4.19.273-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.19.273-rc1 review
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Feb 2023 13:35:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.273-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.273-rc1
Chris Healy <[email protected]>
net: phy: meson-gxl: Add generic dummy stubs for MMD register access
Ryusuke Konishi <[email protected]>
nilfs2: fix underflow in second superblock position calculations
Greg Kroah-Hartman <[email protected]>
kvm: initialize all of the kvm_debugregs structure before sending it to userspace
Natalia Petrova <[email protected]>
i40e: Add checking for null for nlmsg_find_attr()
Guillaume Nault <[email protected]>
ipv6: Fix tcp socket connection with DSCP.
Guillaume Nault <[email protected]>
ipv6: Fix datagram socket connection with DSCP.
Jakub Kicinski <[email protected]>
net: mpls: fix stale pointer if allocation fails during device rename
Cristian Ciocaltea <[email protected]>
net: stmmac: Restrict warning on disabling DMA store and fwd mode
Michael Chan <[email protected]>
bnxt_en: Fix mqprio and XDP ring checking logic
Johannes Zink <[email protected]>
net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
Miko Larsson <[email protected]>
net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
Kuniyuki Iwashima <[email protected]>
dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
Rafał Miłecki <[email protected]>
net: bgmac: fix BCM5358 support by setting correct flags
Jason Xing <[email protected]>
i40e: add double of VLAN header when computing the max MTU
Andrew Morton <[email protected]>
revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
Mike Kravetz <[email protected]>
hugetlb: check for undefined shift on 32 bit architectures
Kailang Yang <[email protected]>
ALSA: hda/realtek - fixed wrong gpio assigned
Bo Liu <[email protected]>
ALSA: hda/conexant: add a new hda codec SN6180
Yang Yingliang <[email protected]>
mmc: sdio: fix possible resource leaks in some error paths
Greg Kroah-Hartman <[email protected]>
Revert "x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN"
Florian Westphal <[email protected]>
netfilter: nft_tproxy: restrict to prerouting hook
Seth Jenkins <[email protected]>
aio: fix mremap after fork null-deref
Amit Engel <[email protected]>
nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
Hyunwoo Kim <[email protected]>
net/rose: Fix to not accept on connected socket
Shunsuke Mie <[email protected]>
tools/virtio: fix the vringh test for virtio ring changes
Arnd Bergmann <[email protected]>
ASoC: cs42l56: fix DT probe
Mike Kravetz <[email protected]>
migrate: hugetlb: check for hugetlb shared PMD in node migration
Toke Høiland-Jørgensen <[email protected]>
bpf: Always return target ifindex in bpf_fib_lookup
Heiner Kallweit <[email protected]>
arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
Heiner Kallweit <[email protected]>
arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
Guo Ren <[email protected]>
riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
Prashant Malani <[email protected]>
usb: typec: altmodes/displayport: Fix probe pin assign check
Mark Pearson <[email protected]>
usb: core: add quirk for Alcor Link AK9563 smartcard reader
Alan Stern <[email protected]>
net: USB: Fix wrong-direction WARNING in plusb.c
Andy Shevchenko <[email protected]>
pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
Andy Shevchenko <[email protected]>
pinctrl: intel: Convert unsigned to unsigned int
Maxim Korotkov <[email protected]>
pinctrl: single: fix potential NULL dereference
Joel Stanley <[email protected]>
pinctrl: aspeed: Fix confusing types in return value
Dan Carpenter <[email protected]>
ALSA: pci: lx6464es: fix a debug loop
Hangbin Liu <[email protected]>
selftests: forwarding: lib: quote the sysctl values
Pietro Borrello <[email protected]>
rds: rds_rm_zerocopy_callback() use list_first_entry()
Heiner Kallweit <[email protected]>
net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
Jerome Brunet <[email protected]>
net: phy: meson-gxl: add g12a support
Heiner Kallweit <[email protected]>
net: phy: add macros for PHYID matching
Dean Luick <[email protected]>
IB/hfi1: Restore allocated resources on failed copyout
Artemii Karasev <[email protected]>
ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
Josef Bacik <[email protected]>
btrfs: limit device extents to the device size
Andreas Kemnade <[email protected]>
iio:adc:twl6030: Enable measurement of VAC
Rafael J. Wysocki <[email protected]>
thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
Ilpo Järvinen <[email protected]>
serial: 8250_dma: Fix DMA Rx rearm race
Ilpo Järvinen <[email protected]>
serial: 8250_dma: Fix DMA Rx completion race
Phillip Lougher <[email protected]>
Squashfs: fix handling and sanity checking of xattr_ids count
Longlong Xia <[email protected]>
mm/swapfile: add cond_resched() in get_swap_pages()
Mike Kravetz <[email protected]>
mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
Andreas Schwab <[email protected]>
riscv: disable generation of unwind tables
Helge Deller <[email protected]>
parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
Helge Deller <[email protected]>
parisc: Fix return code of pdc_iodc_print()
Andreas Kemnade <[email protected]>
iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
Xiongfeng Wang <[email protected]>
iio: adc: berlin2-adc: Add missing of_node_put() in error path
Dmitry Perchanov <[email protected]>
iio: hid: fix the retval in accel_3d_capture_sample
Ard Biesheuvel <[email protected]>
efi: Accept version 2 of memory attributes table
Alexander Egorenkov <[email protected]>
watchdog: diag288_wdt: fix __diag288() inline assembly
Alexander Egorenkov <[email protected]>
watchdog: diag288_wdt: do not use stack buffers for hardware data
Samuel Thibault <[email protected]>
fbcon: Check font dimension limits
Srinivas Pandruvada <[email protected]>
thermal: intel: int340x: Protect trip temperature from concurrent updates
Hendrik Borghorst <[email protected]>
KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
Sean Christopherson <[email protected]>
KVM: VMX: Move caching of MSR_IA32_XSS to hardware_setup()
Sean Christopherson <[email protected]>
KVM: VMX: Move VMX specific files to a "vmx" subdirectory
Krish Sadhukhan <[email protected]>
nVMX x86: Check VMX-preemption timer controls on vmentry of L2 guests
Werner Sembach <[email protected]>
Input: i8042 - add Clevo PCX0DX to i8042 quirk table
Werner Sembach <[email protected]>
Input: i8042 - add TUXEDO devices to i8042 quirk tables
Werner Sembach <[email protected]>
Input: i8042 - merge quirk tables
Werner Sembach <[email protected]>
Input: i8042 - move __initconst to fix code styling warning
George Kennedy <[email protected]>
vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
Udipto Goswami <[email protected]>
usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
Neil Armstrong <[email protected]>
usb: dwc3: qcom: enable vbus override when in OTG dr-mode
Wesley Cheng <[email protected]>
usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
Olivier Moysan <[email protected]>
iio: adc: stm32-dfsdm: fill module aliases
Hyunwoo Kim <[email protected]>
net/x25: Fix to not accept on connected socket
Randy Dunlap <[email protected]>
i2c: rk3x: fix a bunch of kernel-doc warnings
Mike Christie <[email protected]>
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
Maurizio Lombardi <[email protected]>
scsi: target: core: Fix warning on RT kernels
Fedor Pchelkin <[email protected]>
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
Damien Le Moal <[email protected]>
ata: libata: Fix sata_down_spd_limit() when no link speed is reported
Fedor Pchelkin <[email protected]>
squashfs: harden sanity check in squashfs_read_xattr_id_table
Hyunwoo Kim <[email protected]>
netrom: Fix use-after-free caused by accept on already connected socket
Artemii Karasev <[email protected]>
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
Yuan Can <[email protected]>
bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
Takashi Sakamoto <[email protected]>
firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +-
arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +-
arch/parisc/kernel/firmware.c | 5 +-
arch/parisc/kernel/ptrace.c | 15 +-
arch/riscv/Makefile | 3 +
arch/riscv/mm/cacheflush.c | 4 +-
arch/x86/kernel/fpu/init.c | 7 +-
arch/x86/kvm/Makefile | 2 +-
arch/x86/kvm/{ => vmx}/pmu_intel.c | 0
arch/x86/kvm/{ => vmx}/vmx.c | 37 +-
arch/x86/kvm/{ => vmx}/vmx_evmcs.h | 0
arch/x86/kvm/{ => vmx}/vmx_shadow_fields.h | 0
arch/x86/kvm/x86.c | 3 +-
drivers/ata/libata-core.c | 2 +-
drivers/bus/sunxi-rsb.c | 8 +-
drivers/firewire/core-cdev.c | 4 +-
drivers/firmware/efi/memattr.c | 2 +-
drivers/i2c/busses/i2c-rk3x.c | 44 +-
drivers/iio/accel/hid-sensor-accel-3d.c | 1 +
drivers/iio/adc/berlin2-adc.c | 4 +-
drivers/iio/adc/stm32-dfsdm-adc.c | 1 +
drivers/iio/adc/twl6030-gpadc.c | 32 +
drivers/infiniband/hw/hfi1/file_ops.c | 7 +-
drivers/input/serio/i8042-x86ia64io.h | 1188 ++++++++++++--------
drivers/mmc/core/sdio_bus.c | 17 +-
drivers/mmc/core/sdio_cis.c | 12 -
drivers/net/ethernet/broadcom/bgmac-bcma.c | 6 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 3 +-
.../net/ethernet/stmicro/stmmac/stmmac_platform.c | 2 +-
drivers/net/phy/meson-gxl.c | 15 +
drivers/net/usb/kalmia.c | 8 +-
drivers/net/usb/plusb.c | 4 +-
drivers/nvme/target/fc.c | 4 +-
drivers/pinctrl/aspeed/pinctrl-aspeed.c | 2 +-
drivers/pinctrl/intel/pinctrl-intel.c | 117 +-
drivers/pinctrl/intel/pinctrl-intel.h | 32 +-
drivers/pinctrl/pinctrl-single.c | 2 +
drivers/scsi/iscsi_tcp.c | 9 +-
drivers/target/target_core_tmr.c | 4 +-
.../thermal/int340x_thermal/int340x_thermal_zone.c | 28 +-
.../thermal/int340x_thermal/int340x_thermal_zone.h | 1 +
drivers/tty/serial/8250/8250_dma.c | 26 +-
drivers/tty/vt/vc_screen.c | 9 +-
drivers/usb/core/quirks.c | 3 +
drivers/usb/dwc3/dwc3-qcom.c | 10 +-
drivers/usb/gadget/function/f_fs.c | 4 +-
drivers/usb/typec/altmodes/displayport.c | 8 +-
drivers/video/fbdev/core/fbcon.c | 7 +-
drivers/watchdog/diag288_wdt.c | 15 +-
fs/aio.c | 4 +
fs/btrfs/volumes.c | 6 +-
fs/nilfs2/ioctl.c | 7 +
fs/nilfs2/super.c | 9 +
fs/nilfs2/the_nilfs.c | 8 +-
fs/proc/task_mmu.c | 4 +-
fs/squashfs/squashfs_fs.h | 2 +-
fs/squashfs/squashfs_fs_sb.h | 2 +-
fs/squashfs/xattr.h | 4 +-
fs/squashfs/xattr_id.c | 2 +-
include/linux/hugetlb.h | 18 +-
include/linux/phy.h | 4 +
include/net/sock.h | 13 +
mm/mempolicy.c | 3 +-
mm/swapfile.c | 1 +
net/core/filter.c | 3 +-
net/dccp/ipv6.c | 7 +-
net/ipv6/datagram.c | 2 +-
net/ipv6/tcp_ipv6.c | 11 +-
net/mpls/af_mpls.c | 4 +
net/netfilter/nft_tproxy.c | 8 +
net/netrom/af_netrom.c | 5 +
net/openvswitch/datapath.c | 12 +-
net/rds/message.c | 6 +-
net/rose/af_rose.c | 8 +
net/x25/af_x25.c | 6 +
sound/pci/hda/patch_conexant.c | 1 +
sound/pci/hda/patch_realtek.c | 2 +-
sound/pci/hda/patch_via.c | 3 +
sound/pci/lx6464es/lx_core.c | 11 +-
sound/soc/codecs/cs42l56.c | 6 -
sound/synth/emux/emux_nrpn.c | 3 +
tools/testing/selftests/net/forwarding/lib.sh | 4 +-
tools/virtio/linux/bug.h | 8 +-
tools/virtio/linux/build_bug.h | 7 +
tools/virtio/linux/cpumask.h | 7 +
tools/virtio/linux/gfp.h | 7 +
tools/virtio/linux/kernel.h | 1 +
tools/virtio/linux/kmsan.h | 12 +
tools/virtio/linux/scatterlist.h | 1 +
tools/virtio/linux/topology.h | 7 +
93 files changed, 1251 insertions(+), 731 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/89 firewire: fix memory leak for payload of request subaction to IEC 61883-1 FCP region
From: Takashi Sakamoto <[email protected]>
commit 531390a243ef47448f8bad01c186c2787666bf4d upstream.
This patch is fix for Linux kernel v2.6.33 or later.
For request subaction to IEC 61883-1 FCP region, Linux FireWire subsystem have had an issue of use-after-free. The subsystem allows multiple user space listeners to the region, while data of the payload was likely released before the listeners execute read(2) to access to it for copying to user space.
The issue was fixed by a commit 281e20323ab7 ("firewire: core: fix use-after-free regression in FCP handler"). The object of payload is duplicated in kernel space for each listener. When the listener executes ioctl(2) with FW_CDEV_IOC_SEND_RESPONSE request, the object is going to be released.
However, it causes memory leak since the commit relies on call of release_request() in drivers/firewire/core-cdev.c. Against the expectation, the function is never called due to the design of release_client_resource(). The function delegates release task to caller when called with non-NULL fourth argument. The implementation of ioctl_send_response() is the case. It should release the object explicitly.
This commit fixes the bug.
--- drivers/firewire/core-cdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/firewire/core-cdev.c +3 -1
@@ -831,8 +831,10 @@ static int ioctl_send_response(struct cl r = container_of(resource, struct inbound_transaction_resource, resource); -if (is_fcp_request (r->request)) +if (is_fcp_request (r->request)) { +kfree (r->data); goto out; + }if (a->length !=fw_get_response_length (r->request)) { ret = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 2/89 bus: sunxi-rsb: Fix error handling in sunxi_rsb_init()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit f71eaf2708be7831428eacae7db25d8ec6b8b4c5 ]
The sunxi_rsb_init() returns the platform_driver_register() directly without checking its return value, if platform_driver_register() failed, the sunxi_rsb_bus is not unregistered.
Fix by unregister sunxi_rsb_bus when platform_driver_register() failed.
--- drivers/bus/sunxi-rsb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/bus/sunxi-rsb.c +7 -1
@@ -783,7 +783,13 @@ static int __init sunxi_rsb_init(void)return ret; } -return platform_driver_register (&sunxi_rsb_driver); + ret =platform_driver_register (&sunxi_rsb_driver); +if (ret) { +bus_unregister (&sunxi_rsb_bus); +return ret; + } + +return 0 ; }module_init (sunxi_rsb_init);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 3/89 ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
In reply to Greg Kroah-HartmanFrom: Artemii Karasev <[email protected]>
[ Upstream commit b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa ]
snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/pci/hda/patch_via.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/patch_via.c +3 -0
@@ -834,6 +834,9 @@ static int add_secret_dac_path(struct hda_codec *codec)return 0 ; nums =snd_hda_get_connections (codec, spec->gen.mixer_nid, conn,ARRAY_SIZE (conn) -1 ); +if (nums <0 ) +return nums; +for (i =0 ; i < nums; i++) {if (get_wcaps_type (get_wcaps (codec, conn[i])) ==AC_WID_AUD_OUT )return 0 ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 4/89 netrom: Fix use-after-free caused by accept on already connected socket
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
[ Upstream commit 611792920925fb088ddccbe2783c7f92fdfb6b64 ]
If you call listen() and accept() on an already connect()ed AF_NETROM socket, accept() can successfully connect. This is because when the peer socket sends data to sendmsg, the skb with its own sk stored in the connected socket's sk->sk_receive_queue is connected, and nr_accept() dequeues the skb waiting in the sk->sk_receive_queue.
As a result, nr_accept() allocates and returns a sock with the sk of the parent AF_NETROM socket.
And here use-after-free can happen through complex race conditions:
```
cpu0 cpu1
1. socket_2 = socket(AF_NETROM)
.
.
listen(socket_2)
accepted_socket = accept(socket_2)
2. socket_1 = socket(AF_NETROM)
nr_create() // sk refcount : 1
connect(socket_1)
3. write(accepted_socket)
nr_sendmsg()
nr_output()
nr_kick()
nr_send_iframe()
nr_transmit_buffer()
nr_route_frame()
nr_loopback_queue()
nr_loopback_timer()
nr_rx_frame()
nr_process_rx_frame(sk, skb); // sk : socket_1's sk
nr_state3_machine()
nr_queue_rx_frame()
sock_queue_rcv_skb()
sock_queue_rcv_skb_reason()
__sock_queue_rcv_skb()
__skb_queue_tail(list, skb); // list : socket_1's sk->sk_receive_queue
4. listen(socket_1)
nr_listen()
uaf_socket = accept(socket_1)
nr_accept()
skb_dequeue(&sk->sk_receive_queue);
5. close(accepted_socket)
nr_release()
nr_write_internal(sk, NR_DISCREQ)
nr_transmit_buffer() // NR_DISCREQ
nr_route_frame()
nr_loopback_queue()
nr_loopback_timer()
nr_rx_frame() // sk : socket_1's sk
nr_process_rx_frame() // NR_STATE_3
nr_state3_machine() // NR_DISCREQ
nr_disconnect()
nr_sk(sk)->state = NR_STATE_0;
6. close(socket_1) // sk refcount : 3
nr_release() // NR_STATE_0
sock_put(sk); // sk refcount : 0
sk_free(sk);
close(uaf_socket)
nr_release()
sock_hold(sk); // UAF
```KASAN report by syzbot:
``` BUG: KASAN: use-after-free in nr_release+0x66/0x460 net/netrom/af_netrom.c:520 Write of size 4 at addr ffff8880235d8080 by task syz-executor564/5128 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x141/0x190 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:116 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] sock_hold include/net/sock.h:775 [inline] nr_release+0x66/0x460 net/netrom/af_netrom.c:520 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6c19e3c9b9 Code: Unable to access opcode bytes at 0x7f6c19e3c98f. RSP: 002b:00007fffd4ba2ce8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: 0000000000000116 RBX: 0000000000000003 RCX: 00007f6c19e3c9b9 RDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000006 RBP: 0000000000000003 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 000055555566a2c0 R13: 0000000000000011 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 __sock_create+0x359/0x790 net/socket.c:1515 sock_create net/socket.c:1566 [inline] __sys_socket_create net/socket.c:1603 [inline] __sys_socket_create net/socket.c:1588 [inline] __sys_socket+0x133/0x250 net/socket.c:1636 __do_sys_socket net/socket.c:1649 [inline] __se_sys_socket net/socket.c:1647 [inline] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 5128: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] __cache_free mm/slab.c:3394 [inline] __do_kmem_cache_free mm/slab.c:3580 [inline] __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 sk_prot_free net/core/sock.c:2074 [inline] __sk_destruct+0x5df/0x750 net/core/sock.c:2166 sk_destruct net/core/sock.c:2181 [inline] __sk_free+0x175/0x460 net/core/sock.c:2192 sk_free+0x7c/0xa0 net/core/sock.c:2203 sock_put include/net/sock.h:1991 [inline] nr_release+0x39e/0x460 net/netrom/af_netrom.c:554 __sock_release+0xcd/0x280 net/socket.c:650 sock_close+0x1c/0x20 net/socket.c:1365 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaa8/0x2950 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x21c3/0x2450 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd ```
To fix this issue, nr_listen() returns -EINVAL for sockets that successfully nr_connect().
