmi_system_id fwbug_list[] = { DMI_MATCH(DMI_PRODUCT_NAME, "21A1"), } }, + { + .ident = "ROG Xbox Ally RC73YA", + .driver_data = &quirk_spurious_8042, + .matches = { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_BOARD_NAME, "RC73YA"), + } + },/* https://bugzilla.kernel.org/show_bug.cgi?id=218024 */ { .ident = "V14 G4 AMN",
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 44/60 sched_ext: Fix possible deadlock in the deferred_irq_workfn()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit a257e974210320ede524f340ffe16bf4bf0dda1e ]
For PREEMPT_RT=y kernels, the deferred_irq_workfn() is executed in the per-cpu irq_work/* task context and not disable-irq, if the rq returned by container_of() is current CPU's rq, the following scenarios may occur:
lock(&rq->__lock);
<Interrupt>
lock(&rq->__lock);
This commit use IRQ_WORK_INIT_HARD() to replace init_irq_work() to initialize rq->scx.deferred_irq_work, make the deferred_irq_workfn() is always invoked in hard-irq context.
--- kernel/sched/ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/ext.c +1 -1
@@ -5377,7 +5377,7 @@ void __init init_sched_ext_class(void)BUG_ON (!zalloc_cpumask_var_node (&rq->scx.cpus_to_kick_if_idle,GFP_KERNEL , n));BUG_ON (!zalloc_cpumask_var_node (&rq->scx.cpus_to_preempt,GFP_KERNEL , n));BUG_ON (!zalloc_cpumask_var_node (&rq->scx.cpus_to_wait,GFP_KERNEL , n)); -init_irq_work (&rq->scx.deferred_irq_work, deferred_irq_workfn); + rq->scx.deferred_irq_work =IRQ_WORK_INIT_HARD (deferred_irq_workfn);init_irq_work (&rq->scx.kick_cpus_irq_work, kick_cpus_irq_workfn);if (cpu_online (cpu))
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 45/60 platform/x86/intel/hid: Add Nova Lake support
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <[email protected]>
[ Upstream commit ddf5ffff3a5fe95bed178f5554596b93c52afbc9 ]
Add ACPI ID for Nova Lake.
--- drivers/platform/x86/intel/hid.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/intel/hid.c +1 -0
@@ -55,6 +55,7 @@ static const struct acpi_device_id intel_hid_ids[] = { { "INTC10CB" }, { "INTC10CC" }, { "INTC10F1" }, + { "INTC10F2" }, { } };MODULE_DEVICE_TABLE (acpi, intel_hid_ids);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 46/60 HID: elecom: Add support for ELECOM M-XT3URBK (018F)
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naoki Ueki <[email protected]>
[ Upstream commit cdcbb8e8d10f656642380ee13516290437b52b36 ]
The ELECOM M-XT3URBK trackball has an additional device ID (0x018F), which shares the same report descriptor as the existing device (0x00FB). However, the driver does not currently recognize this new ID, resulting in only five buttons being functional.
This patch adds the new device ID so that all six buttons work properly.
--- drivers/hid/hid-elecom.c | 6 ++++-- drivers/hid/hid-ids.h | 3 ++- drivers/hid/hid-quirks.c | 3 ++- 3 files changed, 8 insertions(+), 4 deletions(-)
drivers/hid/hid-elecom.c +4 -2
@@ -75,7 +75,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,*/ mouse_button_fixup (hdev, rdesc, *rsize,20 ,28 ,22 ,14 ,8 );break ; -case USB_DEVICE_ID_ELECOM_M_XT3URBK : +case USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB : +case USB_DEVICE_ID_ELECOM_M_XT3URBK_018F :case USB_DEVICE_ID_ELECOM_M_XT3DRBK :case USB_DEVICE_ID_ELECOM_M_XT4DRBK :/*
@@ -119,7 +120,8 @@ static const __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,static const struct hid_device_id elecom_devices[] = { {HID_BLUETOOTH_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_BM084 ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XGL20DLBK ) }, - {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB ) }, + {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3URBK_018F ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT3DRBK ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_XT4DRBK ) }, {HID_USB_DEVICE (USB_VENDOR_ID_ELECOM ,USB_DEVICE_ID_ELECOM_M_DT1URBK ) },
drivers/hid/hid-ids.h +2 -1
@@ -449,7 +449,8 @@#define USB_VENDOR_ID_ELECOM 0x056e#define USB_DEVICE_ID_ELECOM_BM084 0x0061#define USB_DEVICE_ID_ELECOM_M_XGL20DLBK 0x00e6 -#define USB_DEVICE_ID_ELECOM_M_XT3URBK 0x00fb +#define USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB 0x00fb +#define USB_DEVICE_ID_ELECOM_M_XT3URBK_018F 0x018f#define USB_DEVICE_ID_ELECOM_M_XT3DRBK 0x00fc#define USB_DEVICE_ID_ELECOM_M_XT4DRBK 0x00fd#define USB_DEVICE_ID_ELECOM_M_DT1URBK 0x00fe
drivers/hid/hid-quirks.c +2 -1
@@ -410,7 +410,8 @@ static const struct hid_device_id hid_have_special_driver[] = { #if IS_ENABLED(CONFIG_HID_ELECOM) { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) }, { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XGL20DLBK) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_00FB) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3URBK_018F) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT3DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_XT4DRBK) }, { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_M_DT1URBK) },
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 47/60 sched_ext: Use IRQ_WORK_INIT_HARD() to initialize rq->scx.kick_cpus_irq_work
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit 36c6f3c03d104faf1aa90922f2310549c175420f ]
For PREEMPT_RT kernels, the kick_cpus_irq_workfn() be invoked in the per-cpu irq_work/* task context and there is no rcu-read critical section to protect. this commit therefore use IRQ_WORK_INIT_HARD() to initialize the per-cpu rq->scx.kick_cpus_irq_work in the init_sched_ext_class().