--- net/netrom/af_netrom.c | 5 +++++ 1 file changed, 5 insertions(+)
net/netrom/af_netrom.c +5 -0
@@ -403,6 +403,11 @@ static int nr_listen(struct socket *sock, int backlog)struct sock *sk = sock->sk;lock_sock (sk); +if (sock->state !=SS_UNCONNECTED ) { +release_sock (sk); +return -EINVAL ; + } +if (sk->sk_state !=TCP_LISTEN ) {memset (&nr_sk (sk)->user_addr,0 ,AX25_ADDR_LEN ); sk->sk_max_ack_backlog = backlog;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 5/89 squashfs: harden sanity check in squashfs_read_xattr_id_table
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 72e544b1b28325fe78a4687b980871a7e4101f76 ]
While mounting a corrupted filesystem, a signed integer '*xattr_ids' can become less than zero. This leads to the incorrect computation of 'len' and 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor() or out-of-bounds accesses in the next sanity checks inside squashfs_read_xattr_id_table().
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- fs/squashfs/xattr_id.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/squashfs/xattr_id.c +1 -1
@@ -89,7 +89,7 @@ __le64 *squashfs_read_xattr_id_table(struct super_block *sb, u64 table_start,/* Sanity check values */ /* there is always at least one xattr id */ -if (*xattr_ids ==0 ) +if (*xattr_ids <=0 )return ERR_PTR (-EINVAL ); len =SQUASHFS_XATTR_BLOCK_BYTES (*xattr_ids);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 6/89 ata: libata: Fix sata_down_spd_limit() when no link speed is reported
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 69f2c9346313ba3d3dfa4091ff99df26c67c9021 ]
Commit 2dc0b46b5ea3 ("libata: sata_down_spd_limit should return if driver has not recorded sstatus speed") changed the behavior of sata_down_spd_limit() to return doing nothing if a drive does not report a current link speed, to avoid reducing the link speed to the lowest 1.5 Gbps speed.
However, the change assumed that a speed was recorded before probing (e.g. before a suspend/resume) and set in link->sata_spd. This causes problems with adapters/drives combination failing to establish a link speed during probe autonegotiation. One example reported of this problem is an mvebu adapter with a 3Gbps port-multiplier box: autonegotiation fails, leaving no recorded link speed and no reported current link speed. Probe retries also fail as no action is taken by sata_set_spd() after each retry.
Fix this by returning early in sata_down_spd_limit() only if we do have a recorded link speed, that is, if link->sata_spd is not 0. With this fix, a failed probe not leading to a recorded link speed is retried at the lower 1.5 Gbps speed, with the link speed potentially increased later on the second revalidate of the device if the device reports that it supports higher link speeds.
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -3112,7 +3112,7 @@ int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)*/ if (spd >1 ) mask &= (1 << (spd -1 )) -1 ; -else +else if (link->sata_spd)return -EINVAL ;/* were we already at the bottom? */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 7/89 net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 0c598aed445eb45b0ee7ba405f7ece99ee349c30 ]
Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is not freed when an allocation of a key fails.
BUG: memory leak
unreferenced object 0xffff888116668000 (size 632):
comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline]
[<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77
[<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957
[<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
[<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800
[<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515
[<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
[<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
[<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339
[<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934
[<00000000482b476f>] sock_sendmsg_nosec net/socket.c:651 [inline]
[<00000000482b476f>] sock_sendmsg+0x152/0x190 net/socket.c:671
[<00000000698574ba>] ____sys_sendmsg+0x70a/0x870 net/socket.c:2356
[<00000000d28d9e11>] ___sys_sendmsg+0xf3/0x170 net/socket.c:2410
[<0000000083ba9120>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
[<00000000c00628f8>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
[<000000004abfdcf4>] entry_SYSCALL_64_after_hwframe+0x61/0xc6To fix this the patch rearranges the goto labels to reflect the order of object allocations and adds appropriate goto statements on the error paths.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/openvswitch/datapath.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/openvswitch/datapath.c +6 -6
@@ -934,14 +934,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) key =kzalloc (sizeof (*key),GFP_KERNEL );if (!key) { error = -ENOMEM ; - goto err_kfree_key; + goto err_kfree_flow; }ovs_match_init (&match, key, false, &mask); error =ovs_nla_get_match (net, &match, a[OVS_FLOW_ATTR_KEY ], a[OVS_FLOW_ATTR_MASK ], log);if (error) - goto err_kfree_flow; + goto err_kfree_key;ovs_flow_mask_key (&new_flow->key, key, true, &mask);
@@ -949,14 +949,14 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) error =ovs_nla_get_identifier (&new_flow->id, a[OVS_FLOW_ATTR_UFID ], key, log);if (error) - goto err_kfree_flow; + goto err_kfree_key;/* Validate actions. */ error =ovs_nla_copy_actions (net, a[OVS_FLOW_ATTR_ACTIONS ], &new_flow->key, &acts, log);if (error) {OVS_NLERR (log,"Flow actions may not be safe on all matching packets." ); - goto err_kfree_flow; + goto err_kfree_key; } reply = ovs_flow_cmd_alloc_info(acts, &new_flow->id, info, false,
@@ -1056,10 +1056,10 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info)kfree_skb (reply); err_kfree_acts:ovs_nla_free_flow_actions (acts); -err_kfree_flow: -ovs_flow_free (new_flow, false); err_kfree_key:kfree (key); +err_kfree_flow: +ovs_flow_free (new_flow, false); error:return error; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 8/89 scsi: target: core: Fix warning on RT kernels
In reply to Greg Kroah-HartmanFrom: Maurizio Lombardi <[email protected]>
[ Upstream commit 84ed64b1a7a7fcd507598dee7708c1f225123711 ]
Calling spin_lock_irqsave() does not disable the interrupts on realtime kernels, remove the warning and replace assert_spin_locked() with lockdep_assert_held().
--- drivers/target/target_core_tmr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/target/target_core_tmr.c +2 -2
@@ -95,8 +95,8 @@ static bool __target_check_io_state(struct se_cmd *se_cmd, {struct se_session *sess = se_cmd->se_sess; -assert_spin_locked (&sess->sess_cmd_lock); -WARN_ON_ONCE (!irqs_disabled ()); +lockdep_assert_held (&sess->sess_cmd_lock); +/* * If command already reached CMD_T_COMPLETE state within * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 9/89 scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
In reply to Greg Kroah-HartmanFrom: Mike Christie <[email protected]>
[ Upstream commit f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3 ]
If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug.
Set the tcp_sw_host->session after we have completed session creation and can no longer fail.
--- drivers/scsi/iscsi_tcp.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/scsi/iscsi_tcp.c +6 -3
@@ -775,7 +775,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, enum iscsi_host_param param, char *buf) { struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(shost); -struct iscsi_session *session = tcp_sw_host->session; +struct iscsi_session *session;struct iscsi_conn *conn;struct iscsi_tcp_conn *tcp_conn;struct iscsi_sw_tcp_conn *tcp_sw_conn;
@@ -784,6 +784,7 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost,switch (param) {case ISCSI_HOST_PARAM_IPADDRESS : + session = tcp_sw_host->session;if (!session)return -ENOTCONN ;
@@ -872,12 +873,14 @@ iscsi_sw_tcp_session_create(struct iscsi_endpoint *ep, uint16_t cmds_max,if (!cls_session) goto remove_host; session = cls_session->dd_data; - tcp_sw_host =iscsi_host_priv (shost); - tcp_sw_host->session = session; shost->can_queue = session->scsi_cmds_max;if (iscsi_tcp_r2tpool_alloc (session)) goto remove_session; + +/* We are now fully setup so expose the session to sysfs. */ + tcp_sw_host =iscsi_host_priv (shost); + tcp_sw_host->session = session;return cls_session; remove_session:
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 10/89 i2c: rk3x: fix a bunch of kernel-doc warnings
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 0582d984793d30442da88fe458674502bad1ad29 ]
Fix multiple W=1 kernel-doc warnings in i2c-rk3x.c:
drivers/i2c/busses/i2c-rk3x.c:83: warning: missing initial short description on line:
* struct i2c_spec_values:drivers/i2c/busses/i2c-rk3x.c:139: warning: missing initial short description on line:
* struct rk3x_i2c_calced_timings:drivers/i2c/busses/i2c-rk3x.c:162: warning: missing initial short description on line:
* struct rk3x_i2c_soc_data:drivers/i2c/busses/i2c-rk3x.c:242: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Generate a START condition, which triggers a REG_INT_START interrupt.drivers/i2c/busses/i2c-rk3x.c:261: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Generate a STOP condition, which triggers a REG_INT_STOP interrupt.drivers/i2c/busses/i2c-rk3x.c:304: warning: expecting prototype for Setup a read according to i2c(). Prototype was for rk3x_i2c_prepare_read() instead drivers/i2c/busses/i2c-rk3x.c:335: warning: expecting prototype for Fill the transmit buffer with data from i2c(). Prototype was for rk3x_i2c_fill_transmit_buf() instead drivers/i2c/busses/i2c-rk3x.c:535: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Get timing values of I2C specificationdrivers/i2c/busses/i2c-rk3x.c:552: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Calculate divider values for desired SCL frequencydrivers/i2c/busses/i2c-rk3x.c:713: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Calculate timing values for desired SCL frequencydrivers/i2c/busses/i2c-rk3x.c:963: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
* Setup I2C registers for an I2C operation specified by msgs, num.
--- drivers/i2c/busses/i2c-rk3x.c | 44 +++++++++++++++++------------------ 1 file changed, 22 insertions(+), 22 deletions(-)
drivers/i2c/busses/i2c-rk3x.c +22 -22
@@ -82,7 +82,7 @@ enum {#define DEFAULT_SCL_RATE (100 * 1000)/* Hz */ /** -* struct i2c_spec_values: +* struct i2c_spec_values - I2C specification values for various modes * @min_hold_start_ns: min hold time (repeated) START condition * @min_low_ns: min LOW period of the SCL clock * @min_high_ns: min HIGH period of the SCL cloc
@@ -138,7 +138,7 @@ static const struct i2c_spec_values fast_mode_plus_spec = { };/** -* struct rk3x_i2c_calced_timings: +* struct rk3x_i2c_calced_timings - calculated V1 timings * @div_low: Divider output for low * @div_high: Divider output for high * @tuning: Used to adjust setup/hold data time,
@@ -161,7 +161,7 @@ enum rk3x_i2c_state { };/** -* struct rk3x_i2c_soc_data: +* struct rk3x_i2c_soc_data - SOC-specific data * @grf_offset: offset inside the grf regmap for setting the i2c type * @calc_timings: Callback function for i2c timing information calculated */
@@ -241,7 +241,8 @@ static inline void rk3x_i2c_clean_ipd(struct rk3x_i2c *i2c) }/** -* Generate a START condition, which triggers a REG_INT_START interrupt. +* rk3x_i2c_start - Generate a START condition, which triggers a REG_INT_START interrupt. +* @i2c: target controller data */ static void rk3x_i2c_start (struct rk3x_i2c *i2c) {
@@ -260,8 +261,8 @@ static void rk3x_i2c_start(struct rk3x_i2c *i2c) }/** -* Generate a STOP condition, which triggers a REG_INT_STOP interrupt. -* +* rk3x_i2c_stop - Generate a STOP condition, which triggers a REG_INT_STOP interrupt. +* @i2c: target controller data * @error: Error code to return in rk3x_i2c_xfer */ static void rk3x_i2c_stop (struct rk3x_i2c *i2c,int error)
@@ -300,7 +301,8 @@ static void rk3x_i2c_stop(struct rk3x_i2c *i2c, int error) }/** -* Setup a read according to i2c->msg +* rk3x_i2c_prepare_read - Setup a read according to i2c->msg +* @i2c: target controller data */ static void rk3x_i2c_prepare_read (struct rk3x_i2c *i2c) {
@@ -331,7 +333,8 @@ static void rk3x_i2c_prepare_read(struct rk3x_i2c *i2c) }/** -* Fill the transmit buffer with data from i2c->msg +* rk3x_i2c_fill_transmit_buf - Fill the transmit buffer with data from i2c->msg +* @i2c: target controller data */ static void rk3x_i2c_fill_transmit_buf (struct rk3x_i2c *i2c) {
@@ -534,11 +537,10 @@ static irqreturn_t rk3x_i2c_irq(int irqno, void *dev_id) }/** -* Get timing values of I2C specification -* +* rk3x_i2c_get_spec - Get timing values of I2C specification * @speed: Desired SCL frequency * -* Returns: Matched i2c spec values. +* Return: Matched i2c_spec_values. */ static const struct i2c_spec_values *rk3x_i2c_get_spec (unsigned int speed) {
@@ -551,13 +553,12 @@ static const struct i2c_spec_values *rk3x_i2c_get_spec(unsigned int speed) }/** -* Calculate divider values for desired SCL frequency -* +* rk3x_i2c_v0_calc_timings - Calculate divider values for desired SCL frequency * @clk_rate: I2C input clock rate * @t: Known I2C timing information * @t_calc: Caculated rk3x private timings that would be written into regs * -* Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case +* Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case * a best-effort divider value is returned in divs. If the target rate is * too high, we silently use the highest possible rate. */
@@ -712,13 +713,12 @@ static int rk3x_i2c_v0_calc_timings(unsigned long clk_rate, }/** -* Calculate timing values for desired SCL frequency -* +* rk3x_i2c_v1_calc_timings - Calculate timing values for desired SCL frequency * @clk_rate: I2C input clock rate * @t: Known I2C timing information * @t_calc: Caculated rk3x private timings that would be written into regs * -* Returns: 0 on success, -EINVAL if the goal SCL rate is too slow. In that case +* Return: %0 on success, -%EINVAL if the goal SCL rate is too slow. In that case * a best-effort divider value is returned in divs. If the target rate is * too high, we silently use the highest possible rate. * The following formulas are v1's method to calculate timings.
@@ -962,14 +962,14 @@ static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long }/** -* Setup I2C registers for an I2C operation specified by msgs, num. -* -* Must be called with i2c->lock held. -* +* rk3x_i2c_setup - Setup I2C registers for an I2C operation specified by msgs, num. +* @i2c: target controller data * @msgs: I2C msgs to process * @num: Number of msgs * -* returns: Number of I2C msgs processed or negative in case of error +* Must be called with i2c->lock held. +* +* Return: Number of I2C msgs processed or negative in case of error */ static int rk3x_i2c_setup (struct rk3x_i2c *i2c,struct i2c_msg *msgs,int num) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 11/89 net/x25: Fix to not accept on connected socket
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
[ Upstream commit f2b0b5210f67c56a3bcdf92ff665fb285d6e0067 ]
When listen() and accept() are called on an x25 socket that connect() succeeds, accept() succeeds immediately. This is because x25_connect() queues the skb to sk->sk_receive_queue, and x25_accept() dequeues it.
This creates a child socket with the sk of the parent x25 socket, which can cause confusion.
Fix x25_listen() to return -EINVAL if the socket has already been successfully connect()ed to avoid this issue.
--- net/x25/af_x25.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/x25/af_x25.c +6 -0
@@ -497,6 +497,12 @@ static int x25_listen(struct socket *sock, int backlog)int rc = -EOPNOTSUPP ;lock_sock (sk); +if (sock->state !=SS_UNCONNECTED ) { + rc = -EINVAL ; +release_sock (sk); +return rc; + } +if (sk->sk_state !=TCP_LISTEN ) {memset (&x25_sk (sk)->dest_addr,0 ,X25_ADDR_LEN ); sk->sk_max_ack_backlog = backlog;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 12/89 iio: adc: stm32-dfsdm: fill module aliases
In reply to Greg Kroah-HartmanFrom: Olivier Moysan <[email protected]>
[ Upstream commit cc3304052a89ab6ac887ed9224420a27e3d354e1 ]
When STM32 DFSDM driver is built as module, no modalias information is available. This prevents module to be loaded by udev. Add MODULE_DEVICE_TABLE() to fill module aliases.
--- drivers/iio/adc/stm32-dfsdm-adc.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/adc/stm32-dfsdm-adc.c +1 -0
@@ -1099,6 +1099,7 @@ static const struct of_device_id stm32_dfsdm_adc_match[] = { }, {} }; +MODULE_DEVICE_TABLE (of, stm32_dfsdm_adc_match);static int stm32_dfsdm_adc_probe (struct platform_device *pdev) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 13/89 usb: dwc3: dwc3-qcom: Fix typo in the dwc3 vbus override API
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
[ Upstream commit 8e6cb5d27e8246d9c986ec162d066a502d2b602b ]
There was an extra character in the dwc3_qcom_vbus_override_enable() function. Removed the extra character.
Stable-dep-of: eb320f76e31d ("usb: dwc3: qcom: enable vbus override when in OTG dr-mode")
--- drivers/usb/dwc3/dwc3-qcom.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/dwc3/dwc3-qcom.c +4 -4
@@ -85,7 +85,7 @@ static inline void dwc3_qcom_clrbits(void __iomem *base, u32 offset, u32 val)readl (base + offset); } -static void dwc3_qcom_vbus_overrride_enable (struct dwc3_qcom *qcom,bool enable) +static void dwc3_qcom_vbus_override_enable (struct dwc3_qcom *qcom,bool enable) {if (enable) { dwc3_qcom_setbits(qcom->qscratch_base, QSCRATCH_SS_PHY_CTRL,
@@ -106,7 +106,7 @@ static int dwc3_qcom_vbus_notifier(struct notifier_block *nb, struct dwc3_qcom *qcom = container_of(nb, struct dwc3_qcom, vbus_nb);/* enable vbus override for device mode */ -dwc3_qcom_vbus_overrride_enable (qcom, event); +dwc3_qcom_vbus_override_enable (qcom, event); qcom->mode = event ?USB_DR_MODE_PERIPHERAL :USB_DR_MODE_HOST ;return NOTIFY_DONE ;
@@ -118,7 +118,7 @@ static int dwc3_qcom_host_notifier(struct notifier_block *nb, struct dwc3_qcom *qcom = container_of(nb, struct dwc3_qcom, host_nb);/* disable vbus override in host mode */ -dwc3_qcom_vbus_overrride_enable (qcom, !event); +dwc3_qcom_vbus_override_enable (qcom, !event); qcom->mode = event ?USB_DR_MODE_HOST :USB_DR_MODE_PERIPHERAL ;return NOTIFY_DONE ;
@@ -513,7 +513,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev)/* enable vbus override for device mode */ if (qcom->mode ==USB_DR_MODE_PERIPHERAL ) -dwc3_qcom_vbus_overrride_enable (qcom, true); +dwc3_qcom_vbus_override_enable (qcom, true);/* register extcon to override sw_vbus on Vbus change later */ ret =dwc3_qcom_register_extcon (qcom);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 14/89 usb: dwc3: qcom: enable vbus override when in OTG dr-mode
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit eb320f76e31dc835b9f57f04af1a2353b13bb7d8 ]
With vbus override enabled when in OTG dr_mode, Host<->Peripheral switch now works on SM8550, otherwise the DWC3 seems to be stuck in Host mode only.