--- kernel/sched/ext.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/ext.c +1 -1
@@ -5378,7 +5378,7 @@ void __init init_sched_ext_class(void)BUG_ON (!zalloc_cpumask_var_node (&rq->scx.cpus_to_preempt,GFP_KERNEL , n));BUG_ON (!zalloc_cpumask_var_node (&rq->scx.cpus_to_wait,GFP_KERNEL , n)); rq->scx.deferred_irq_work =IRQ_WORK_INIT_HARD (deferred_irq_workfn); -init_irq_work (&rq->scx.kick_cpus_irq_work, kick_cpus_irq_workfn); + rq->scx.kick_cpus_irq_work =IRQ_WORK_INIT_HARD (kick_cpus_irq_workfn);if (cpu_online (cpu))cpu_rq (cpu)->scx.flags |=SCX_RQ_ONLINE ;
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 48/60 LoongArch: Mask all interrupts during kexec/kdump
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <[email protected]>
[ Upstream commit 863a320dc6fd7c855f47da4bb82a8de2d9102ea2 ]
If the default state of the interrupt controllers in the first kernel don't mask any interrupts, it may cause the second kernel to potentially receive interrupts (which were previously allocated by the first kernel) immediately after a CPU becomes online during its boot process. These interrupts cannot be properly routed, leading to bad IRQ issues.
This patch calls machine_kexec_mask_interrupts() to mask all interrupts during the kexec/kdump process.
--- arch/loongarch/kernel/machine_kexec.c | 2 ++ 1 file changed, 2 insertions(+)
arch/loongarch/kernel/machine_kexec.c +2 -0
@@ -249,6 +249,7 @@ void machine_crash_shutdown(struct pt_regs *regs)#ifdef CONFIG_SMP crash_smp_send_stop ();#endif +machine_kexec_mask_interrupts ();cpumask_set_cpu (crashing_cpu, &cpus_in_crash);pr_info ("Starting crashdump kernel...\n" );
@@ -286,6 +287,7 @@ void machine_kexec(struct kimage *image)/* We do not want to be bothered. */ local_irq_disable (); +machine_kexec_mask_interrupts ();pr_notice ("EFI boot flag 0x%lx\n" , efi_boot);pr_notice ("Command line at 0x%lx\n" , cmdline_ptr);
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 49/60 samples: work around glibc redefining some of our defines wrong
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
[ Upstream commit a48f822908982353c3256e35a089e9e7d0d61580 ]
Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE and some of the other flags for renameat2() and friends in <stdio.h>.
Which would all be fine, except for inexplicable reasons glibc decided to define them _differently_ from the kernel definitions, which then makes some of our sample code that includes both kernel headers and user space headers unhappy, because the compiler will (correctly) complain about redefining things.
Now, mixing kernel headers and user space headers is always a somewhat iffy proposition due to namespacing issues, but it's kind of inevitable in our sample and selftest code. And this is just glibc being stupid.
Those defines come from the kernel, glibc is exposing the kernel interfaces, and glibc shouldn't make up some random new expressions for these values.
It's not like glibc headers changed the actual result values, but they arbitrarily just decided to use a different expression to describe those values. The kernel just does
#define AT_RENAME_NOREPLACE 0x0001
while glibc does
# define RENAME_NOREPLACE (1 << 0)
# define AT_RENAME_NOREPLACE RENAME_NOREPLACEinstead. Same value in the end, but very different macro definition.
For absolutely no reason.
This has since been fixed in the glibc development tree, so eventually we'll end up with the canonical expressions and no clashes. But in the meantime the broken headers are in the glibc-2.42 release and have made it out into distributions.
Do a minimal work-around to make the samples build cleanly by just undefining the affected macros in between the user space header include and the kernel header includes.
--- samples/vfs/test-statx.c | 6 ++++++ samples/watch_queue/watch_test.c | 6 ++++++ 2 files changed, 12 insertions(+)
samples/vfs/test-statx.c +6 -0
@@ -19,6 +19,12 @@#include <time.h> #include <sys/syscall.h> #include <sys/types.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/stat.h> #include <linux/fcntl.h> #define statx foo
samples/watch_queue/watch_test.c +6 -0
@@ -16,6 +16,12 @@#include <errno.h> #include <sys/ioctl.h> #include <limits.h> + +// Work around glibc header silliness +#undef AT_RENAME_NOREPLACE +#undef AT_RENAME_EXCHANGE +#undef AT_RENAME_WHITEOUT +#include <linux/watch_queue.h> #include <linux/unistd.h> #include <linux/keyctl.h>
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 50/60 platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chomal <[email protected]>
[ Upstream commit fb146a38cb119c8d69633851c7a2ce2c8d34861a ]
The newer HP Omen laptops, such as Omen 16-wf1xxx, use the same WMI-based thermal profile interface as Victus 16-r1000 and 16-s1000 models.
Add the DMI board name "8C78" to the victus_s_thermal_profile_boards list to enable proper fan and thermal mode control.