--- drivers/usb/dwc3/dwc3-qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-qcom.c +1 -1
@@ -512,7 +512,7 @@ static int dwc3_qcom_probe(struct platform_device *pdev) qcom->mode =usb_get_dr_mode (&qcom->dwc3->dev);/* enable vbus override for device mode */ -if (qcom->mode ==USB_DR_MODE_PERIPHERAL ) +if (qcom->mode !=USB_DR_MODE_HOST )dwc3_qcom_vbus_override_enable (qcom, true);/* register extcon to override sw_vbus on Vbus change later */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 15/89 usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait
In reply to Greg Kroah-HartmanFrom: Udipto Goswami <[email protected]>
[ Upstream commit 921deb9da15851425ccbb6ee409dc2fd8fbdfe6b ]
__ffs_ep0_queue_wait executes holding the spinlock of &ffs->ev.waitq.lock and unlocks it after the assignments to usb_request are done. However in the code if the request is already NULL we bail out returning -EINVAL but never unlocked the spinlock.
Fix this by adding spin_unlock_irq &ffs->ev.waitq.lock before returning.
--- drivers/usb/gadget/function/f_fs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +3 -1
@@ -271,8 +271,10 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)struct usb_request *req = ffs->ep0req;int ret; -if (!req) +if (!req) { +spin_unlock_irq (&ffs->ev.waitq.lock);return -EINVAL ; + } req->zero = len <le16_to_cpu (ffs->ev.setup.wLength);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 16/89 vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
In reply to Greg Kroah-HartmanFrom: George Kennedy <[email protected]>
[ Upstream commit 226fae124b2dac217ea5436060d623ff3385bc34 ]
After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, the struct vc_data pointer load must be done at the top of while loop in vcs_read() to avoid a UAF when vcs_size() is called.
Syzkaller reported a UAF in vcs_size().
BUG: KASAN: use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8881137479a8 by task 4a005ed81e27e65/1537 CPU: 0 PID: 1537 Comm: 4a005ed81e27e65 Not tainted 6.2.0-rc5 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module Call Trace: <TASK>
__asan_report_load4_noabort (mm/kasan/report_generic.c:350) vcs_size (drivers/tty/vt/vc_screen.c:215)vcs_read (drivers/tty/vt/vc_screen.c:415)vfs_read (fs/read_write.c:468 fs/read_write.c:450)
...
</TASK>
Allocated by task 1191:
...
kmalloc_trace (mm/slab_common.c:1069)
vc_allocate (./include/linux/slab.h:580 ./include/linux/slab.h:720
drivers/tty/vt/vt.c:1128 drivers/tty/vt/vt.c:1108)
con_install (drivers/tty/vt/vt.c:3383)
tty_init_dev (drivers/tty/tty_io.c:1301 drivers/tty/tty_io.c:1413
drivers/tty/tty_io.c:1390)
tty_open (drivers/tty/tty_io.c:2080 drivers/tty/tty_io.c:2126)chrdev_open (fs/char_dev.c:415)do_dentry_open (fs/open.c:883)vfs_open (fs/open.c:1014)
...
Freed by task 1548:
...
kfree (mm/slab_common.c:1021)vc_port_destruct (drivers/tty/vt/vt.c:1094) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903)tty_ioctl (drivers/tty/tty_io.c:2776)
...
The buggy address belongs to the object at ffff888113747800 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 424 bytes inside of
1024-byte region [ffff888113747800, ffff888113747c00)
The buggy address belongs to the physical page:
page:00000000b3fe6c7c refcount:1 mapcount:0 mapping:0000000000000000
index:0x0 pfn:0x113740
head:00000000b3fe6c7c order:3 compound_mapcount:0 subpages_mapcount:0
compound_pincount:0
anon flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
raw: 0017ffffc0010200 ffff888100042dc0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888113747880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888113747900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fbQuoted 1 line
ffff888113747980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888113747a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888113747a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Disabling lock debugging due to kernel taint
--- drivers/tty/vt/vc_screen.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/tty/vt/vc_screen.c +5 -4
@@ -247,10 +247,6 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) uni_mode =use_unicode (inode); attr =use_attributes (inode); - ret = -ENXIO ; - vc =vcs_vc (inode, &viewed); -if (!vc) - goto unlock_out; ret = -EINVAL ;if (pos <0 )
@@ -270,6 +266,11 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)ssize_t orig_count;long p = pos; + ret = -ENXIO ; + vc =vcs_vc (inode, &viewed); +if (!vc) + goto unlock_out; +/* Check whether we are above size each round, * as copy_to_user at the end of this loop * could sleep.
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 17/89 Input: i8042 - move __initconst to fix code styling warning
In reply to Greg Kroah-HartmanFrom: Werner Sembach <[email protected]>
[ Upstream commit 95a9916c909f0b1d95e24b4232b4bc38ff755415 ]
Move __intconst from before i8042_dmi_laptop_table[] to after it for consistent code styling.
Stable-dep-of: 9c445d2637c9 ("Input: i8042 - add Clevo PCX0DX to i8042 quirk table")
--- drivers/input/serio/i8042-x86ia64io.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/serio/i8042-x86ia64io.h +1 -1
@@ -795,7 +795,7 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = { { } }; -static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = { +static const struct dmi_system_id i8042_dmi_laptop_table[]__initconst = { { .matches = {DMI_MATCH (DMI_CHASSIS_TYPE ,"8" ),/* Portable */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 18/89 Input: i8042 - merge quirk tables
In reply to Greg Kroah-HartmanFrom: Werner Sembach <[email protected]>
[ Upstream commit ff946268a0813c35b790dfbe07c3bfaa7bfb869c ]
Merge i8042 quirk tables to reduce code duplication for devices that need more than one quirk. Before every quirk had its own table with devices needing that quirk. If a new quirk needed to be added a new table had to be created. When a device needed multiple quirks, it appeared in multiple tables. Now only one table called i8042_dmi_quirk_table exists. In it every device has one entry and required quirks are coded in the .driver_data field of the struct dmi_system_id used by this table. Multiple quirks for one device can be applied by bitwise-or of the new SERIO_QUIRK_* defines.
Also align quirkable options with command line parameters and make vendor wide quirks per device overwriteable on a per device basis. The first match is honored while following matches are ignored. So when a vendor wide quirk is defined in the table, a device can inserted before and therefore ignoring the vendor wide define.
Stable-dep-of: 9c445d2637c9 ("Input: i8042 - add Clevo PCX0DX to i8042 quirk table")
--- drivers/input/serio/i8042-x86ia64io.h | 1100 +++++++++++++------------ 1 file changed, 595 insertions(+), 505 deletions(-)
drivers/input/serio/i8042-x86ia64io.h +595 -505
@@ -71,654 +71,735 @@ static inline void i8042_write_command(int val)#include <linux/dmi.h> -static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { +#define SERIO_QUIRK_NOKBD BIT(0) +#define SERIO_QUIRK_NOAUX BIT(1) +#define SERIO_QUIRK_NOMUX BIT(2) +#define SERIO_QUIRK_FORCEMUX BIT(3) +#define SERIO_QUIRK_UNLOCK BIT(4) +#define SERIO_QUIRK_PROBE_DEFER BIT(5) +#define SERIO_QUIRK_RESET_ALWAYS BIT(6) +#define SERIO_QUIRK_RESET_NEVER BIT(7) +#define SERIO_QUIRK_DIECT BIT(8) +#define SERIO_QUIRK_DUMBKBD BIT(9) +#define SERIO_QUIRK_NOLOOP BIT(10) +#define SERIO_QUIRK_NOTIMEOUT BIT(11) +#define SERIO_QUIRK_KBDRESET BIT(12) +#define SERIO_QUIRK_DRITEK BIT(13) +#define SERIO_QUIRK_NOPNP BIT(14) + +/* Quirk table for different mainboards. Options similar or identical to i8042 +* module parameters. +* ORDERING IS IMPORTANT! The first match will be apllied and the rest ignored. +* This allows entries to overwrite vendor wide quirks on a per device basis. +* Where this is irrelevant, entries are sorted case sensitive by DMI_SYS_VENDOR +* and/or DMI_BOARD_VENDOR to make it easier to avoid dublicate entries. +*/ +static const struct dmi_system_id i8042_dmi_quirk_table[]__initconst = { { -/* -* Arima-Rioworks HDAMB - -* AUX LOOP command does not raise AUX IRQ -*/ .matches = { -DMI_MATCH (DMI_BOARD_VENDOR ,"RIOWORKS" ), -DMI_MATCH (DMI_BOARD_NAME ,"HDAMB" ), -DMI_MATCH (DMI_BOARD_VERSION ,"Rev E" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ALIENWARE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Sentia" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* ASUS G1S */ .matches = { -DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK Computer Inc." ), -DMI_MATCH (DMI_BOARD_NAME ,"G1S" ), -DMI_MATCH (DMI_BOARD_VERSION ,"1.0" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"X750LN" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* ASUS P65UP5 - AUX LOOP command does not raise AUX IRQ */ +/* Asus X450LCP */ .matches = { -DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK Computer INC." ), -DMI_MATCH (DMI_BOARD_NAME ,"P/I-P65UP5" ), -DMI_MATCH (DMI_BOARD_VERSION ,"REV 2.X" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"X450LCP" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_NEVER ) }, { +/* ASUS ZenBook UX425UA */ .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"X750LN" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"ZenBook UX425UA" ), }, + .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER |SERIO_QUIRK_RESET_NEVER ) }, { +/* ASUS ZenBook UM325UA */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Compaq" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"ProLiant" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"8500" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"ZenBook UX325UA_UM325UA" ), }, + .driver_data = (void *)(SERIO_QUIRK_PROBE_DEFER |SERIO_QUIRK_RESET_NEVER ) }, +/* +* On some Asus laptops, just running self tests cause problems. +*/ { .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Compaq" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"ProLiant" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"DL760" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_CHASSIS_TYPE ,"10" ),/* Notebook */ }, + .driver_data = (void *)(SERIO_QUIRK_RESET_NEVER ) }, { -/* Dell Embedded Box PC 3000 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Embedded Box PC 3000" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), +DMI_MATCH (DMI_CHASSIS_TYPE ,"31" ),/* Convertible Notebook */ }, + .driver_data = (void *)(SERIO_QUIRK_RESET_NEVER ) }, { -/* OQO Model 01 */ +/* ASUS P65UP5 - AUX LOOP command does not raise AUX IRQ */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"OQO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"ZEPTO" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"00" ), +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK Computer INC." ), +DMI_MATCH (DMI_BOARD_NAME ,"P/I-P65UP5" ), +DMI_MATCH (DMI_BOARD_VERSION ,"REV 2.X" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* ULI EV4873 - AUX LOOP does not work properly */ +/* ASUS G1S */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ULI" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"EV4873" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"5a" ), +DMI_MATCH (DMI_BOARD_VENDOR ,"ASUSTeK Computer Inc." ), +DMI_MATCH (DMI_BOARD_NAME ,"G1S" ), +DMI_MATCH (DMI_BOARD_VERSION ,"1.0" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Microsoft Virtual Machine */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Microsoft Corporation" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Virtual Machine" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"VS2005R2" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 1360" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Medion MAM 2070 */ +/* Acer Aspire 5710 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"MAM 2070" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"5a" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5710" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Medion Akoya E7225 */ +/* Acer Aspire 7738 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Medion" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Akoya E7225" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"1.0" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 7738" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Blue FB5601 */ +/* Acer Aspire 5536 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"blue" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"FB5601" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"M606" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5536" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"0100" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Gigabyte M912 */ +/* +* Acer Aspire 5738z +* Touchpad stops working in mux mode when dis- + re-enabled +* with the touchpad enable/disable toggle hotkey +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"M912" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"01" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5738" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Gigabyte M1022M netbook */ +/* Acer Aspire One 150 */ .matches = { -DMI_MATCH (DMI_BOARD_VENDOR ,"Gigabyte Technology Co.,Ltd." ), -DMI_MATCH (DMI_BOARD_NAME ,"M1022E" ), -DMI_MATCH (DMI_BOARD_VERSION ,"1.02" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"AOA150" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* Gigabyte Spring Peak - defines wrong chassis type */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Spring Peak" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire A114-31" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* Gigabyte T1005 - defines wrong chassis type ("Other") */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"T1005" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire A314-31" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* Gigabyte T1005M/P - defines wrong chassis type ("Other") */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"T1005M/P" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire A315-31" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion dv9700" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"Rev 1" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire ES1-132" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"PEGATRON CORPORATION" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"C15B" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire ES1-332" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ByteSpeed LLC" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"ByteSpeed Laptop C15B" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire ES1-432" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, - { } -}; - -/* -* Some Fujitsu notebooks are having trouble with touchpads if -* active multiplexing mode is activated. Luckily they don't have -* external PS/2 ports so we can safely disable it. -* ... apparently some Toshibas don't like MUX mode either and -* die horrible death on reboot. -*/ -static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { { -/* Fujitsu Lifebook P7010/P7010D */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"P7010" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate Spin B118-RN" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, +/* +* Some Wistron based laptops need us to explicitly enable the 'Dritek +* keyboard extension' to make their extra keys start generating scancodes. +* Originally, this was just confined to older laptops, but a few Acer laptops +* have turned up in 2007 that also need this again. +*/ { -/* Fujitsu Lifebook P7010 */ +/* Acer Aspire 5100 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"0000000000" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5100" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu Lifebook P5020D */ +/* Acer Aspire 5610 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LifeBook P Series" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5610" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu Lifebook S2000 */ +/* Acer Aspire 5630 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LifeBook S Series" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5630" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu Lifebook S6230 */ +/* Acer Aspire 5650 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LifeBook S6230" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5650" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu Lifebook T725 laptop */ +/* Acer Aspire 5680 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK T725" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5680" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu Lifebook U745 */ +/* Acer Aspire 5720 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK U745" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5720" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu T70H */ +/* Acer Aspire 9110 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"FMVLT70H" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 9110" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu-Siemens Lifebook T3010 */ +/* Acer TravelMate 660 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK T3010" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate 660" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu-Siemens Lifebook E4010 */ +/* Acer TravelMate 2490 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK E4010" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate 2490" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu-Siemens Amilo Pro 2010 */ +/* Acer TravelMate 4280 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"AMILO Pro V2010" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate 4280" ), }, + .driver_data = (void *)(SERIO_QUIRK_DRITEK ) }, { -/* Fujitsu-Siemens Amilo Pro 2030 */ +/* Amoi M636/A737 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"AMILO PRO V2030" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Amoi Electronics CO.,LTD." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"M636/A737 platform" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* -* No data is coming from the touchscreen unless KBC -* is in legacy mode. -*/ -/* Panasonic CF-29 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Matsushita" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"CF-29" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ByteSpeed LLC" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"ByteSpeed Laptop C15B" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* -* HP Pavilion DV4017EA - -* errors on MUX ports are reported without raising AUXDATA -* causing "spurious NAK" messages. -*/ +/* Compal HEL80I */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Pavilion dv4000 (EA032EA#ABF)" ), +DMI_MATCH (DMI_SYS_VENDOR ,"COMPAL" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"HEL80I" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* -* HP Pavilion ZT1000 - -* like DV4017EA does not raise AUXERR for errors on MUX ports. -*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion Notebook PC" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"HP Pavilion Notebook ZT1000" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Compaq" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"ProLiant" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"8500" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* -* HP Pavilion DV4270ca - -* like DV4017EA does not raise AUXERR for errors on MUX ports. -*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Pavilion dv4000 (EH476UA#ABL)" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Compaq" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"ProLiant" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"DL760" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { +/* Advent 4211 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Satellite P10" ), +DMI_MATCH (DMI_SYS_VENDOR ,"DIXONSXP" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Advent 4211" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { +/* Dell Embedded Box PC 3000 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"EQUIUM A110" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Embedded Box PC 3000" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { +/* Dell XPS M1530 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"SATELLITE C850D" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"XPS M1530" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { +/* Dell Vostro 1510 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ALIENWARE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Sentia" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro1510" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Sharp Actius MM20 */ +/* Dell Vostro V13 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"SHARP" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"PC-MM20 Series" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro V13" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_NOTIMEOUT ) }, { -/* Sony Vaio FS-115b */ +/* Dell Vostro 1320 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"VGN-FS115B" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro 1320" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* -* Sony Vaio FZ-240E - -* reset and GET ID commands issued via KBD port are -* sometimes being delivered to AUX3. -*/ +/* Dell Vostro 1520 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"VGN-FZ240E" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro 1520" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* -* Most (all?) VAIOs do not have external PS/2 ports nor -* they implement active multiplexing properly, and -* MUX discovery usually messes up keyboard/touchpad. -*/ +/* Dell Vostro 1720 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), -DMI_MATCH (DMI_BOARD_NAME ,"VAIO" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro 1720" ), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* Amoi M636/A737 */ +/* Entroware Proteus */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Amoi Electronics CO.,LTD." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"M636/A737 platform" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Entroware" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Proteus" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"EL07R4" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS ) }, +/* +* Some Fujitsu notebooks are having trouble with touchpads if +* active multiplexing mode is activated. Luckily they don't have +* external PS/2 ports so we can safely disable it. +* ... apparently some Toshibas don't like MUX mode either and +* die horrible death on reboot. +*/ { -/* Lenovo 3000 n100 */ +/* Fujitsu Lifebook P7010/P7010D */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"076804U" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"P7010" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Lenovo XiaoXin Air 12 */ +/* Fujitsu Lifebook P5020D */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"80UN" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LifeBook P Series" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { +/* Fujitsu Lifebook S2000 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 1360" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LifeBook S Series" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer Aspire 5710 */ +/* Fujitsu Lifebook S6230 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5710" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LifeBook S6230" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer Aspire 7738 */ +/* Fujitsu Lifebook T725 laptop */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 7738" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK T725" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_NOTIMEOUT ) }, { -/* Gericom Bellagio */ +/* Fujitsu Lifebook U745 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Gericom" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"N34AS6" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK U745" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* IBM 2656 */ +/* Fujitsu T70H */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"IBM" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"2656" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"FMVLT70H" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Dell XPS M1530 */ +/* Fujitsu A544 laptop */ +/* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"XPS M1530" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK A544" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT ) }, { -/* Compal HEL80I */ +/* Fujitsu AH544 laptop */ +/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"COMPAL" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"HEL80I" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK AH544" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT ) }, { -/* Dell Vostro 1510 */ +/* Fujitsu U574 laptop */ +/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro1510" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK U574" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT ) }, { -/* Acer Aspire 5536 */ +/* Fujitsu UH554 laptop */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5536" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"0100" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK UH544" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOTIMEOUT ) }, { -/* Dell Vostro V13 */ +/* Fujitsu Lifebook P7010 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro V13" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"0000000000" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Newer HP Pavilion dv4 models */ +/* Fujitsu-Siemens Lifebook T3010 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion dv4 Notebook PC" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK T3010" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Asus X450LCP */ +/* Fujitsu-Siemens Lifebook E4010 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"X450LCP" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK E4010" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Avatar AVIU-145A6 */ +/* Fujitsu-Siemens Amilo Pro 2010 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Intel" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"IC4I" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"AMILO Pro V2010" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* TUXEDO BU1406 */ +/* Fujitsu-Siemens Amilo Pro 2030 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"N24_25BU" ), +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU SIEMENS" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"AMILO PRO V2030" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Lenovo LaVie Z */ +/* Gigabyte M912 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"Lenovo LaVie Z" ), +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"M912" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"01" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* -* Acer Aspire 5738z -* Touchpad stops working in mux mode when dis- + re-enabled -* with the touchpad enable/disable toggle hotkey -*/ +/* Gigabyte Spring Peak - defines wrong chassis type */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5738" ), +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Spring Peak" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Entroware Proteus */ +/* Gigabyte T1005 - defines wrong chassis type ("Other") */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Entroware" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Proteus" ), -DMI_MATCH (DMI_PRODUCT_VERSION ,"EL07R4" ), +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"T1005" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, - { } -}; - -static const struct dmi_system_id i8042_dmi_forcemux_table[]__initconst = { { -/* -* Sony Vaio VGN-CS series require MUX or the touch sensor -* buttons will disturb touchpad operation -*/ +/* Gigabyte T1005M/P - defines wrong chassis type ("Other") */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"VGN-CS" ), +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"T1005M/P" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, - { } -}; - -/* -* On some Asus laptops, just running self tests cause problems. -*/ -static const struct dmi_system_id i8042_dmi_noselftest_table[] = { +/* +* Some laptops need keyboard reset before probing for the trackpad to get +* it detected, initialised & finally work. +*/ { +/* Gigabyte P35 v2 - Elantech touchpad */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), -DMI_MATCH (DMI_CHASSIS_TYPE ,"10" ),/* Notebook */ - }, - }, { - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), -DMI_MATCH (DMI_CHASSIS_TYPE ,"31" ),/* Convertible Notebook */ +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"P35V2" ), }, + .driver_data = (void *)(SERIO_QUIRK_KBDRESET ) }, - { } -}; -static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { - { -/* MSI Wind U-100 */ + { +/* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ .matches = { -DMI_MATCH (DMI_BOARD_NAME ,"U-100" ), -DMI_MATCH (DMI_BOARD_VENDOR ,"MICRO-STAR INTERNATIONAL CO., LTD" ), +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"X3" ), }, + .driver_data = (void *)(SERIO_QUIRK_KBDRESET ) }, { -/* LG Electronics X110 */ +/* Gigabyte P34 - Elantech touchpad */ .matches = { -DMI_MATCH (DMI_BOARD_NAME ,"X110" ), -DMI_MATCH (DMI_BOARD_VENDOR ,"LG Electronics Inc." ), +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"P34" ), }, + .driver_data = (void *)(SERIO_QUIRK_KBDRESET ) }, { -/* Acer Aspire One 150 */ +/* Gigabyte P57 - Elantech touchpad */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"AOA150" ), +DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"P57" ), }, + .driver_data = (void *)(SERIO_QUIRK_KBDRESET ) }, { +/* Gericom Bellagio */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire A114-31" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Gericom" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"N34AS6" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { +/* Gigabyte M1022M netbook */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire A314-31" ), +DMI_MATCH (DMI_BOARD_VENDOR ,"Gigabyte Technology Co.,Ltd." ), +DMI_MATCH (DMI_BOARD_NAME ,"M1022E" ), +DMI_MATCH (DMI_BOARD_VERSION ,"1.02" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire A315-31" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion dv9700" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"Rev 1" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { +/* +* HP Pavilion DV4017EA - +* errors on MUX ports are reported without raising AUXDATA +* causing "spurious NAK" messages. +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire ES1-132" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Pavilion dv4000 (EA032EA#ABF)" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { +/* +* HP Pavilion ZT1000 - +* like DV4017EA does not raise AUXERR for errors on MUX ports. +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire ES1-332" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion Notebook PC" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"HP Pavilion Notebook ZT1000" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { +/* +* HP Pavilion DV4270ca - +* like DV4017EA does not raise AUXERR for errors on MUX ports. +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire ES1-432" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Pavilion dv4000 (EH476UA#ABL)" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { +/* Newer HP Pavilion dv4 models */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate Spin B118-RN" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion dv4 Notebook PC" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_NOTIMEOUT ) }, { -/* Advent 4211 */ +/* IBM 2656 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"DIXONSXP" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Advent 4211" ), +DMI_MATCH (DMI_SYS_VENDOR ,"IBM" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"2656" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Medion Akoya Mini E1210 */ +/* Avatar AVIU-145A6 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"MEDION" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"E1210" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Intel" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"IC4I" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Medion Akoya E1222 */ +/* Intel MBO Desktop D845PESV */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"MEDION" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"E122X" ), +DMI_MATCH (DMI_BOARD_VENDOR ,"Intel Corporation" ), +DMI_MATCH (DMI_BOARD_NAME ,"D845PESV" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOPNP ) }, { -/* Mivvy M310 */ +/* +* Intel NUC D54250WYK - does not have i8042 controller but +* declares PS/2 devices in DSDT. +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"VIOOO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"N10" ), +DMI_MATCH (DMI_BOARD_VENDOR ,"Intel Corporation" ), +DMI_MATCH (DMI_BOARD_NAME ,"D54250WYK" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOPNP ) }, { -/* Dell Vostro 1320 */ +/* Lenovo 3000 n100 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro 1320" ), +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"076804U" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Dell Vostro 1520 */ +/* Lenovo XiaoXin Air 12 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro 1520" ), +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"80UN" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Dell Vostro 1720 */ +/* Lenovo LaVie Z */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro 1720" ), +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"Lenovo LaVie Z" ), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, {/* Lenovo Ideapad U455 */
@@ -726,6 +807,7 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), DMI_MATCH(DMI_PRODUCT_NAME, "20046"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, {/* Lenovo ThinkPad L460 */
@@ -733,13 +815,7 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"), }, - }, - { -/* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), - DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"), - }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, {/* Lenovo ThinkPad Twist S230u */
@@ -747,275 +823,269 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* Entroware Proteus */ +/* LG Electronics X110 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Entroware" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Proteus" ), - DMI_MATCH(DMI_PRODUCT_VERSION, "EL07R4"), +DMI_MATCH (DMI_BOARD_VENDOR ,"LG Electronics Inc." ), + DMI_MATCH(DMI_BOARD_NAME, "X110"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, - { } -}; - -#ifdef CONFIG_PNP -static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = { { -/* Intel MBO Desktop D845PESV */ +/* Medion Akoya Mini E1210 */ .matches = { -DMI_MATCH (DMI_BOARD_NAME ,"D845PESV" ), -DMI_MATCH (DMI_BOARD_VENDOR ,"Intel Corporation" ), +DMI_MATCH (DMI_SYS_VENDOR ,"MEDION" ), + DMI_MATCH(DMI_PRODUCT_NAME, "E1210"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* -* Intel NUC D54250WYK - does not have i8042 controller but -* declares PS/2 devices in DSDT. -*/ +/* Medion Akoya E1222 */ .matches = { -DMI_MATCH (DMI_BOARD_NAME ,"D54250WYK" ), -DMI_MATCH (DMI_BOARD_VENDOR ,"Intel Corporation" ), +DMI_MATCH (DMI_SYS_VENDOR ,"MEDION" ), + DMI_MATCH(DMI_PRODUCT_NAME, "E122X"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, {/* MSI Wind U-100 */ .matches = { -DMI_MATCH (DMI_BOARD_NAME ,"U-100" ), -DMI_MATCH (DMI_BOARD_VENDOR ,"MICRO-STAR INTERNATIONAL CO., LTD" ), - }, - }, - { -/* Acer Aspire 5 A515 */ - .matches = { -DMI_MATCH (DMI_BOARD_NAME ,"Grumpy_PK" ), -DMI_MATCH (DMI_BOARD_VENDOR ,"PK" ), - }, - }, - { } -}; - -static const struct dmi_system_id i8042_dmi_laptop_table[]__initconst = { - { - .matches = { -DMI_MATCH (DMI_CHASSIS_TYPE ,"8" ),/* Portable */ - }, - }, - { - .matches = { -DMI_MATCH (DMI_CHASSIS_TYPE ,"9" ),/* Laptop */ +DMI_MATCH (DMI_BOARD_VENDOR ,"MICRO-STAR INTERNATIONAL CO., LTD" ), + DMI_MATCH(DMI_BOARD_NAME, "U-100"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS |SERIO_QUIRK_NOPNP ) }, { +/* +* No data is coming from the touchscreen unless KBC +* is in legacy mode. +*/ +/* Panasonic CF-29 */ .matches = { -DMI_MATCH (DMI_CHASSIS_TYPE ,"10" ),/* Notebook */ +DMI_MATCH (DMI_SYS_VENDOR ,"Matsushita" ), + DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { +/* Medion Akoya E7225 */ .matches = { -DMI_MATCH (DMI_CHASSIS_TYPE ,"14" ),/* Sub-Notebook */ +DMI_MATCH (DMI_SYS_VENDOR ,"Medion" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Akoya E7225" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "1.0"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, - { } -}; -#endif - -static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { { -/* Dell Vostro V13 */ +/* Microsoft Virtual Machine */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Vostro V13" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Microsoft Corporation" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Virtual Machine" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "VS2005R2"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Newer HP Pavilion dv4 models */ +/* Medion MAM 2070 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"HP Pavilion dv4 Notebook PC" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"MAM 2070" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "5a"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Fujitsu A544 laptop */ -/* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */ +/* TUXEDO BU1406 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK A544" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), + DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Fujitsu AH544 laptop */ -/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ +/* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK AH544" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), + DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, { -/* Fujitsu Lifebook T725 laptop */ +/* OQO Model 01 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK T725" ), +DMI_MATCH (DMI_SYS_VENDOR ,"OQO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"ZEPTO" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "00"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Fujitsu U574 laptop */ -/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK U574" ), +DMI_MATCH (DMI_SYS_VENDOR ,"PEGATRON CORPORATION" ), + DMI_MATCH(DMI_PRODUCT_NAME, "C15B"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Fujitsu UH554 laptop */ +/* Acer Aspire 5 A515 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"LIFEBOOK UH544" ), +DMI_MATCH (DMI_BOARD_VENDOR ,"PK" ), + DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"), }, + .driver_data = (void *)(SERIO_QUIRK_NOPNP ) }, - { } -}; - -/* -* Some Wistron based laptops need us to explicitly enable the 'Dritek -* keyboard extension' to make their extra keys start generating scancodes. -* Originally, this was just confined to older laptops, but a few Acer laptops -* have turned up in 2007 that also need this again. -*/ -static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = { { -/* Acer Aspire 5100 */ +/* ULI EV4873 - AUX LOOP does not work properly */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5100" ), +DMI_MATCH (DMI_SYS_VENDOR ,"ULI" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"EV4873" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "5a"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Acer Aspire 5610 */ +/* +* Arima-Rioworks HDAMB - +* AUX LOOP command does not raise AUX IRQ +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5610" ), +DMI_MATCH (DMI_BOARD_VENDOR ,"RIOWORKS" ), +DMI_MATCH (DMI_BOARD_NAME ,"HDAMB" ), + DMI_MATCH(DMI_BOARD_VERSION, "Rev E"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, { -/* Acer Aspire 5630 */ +/* Sharp Actius MM20 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5630" ), +DMI_MATCH (DMI_SYS_VENDOR ,"SHARP" ), + DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer Aspire 5650 */ +/* +* Sony Vaio FZ-240E - +* reset and GET ID commands issued via KBD port are +* sometimes being delivered to AUX3. +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5650" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), + DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ240E"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer Aspire 5680 */ +/* +* Most (all?) VAIOs do not have external PS/2 ports nor +* they implement active multiplexing properly, and +* MUX discovery usually messes up keyboard/touchpad. +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5680" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), + DMI_MATCH(DMI_BOARD_NAME, "VAIO"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer Aspire 5720 */ +/* Sony Vaio FS-115b */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 5720" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), + DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer Aspire 9110 */ +/* +* Sony Vaio VGN-CS series require MUX or the touch sensor +* buttons will disturb touchpad operation +*/ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"Aspire 9110" ), +DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), + DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"), }, + .driver_data = (void *)(SERIO_QUIRK_FORCEMUX ) }, { -/* Acer TravelMate 660 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate 660" ), +DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P10"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer TravelMate 2490 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate 2490" ), +DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), + DMI_MATCH(DMI_PRODUCT_NAME, "EQUIUM A110"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, { -/* Acer TravelMate 4280 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"TravelMate 4280" ), +DMI_MATCH (DMI_SYS_VENDOR ,"TOSHIBA" ), + DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"), }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) }, - { } -}; - -/* -* Some laptops need keyboard reset before probing for the trackpad to get -* it detected, initialised & finally work. -*/ -static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { { -/* Gigabyte P35 v2 - Elantech touchpad */ +/* Mivvy M310 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"P35V2" ), +DMI_MATCH (DMI_SYS_VENDOR ,"VIOOO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "N10"), }, + .driver_data = (void *)(SERIO_QUIRK_RESET_ALWAYS ) }, - { -/* Aorus branded Gigabyte X3 Plus - Elantech touchpad */ + /* + * Some laptops need keyboard reset before probing for the trackpad to get + * it detected, initialised & finally work. + */ + { +/* Schenker XMG C504 - Elantech touchpad */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"X3" ), +DMI_MATCH (DMI_SYS_VENDOR ,"XMG" ), + DMI_MATCH(DMI_PRODUCT_NAME, "C504"), }, + .driver_data = (void *)(SERIO_QUIRK_KBDRESET ) }, { -/* Gigabyte P34 - Elantech touchpad */ +/* Blue FB5601 */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"P34" ), +DMI_MATCH (DMI_SYS_VENDOR ,"blue" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"FB5601" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "M606"), }, + .driver_data = (void *)(SERIO_QUIRK_NOLOOP ) }, + { } +}; + +#ifdef CONFIG_PNP +static const struct dmi_system_id i8042_dmi_laptop_table[]__initconst = { { -/* Gigabyte P57 - Elantech touchpad */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"GIGABYTE" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"P57" ), +DMI_MATCH (DMI_CHASSIS_TYPE ,"8" ),/* Portable */ }, }, { -/* Schenker XMG C504 - Elantech touchpad */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"XMG" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"C504" ), +DMI_MATCH (DMI_CHASSIS_TYPE ,"9" ),/* Laptop */ }, }, - { } -}; - -static const struct dmi_system_id i8042_dmi_probe_defer_table[]__initconst = { { -/* ASUS ZenBook UX425UA */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"ZenBook UX425UA" ), +DMI_MATCH (DMI_CHASSIS_TYPE ,"10" ),/* Notebook */ }, }, { -/* ASUS ZenBook UM325UA */ .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"ASUSTeK COMPUTER INC." ), -DMI_MATCH (DMI_PRODUCT_NAME ,"ZenBook UX325UA_UM325UA" ), +DMI_MATCH (DMI_CHASSIS_TYPE ,"14" ),/* Sub-Notebook */ }, }, { } }; +#endif #endif /* CONFIG_X86 */
@@ -1170,11 +1240,6 @@ static int __init i8042_pnp_init(void)bool pnp_data_busted = false;int err; -#ifdef CONFIG_X86 -if (dmi_check_system (i8042_dmi_nopnp_table)) - i8042_nopnp = true; -#endif -if (i8042_nopnp) {pr_info ("PNP detection disabled\n" );return 0 ;
@@ -1278,6 +1343,59 @@ static inline int i8042_pnp_init(void) { return 0; }static inline void i8042_pnp_exit (void ) { }#endif /* CONFIG_PNP */ + +#ifdef CONFIG_X86 +static void __init i8042_check_quirks (void ) +{ +const struct dmi_system_id *device_quirk_info; +uintptr_t quirks; + + device_quirk_info =dmi_first_match (i8042_dmi_quirk_table); +if (!device_quirk_info) +return ; + + quirks = (uintptr_t )device_quirk_info->driver_data; + +if (quirks &SERIO_QUIRK_NOKBD ) + i8042_nokbd = true; +if (quirks &SERIO_QUIRK_NOAUX ) + i8042_noaux = true; +if (quirks &SERIO_QUIRK_NOMUX ) + i8042_nomux = true; +if (quirks &SERIO_QUIRK_FORCEMUX ) + i8042_nomux = false; +if (quirks &SERIO_QUIRK_UNLOCK ) + i8042_unlock = true; +if (quirks &SERIO_QUIRK_PROBE_DEFER ) + i8042_probe_defer = true; +/* Honor module parameter when value is not default */ +if (i8042_reset ==I8042_RESET_DEFAULT ) { +if (quirks &SERIO_QUIRK_RESET_ALWAYS ) + i8042_reset =I8042_RESET_ALWAYS ; +if (quirks &SERIO_QUIRK_RESET_NEVER ) + i8042_reset =I8042_RESET_NEVER ; + } +if (quirks &SERIO_QUIRK_DIECT ) + i8042_direct = true; +if (quirks &SERIO_QUIRK_DUMBKBD ) + i8042_dumbkbd = true; +if (quirks &SERIO_QUIRK_NOLOOP ) + i8042_noloop = true; +if (quirks &SERIO_QUIRK_NOTIMEOUT ) + i8042_notimeout = true; +if (quirks &SERIO_QUIRK_KBDRESET ) + i8042_kbdreset = true; +if (quirks &SERIO_QUIRK_DRITEK ) + i8042_dritek = true; +#ifdef CONFIG_PNP +if (quirks &SERIO_QUIRK_NOPNP ) + i8042_nopnp = true; +#endif +} +#else +static inline void i8042_check_quirks (void ) {} +#endif +static int __init i8042_platform_init (void ) {int retval;
@@ -1300,45 +1418,17 @@ static int __init i8042_platform_init(void) i8042_kbd_irq =I8042_MAP_IRQ (1 ); i8042_aux_irq =I8042_MAP_IRQ (12 ); - retval =i8042_pnp_init (); -if (retval) -return retval; -#if defined(__ia64__) - i8042_reset =I8042_RESET_ALWAYS ; + i8042_reset =I8042_RESET_ALWAYS ;#endif -#ifdef CONFIG_X86 -/* Honor module parameter when value is not default */ -if (i8042_reset ==I8042_RESET_DEFAULT ) { -if (dmi_check_system (i8042_dmi_reset_table)) - i8042_reset =I8042_RESET_ALWAYS ; - -if (dmi_check_system (i8042_dmi_noselftest_table)) - i8042_reset =I8042_RESET_NEVER ; - } - -if (dmi_check_system (i8042_dmi_noloop_table)) - i8042_noloop = true; - -if (dmi_check_system (i8042_dmi_nomux_table)) - i8042_nomux = true; - -if (dmi_check_system (i8042_dmi_forcemux_table)) - i8042_nomux = false; - -if (dmi_check_system (i8042_dmi_notimeout_table)) - i8042_notimeout = true; - -if (dmi_check_system (i8042_dmi_dritek_table)) - i8042_dritek = true; - -if (dmi_check_system (i8042_dmi_kbdreset_table)) - i8042_kbdreset = true; +i8042_check_quirks (); -if (dmi_check_system (i8042_dmi_probe_defer_table)) - i8042_probe_defer = true; + retval =i8042_pnp_init (); +if (retval) +return retval; +#ifdef CONFIG_X86 /* * A20 was already enabled during early kernel init. But some buggy * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 19/89 Input: i8042 - add TUXEDO devices to i8042 quirk tables
In reply to Greg Kroah-HartmanFrom: Werner Sembach <[email protected]>
[ Upstream commit a6a87c36165e6791eeaed88025cde270536c3198 ]
A lot of modern Clevo barebones have touchpad and/or keyboard issues after suspend fixable with nomux + reset + noloop + nopnp. Luckily, none of them have an external PS/2 port so this can safely be set for all of them.