Tested on: HP Omen 16-wf1xxx (board 8C78)
Result:
* Fan RPMs are readable
* echo 0 | sudo tee /sys/devices/platform/hp-wmi/hwmon/*/pwm1_enable allows the fans to run on max RPM.
--- drivers/platform/x86/hp/hp-wmi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/hp/hp-wmi.c +1 -1
@@ -95,7 +95,7 @@ static const char * const victus_thermal_profile_boards[] = {/* DMI Board names of Victus 16-r and Victus 16-s laptops */ static const char *const victus_s_thermal_profile_boards[] = {"8BBE" ,"8BD4" ,"8BD5" , -"8C99" ,"8C9C" +"8C78" ,"8C99" ,"8C9C" , };enum hp_wmi_radio {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 51/60 platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcos Vega <[email protected]>
[ Upstream commit fa0498f8047536b877819ce4ab154d332b243d43 ]
New HP Omen laptops follow the same WMI thermal profile as Victus 16-r1000 and 16-s1000.
Add DMI board 8D41 to victus_s_thermal_profile_boards.
--- drivers/platform/x86/hp/hp-wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/hp/hp-wmi.c +1 -0
@@ -96,6 +96,7 @@ static const char * const victus_thermal_profile_boards[] = {static const char *const victus_s_thermal_profile_boards[] = {"8BBE" ,"8BD4" ,"8BD5" ,"8C78" ,"8C99" ,"8C9C" , +"8D41" , };enum hp_wmi_radio {
Signature · 1 line
2.51.0
Greg Kroah-Hartman
maintainerPATCH 52/60 wifi: rtl8xxxu: Add USB ID 2001:3328 for D-Link AN3U rev. A1
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zenm Chen <[email protected]>
commit 3f9553f65d0b77b724565bbe42c4daa3fab57d5c upstream.
Add USB ID 2001:3328 for D-Link AN3U rev. A1 which is a RTL8192FU-based Wi-Fi adapter.
Compile tested only.
--- drivers/net/wireless/realtek/rtl8xxxu/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/realtek/rtl8xxxu/core.c +3 -0
@@ -8113,6 +8113,9 @@ static const struct usb_device_id dev_ta/* TP-Link TL-WN823N V2 */ {USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0135, 0xff, 0xff, 0xff), .driver_info = (unsigned long)&rtl8192fu_fops}, +/* D-Link AN3U rev. A1 */ +{USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3328, 0xff, 0xff, 0xff), + .driver_info = (unsigned long)&rtl8192fu_fops}, #ifdef CONFIG_RTL8XXXU_UNTESTED /* Still supported by rtlwifi */ {USB_DEVICE_AND_INTERFACE_INFO(USB_VENDOR_ID_REALTEK, 0x8176, 0xff, 0xff, 0xff),
Greg Kroah-Hartman
maintainerPATCH 53/60 wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zenm Chen <[email protected]>
commit b377dcd9a286a6f81922ae442cd1c743bc4a2b35 upstream.
Add USB ID 2001:3329 for D-Link AC13U rev. A1 which is a RTL8812CU-based Wi-Fi adapter.
Compile tested only.
--- drivers/net/wireless/realtek/rtw88/rtw8822cu.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/realtek/rtw88/rtw8822cu.c +2 -0
@@ -21,6 +21,8 @@ static const struct usb_device_id rtw_88 .driver_info = (kernel_ulong_t)&(rtw8822c_hw_spec) }, { USB_DEVICE_AND_INTERFACE_INFO(0x13b1, 0x0043, 0xff, 0xff, 0xff), .driver_info = (kernel_ulong_t)&(rtw8822c_hw_spec) }, /* Alpha - Alpha */ + { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3329, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&(rtw8822c_hw_spec) }, /* D-Link AC13U rev. A1 */ {}, };MODULE_DEVICE_TABLE (usb, rtw_8822cu_id_table);
Greg Kroah-Hartman
maintainerPATCH 54/60 iio: adc: ad4080: fix chip identification
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoniu Miclaus <[email protected]>
commit b66cddc8be7278fd14650ff9182f3794397f8b31 upstream.
Fix AD4080 chip identification by using the correct 16-bit product ID (0x0050) instead of GENMASK(2, 0). Update the chip reading logic to use regmap_bulk_read to read both PRODUCT_ID_L and PRODUCT_ID_H registers and combine them into a 16-bit value.
The original implementation was incorrectly reading only 3 bits, which would not correctly identify the AD4080 chip.
--- drivers/iio/adc/ad4080.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/iio/adc/ad4080.c +6 -3
@@ -125,7 +125,7 @@/* Miscellaneous Definitions */ #define AD4080_SPI_READ BIT(7) -#define AD4080_CHIP_ID GENMASK(2, 0) +#define AD4080_CHIP_ID 0x0050#define AD4080_LVDS_CNV_CLK_CNT_MAX 7
@@ -445,7 +445,8 @@ static int ad4080_setup(struct iio_dev * {struct ad4080_state *st =iio_priv (indio_dev);struct device *dev =regmap_get_device (st->regmap); -unsigned int id; +__le16 id_le; +u16 id;int ret; ret = regmap_write(st->regmap, AD4080_REG_INTERFACE_CONFIG_A,
@@ -458,10 +459,12 @@ static int ad4080_setup(struct iio_dev *if (ret)return ret; - ret =regmap_read (st->regmap,AD4080_REG_CHIP_TYPE , &id); + ret =regmap_bulk_read (st->regmap,AD4080_REG_PRODUCT_ID_L , &id_le, +sizeof (id_le));if (ret)return ret; + id =le16_to_cpu (id_le);if (id !=AD4080_CHIP_ID )dev_info (dev,"Unrecognized CHIP_ID 0x%X\n" , id);
Greg Kroah-Hartman
maintainerPATCH 55/60 comedi: c6xdigio: Fix invalid PNP driver unregistration
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Abbott <[email protected]>
commit 72262330f7b3ad2130e800cecf02adcce3c32c77 upstream.