I'm not entirely sure if every device listed really needs all four quirks, but after testing and production use. No negative effects could be observed when setting all four.
The list is quite massive as neither the TUXEDO nor the Clevo dmi strings have been very consistent historically. I tried to keep the list as short as possible without risking on missing an affected device.
This is revision 3. The Clevo N150CU barebone is still removed as it might have problems with the fix and needs further investigations. The SchenkerTechnologiesGmbH System-/Board-Vendor string variations are added. This is now based in the quirk table refactor. This now also includes the additional noaux flag for the NS7xMU.
Stable-dep-of: 9c445d2637c9 ("Input: i8042 - add Clevo PCX0DX to i8042 quirk table")
--- drivers/input/serio/i8042-x86ia64io.h | 129 ++++++++++++++++++++++++++ 1 file changed, 129 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +129 -0
@@ -1029,6 +1029,29 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_NOMUX) }, +/* +* A lot of modern Clevo barebones have touchpad and/or keyboard issues +* after suspend fixable with nomux + reset + noloop + nopnp. Luckily, +* none of them have an external PS/2 port so this can safely be set for +* all of them. These two are based on a Clevo design, but have the +* board_name changed. +*/ + { + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"TUXEDO" ), + DMI_MATCH(DMI_BOARD_NAME, "AURA1501"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, + { + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"TUXEDO" ), + DMI_MATCH(DMI_BOARD_NAME, "EDUBOOK1502"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, {/* Mivvy M310 */ .matches = {
@@ -1058,6 +1081,112 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_NOLOOP) }, +/* +* A lot of modern Clevo barebones have touchpad and/or keyboard issues +* after suspend fixable with nomux + reset + noloop + nopnp. Luckily, +* none of them have an external PS/2 port so this can safely be set for +* all of them. +* Clevo barebones come with board_vendor and/or system_vendor set to +* either the very generic string "Notebook" and/or a different value +* for each individual reseller. The only somewhat universal way to +* identify them is by board_name. +*/ + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "LAPQC71A"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "LAPQC71B"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "N140CU"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "N141CU"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NH5xAx"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + /* + * At least one modern Clevo barebone has the touchpad connected both + * via PS/2 and i2c interface. This causes a race condition between the + * psmouse and i2c-hid driver. Since the full capability of the touchpad + * is available via the i2c interface and the device has no external + * PS/2 port, it is safe to just ignore all ps2 mouses here to avoid + * this issue. The known affected device is the + * TUXEDO InfinityBook S17 Gen6 / Clevo NS70MU which comes with one of + * the two different dmi strings below. NS50MU is not a typo! + */ + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NS50MU"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX | + SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | + SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NS50_70MU"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOAUX | SERIO_QUIRK_NOMUX | + SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | + SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "NJ50_70CU"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PB50_70DFx,DDx"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "X170SM"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "X170KM-G"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | + SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) + }, { } };
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 20/89 Input: i8042 - add Clevo PCX0DX to i8042 quirk table
In reply to Greg Kroah-HartmanFrom: Werner Sembach <[email protected]>
[ Upstream commit 9c445d2637c938a800fcc8b5f0b10e60c94460c7 ]
The Clevo PCX0DX/TUXEDO XP1511, need quirks for the keyboard to not be occasionally unresponsive after resume.
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -1173,6 +1173,13 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { .driver_data = (void *)(SERIO_QUIRK_NOMUX | SERIO_QUIRK_RESET_ALWAYS | SERIO_QUIRK_NOLOOP | SERIO_QUIRK_NOPNP) }, + { + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PCX0DX"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX |SERIO_QUIRK_RESET_ALWAYS | +SERIO_QUIRK_NOLOOP |SERIO_QUIRK_NOPNP ) + }, { .matches = { DMI_MATCH(DMI_BOARD_NAME, "X170SM"),
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 21/89 nVMX x86: Check VMX-preemption timer controls on vmentry of L2 guests
In reply to Greg Kroah-HartmanFrom: Krish Sadhukhan <[email protected]>
[ Upstream commit 14aa61d0a9eb3ddad06c3a0033f88b5fa7f05613 ]
According to section "Checks on VMX Controls" in Intel SDM vol 3C, the following check needs to be enforced on vmentry of L2 guests:
If the "activate VMX-preemption timer" VM-execution control is 0, the the "save VMX-preemption timer value" VM-exit control must also be 0.
Stable-dep-of: a44b331614e6 ("KVM: x86/vmx: Do not skip segment attributes if unusable bit is set")
--- arch/x86/kvm/vmx.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/x86/kvm/vmx.c +10 -0
@@ -2062,6 +2062,12 @@ static inline bool nested_cpu_has_shadow_vmcs(struct vmcs12 *vmcs12)return nested_cpu_has2 (vmcs12,SECONDARY_EXEC_SHADOW_VMCS ); } +static inline bool nested_cpu_has_save_preemption_timer (struct vmcs12 *vmcs12) +{ +return vmcs12->vm_exit_controls & +VM_EXIT_SAVE_VMX_PREEMPTION_TIMER ; +} +static inline bool is_nmi (u32 intr_info) {return (intr_info & (INTR_INFO_INTR_TYPE_MASK |INTR_INFO_VALID_MASK ))
@@ -12609,6 +12615,10 @@ static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)if (nested_vmx_check_msr_switch_controls (vcpu, vmcs12))return VMXERR_ENTRY_INVALID_CONTROL_FIELD ; +if (!nested_cpu_has_preemption_timer (vmcs12) && +nested_cpu_has_save_preemption_timer (vmcs12)) +return VMXERR_ENTRY_INVALID_CONTROL_FIELD ; +if (nested_vmx_check_pml_controls (vcpu, vmcs12))return VMXERR_ENTRY_INVALID_CONTROL_FIELD ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 22/89 KVM: VMX: Move VMX specific files to a "vmx" subdirectory
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit a821bab2d1ee869e04b218b198837bf07f2d27c1 ]
...to prepare for shattering vmx.c into multiple files without having to prepend "vmx_" to all new files.
Stable-dep-of: a44b331614e6 ("KVM: x86/vmx: Do not skip segment attributes if unusable bit is set")
---
arch/x86/kvm/Makefile | 2 +-
arch/x86/kvm/{ => vmx}/pmu_intel.c | 0
arch/x86/kvm/{ => vmx}/vmx.c | 0
arch/x86/kvm/{ => vmx}/vmx_evmcs.h | 0
arch/x86/kvm/{ => vmx}/vmx_shadow_fields.h | 0
5 files changed, 1 insertion(+), 1 deletion(-)
rename arch/x86/kvm/{ => vmx}/pmu_intel.c (100%)
rename arch/x86/kvm/{ => vmx}/vmx.c (100%)
rename arch/x86/kvm/{ => vmx}/vmx_evmcs.h (100%)
rename arch/x86/kvm/{ => vmx}/vmx_shadow_fields.h (100%)arch/x86/kvm/Makefile +1 -1
@@ -16,7 +16,7 @@ kvm-y += x86.o mmu.o emulate.o i8259.o irq.o lapic.o \ i8254.o ioapic.o irq_comm.o cpuid.o pmu.o mtrr.o \ hyperv.o page_track.o debugfs.o -kvm-intel-y += vmx.o pmu_intel.o +kvm-intel-y += vmx/vmx.o vmx/pmu_intel.o kvm-amd-y += svm.o pmu_amd.o obj-$(CONFIG_KVM) += kvm.o
arch/x86/kvm/vmx/pmu_intel.c renamed from arch/x86/kvm/pmu_intel.c +0 -0
arch/x86/kvm/vmx/vmx.c renamed from arch/x86/kvm/vmx.c +0 -0
arch/x86/kvm/vmx/vmx_evmcs.h renamed from arch/x86/kvm/vmx_evmcs.h +0 -0
arch/x86/kvm/vmx/vmx_shadow_fields.h renamed from arch/x86/kvm/vmx_shadow_fields.h +0 -0
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 23/89 KVM: VMX: Move caching of MSR_IA32_XSS to hardware_setup()
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 71d9409e20934e16f2d2ea88f0d1fb9851a7da3b ]
MSR_IA32_XSS has no relation to the VMCS whatsoever, it doesn't belong in setup_vmcs_config() and its reference to host_xss prevents moving setup_vmcs_config() to a dedicated file.
Stable-dep-of: a44b331614e6 ("KVM: x86/vmx: Do not skip segment attributes if unusable bit is set")
--- arch/x86/kvm/vmx/vmx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kvm/vmx/vmx.c +3 -3
@@ -4740,9 +4740,6 @@ static __init int setup_vmcs_config(struct vmcs_config *vmcs_conf) } } -if (boot_cpu_has (X86_FEATURE_XSAVES )) -rdmsrl (MSR_IA32_XSS , host_xss); -return 0 ; }
@@ -7957,6 +7954,9 @@ static __init int hardware_setup(void)WARN_ONCE (host_bndcfgs,"KVM: BNDCFGS in host will be lost" ); } +if (boot_cpu_has (X86_FEATURE_XSAVES )) +rdmsrl (MSR_IA32_XSS , host_xss); +if (!cpu_has_vmx_vpid () || !cpu_has_vmx_invvpid () || !(cpu_has_vmx_invvpid_single () ||cpu_has_vmx_invvpid_global ())) enable_vpid =0 ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 24/89 KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
In reply to Greg Kroah-HartmanFrom: Hendrik Borghorst <[email protected]>
[ Upstream commit a44b331614e6f7e63902ed7dff7adc8c85edd8bc ]
When serializing and deserializing kvm_sregs, attributes of the segment descriptors are stored by user space. For unusable segments, vmx_segment_access_rights skips all attributes and sets them to 0.
This means we zero out the DPL (Descriptor Privilege Level) for unusable entries.
Unusable segments are - contrary to their name - usable in 64bit mode and are used by guests to for example create a linear map through the NULL selector.
VMENTER checks if SS.DPL is correct depending on the CS segment type. For types 9 (Execute Only) and 11 (Execute Read), CS.DPL must be equal to SS.DPL [1].
We have seen real world guests setting CS to a usable segment with DPL=3 and SS to an unusable segment with DPL=3. Once we go through an sregs get/set cycle, SS.DPL turns to 0. This causes the virtual machine to crash reproducibly.
This commit changes the attribute logic to always preserve attributes for unusable segments. According to [2] SS.DPL is always saved on VM exits, regardless of the unusable bit so user space applications should have saved the information on serialization correctly.
[3] specifies that besides SS.DPL the rest of the attributes of the descriptors are undefined after VM entry if unusable bit is set. So, there should be no harm in setting them all to the previous state.
[1] Intel SDM Vol 3C 26.3.1.2 Checks on Guest Segment Registers
[2] Intel SDM Vol 3C 27.3.2 Saving Segment Registers and Descriptor-Table Registers
[3] Intel SDM Vol 3C 26.3.2.2 Loading Guest Segment Registers and Descriptor-Table Registers
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/vmx.c +9 -12
@@ -5521,18 +5521,15 @@ static u32 vmx_segment_access_rights(struct kvm_segment *var) {u32 ar; -if (var->unusable || !var->present) - ar =1 <<16 ; -else { - ar = var->type &15 ; - ar |= (var->s &1 ) <<4 ; - ar |= (var->dpl &3 ) <<5 ; - ar |= (var->present &1 ) <<7 ; - ar |= (var->avl &1 ) <<12 ; - ar |= (var->l &1 ) <<13 ; - ar |= (var->db &1 ) <<14 ; - ar |= (var->g &1 ) <<15 ; - } + ar = var->type &15 ; + ar |= (var->s &1 ) <<4 ; + ar |= (var->dpl &3 ) <<5 ; + ar |= (var->present &1 ) <<7 ; + ar |= (var->avl &1 ) <<12 ; + ar |= (var->l &1 ) <<13 ; + ar |= (var->db &1 ) <<14 ; + ar |= (var->g &1 ) <<15 ; + ar |= (var->unusable || !var->present) <<16 ;return ar; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 25/89 thermal: intel: int340x: Protect trip temperature from concurrent updates
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit 6757a7abe47bcb12cb2d45661067e182424b0ee3 ]
Trip temperatures are read using ACPI methods and stored in the memory during zone initializtion and when the firmware sends a notification for change. This trip temperature is returned when the thermal core calls via callback get_trip_temp().
But it is possible that while updating the memory copy of the trips when the firmware sends a notification for change, thermal core is reading the trip temperature via the callback get_trip_temp(). This may return invalid trip temperature.
To address this add a mutex to protect the invalid temperature reads in the callback get_trip_temp() and int340x_thermal_read_trips().
--- .../int340x_thermal/int340x_thermal_zone.c | 18 +++++++++++++++--- .../int340x_thermal/int340x_thermal_zone.h | 1 + 2 files changed, 16 insertions(+), 3 deletions(-)
drivers/thermal/int340x_thermal/int340x_thermal_zone.c +15 -3
@@ -52,11 +52,13 @@ static int int340x_thermal_get_trip_temp(struct thermal_zone_device *zone, int trip, int *temp) { struct int34x_thermal_zone *d = zone->devdata; -int i; +int i, ret =0 ;if (d->override_ops && d->override_ops->get_trip_temp)return d->override_ops->get_trip_temp (zone, trip, temp); +mutex_lock (&d->trip_mutex); +if (trip < d->aux_trip_nr) *temp = d->aux_trips[trip];else if (trip == d->crt_trip_id)
@@ -74,10 +76,12 @@ static int int340x_thermal_get_trip_temp(struct thermal_zone_device *zone, } }if (i ==INT340X_THERMAL_MAX_ACT_TRIP_COUNT ) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +mutex_unlock (&d->trip_mutex); + +return ret; } static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone,
@@ -182,6 +186,8 @@ int int340x_thermal_read_trips(struct int34x_thermal_zone *int34x_zone)int trip_cnt = int34x_zone->aux_trip_nr;int i; +mutex_lock (&int34x_zone->trip_mutex); + int34x_zone->crt_trip_id =-1 ;if (!int340x_thermal_get_trip_config (int34x_zone->adev->handle,"_CRT" , &int34x_zone->crt_temp))
@@ -209,6 +215,8 @@ int int340x_thermal_read_trips(struct int34x_thermal_zone *int34x_zone) int34x_zone->act_trips[i].valid = true; } +mutex_unlock (&int34x_zone->trip_mutex); +return trip_cnt; }EXPORT_SYMBOL_GPL (int340x_thermal_read_trips);
@@ -232,6 +240,8 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,if (!int34x_thermal_zone)return ERR_PTR (-ENOMEM ); +mutex_init (&int34x_thermal_zone->trip_mutex); + int34x_thermal_zone->adev = adev; int34x_thermal_zone->override_ops = override_ops;
@@ -274,6 +284,7 @@ struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *adev,acpi_lpat_free_conversion_table (int34x_thermal_zone->lpat_table);kfree (int34x_thermal_zone->aux_trips); err_trip_alloc: +mutex_destroy (&int34x_thermal_zone->trip_mutex);kfree (int34x_thermal_zone);return ERR_PTR (ret); }
@@ -285,6 +296,7 @@ void int340x_thermal_zone_remove(struct int34x_thermal_zonethermal_zone_device_unregister (int34x_thermal_zone->zone);acpi_lpat_free_conversion_table (int34x_thermal_zone->lpat_table);kfree (int34x_thermal_zone->aux_trips); +mutex_destroy (&int34x_thermal_zone->trip_mutex);kfree (int34x_thermal_zone); }EXPORT_SYMBOL_GPL (int340x_thermal_zone_remove);
drivers/thermal/int340x_thermal/int340x_thermal_zone.h +1 -0
@@ -41,6 +41,7 @@ struct int34x_thermal_zone {struct thermal_zone_device_ops *override_ops;void *priv_data;struct acpi_lpat_conversion_table *lpat_table; +struct mutex trip_mutex; }; struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 26/89 fbcon: Check font dimension limits
In reply to Greg Kroah-HartmanFrom: Samuel Thibault <[email protected]>
commit 2b09d5d364986f724f17001ccfe4126b9b43a0be upstream.
blit_x and blit_y are u32, so fbcon currently cannot support fonts larger than 32x32.