The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler c6xdigio_attach() to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with pnp_register_driver(), but ignores the return value. (The struct pnp_driver it uses has only the name and id_table members filled in.) The driver's Comedi "detach" handler c6xdigio_detach() unconditionally unregisters the PNP driver with pnp_unregister_driver().
It is possible for c6xdigio_attach() to return an error before it calls pnp_register_driver() and it is possible for the call to pnp_register_driver() to return an error (that is ignored). In both cases, the driver should not be calling pnp_unregister_driver() as it does in c6xdigio_detach(). (Note that c6xdigio_detach() will be called by the Comedi core if c6xdigio_attach() returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.)
The unconditional call to pnp_unregister_driver() without a previous successful call to pnp_register_driver() will cause driver_unregister() to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1].
Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.)
Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since c6xdigio_detach() now only calls comedi_legacy_detach(), remove the function and change the Comedi driver "detach" handler to comedi_legacy_detach.
-------------------------------------------
[1] Syzbot sample crash report:
Unexpected driver unregister!
WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline] WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Modules linked in: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:driver_unregister drivers/base/driver.c:273 [inline] RIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Code: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41 RSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8 RDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000 FS: 000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0 Call Trace: <TASK> comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207 comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215 comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011 do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc05798eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8184238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc057be5fa0 RCX: 00007fc05798eec9 RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fc057a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc057be5fa0 R14: 00007fc057be5fa0 R15: 0000000000000003 </TASK> -------------------------------------------
--- drivers/comedi/drivers/c6xdigio.c | 46 ++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-)
drivers/comedi/drivers/c6xdigio.c +35 -11
@@ -249,9 +249,6 @@ static int c6xdigio_attach(struct comediif (ret)return ret; -/* Make sure that PnP ports get activated */ -pnp_register_driver (&c6xdigio_pnp_driver); - s = &dev->subdevices[0 ];/* pwm output subdevice */ s->type =COMEDI_SUBD_PWM ;
@@ -278,19 +275,46 @@ static int c6xdigio_attach(struct comedireturn 0 ; } -static void c6xdigio_detach (struct comedi_device *dev) -{ -comedi_legacy_detach (dev); -pnp_unregister_driver (&c6xdigio_pnp_driver); -} -static struct comedi_driver c6xdigio_driver = { .driver_name ="c6xdigio" , .module =THIS_MODULE , .attach = c6xdigio_attach, - .detach = c6xdigio_detach, + .detach = comedi_legacy_detach, }; -module_comedi_driver (c6xdigio_driver); + +static bool c6xdigio_pnp_registered = false; + +static int __init c6xdigio_module_init (void ) +{ +int ret; + + ret =comedi_driver_register (&c6xdigio_driver); +if (ret) +return ret; + +if (IS_ENABLED (CONFIG_PNP )) { +/* Try to activate the PnP ports */ + ret =pnp_register_driver (&c6xdigio_pnp_driver); +if (ret) { +pr_warn ("failed to register pnp driver - err %d\n" , + ret); + ret =0 ;/* ignore the error. */ + }else { + c6xdigio_pnp_registered = true; + } + } + +return 0 ; +} +module_init (c6xdigio_module_init); + +static void __exit c6xdigio_module_exit(void) +{ +if (c6xdigio_pnp_registered) +pnp_unregister_driver (&c6xdigio_pnp_driver); +comedi_driver_unregister (&c6xdigio_driver); +} +module_exit (c6xdigio_module_exit);MODULE_AUTHOR ("Comedi https://www.comedi.org" );MODULE_DESCRIPTION ("Comedi driver for the C6x_DIGIO DSP daughter card" );
Greg Kroah-Hartman
maintainerPATCH 56/60 comedi: multiq3: sanitize config options in multiq3_attach()
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit f24c6e3a39fa355dabfb684c9ca82db579534e72 upstream.
Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specifically, in the case of multiq3 driver.
This problem arose when syzkaller managed to craft weird configuration options used to specify the number of channels in encoder subdevice. If a particularly great number is passed to s->n_chan in multiq3_attach() via it->options[2], then multiple calls to multiq3_encoder_reset() at the end of driver-specific attach() method will be running for minutes, thus blocking tasks and affected devices as well.
While this issue is most likely not too dangerous for real-life devices, it still makes sense to sanitize configuration inputs. Enable a sensible limit on the number of encoder chips (4 chips max, each with 2 channels) to stop this behaviour from manifesting.
[1] Syzbot crash:
INFO: task syz.2.19:6067 blocked for more than 143 seconds. ... Call Trace: <TASK> context_switch kernel/sched/core.c:5254 [inline] __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862 __schedule_loop kernel/sched/core.c:6944 [inline] schedule+0x165/0x360 kernel/sched/core.c:6959 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760 comedi_open+0xc0/0x590 drivers/comedi/comedi_fops.c:2868 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x953/0x13f0 fs/open.c:965 vfs_open+0x3b/0x340 fs/open.c:1097
...
--- drivers/comedi/drivers/multiq3.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/comedi/drivers/multiq3.c +9 -0
@@ -67,6 +67,11 @@#define MULTIQ3_TRSFRCNTR_OL 0x10/* xfer CNTR to OL (x and y) */ #define MULTIQ3_EFLAG_RESET 0x06/* reset E bit of flag reg */ +/* +* Limit on the number of optional encoder channels +*/ +#define MULTIQ3_MAX_ENC_CHANS 8 +static void multiq3_set_ctrl (struct comedi_device *dev,unsigned int bits) {/*
@@ -312,6 +317,10 @@ static int multiq3_attach(struct comedi_ s->insn_read = multiq3_encoder_insn_read; s->insn_config = multiq3_encoder_insn_config; +/* sanity check for number of encoder channels */ +if (s->n_chan >MULTIQ3_MAX_ENC_CHANS ) + s->n_chan =MULTIQ3_MAX_ENC_CHANS ; +for (i =0 ; i < s->n_chan; i++)multiq3_encoder_reset (dev, i);
Greg Kroah-Hartman
maintainerPATCH 57/60 comedi: check devices attached status in compat ioctls
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 0de7d9cd07a2671fa6089173bccc0b2afe6b93ee upstream.
Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig().
As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG.
Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback.
Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions.
[1] Syzbot report:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: <TASK> get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
...
--- drivers/comedi/comedi_fops.c | 42 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 36 insertions(+), 6 deletions(-)
drivers/comedi/comedi_fops.c +36 -6
@@ -3023,7 +3023,12 @@ static int compat_chaninfo(struct file * chaninfo.rangelist =compat_ptr (chaninfo32.rangelist);mutex_lock (&dev->mutex); - err =do_chaninfo_ioctl (dev, &chaninfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_chaninfo_ioctl (dev, &chaninfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -3044,7 +3049,12 @@ static int compat_rangeinfo(struct file rangeinfo.range_ptr =compat_ptr (rangeinfo32.range_ptr);mutex_lock (&dev->mutex); - err =do_rangeinfo_ioctl (dev, &rangeinfo); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + err = -ENODEV ; + }else { + err =do_rangeinfo_ioctl (dev, &rangeinfo); + }mutex_unlock (&dev->mutex);return err; }
@@ -3120,7 +3130,12 @@ static int compat_cmd(struct file *file,return rc;mutex_lock (&dev->mutex); - rc =do_cmd_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmd_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) {/* Special case: copy cmd back to user. */
@@ -3145,7 +3160,12 @@ static int compat_cmdtest(struct file *freturn rc;mutex_lock (&dev->mutex); - rc =do_cmdtest_ioctl (dev, &cmd, ©, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_cmdtest_ioctl (dev, &cmd, ©, file); + }mutex_unlock (&dev->mutex);if (copy) { err =put_compat_cmd (compat_ptr (arg), &cmd);
@@ -3205,7 +3225,12 @@ static int compat_insnlist(struct file * }mutex_lock (&dev->mutex); - rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insnlist_ioctl (dev, insns, insnlist32.n_insns, file); + }mutex_unlock (&dev->mutex);kfree (insns);return rc;
@@ -3224,7 +3249,12 @@ static int compat_insn(struct file *filereturn rc;mutex_lock (&dev->mutex); - rc =do_insn_ioctl (dev, &insn, file); +if (!dev->attached) { +dev_dbg (dev->class_dev,"no driver attached\n" ); + rc = -ENODEV ; + }else { + rc =do_insn_ioctl (dev, &insn, file); + }mutex_unlock (&dev->mutex);return rc; }
Greg Kroah-Hartman
maintainerPATCH 58/60 staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 154828bf9559b9c8421fc2f0d7f7f76b3683aaed upstream.
The Information Element (IE) parser rtw_get_ie() trusted the length byte of each IE without validating that the IE body (len bytes after the 2-byte header) fits inside the remaining frame buffer. A malformed frame can advertise an IE length larger than the available data, causing the parser to increment its pointer beyond the buffer end. This results in out-of-bounds reads or, depending on the pattern, an infinite loop.
Fix by validating that (offset + 2 + len) does not exceed the limit before accepting the IE or advancing to the next element.
This prevents OOB reads and ensures the parser terminates safely on malformed frames.
--- drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/staging/rtl8723bs/core/rtw_ieee80211.c +8 -6
@@ -140,22 +140,24 @@ u8 *rtw_get_ie(u8 *pbuf, signed int indesigned int tmp, i;u8 *p; -if (limit <1 ) +if (limit <2 )return NULL ; p = pbuf; i =0 ; *len =0 ; -while (1 ) { +while (i +2 <= limit) { + tmp = *(p +1 ); +if (i +2 + tmp > limit) +break ; +if (*p == index) { - *len = *(p +1 ); + *len = tmp;return p; } - tmp = *(p +1 ); + p += (tmp +2 ); i += (tmp +2 ); -if (i >= limit) -break ; }return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 59/60 staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 6ef0e1c10455927867cac8f0ed6b49f328f8cf95 upstream.
The Supported Rates IE length from an incoming Association Request frame was used directly as the memcpy() length when copying into a fixed-size 16-byte stack buffer (supportRate). A malicious station can advertise an IE length larger than 16 bytes, causing a stack buffer overflow.
Clamp ie_len to the buffer size before copying the Supported Rates IE, and correct the bounds check when merging Extended Supported Rates to prevent a second potential overflow.