The 32x32 case also needs shifting an unsigned int, to properly set bit 31, otherwise we get "UBSAN: shift-out-of-bounds in fbcon_set_font", as reported on:
http://lore.kernel.org/all/IA1PR07MB98308653E259A6F2CE94A4AFABCE9@IA1PR07MB9830.namprd07.prod.outlook.com
Kernel Branch: 6.2.0-rc5-next-20230124
Kernel config: https://drive.google.com/file/d/1F-LszDAizEEH0ZX0HcSR06v5q8FPl2Uv/view?usp=sharing
Reproducer: https://drive.google.com/file/d/1mP1jcLBY7vWCNM60OMf-ogw-urQRjNrm/view?usp=sharing
--- drivers/video/fbdev/core/fbcon.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/video/fbdev/core/fbcon.c +5 -2
@@ -2475,9 +2475,12 @@ static int fbcon_set_font(struct vc_data h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres))return -EINVAL ; +if (font->width >32 || font->height >32 ) +return -EINVAL ; +/* Make sure drawing engine can handle the font */ -if (!(info->pixmap.blit_x & (1 << (font->width -1 ))) || - !(info->pixmap.blit_y & (1 << (font->height -1 )))) +if (!(info->pixmap.blit_x &BIT (font->width -1 )) || + !(info->pixmap.blit_y &BIT (font->height -1 )))return -EINVAL ;/* Make sure driver can handle the font length */
Greg Kroah-Hartman
maintainerPATCH 27/89 watchdog: diag288_wdt: do not use stack buffers for hardware data
In reply to Greg Kroah-HartmanFrom: Alexander Egorenkov <[email protected]>
commit fe8973a3ad0905cb9ba2d42db42ed51de14737df upstream.
With CONFIG_VMAP_STACK=y the stack is allocated from the vmalloc space. Data passed to a hardware or a hypervisor interface that requires V=R can no longer be allocated on the stack.
Use kmalloc() to get memory for a diag288 command.
--- drivers/watchdog/diag288_wdt.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/watchdog/diag288_wdt.c +11 -2
@@ -274,12 +274,21 @@ static int __init diag288_init(void)char ebc_begin[] = {194 ,197 ,199 ,201 ,213 }; +char *ebc_cmd;watchdog_set_nowayout (&wdt_dev, nowayout_info);if (MACHINE_IS_VM ) { -if (__diag288_vm (WDT_FUNC_INIT ,15 , - ebc_begin,sizeof (ebc_begin)) !=0 ) { + ebc_cmd =kmalloc (sizeof (ebc_begin),GFP_KERNEL ); +if (!ebc_cmd) { +pr_err ("The watchdog cannot be initialized\n" ); +return -ENOMEM ; + } +memcpy (ebc_cmd, ebc_begin,sizeof (ebc_begin)); + ret =__diag288_vm (WDT_FUNC_INIT ,15 , + ebc_cmd,sizeof (ebc_begin)); +kfree (ebc_cmd); +if (ret !=0 ) {pr_err ("The watchdog cannot be initialized\n" );return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 28/89 watchdog: diag288_wdt: fix __diag288() inline assembly
In reply to Greg Kroah-HartmanFrom: Alexander Egorenkov <[email protected]>
commit 32e40f9506b9e32917eb73154f93037b443124d1 upstream.
The DIAG 288 statement consumes an EBCDIC string the address of which is passed in a register. Use a "memory" clobber to tell the compiler that memory is accessed within the inline assembly.
--- drivers/watchdog/diag288_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/diag288_wdt.c +1 -1
@@ -88,7 +88,7 @@ static int __diag288(unsigned int func,"1:\n" EX_TABLE (0b ,1b ) : "+d" (err) : "d"(__func), "d"(__timeout), - "d"(__action), "d"(__len) : "1", "cc"); + "d"(__action), "d"(__len) : "1", "cc", "memory"); return err; }
Greg Kroah-Hartman
maintainerPATCH 29/89 efi: Accept version 2 of memory attributes table
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit 636ab417a7aec4ee993916e688eb5c5977570836 upstream.
UEFI v2.10 introduces version 2 of the memory attributes table, which turns the reserved field into a flags field, but is compatible with version 1 in all other respects. So let's not complain about version 2 if we encounter it.
--- drivers/firmware/efi/memattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/efi/memattr.c +1 -1
@@ -35,7 +35,7 @@ int __init efi_memattr_init(void)return -ENOMEM ; } -if (tbl->version >1 ) { +if (tbl->version >2 ) {pr_warn ("Unexpected EFI Memory Attributes table version %d\n" , tbl->version); goto unmap;
Greg Kroah-Hartman
maintainerPATCH 30/89 iio: hid: fix the retval in accel_3d_capture_sample
In reply to Greg Kroah-HartmanFrom: Dmitry Perchanov <[email protected]>
commit f7b23d1c35d8b8de1425bdfccaefd01f3b7c9d1c upstream.
Return value should be zero for success. This was forgotten for timestamp feature. Verified on RealSense cameras.
--- drivers/iio/accel/hid-sensor-accel-3d.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/accel/hid-sensor-accel-3d.c +1 -0
@@ -292,6 +292,7 @@ static int accel_3d_capture_sample(struchid_sensor_convert_timestamp ( &accel_state->common_attributes, *(int64_t *)raw_data); + ret =0 ;break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 31/89 iio: adc: berlin2-adc: Add missing of_node_put() in error path
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
commit cbd3a0153cd18a2cbef6bf3cf31bb406c3fc9f55 upstream.
of_get_parent() will return a device_node pointer with refcount incremented. We need to use of_node_put() on it when done. Add the missing of_node_put() in the error path of berlin2_adc_probe();
--- drivers/iio/adc/berlin2-adc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/adc/berlin2-adc.c +3 -1
@@ -289,8 +289,10 @@ static int berlin2_adc_probe(struct platint ret; indio_dev =devm_iio_device_alloc (&pdev->dev,sizeof (*priv)); -if (!indio_dev) +if (!indio_dev) { +of_node_put (parent_np);return -ENOMEM ; + } priv =iio_priv (indio_dev);platform_set_drvdata (pdev, indio_dev);
Greg Kroah-Hartman
maintainerPATCH 32/89 iio:adc:twl6030: Enable measurements of VUSB, VBAT and others
In reply to Greg Kroah-HartmanFrom: Andreas Kemnade <[email protected]>
commit f804bd0dc28683a93a60f271aaefb2fc5b0853dd upstream.
Some inputs need to be wired up to produce proper measurements, without this change only near zero values are reported.
--- drivers/iio/adc/twl6030-gpadc.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
drivers/iio/adc/twl6030-gpadc.c +32 -0
@@ -71,6 +71,18 @@#define TWL6030_GPADCS BIT(1)#define TWL6030_GPADCR BIT(0) +#define USB_VBUS_CTRL_SET 0x04 +#define USB_ID_CTRL_SET 0x06 + +#define TWL6030_MISC1 0xE4 +#define VBUS_MEAS 0x01 +#define ID_MEAS 0x01 + +#define VAC_MEAS 0x04 +#define VBAT_MEAS 0x02 +#define BB_MEAS 0x01 + +/** * struct twl6030_chnl_calib - channel calibration * @gain: slope coefficient for ideal curve
@@ -943,6 +955,26 @@ static int twl6030_gpadc_probe(struct plreturn ret; } + ret =twl_i2c_write_u8 (TWL_MODULE_USB ,VBUS_MEAS ,USB_VBUS_CTRL_SET ); +if (ret <0 ) { +dev_err (dev,"failed to wire up inputs\n" ); +return ret; + } + + ret =twl_i2c_write_u8 (TWL_MODULE_USB ,ID_MEAS ,USB_ID_CTRL_SET ); +if (ret <0 ) { +dev_err (dev,"failed to wire up inputs\n" ); +return ret; + } + + ret =twl_i2c_write_u8 (TWL6030_MODULE_ID0 , +VBAT_MEAS |BB_MEAS |BB_MEAS , +TWL6030_MISC1 ); +if (ret <0 ) { +dev_err (dev,"failed to wire up inputs\n" ); +return ret; + } + indio_dev->name =DRIVER_NAME ; indio_dev->dev.parent = dev; indio_dev->info = &twl6030_gpadc_iio_info;
Greg Kroah-Hartman
maintainerPATCH 33/89 parisc: Fix return code of pdc_iodc_print()
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 5d1335dabb3c493a3d6d5b233953b6ac7b6c1ff2 upstream.
There is an off-by-one if the printed string includes a new-line char.
--- arch/parisc/kernel/firmware.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/parisc/kernel/firmware.c +3 -2
@@ -1197,7 +1197,7 @@ static char __attribute__((aligned(64)))*/ int pdc_iodc_print (const unsigned char *str,unsigned count) { -unsigned int i; +unsigned int i, found =0 ;unsigned long flags;for (i =0 ; i < count;) {
@@ -1206,6 +1206,7 @@ int pdc_iodc_print(const unsigned char * iodc_dbuf[i+0 ] ='\r' ; iodc_dbuf[i+1 ] ='\n' ; i +=2 ; + found =1 ; goto print;default : iodc_dbuf[i] = str[i];
@@ -1222,7 +1223,7 @@ print: __pa(iodc_retbuf), 0, __pa(iodc_dbuf), i, 0);spin_unlock_irqrestore (&pdc_lock, flags); -return i; +return i - found; }#if !defined(BOOTLOADER )
Greg Kroah-Hartman
maintainerPATCH 34/89 parisc: Wire up PTRACE_GETREGS/PTRACE_SETREGS for compat case
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 316f1f42b5cc1d95124c1f0387c867c1ba7b6d0e upstream.
Wire up the missing ptrace requests PTRACE_GETREGS, PTRACE_SETREGS, PTRACE_GETFPREGS and PTRACE_SETFPREGS when running 32-bit applications on 64-bit kernels.
--- arch/parisc/kernel/ptrace.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
arch/parisc/kernel/ptrace.c +13 -2
@@ -128,6 +128,12 @@ long arch_ptrace(struct task_struct *chiunsigned long tmp;long ret = -EIO ; +unsigned long user_regs_struct_size =sizeof (struct user_regs_struct ); +#ifdef CONFIG_64BIT +if (is_compat_task ()) + user_regs_struct_size /=2 ; +#endif +switch (request) {/* Read the word at location addr in the USER area. For ptraced
@@ -183,14 +189,14 @@ long arch_ptrace(struct task_struct *chireturn copy_regset_to_user (child,task_user_regset_view (current),REGSET_GENERAL , -0 ,sizeof (struct user_regs_struct ), +0 , user_regs_struct_size, datap);case PTRACE_SETREGS :/* Set all gp regs in the child. */ return copy_regset_from_user (child,task_user_regset_view (current),REGSET_GENERAL , -0 ,sizeof (struct user_regs_struct ), +0 , user_regs_struct_size, datap);case PTRACE_GETFPREGS :/* Get the child FPU state. */
@@ -304,6 +310,11 @@ long compat_arch_ptrace(struct task_stru } }break ; +case PTRACE_GETREGS : +case PTRACE_SETREGS : +case PTRACE_GETFPREGS : +case PTRACE_SETFPREGS : +return arch_ptrace (child, request, addr, data);default : ret =compat_ptrace_request (child, request, addr, data);
Greg Kroah-Hartman
maintainerPATCH 35/89 riscv: disable generation of unwind tables
In reply to Greg Kroah-HartmanFrom: Andreas Schwab <[email protected]>
commit 2f394c0e7d1129a35156e492bc8f445fb20f43ac upstream.
GCC 13 will enable -fasynchronous-unwind-tables by default on riscv. In the kernel, we don't have any use for unwind tables yet, so disable them. More importantly, the .eh_frame section brings relocations (R_RISC_32_PCREL, R_RISCV_SET{6,8,16}, R_RISCV_SUB{6,8,16}) into modules that we are not prepared to handle.
--- arch/riscv/Makefile | 3 +++ 1 file changed, 3 insertions(+)
arch/riscv/Makefile +3 -0
@@ -72,6 +72,9 @@ ifeq ($(CONFIG_MODULE_SECTIONS),y) KBUILD_LDFLAGS_MODULE += -T $(srctree)/arch/riscv/kernel/module.lds endif +# Avoid generating .eh_frame sections. +KBUILD_CFLAGS += -fno-asynchronous-unwind-tables -fno-unwind-tables + KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-relax) KBUILD_AFLAGS_MODULE += $(call as-option,-Wa$(comma)-mno-relax)
Greg Kroah-Hartman
maintainerPATCH 36/89 mm: hugetlb: proc: check for hugetlb shared PMD in /proc/PID/smaps
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
commit 3489dbb696d25602aea8c3e669a6d43b76bd5358 upstream.
Patch series "Fixes for hugetlb mapcount at most 1 for shared PMDs".
This issue of mapcount in hugetlb pages referenced by shared PMDs was discussed in [1]. The following two patches address user visible behavior caused by this issue.
[1] https://lore.kernel.org/linux-mm/Y9BF+OCdWnCSilEu@monkey/
This patch (of 2):
A hugetlb page will have a mapcount of 1 if mapped by multiple processes via a shared PMD. This is because only the first process increases the map count, and subsequent processes just add the shared PMD page to their page table.
page_mapcount is being used to decide if a hugetlb page is shared or private in /proc/PID/smaps. Pages referenced via a shared PMD were incorrectly being counted as private.
To fix, check for a shared PMD if mapcount is 1. If a shared PMD is found count the hugetlb page as shared. A new helper to check for a shared PMD is added.
--- fs/proc/task_mmu.c | 4 +--- include/linux/hugetlb.h | 13 +++++++++++++ 2 files changed, 14 insertions(+), 3 deletions(-)
fs/proc/task_mmu.c +1 -3
@@ -701,9 +701,7 @@ static int smaps_hugetlb_range(pte_t *pt page =device_private_entry_to_page (swpent); }if (page) { -int mapcount =page_mapcount (page); - -if (mapcount >=2 ) +if (page_mapcount (page) >=2 ||hugetlb_pmd_shared (pte)) mss->shared_hugetlb +=huge_page_size (hstate_vma (vma));else mss->private_hugetlb +=huge_page_size (hstate_vma (vma));
include/linux/hugetlb.h +13 -0
@@ -7,6 +7,7 @@#include <linux/fs.h> #include <linux/hugetlb_inline.h> #include <linux/cgroup.h> +#include <linux/page_ref.h> #include <linux/list.h> #include <linux/kref.h> #include <asm/pgtable.h>
@@ -626,4 +627,16 @@ static inline spinlock_t *huge_pte_lock( return ptl; } +#ifdef CONFIG_ARCH_WANT_HUGE_PMD_SHARE +static inline bool hugetlb_pmd_shared (pte_t *pte) +{ +return page_count (virt_to_page (pte)) >1 ; +} +#else +static inline bool hugetlb_pmd_shared (pte_t *pte) +{ +return false; +} +#endif +#endif /* _LINUX_HUGETLB_H */
Greg Kroah-Hartman
maintainerPATCH 37/89 mm/swapfile: add cond_resched() in get_swap_pages()
In reply to Greg Kroah-HartmanFrom: Longlong Xia <[email protected]>
commit 7717fc1a12f88701573f9ed897cc4f6699c661e3 upstream.
The softlockup still occurs in get_swap_pages() under memory pressure. 64 CPU cores, 64GB memory, and 28 zram devices, the disksize of each zram device is 50MB with same priority as si. Use the stress-ng tool to increase memory pressure, causing the system to oom frequently.
The plist_for_each_entry_safe() loops in get_swap_pages() could reach tens of thousands of times to find available space (extreme case:cond_resched() is not called in scan_swap_map_slots()). Let's add cond_resched() into get_swap_pages() when failed to find available space to avoid softlockup.
--- mm/swapfile.c | 1 + 1 file changed, 1 insertion(+)
mm/swapfile.c +1 -0
@@ -1008,6 +1008,7 @@ start_over: goto check_out;pr_debug ("scan_swap_map of si %d failed to find offset\n" , si->type); +cond_resched ();spin_lock (&swap_avail_lock); nextsi:
Greg Kroah-Hartman
maintainerPATCH 38/89 Squashfs: fix handling and sanity checking of xattr_ids count
In reply to Greg Kroah-HartmanFrom: Phillip Lougher <[email protected]>
commit f65c4bbbd682b0877b669828b4e033b8d5d0a2dc upstream.
A Sysbot [1] corrupted filesystem exposes two flaws in the handling and sanity checking of the xattr_ids count in the filesystem. Both of these flaws cause computation overflow due to incorrect typing.
In the corrupted filesystem the xattr_ids value is 4294967071, which stored in a signed variable becomes the negative number -225.
Flaw 1 (64-bit systems only):
The signed integer xattr_ids variable causes sign extension.
This causes variable overflow in the SQUASHFS_XATTR_*(A) macros. The variable is first multiplied by sizeof(struct squashfs_xattr_id) where the type of the sizeof operator is "unsigned long".
On a 64-bit system this is 64-bits in size, and causes the negative number to be sign extended and widened to 64-bits and then become unsigned. This produces the very large number 18446744073709548016 or 2^64 - 3600. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows and produces a length of 0 (stored in len).
Flaw 2 (32-bit systems only):
On a 32-bit system the integer variable is not widened by the unsigned long type of the sizeof operator (32-bits), and the signedness of the variable has no effect due it always being treated as unsigned.
The above corrupted xattr_ids value of 4294967071, when multiplied overflows and produces the number 4294963696 or 2^32 - 3400. This number when rounded up by SQUASHFS_METADATA_SIZE - 1 (8191 bytes) and divided by SQUASHFS_METADATA_SIZE overflows again and produces a length of 0.
The effect of the 0 length computation:
In conjunction with the corrupted xattr_ids field, the filesystem also has a corrupted xattr_table_start value, where it matches the end of filesystem value of 850.
This causes the following sanity check code to fail because the incorrectly computed len of 0 matches the incorrect size of the table reported by the superblock (0 bytes).
len = SQUASHFS_XATTR_BLOCK_BYTES(*xattr_ids);
indexes = SQUASHFS_XATTR_BLOCKS(*xattr_ids);
/*
* The computed size of the index table (len bytes) should exactly
* match the table start and end points
*/
start = table_start + sizeof(*id_table);
end = msblk->bytes_used;
if (len != (end - start))
return ERR_PTR(-EINVAL);Changing the xattr_ids variable to be "usigned int" fixes the flaw on a 64-bit system. This relies on the fact the computation is widened by the unsigned long type of the sizeof operator.
Casting the variable to u64 in the above macro fixes this flaw on a 32-bit system.
It also means 64-bit systems do not implicitly rely on the type of the sizeof operator to widen the computation.