This prevents kernel stack corruption triggered by malformed association requests.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +4 -1
@@ -1033,6 +1033,9 @@ unsigned int OnAssocReq(struct adapter * status =WLAN_STATUS_CHALLENGE_FAIL ; goto OnAssocReqFail; }else { +if (ie_len >sizeof (supportRate)) + ie_len =sizeof (supportRate); +memcpy (supportRate, p+2 , ie_len); supportRateNum = ie_len;
@@ -1040,7 +1043,7 @@ unsigned int OnAssocReq(struct adapter * pkt_len - WLAN_HDR_A3_LEN - ie_offset);if (p) { -if (supportRateNum <=sizeof (supportRate)) { +if (supportRateNum + ie_len <=sizeof (supportRate)) {memcpy (supportRate+supportRateNum, p+2 , ie_len); supportRateNum += ie_len; }
Greg Kroah-Hartman
maintainerPATCH 60/60 staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing
In reply to Greg Kroah-Hartman6.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Navaneeth K <[email protected]>
commit 502ddcc405b69fa92e0add6c1714d654504f6fd7 upstream.
The Extended Supported Rates (ESR) IE handling in OnBeacon accessed *(p + 1 + ielen) and *(p + 2 + ielen) without verifying that these offsets lie within the received frame buffer. A malformed beacon with an ESR IE positioned at the end of the buffer could cause an out-of-bounds read, potentially triggering a kernel panic.
Add a boundary check to ensure that the ESR IE body and the subsequent bytes are within the limits of the frame before attempting to access them.
This prevents OOB reads caused by malformed beacon frames.
--- drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c +5 -3
@@ -579,9 +579,11 @@ unsigned int OnBeacon(struct adapter *pa p =rtw_get_ie (pframe +sizeof (struct ieee80211_hdr_3addr ) + _BEACON_IE_OFFSET_,WLAN_EID_EXT_SUPP_RATES , &ielen, precv_frame->u.hdr.len -sizeof (struct ieee80211_hdr_3addr ) - _BEACON_IE_OFFSET_);if (p && ielen >0 ) { -if ((*(p +1 + ielen) ==0x2D ) && (*(p +2 + ielen) !=0x2D )) -/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ - *(p +1 ) = ielen -1 ; +if (p +2 + ielen < pframe + len) { +if ((*(p +1 + ielen) ==0x2D ) && (*(p +2 + ielen) !=0x2D )) +/* Invalid value 0x2D is detected in Extended Supported Rates (ESR) IE. Try to fix the IE length to avoid failed Beacon parsing. */ + *(p +1 ) = ielen -1 ; + } }if (pmlmeext->sitesurvey_res.state ==SCAN_PROCESS ) {
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.17.12-rc1-ge7c0ca6d291c #1 SMP PREEMPT_DYNAMIC Wed Dec 10 10:02:01 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphics
sudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...
$
--
software engineer
rajagiri school of engineering and technology
Greg Kroah-Hartman
maintainerQuoted 8 lines · Jeffrin Thalakkottoor
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphicssudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...$
Is ths new? if so, can you bisect?
Quoted 5 lines · Greg Kroah-Hartman
Quoted 3 lines · Jeffrin Thalakkottoor
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphics
Quoted 7 lines
Quoted 5 lines
sudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...$
Is ths new? if so, can you bisect?
this is new related. Previous stable release err and warn disappeared (i think i changed .config)
can you give me a step by step tutorial for git bisect
t
Signature · 2 lines
software engineer rajagiri school of engineering and technology
Quoted 13 lines · Jeffrin Thalakkottoor
Quoted 11 lines · Greg Kroah-Hartman
Quoted 8 lines · Jeffrin Thalakkottoor
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphicssudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...$
Quoted 6 lines
Quoted 1 line
Is ths new? if so, can you bisect?
this is new related. Previous stable release err and warn disappeared (i think i changed .config)
can you give me a step by step tutorial for git bisect
1) cd to wherever you have your kernel checked out
2) git bisect start
3) if you're already on a known-bad commit, then mark it as such:
git bisect bad
4) Mark the last known good commit as such:
git bisect good <commit / tag>
git bisect will choose a commit to test.
5) Build, install and boot your kernel as you usually do
6) Run whatever test you need to determine if the booted kernel is good or bad (check dmesg in this case)
7) Mark the commit as good or bad. Git will choose another commit for you.
8) Goto 5.
git help bisect will give you more information.
At the end of the process git will tell you the first bad commit found. You can dump the bisection log with:
git bisect log
which you can reply here with.
HTH.
Cheers,
Brett
Quoted 52 lines · Brett A C Sheffield
Quoted 13 lines · Jeffrin Thalakkottoor
Quoted 11 lines · Greg Kroah-Hartman
Quoted 8 lines · Jeffrin Thalakkottoor
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphicssudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...$
Quoted 6 lines
Quoted 1 line
Is ths new? if so, can you bisect?
this is new related. Previous stable release err and warn disappeared (i think i changed .config)
can you give me a step by step tutorial for git bisect
1) cd to wherever you have your kernel checked out
2)
git bisect start3) if you're already on a known-bad commit, then mark it as such:
git bisect bad4) Mark the last known good commit as such:
git bisect good <commit / tag>git bisect will choose a commit to test.
5) Build, install and boot your kernel as you usually do
6) Run whatever test you need to determine if the booted kernel is good or bad (check dmesg in this case)
7) Mark the commit as good or bad. Git will choose another commit for you.
8) Goto 5.
git help bisectwill give you more information.At the end of the process git will tell you the first bad commit found. You can dump the bisection log with:
git bisect log
Quoted 8 lines
which you can reply here with.
HTH.
Cheers,
Brett
Thnaks for the tutorial :)
1. should i start with the bad commit first ?
2. how to move forward or backward in commits ?
3. what is the point in re-compiling the kernel if it cannot narrow down and test news lines of code
Signature · 2 lines
software engineer rajagiri school of engineering and technology
Quoted 55 lines · Jeffrin Thalakkottoor
Quoted 54 lines · Brett A C Sheffield
Quoted 13 lines · Jeffrin Thalakkottoor
Quoted 11 lines · Greg Kroah-Hartman
Quoted 8 lines · Jeffrin Thalakkottoor
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphicssudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...$
Quoted 6 lines
Quoted 1 line
Is ths new? if so, can you bisect?
this is new related. Previous stable release err and warn disappeared (i think i changed .config)
can you give me a step by step tutorial for git bisect
1) cd to wherever you have your kernel checked out
2)
git bisect start3) if you're already on a known-bad commit, then mark it as such:
git bisect bad4) Mark the last known good commit as such:
git bisect good <commit / tag>git bisect will choose a commit to test.
5) Build, install and boot your kernel as you usually do
6) Run whatever test you need to determine if the booted kernel is good or bad (check dmesg in this case)
7) Mark the commit as good or bad. Git will choose another commit for you.
8) Goto 5.
git help bisectwill give you more information.At the end of the process git will tell you the first bad commit found. You can dump the bisection log with:
git bisect logwhich you can reply here with.
Quoted 8 lines
Quoted 6 lines
HTH.
Cheers,
Brett
Thnaks for the tutorial :)
1. should i start with the bad commit first ?
You start by marking one good (past) commit and one bad commit. It doesn't matter what order.
You have at least one "bad" commit you know of: 4112049d7836ad4233321c3d2b6853db1627c49c
This is the 6.12.62-rc1 commit that you reported had the error.
So, in your kernel worktree:
git bisect startgit bisect bad 4112049d7836ad4233321c3d2b6853db1627c49c
Now we need to tell git bisect the most recent "good" commit we know of (where the error didn't occur).
If you already know the commit or tag of a previous version where you did not get the error, mark that as good. If not, pick a previous release, check it out, and go to step 5.
Quoted 1 line
2. how to move forward or backward in commits ?
git bisect will do that for you as soon as you mark a good and bad commit. If you want to manually test a specific commit, just git checkout <ref> as usual, and continue at step 5 in the instructions I gave you.
Quoted 2 lines
3. what is the point in re-compiling the kernel if it cannot narrow down and test news lines of code
We're narrowing down the error to a specific kernel commit. Once we know which specific commit introduced the error, we can look at the lines changed and try to understand why. We need your help to find that commit, because it's happening on your system.
Please do read git help bisect (man 1 git-bisect). It explains all this better than I can.
Thanks for testing and good luck!
Brett
Quoted 99 lines · Brett A C Sheffield
Quoted 55 lines · Jeffrin Thalakkottoor
Quoted 54 lines · Brett A C Sheffield
Quoted 13 lines · Jeffrin Thalakkottoor
Quoted 11 lines · Greg Kroah-Hartman
Quoted 8 lines · Jeffrin Thalakkottoor
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphicssudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...$
Quoted 6 lines
Quoted 1 line
Is ths new? if so, can you bisect?
this is new related. Previous stable release err and warn disappeared (i think i changed .config)
can you give me a step by step tutorial for git bisect
1) cd to wherever you have your kernel checked out
2)
git bisect start3) if you're already on a known-bad commit, then mark it as such:
git bisect bad4) Mark the last known good commit as such:
git bisect good <commit / tag>git bisect will choose a commit to test.
5) Build, install and boot your kernel as you usually do
6) Run whatever test you need to determine if the booted kernel is good or bad (check dmesg in this case)
7) Mark the commit as good or bad. Git will choose another commit for you.
8) Goto 5.
git help bisectwill give you more information.At the end of the process git will tell you the first bad commit found. You can dump the bisection log with:
git bisect logwhich you can reply here with.
Quoted 8 lines
Quoted 6 lines
HTH.
Cheers,
Brett
Thnaks for the tutorial :)
1. should i start with the bad commit first ?You start by marking one good (past) commit and one bad commit. It doesn't matter what order.
You have at least one "bad" commit you know of:
4112049d7836ad4233321c3d2b6853db1627c49cThis is the 6.12.62-rc1 commit that you reported had the error.
So, in your kernel worktree:
git bisect startgit bisect bad 4112049d7836ad4233321c3d2b6853db1627c49cNow we need to tell git bisect the most recent "good" commit we know of (where the error didn't occur).
If you already know the commit or tag of a previous version where you did not get the error, mark that as good. If not, pick a previous release, check it out, and go to step 5.
Quoted 1 line
2. how to move forward or backward in commits ?
git bisect will do that for you as soon as you mark a good and bad commit. If you want to manually test a specific commit, just
git checkout <ref>as usual, and continue at step 5 in the instructions I gave you.Quoted 2 lines
3. what is the point in re-compiling the kernel if it cannot narrow down and test news lines of code
We're narrowing down the error to a specific kernel commit. Once we know which specific commit introduced the error, we can look at the lines changed and try to understand why. We need your help to find that commit, because it's happening on your system.
Quoted 8 lines
Please do read
git help bisect(man 1 git-bisect). It explains all this better than I can.Thanks for testing and good luck!
Brett
Now i have a much clearer vision. Thanks a ton !