[1] https://lore.kernel.org/lkml/[email protected]/
--- fs/squashfs/squashfs_fs.h | 2 +- fs/squashfs/squashfs_fs_sb.h | 2 +- fs/squashfs/xattr.h | 4 ++-- fs/squashfs/xattr_id.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
fs/squashfs/squashfs_fs.h +1 -1
@@ -196,7 +196,7 @@ static inline int squashfs_block_size(__#define SQUASHFS_ID_BLOCK_BYTES (A ) (SQUASHFS_ID_BLOCKS(A) *\ sizeof(u64))/* xattr id lookup table defines */ -#define SQUASHFS_XATTR_BYTES (A ) ((A) * sizeof(struct squashfs_xattr_id)) +#define SQUASHFS_XATTR_BYTES (A ) (((u64) (A)) * sizeof(struct squashfs_xattr_id))#define SQUASHFS_XATTR_BLOCK (A ) (SQUASHFS_XATTR_BYTES(A) / \ SQUASHFS_METADATA_SIZE)
fs/squashfs/squashfs_fs_sb.h +1 -1
@@ -76,7 +76,7 @@ struct squashfs_sb_info {long long bytes_used;unsigned int inodes;unsigned int fragments; -int xattr_ids; +unsigned int xattr_ids; unsigned int ids; };#endif
fs/squashfs/xattr.h +2 -2
@@ -23,12 +23,12 @@#ifdef CONFIG_SQUASHFS_XATTR extern __le64 *squashfs_read_xattr_id_table (struct super_block *,u64 , -u64 *,int *); +u64 *,unsigned int *);extern int squashfs_xattr_lookup (struct super_block *,unsigned int ,int *,unsigned int *,unsigned long long *);#else static inline __le64 *squashfs_read_xattr_id_table (struct super_block *sb, -u64 start,u64 *xattr_table_start,int *xattr_ids) +u64 start,u64 *xattr_table_start,unsigned int *xattr_ids) {struct squashfs_xattr_id_table *id_table;
fs/squashfs/xattr_id.c +1 -1
@@ -69,7 +69,7 @@ int squashfs_xattr_lookup(struct super_b* Read uncompressed xattr id lookup table indexes from disk into memory */ __le64 *squashfs_read_xattr_id_table (struct super_block *sb,u64 table_start, -u64 *xattr_table_start,int *xattr_ids) +u64 *xattr_table_start,unsigned int *xattr_ids) {struct squashfs_sb_info *msblk = sb->s_fs_info;unsigned int len, indexes;
Greg Kroah-Hartman
maintainerPATCH 39/89 serial: 8250_dma: Fix DMA Rx completion race
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
commit 31352811e13dc2313f101b890fd4b1ce760b5fe7 upstream.
__dma_rx_complete() is called from two places:
- Through the DMA completion callback dma_rx_complete()
- From serial8250_rx_dma_flush() after IIR_RLSI or IIR_RX_TIMEOUT
The former does not hold port's lock during __dma_rx_complete() which allows these two to race and potentially insert the same data twice.
Extend port's lock coverage in dma_rx_complete() to prevent the race and check if the DMA Rx is still pending completion before calling into __dma_rx_complete().
--- drivers/tty/serial/8250/8250_dma.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_dma.c +13 -1
@@ -61,6 +61,18 @@ static void __dma_rx_complete(void *paratty_flip_buffer_push (tty_port); } +static void dma_rx_complete (void *param) +{ +struct uart_8250_port *p = param; +struct uart_8250_dma *dma = p->dma; +unsigned long flags; + +spin_lock_irqsave (&p->port.lock, flags); +if (dma->rx_running) +__dma_rx_complete (p); +spin_unlock_irqrestore (&p->port.lock, flags); +} +int serial8250_tx_dma (struct uart_8250_port *p) {struct uart_8250_dma *dma = p->dma;
@@ -126,7 +138,7 @@ int serial8250_rx_dma(struct uart_8250_preturn -EBUSY ; dma->rx_running =1 ; - desc->callback = __dma_rx_complete; + desc->callback = dma_rx_complete; desc->callback_param = p; dma->rx_cookie =dmaengine_submit (desc);
Greg Kroah-Hartman
maintainerPATCH 40/89 serial: 8250_dma: Fix DMA Rx rearm race
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
commit 57e9af7831dcf211c5c689c2a6f209f4abdf0bce upstream.
As DMA Rx can be completed from two places, it is possible that DMA Rx completes before DMA completion callback had a chance to complete it. Once the previous DMA Rx has been completed, a new one can be started on the next UART interrupt. The following race is possible (uart_unlock_and_check_sysrq_irqrestore() replaced with spin_unlock_irqrestore() for simplicity/clarity):
CPU0 CPU1
dma_rx_complete()serial8250_handle_irq()
spin_lock_irqsave(&port->lock)
handle_rx_dma()
serial8250_rx_dma_flush()
__dma_rx_complete()
dma->rx_running = 0
// Complete DMA Rx spin_unlock_irqrestore(&port->lock)
serial8250_handle_irq()
spin_lock_irqsave(&port->lock)
handle_rx_dma()
serial8250_rx_dma()
dma->rx_running = 1
// Setup a new DMA Rx spin_unlock_irqrestore(&port->lock)
spin_lock_irqsave(&port->lock) // sees dma->rx_running = 1 __dma_rx_complete() dma->rx_running = 0 // Incorrectly complete // running DMA Rx
This race seems somewhat theoretical to occur for real but handle it correctly regardless. Check what is the DMA status before complething anything in __dma_rx_complete().
--- drivers/tty/serial/8250/8250_dma.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/tty/serial/8250/8250_dma.c +10 -2
@@ -48,15 +48,23 @@ static void __dma_rx_complete(void *parastruct uart_8250_dma *dma = p->dma;struct tty_port *tty_port = &p->port.state->port;struct dma_tx_state state; +enum dma_status dma_status;int count; - dma->rx_running =0 ; -dmaengine_tx_status (dma->rxchan, dma->rx_cookie, &state); +/* +* New DMA Rx can be started during the completion handler before it +* could acquire port's lock and it might still be ongoing. Don't to +* anything in such case. +*/ + dma_status =dmaengine_tx_status (dma->rxchan, dma->rx_cookie, &state); +if (dma_status ==DMA_IN_PROGRESS ) +return ; count = dma->rx_size - state.residue;tty_insert_flip_string (tty_port, dma->rx_buf, count); p->port.icount.rx += count; + dma->rx_running =0 ;tty_flip_buffer_push (tty_port); }
Greg Kroah-Hartman
maintainerPATCH 41/89 thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit acd7e9ee57c880b99671dd99680cb707b7b5b0ee upstream.
In order to prevent int340x_thermal_get_trip_type() from possibly racing with int340x_thermal_read_trips() invoked by int3403_notify() add locking to it in analogy with int340x_thermal_get_trip_temp().
--- drivers/thermal/int340x_thermal/int340x_thermal_zone.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/thermal/int340x_thermal/int340x_thermal_zone.c +7 -3
@@ -89,11 +89,13 @@ static int int340x_thermal_get_trip_type enum thermal_trip_type *type) {struct int34x_thermal_zone *d = zone->devdata; -int i; +int i, ret =0 ;if (d->override_ops && d->override_ops->get_trip_type)return d->override_ops->get_trip_type (zone, trip, type); +mutex_lock (&d->trip_mutex); +if (trip < d->aux_trip_nr) *type =THERMAL_TRIP_PASSIVE ;else if (trip == d->crt_trip_id)
@@ -111,10 +113,12 @@ static int int340x_thermal_get_trip_type } }if (i ==INT340X_THERMAL_MAX_ACT_TRIP_COUNT ) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +mutex_unlock (&d->trip_mutex); + +return ret; } static int int340x_thermal_set_trip_temp(struct thermal_zone_device *zone,
Greg Kroah-Hartman
maintainerPATCH 42/89 iio:adc:twl6030: Enable measurement of VAC
In reply to Greg Kroah-HartmanFrom: Andreas Kemnade <[email protected]>
[ Upstream commit bffb7d9d1a3dbd09e083b88aefd093b3b10abbfb ]
VAC needs to be wired up to produce proper measurements, without this change only near zero values are reported.
--- drivers/iio/adc/twl6030-gpadc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/twl6030-gpadc.c +1 -1
@@ -968,7 +968,7 @@ static int twl6030_gpadc_probe(struct platform_device *pdev) } ret =twl_i2c_write_u8 (TWL6030_MODULE_ID0 , -VBAT_MEAS |BB_MEAS |BB_MEAS , +VBAT_MEAS |BB_MEAS |VAC_MEAS ,TWL6030_MISC1 );if (ret <0 ) {dev_err (dev,"failed to wire up inputs\n" );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 43/89 btrfs: limit device extents to the device size
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 3c538de0f2a74d50aff7278c092f88ae59cee688 upstream.
There was a recent regression in btrfs/177 that started happening with the size class patches ("btrfs: introduce size class to block group allocator"). This however isn't a regression introduced by those patches, but rather the bug was uncovered by a change in behavior in these patches. The patches triggered more chunk allocations in the ^free-space-tree case, which uncovered a race with device shrink.
The problem is we will set the device total size to the new size, and use this to find a hole for a device extent. However during shrink we may have device extents allocated past this range, so we could potentially find a hole in a range past our new shrink size. We don't actually limit our found extent to the device size anywhere, we assume that we will not find a hole past our device size. This isn't true with shrink as we're relocating block groups and thus creating holes past the device size.
Fix this by making sure we do not search past the new device size, and if we wander into any device extents that start after our device size simply break from the loop and use whatever hole we've already found.
--- fs/btrfs/volumes.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/btrfs/volumes.c +5 -1
@@ -1418,7 +1418,7 @@ again: goto out; } -while (1 ) { +while (search_start < search_end) { l = path->nodes[0 ]; slot = path->slots[0 ];if (slot >=btrfs_header_nritems (l)) {
@@ -1441,6 +1441,9 @@ again:if (key.type !=BTRFS_DEV_EXTENT_KEY ) goto next; +if (key.offset > search_end) +break ; +if (key.offset > search_start) { hole_size = key.offset - search_start;
@@ -1515,6 +1518,7 @@ next:else ret =0 ; +ASSERT (max_hole_start + max_hole_size <= search_end); out:btrfs_free_path (path); *start = max_hole_start;
Greg Kroah-Hartman
maintainerPATCH 44/89 ALSA: emux: Avoid potential array out-of-bound in snd_emux_xg_control()
In reply to Greg Kroah-HartmanFrom: Artemii Karasev <[email protected]>
commit 6a32425f953b955b4ff82f339d01df0b713caa5d upstream.
snd_emux_xg_control() can be called with an argument 'param' greater than size of 'control' array. It may lead to accessing 'control' array at a wrong index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- sound/synth/emux/emux_nrpn.c | 3 +++ 1 file changed, 3 insertions(+)
sound/synth/emux/emux_nrpn.c +3 -0
@@ -363,6 +363,9 @@ int snd_emux_xg_control(struct snd_emux_port *port, struct snd_midi_channel *chan, int param) { + if (param >= ARRAY_SIZE(chan->control)) + return -EINVAL; + return send_converted_effect(xg_effects, ARRAY_SIZE(xg_effects), port, chan, param, chan->control[param],
Greg Kroah-Hartman
maintainerPATCH 45/89 IB/hfi1: Restore allocated resources on failed copyout
In reply to Greg Kroah-HartmanFrom: Dean Luick <[email protected]>
[ Upstream commit 6601fc0d15ffc20654e39486f9bef35567106d68 ]
Fix a resource leak if an error occurs.
--- drivers/infiniband/hw/hfi1/file_ops.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/infiniband/hw/hfi1/file_ops.c +5 -2
@@ -1361,12 +1361,15 @@ static int user_exp_rcv_setup(struct hfi1_filedata *fd, unsigned long arg, addr = arg + offsetof(struct hfi1_tid_info , tidcnt);if (copy_to_user ((void __user *)addr, &tinfo.tidcnt,sizeof (tinfo.tidcnt))) -return -EFAULT ; + ret = -EFAULT ; addr = arg + offsetof(struct hfi1_tid_info , length); -if (copy_to_user ((void __user *)addr, &tinfo.length, +if (!ret &©_to_user ((void __user *)addr, &tinfo.length,sizeof (tinfo.length))) ret = -EFAULT ; + +if (ret) +hfi1_user_exp_rcv_invalid (fd, &tinfo); }return ret;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 46/89 net: phy: add macros for PHYID matching
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit aa2af2eb447c9a21c8c9e8d2336672bb620cf900 ]
Add macros for PHYID matching to be used in PHY driver configs. By using these macros some boilerplate code can be avoided.
Stable-dep-of: 69ff53e4a4c9 ("net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY")
--- include/linux/phy.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/phy.h +4 -0
@@ -667,6 +667,10 @@ struct phy_driver {#define PHY_ANY_ID "MATCH ANY PHY"#define PHY_ANY_UID 0xffffffff +#define PHY_ID_MATCH_EXACT (id) .phy_id = (id), .phy_id_mask = GENMASK(31, 0) +#define PHY_ID_MATCH_MODEL (id) .phy_id = (id), .phy_id_mask = GENMASK(31, 4) +#define PHY_ID_MATCH_VENDOR (id) .phy_id = (id), .phy_id_mask = GENMASK(31, 10) +/* A Structure for boards to register fixups with the PHY Lib */ struct phy_fixup {struct list_head list;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 47/89 net: phy: meson-gxl: add g12a support
In reply to Greg Kroah-HartmanFrom: Jerome Brunet <[email protected]>
[ Upstream commit 5c3407abb3382fb0621a503662d00495f7ab65c4 ]
The g12a SoC family uses the type of internal PHY that was used on the gxl family. The quirks of gxl family, like the LPA register corruption, appear to have been resolved on this new SoC generation.
Stable-dep-of: 69ff53e4a4c9 ("net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY")
--- drivers/net/phy/meson-gxl.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/phy/meson-gxl.c +11 -0
@@ -246,11 +246,22 @@ static struct phy_driver meson_gxl_phy[] = { .config_intr = meson_gxl_config_intr, .suspend = genphy_suspend, .resume = genphy_resume, + }, { + PHY_ID_MATCH_EXACT(0x01803301), + .name = "Meson G12A Internal PHY", + .features = PHY_BASIC_FEATURES, + .flags = PHY_IS_INTERNAL, + .soft_reset = genphy_soft_reset, + .ack_interrupt = meson_gxl_ack_interrupt, + .config_intr = meson_gxl_config_intr, + .suspend = genphy_suspend, + .resume = genphy_resume, }, };static struct mdio_device_id __maybe_unused meson_gxl_tbl[] = { {0x01814400 ,0xfffffff0 }, + {PHY_ID_MATCH_VENDOR (0x01803301 ) }, { } };
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 48/89 net: phy: meson-gxl: use MMD access dummy stubs for GXL, internal PHY
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 69ff53e4a4c9498eeed7d1441f68a1481dc69251 ]
Jerome provided the information that also the GXL internal PHY doesn't support MMD register access and EEE. MMD reads return 0xffff, what results in e.g. completely wrong ethtool --show-eee output. Therefore use the MMD dummy stubs.
--- drivers/net/phy/meson-gxl.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/meson-gxl.c +2 -0
@@ -246,6 +246,8 @@ static struct phy_driver meson_gxl_phy[] = { .config_intr = meson_gxl_config_intr, .suspend = genphy_suspend, .resume = genphy_resume, + .read_mmd = genphy_read_mmd_unsupported, + .write_mmd = genphy_write_mmd_unsupported, }, { PHY_ID_MATCH_EXACT(0x01803301), .name = "Meson G12A Internal PHY",
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 49/89 rds: rds_rm_zerocopy_callback() use list_first_entry()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit f753a68980cf4b59a80fe677619da2b1804f526d ]
rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion.
Use list_first_entry() to actually access the first element of the rs_zcookie_queue list.
--- net/rds/message.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/rds/message.c +3 -3
@@ -104,9 +104,9 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs,spin_lock_irqsave (&q->lock, flags); head = &q->zcookie_head;if (!list_empty (head)) { - info = list_entry(head, struct rds_msg_zcopy_info, - rs_zcookie_next); -if (info &&rds_zcookie_add (info, cookie)) { + info = list_first_entry(head, struct rds_msg_zcopy_info, + rs_zcookie_next); +if (rds_zcookie_add (info, cookie)) {spin_unlock_irqrestore (&q->lock, flags);kfree (rds_info_from_znotifier (znotif));/* caller invokes rds_wake_sk_sleep() */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 50/89 selftests: forwarding: lib: quote the sysctl values
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 3a082086aa200852545cf15159213582c0c80eba ]
When set/restore sysctl value, we should quote the value as some keys may have multi values, e.g. net.ipv4.ping_group_range
--- tools/testing/selftests/net/forwarding/lib.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/forwarding/lib.sh +2 -2
@@ -519,14 +519,14 @@ sysctl_set() local value=$1; shift SYSCTL_ORIG[$key]=$(sysctl -n $key) - sysctl -qw $key=$value + sysctl -qw $key="$value" } sysctl_restore() { local key=$1; shift - sysctl -qw $key=${SYSCTL_ORIG["$key"]} + sysctl -qw $key="${SYSCTL_ORIG[$key]}" } forwarding_enable()
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 51/89 ALSA: pci: lx6464es: fix a debug loop
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 5dac9f8dc25fefd9d928b98f6477ff3daefd73e3 ]
This loop accidentally reuses the "i" iterator for both the inside and the outside loop. The value of MAX_STREAM_BUFFER is 5. I believe that chip->rmh.stat_len is in the 2-12 range. If the value of .stat_len is 4 or more then it will loop exactly one time, but if it's less then it is a forever loop.
It looks like it was supposed to combined into one loop where conditions are checked.
--- sound/pci/lx6464es/lx_core.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
sound/pci/lx6464es/lx_core.c +5 -6
@@ -508,12 +508,11 @@ int lx_buffer_ask(struct lx6464es *chip, u32 pipe, int is_capture,dev_dbg (chip->card->dev,"CMD_08_ASK_BUFFERS: needed %d, freed %d\n" , *r_needed, *r_freed); -for (i =0 ; i <MAX_STREAM_BUFFER ; ++i) { -for (i =0 ; i != chip->rmh.stat_len; ++i) -dev_dbg (chip->card->dev, -" stat[%d]: %x, %x\n" , i, - chip->rmh.stat[i], - chip->rmh.stat[i] &MASK_DATA_SIZE ); +for (i =0 ; i <MAX_STREAM_BUFFER && i < chip->rmh.stat_len; + ++i) { +dev_dbg (chip->card->dev," stat[%d]: %x, %x\n" , i, + chip->rmh.stat[i], + chip->rmh.stat[i] &MASK_DATA_SIZE ); } }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 52/89 pinctrl: aspeed: Fix confusing types in return value
In reply to Greg Kroah-HartmanFrom: Joel Stanley <[email protected]>
[ Upstream commit 287a344a11f1ebd31055cf9b22c88d7005f108d7 ]
The function signature is int, but we return a bool. Instead return a negative errno as the kerneldoc suggests.
--- drivers/pinctrl/aspeed/pinctrl-aspeed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/aspeed/pinctrl-aspeed.c +1 -1
@@ -295,7 +295,7 @@ static int aspeed_disable_sig(const struct aspeed_sig_expr **exprs,int ret =0 ;if (!exprs) -return true; +return -EINVAL ;while (*exprs && !ret) { ret =aspeed_sig_expr_disable (*exprs, maps);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 53/89 pinctrl: single: fix potential NULL dereference
In reply to Greg Kroah-HartmanFrom: Maxim Korotkov <[email protected]>
[ Upstream commit d2d73e6d4822140445ad4a7b1c6091e0f5fe703b ]
Added checking of pointer "function" in pcs_set_mux(). pinmux_generic_get_function() can return NULL and the pointer "function" was dereferenced without checking against NULL.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/pinctrl/pinctrl-single.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pinctrl/pinctrl-single.c +2 -0
@@ -345,6 +345,8 @@ static int pcs_set_mux(struct pinctrl_dev *pctldev, unsigned fselector,if (!pcs->fmask)return 0 ; function =pinmux_generic_get_function (pctldev, fselector); +if (!function) +return -EINVAL ; func = function->data;if (!func)return -EINVAL ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 54/89 pinctrl: intel: Convert unsigned to unsigned int
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 04035f7f59bd106219d062293234bba683f6db71 ]
Simple type conversion with no functional change implied.
Stable-dep-of: a8520be3ffef ("pinctrl: intel: Restore the pins that used to be in Direct IRQ mode")
--- drivers/pinctrl/intel/pinctrl-intel.c | 101 +++++++++++++------------- drivers/pinctrl/intel/pinctrl-intel.h | 32 ++++---- 2 files changed, 67 insertions(+), 66 deletions(-)
drivers/pinctrl/intel/pinctrl-intel.c +51 -50
@@ -116,7 +116,7 @@ struct intel_pinctrl {#define padgroup_offset (g, p) ((p) - (g)->base)static struct intel_community *intel_get_community (struct intel_pinctrl *pctrl, -unsigned pin) +unsigned int pin) {struct intel_community *community;int i;
@@ -134,7 +134,7 @@ static struct intel_community *intel_get_community(struct intel_pinctrl *pctrl,static const struct intel_padgroup *intel_community_get_padgroup (const struct intel_community *community, -unsigned pin) +unsigned int pin) {int i;
@@ -148,11 +148,11 @@ intel_community_get_padgroup(const struct intel_community *community,return NULL ; } -static void __iomem *intel_get_padcfg (struct intel_pinctrl *pctrl,unsigned pin, -unsigned reg) +static void __iomem *intel_get_padcfg (struct intel_pinctrl *pctrl, +unsigned int pin,unsigned int reg) {const struct intel_community *community; -unsigned padno; +unsigned int padno;size_t nregs; community =intel_get_community (pctrl, pin);
@@ -168,11 +168,11 @@ static void __iomem *intel_get_padcfg(struct intel_pinctrl *pctrl, unsigned pin,return community->pad_regs + reg + padno * nregs *4 ; } -static bool intel_pad_owned_by_host (struct intel_pinctrl *pctrl,unsigned pin) +static bool intel_pad_owned_by_host (struct intel_pinctrl *pctrl,unsigned int pin) {const struct intel_community *community;const struct intel_padgroup *padgrp; -unsigned gpp, offset, gpp_offset; +unsigned int gpp, offset, gpp_offset;void __iomem *padown; community =intel_get_community (pctrl, pin);
@@ -193,11 +193,11 @@ static bool intel_pad_owned_by_host(struct intel_pinctrl *pctrl, unsigned pin)return !(readl (padown) &PADOWN_MASK (gpp_offset)); } -static bool intel_pad_acpi_mode (struct intel_pinctrl *pctrl,unsigned pin) +static bool intel_pad_acpi_mode (struct intel_pinctrl *pctrl,unsigned int pin) {const struct intel_community *community;const struct intel_padgroup *padgrp; -unsigned offset, gpp_offset; +unsigned int offset, gpp_offset;void __iomem *hostown; community =intel_get_community (pctrl, pin);
@@ -217,11 +217,11 @@ static bool intel_pad_acpi_mode(struct intel_pinctrl *pctrl, unsigned pin)return !(readl (hostown) &BIT (gpp_offset)); } -static bool intel_pad_locked (struct intel_pinctrl *pctrl,unsigned pin) +static bool intel_pad_locked (struct intel_pinctrl *pctrl,unsigned int pin) {struct intel_community *community;const struct intel_padgroup *padgrp; -unsigned offset, gpp_offset; +unsigned int offset, gpp_offset;u32 value; community =intel_get_community (pctrl, pin);
@@ -254,7 +254,7 @@ static bool intel_pad_locked(struct intel_pinctrl *pctrl, unsigned pin)return false; } -static bool intel_pad_usable (struct intel_pinctrl *pctrl,unsigned pin) +static bool intel_pad_usable (struct intel_pinctrl *pctrl,unsigned int pin) {return intel_pad_owned_by_host (pctrl, pin) && !intel_pad_locked (pctrl, pin);
@@ -268,15 +268,15 @@ static int intel_get_groups_count(struct pinctrl_dev *pctldev) }static const char *intel_get_group_name (struct pinctrl_dev *pctldev, -unsigned group) +unsigned int group) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);return pctrl->soc->groups[group].name; } -static int intel_get_group_pins (struct pinctrl_dev *pctldev,unsigned group, -const unsigned **pins,unsigned *npins) +static int intel_get_group_pins (struct pinctrl_dev *pctldev,unsigned int group, +const unsigned int **pins,unsigned int *npins) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);
@@ -286,7 +286,7 @@ static int intel_get_group_pins(struct pinctrl_dev *pctldev, unsigned group, }static void intel_pin_dbg_show (struct pinctrl_dev *pctldev,struct seq_file *s, -unsigned pin) +unsigned int pin) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);void __iomem *padcfg;
@@ -345,7 +345,7 @@ static int intel_get_functions_count(struct pinctrl_dev *pctldev) }static const char *intel_get_function_name (struct pinctrl_dev *pctldev, -unsigned function) +unsigned int function) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);
@@ -353,9 +353,9 @@ static const char *intel_get_function_name(struct pinctrl_dev *pctldev, }static int intel_get_function_groups (struct pinctrl_dev *pctldev, -unsigned function, +unsigned int function,const char *const **groups, -unsigned *const ngroups) +unsigned int *const ngroups) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);
@@ -364,8 +364,8 @@ static int intel_get_function_groups(struct pinctrl_dev *pctldev,return 0 ; } -static int intel_pinmux_set_mux (struct pinctrl_dev *pctldev,unsigned function, -unsigned group) +static int intel_pinmux_set_mux (struct pinctrl_dev *pctldev, +unsigned int function,unsigned int group) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);const struct intel_pingroup *grp = &pctrl->soc->groups[group];
@@ -447,7 +447,7 @@ static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)static int intel_gpio_request_enable (struct pinctrl_dev *pctldev,struct pinctrl_gpio_range *range, -unsigned pin) +unsigned int pin) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);void __iomem *padcfg0;
@@ -485,7 +485,7 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,static int intel_gpio_set_direction (struct pinctrl_dev *pctldev,struct pinctrl_gpio_range *range, -unsigned pin,bool input) +unsigned int pin,bool input) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);void __iomem *padcfg0;
@@ -510,7 +510,7 @@ static const struct pinmux_ops intel_pinmux_ops = { .gpio_set_direction = intel_gpio_set_direction, }; -static int intel_config_get (struct pinctrl_dev *pctldev,unsigned pin, +static int intel_config_get (struct pinctrl_dev *pctldev,unsigned int pin,unsigned long *config) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);
@@ -599,11 +599,11 @@ static int intel_config_get(struct pinctrl_dev *pctldev, unsigned pin,return 0 ; } -static int intel_config_set_pull (struct intel_pinctrl *pctrl,unsigned pin, +static int intel_config_set_pull (struct intel_pinctrl *pctrl,unsigned int pin,unsigned long config) { -unsigned param =pinconf_to_config_param (config); -unsigned arg =pinconf_to_config_argument (config); +unsigned int param =pinconf_to_config_param (config); +unsigned int arg =pinconf_to_config_argument (config);const struct intel_community *community;void __iomem *padcfg1;unsigned long flags;
@@ -685,8 +685,8 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned pin,return ret; } -static int intel_config_set_debounce (struct intel_pinctrl *pctrl,unsigned pin, -unsigned debounce) +static int intel_config_set_debounce (struct intel_pinctrl *pctrl, +unsigned int pin,unsigned int debounce) {void __iomem *padcfg0, *padcfg2;unsigned long flags;
@@ -732,8 +732,8 @@ static int intel_config_set_debounce(struct intel_pinctrl *pctrl, unsigned pin,return ret; } -static int intel_config_set (struct pinctrl_dev *pctldev,unsigned pin, -unsigned long *configs,unsigned nconfigs) +static int intel_config_set (struct pinctrl_dev *pctldev,unsigned int pin, +unsigned long *configs,unsigned int nconfigs) {struct intel_pinctrl *pctrl =pinctrl_dev_get_drvdata (pctldev);int i, ret;
@@ -790,7 +790,7 @@ static const struct pinctrl_desc intel_pinctrl_desc = {* automatically translated to pinctrl pin number. This function can be * used to find out the corresponding pinctrl pin. */ -static int intel_gpio_to_pin (struct intel_pinctrl *pctrl,unsigned offset, +static int intel_gpio_to_pin (struct intel_pinctrl *pctrl,unsigned int offset,const struct intel_community **community,const struct intel_padgroup **padgrp) {
@@ -824,7 +824,7 @@ static int intel_gpio_to_pin(struct intel_pinctrl *pctrl, unsigned offset,return -EINVAL ; } -static int intel_gpio_get (struct gpio_chip *chip,unsigned offset) +static int intel_gpio_get (struct gpio_chip *chip,unsigned int offset) {struct intel_pinctrl *pctrl =gpiochip_get_data (chip);void __iomem *reg;
@@ -846,7 +846,8 @@ static int intel_gpio_get(struct gpio_chip *chip, unsigned offset)return !!(padcfg0 &PADCFG0_GPIORXSTATE ); } -static void intel_gpio_set (struct gpio_chip *chip,unsigned offset,int value) +static void intel_gpio_set (struct gpio_chip *chip,unsigned int offset, +int value) {struct intel_pinctrl *pctrl =gpiochip_get_data (chip);unsigned long flags;
@@ -895,12 +896,12 @@ static int intel_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)return !!(padcfg0 &PADCFG0_GPIOTXDIS ); } -static int intel_gpio_direction_input (struct gpio_chip *chip,unsigned offset) +static int intel_gpio_direction_input (struct gpio_chip *chip,unsigned int offset) {return pinctrl_gpio_direction_input (chip->base + offset); } -static int intel_gpio_direction_output (struct gpio_chip *chip,unsigned offset, +static int intel_gpio_direction_output (struct gpio_chip *chip,unsigned int offset,int value) {intel_gpio_set (chip, offset, value);
@@ -929,7 +930,7 @@ static void intel_gpio_irq_ack(struct irq_data *d) pin =intel_gpio_to_pin (pctrl,irqd_to_hwirq (d), &community, &padgrp);if (pin >=0 ) { -unsigned gpp, gpp_offset, is_offset; +unsigned int gpp, gpp_offset, is_offset; gpp = padgrp->reg_num; gpp_offset =padgroup_offset (padgrp, pin);
@@ -951,7 +952,7 @@ static void intel_gpio_irq_enable(struct irq_data *d) pin =intel_gpio_to_pin (pctrl,irqd_to_hwirq (d), &community, &padgrp);if (pin >=0 ) { -unsigned gpp, gpp_offset, is_offset; +unsigned int gpp, gpp_offset, is_offset;unsigned long flags;u32 value;
@@ -980,7 +981,7 @@ static void intel_gpio_irq_mask_unmask(struct irq_data *d, bool mask) pin =intel_gpio_to_pin (pctrl,irqd_to_hwirq (d), &community, &padgrp);if (pin >=0 ) { -unsigned gpp, gpp_offset; +unsigned int gpp, gpp_offset;unsigned long flags;void __iomem *reg;u32 value;
@@ -1011,11 +1012,11 @@ static void intel_gpio_irq_unmask(struct irq_data *d)intel_gpio_irq_mask_unmask (d, false); } -static int intel_gpio_irq_type (struct irq_data *d,unsigned type) +static int intel_gpio_irq_type (struct irq_data *d,unsigned int type) {struct gpio_chip *gc =irq_data_get_irq_chip_data (d);struct intel_pinctrl *pctrl =gpiochip_get_data (gc); -unsigned pin =intel_gpio_to_pin (pctrl,irqd_to_hwirq (d),NULL ,NULL ); +unsigned int pin =intel_gpio_to_pin (pctrl,irqd_to_hwirq (d),NULL ,NULL );unsigned long flags;void __iomem *reg;u32 value;
@@ -1072,7 +1073,7 @@ static int intel_gpio_irq_wake(struct irq_data *d, unsigned int on) {struct gpio_chip *gc =irq_data_get_irq_chip_data (d);struct intel_pinctrl *pctrl =gpiochip_get_data (gc); -unsigned pin =intel_gpio_to_pin (pctrl,irqd_to_hwirq (d),NULL ,NULL ); +unsigned int pin =intel_gpio_to_pin (pctrl,irqd_to_hwirq (d),NULL ,NULL );if (on)enable_irq_wake (pctrl->irq);
@@ -1167,7 +1168,7 @@ static int intel_gpio_add_pin_ranges(struct intel_pinctrl *pctrl,static unsigned intel_gpio_ngpio (const struct intel_pinctrl *pctrl) {const struct intel_community *community; -unsigned ngpio =0 ; +unsigned int ngpio =0 ;int i, j;for (i =0 ; i < pctrl->ncommunities; i++) {
@@ -1243,8 +1244,8 @@ static int intel_pinctrl_add_padgroups(struct intel_pinctrl *pctrl, struct intel_community *community) {struct intel_padgroup *gpps; -unsigned npins = community->npins; -unsigned padown_num =0 ; +unsigned int npins = community->npins; +unsigned int padown_num =0 ;size_t ngpps, i;if (community->gpps)
@@ -1260,7 +1261,7 @@ static int intel_pinctrl_add_padgroups(struct intel_pinctrl *pctrl,if (community->gpps) { gpps[i] = community->gpps[i]; }else { -unsigned gpp_size = community->gpp_size; +unsigned int gpp_size = community->gpp_size; gpps[i].reg_num = i; gpps[i].base = community->pin_base + i * gpp_size;
@@ -1431,7 +1432,7 @@ int intel_pinctrl_probe(struct platform_device *pdev,EXPORT_SYMBOL_GPL (intel_pinctrl_probe);#ifdef CONFIG_PM_SLEEP -static bool intel_pinctrl_should_save (struct intel_pinctrl *pctrl,unsigned pin) +static bool intel_pinctrl_should_save (struct intel_pinctrl *pctrl,unsigned int pin) {const struct pin_desc *pd =pin_desc_get (pctrl->pctldev, pin);u32 value;
@@ -1502,7 +1503,7 @@ int intel_pinctrl_suspend(struct device *dev)for (i =0 ; i < pctrl->ncommunities; i++) {struct intel_community *community = &pctrl->communities[i];void __iomem *base; -unsigned gpp; +unsigned int gpp; base = community->regs + community->ie_offset;for (gpp =0 ; gpp < community->ngpps; gpp++)
@@ -1520,7 +1521,7 @@ static void intel_gpio_irq_init(struct intel_pinctrl *pctrl)for (i =0 ; i < pctrl->ncommunities; i++) {const struct intel_community *community;void __iomem *base; -unsigned gpp; +unsigned int gpp; community = &pctrl->communities[i]; base = community->regs;
@@ -1584,7 +1585,7 @@ int intel_pinctrl_resume(struct device *dev)for (i =0 ; i < pctrl->ncommunities; i++) {struct intel_community *community = &pctrl->communities[i];void __iomem *base; -unsigned gpp; +unsigned int gpp; base = community->regs + community->ie_offset;for (gpp =0 ; gpp < community->ngpps; gpp++) {
drivers/pinctrl/intel/pinctrl-intel.h +16 -16
@@ -25,10 +25,10 @@ struct device;*/ struct intel_pingroup {const char *name; -const unsigned *pins; +const unsigned int *pins;size_t npins;unsigned short mode; -const unsigned *modes; +const unsigned int *modes; };/**
@@ -56,11 +56,11 @@ struct intel_function {* to specify them. */ struct intel_padgroup { -unsigned reg_num; -unsigned base; -unsigned size; +unsigned int reg_num; +unsigned int base; +unsigned int size;int gpio_base; -unsigned padown_num; +unsigned int padown_num; };/**
@@ -96,17 +96,17 @@ struct intel_padgroup {* pass custom @gpps and @ngpps instead. */ struct intel_community { -unsigned barno; -unsigned padown_offset; -unsigned padcfglock_offset; -unsigned hostown_offset; -unsigned is_offset; -unsigned ie_offset; -unsigned pin_base; -unsigned gpp_size; -unsigned gpp_num_padown_regs; +unsigned int barno; +unsigned int padown_offset; +unsigned int padcfglock_offset; +unsigned int hostown_offset; +unsigned int is_offset; +unsigned int ie_offset; +unsigned int pin_base; +unsigned int gpp_size; +unsigned int gpp_num_padown_regs;size_t npins; -unsigned features; +unsigned int features;const struct intel_padgroup *gpps;size_t ngpps;/* Reserved for the core driver */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 55/89 pinctrl: intel: Restore the pins that used to be in Direct IRQ mode
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit a8520be3ffef3d25b53bf171a7ebe17ee0154175 ]
If the firmware mangled the register contents too much, check the saved value for the Direct IRQ mode. If it matches, we will restore the pin state.
--- drivers/pinctrl/intel/pinctrl-intel.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/pinctrl/intel/pinctrl-intel.c +13 -3
@@ -1432,6 +1432,12 @@ int intel_pinctrl_probe(struct platform_device *pdev,EXPORT_SYMBOL_GPL (intel_pinctrl_probe);#ifdef CONFIG_PM_SLEEP +static bool __intel_gpio_is_direct_irq (u32 value) +{ +return (value &PADCFG0_GPIROUTIOXAPIC ) && (value &PADCFG0_GPIOTXDIS ) && + (__intel_gpio_get_gpio_mode (value) ==PADCFG0_PMODE_GPIO ); +} +static bool intel_pinctrl_should_save (struct intel_pinctrl *pctrl,unsigned int pin) {const struct pin_desc *pd =pin_desc_get (pctrl->pctldev, pin);
@@ -1465,8 +1471,7 @@ static bool intel_pinctrl_should_save(struct intel_pinctrl *pctrl, unsigned int* See https://bugzilla.kernel.org/show_bug.cgi?id=214749. */ value =readl (intel_get_padcfg (pctrl, pin,PADCFG0 )); -if ((value &PADCFG0_GPIROUTIOXAPIC ) && (value &PADCFG0_