Signature · 2 lines
software engineer rajagiri school of engineering and technology
Quoted 99 lines · Brett A C Sheffield
Quoted 55 lines · Jeffrin Thalakkottoor
Quoted 54 lines · Brett A C Sheffield
Quoted 13 lines · Jeffrin Thalakkottoor
Quoted 11 lines · Greg Kroah-Hartman
Quoted 8 lines · Jeffrin Thalakkottoor
compiled and booted 6.17.12-rc1+
Version: AMD A4-4000 APU with Radeon(tm) HD Graphicssudo dmesg -l errr shows error
j$sudo dmesg -l err
[ 39.915487] Error: Driver 'pcspkr' is already registered, aborting...$
Quoted 6 lines
Quoted 1 line
Is ths new? if so, can you bisect?
this is new related. Previous stable release err and warn disappeared (i think i changed .config)
can you give me a step by step tutorial for git bisect
1) cd to wherever you have your kernel checked out
2)
git bisect start3) if you're already on a known-bad commit, then mark it as such:
git bisect bad4) Mark the last known good commit as such:
git bisect good <commit / tag>git bisect will choose a commit to test.
5) Build, install and boot your kernel as you usually do
6) Run whatever test you need to determine if the booted kernel is good or bad (check dmesg in this case)
7) Mark the commit as good or bad. Git will choose another commit for you.
8) Goto 5.
git help bisectwill give you more information.At the end of the process git will tell you the first bad commit found. You can dump the bisection log with:
git bisect logwhich you can reply here with.
Quoted 8 lines
Quoted 6 lines
HTH.
Cheers,
Brett
Thnaks for the tutorial :)
1. should i start with the bad commit first ?You start by marking one good (past) commit and one bad commit. It doesn't matter what order.
You have at least one "bad" commit you know of:
4112049d7836ad4233321c3d2b6853db1627c49cThis is the 6.12.62-rc1 commit that you reported had the error.
So, in your kernel worktree:
git bisect startgit bisect bad 4112049d7836ad4233321c3d2b6853db1627c49cNow we need to tell git bisect the most recent "good" commit we know of (where the error didn't occur).
If you already know the commit or tag of a previous version where you did not get the error, mark that as good. If not, pick a previous release, check it out, and go to step 5.
Quoted 1 line
2. how to move forward or backward in commits ?
git bisect will do that for you as soon as you mark a good and bad commit. If you want to manually test a specific commit, just
git checkout <ref>as usual, and continue at step 5 in the instructions I gave you.Quoted 2 lines
3. what is the point in re-compiling the kernel if it cannot narrow down and test news lines of code
We're narrowing down the error to a specific kernel commit. Once we know which specific commit introduced the error, we can look at the lines changed and try to understand why. We need your help to find that commit, because it's happening on your system.
Quoted 8 lines
Please do read
git help bisect(man 1 git-bisect). It explains all this better than I can.Thanks for testing and good luck!
Brett
I do not see that error anymore. may be i have made changes in configuration. THANKS
--
software engineer
rajagiri school of engineering and technology
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 12 Dec 2025 07:29:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.17.y
and the diffstat can be found below.thanks,
greg k-h
Thank you! Build tested on all Alpine architectures and boot tested on x86_64.
Am 10.12.2025 um 08:29 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 12 Dec 2025 07:29:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.17.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 12 Dec 2025 07:29:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.17.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 12 Dec 2025 07:29:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.17.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.17.12-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: e7c0ca6d291c41a8a9648a5016ce9b73e492aa3d
* git describe: v6.17.10-208-ge7c0ca6d291c
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.17.y/build/v6.17.10-208-ge7c0ca6d291c
## Test Regressions (compared to v6.17.10-147-gc434a9350a1d)
## Metric Regressions (compared to v6.17.10-147-gc434a9350a1d)
## Test Fixes (compared to v6.17.10-147-gc434a9350a1d)
## Metric Fixes (compared to v6.17.10-147-gc434a9350a1d)
## Test result summary
total: 116299, pass: 98676, fail: 3761, skip: 13862, xfail: 0
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 139 total, 139 passed, 0 failed
* arm64: 57 total, 54 passed, 3 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 33 passed, 1 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 40 total, 39 passed, 1 failed
* riscv: 25 total, 25 passed, 0 failed
* s390: 22 total, 22 passed, 0 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 49 total, 48 passed, 1 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-rust
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
* rt-tests-cyclicdeadline
* rt-tests-pi-stress
* rt-tests-pmqtest
* rt-tests-rt-migrate-test
* rt-tests-signaltest
--
Linaro LKFT
https://lkft.linaro.org
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 12 Dec 2025 07:29:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.17.y
and the diffstat can be found below.thanks,
greg k-h
Build and Boot Report for 6.17.12-rc1
The kernel version 6.17.12 was built and boot-tested using qemu-x86_64 and qemu-arm64 with the default configuration (defconfig). The build and boot processes completed successfully, and the kernel operated as expected in the virtualized environments without any issues.
No dmesg regressions found.
Build Details :
Builds : arm64, x86_64
Kernel Version: 6.17.12
Configuration : defconfig
Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Commit : e7c0ca6d291c41a8a9648a5016ce9b73e492aa3d
Best regards,
Dileep Malepu
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.17.12 release. There are 60 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 12 Dec 2025 07:29:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.17.12-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.17.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.17:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
120 tests: 120 pass, 0 failLinux version: 6.17.12-rc1-ge7c0ca6d291c
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon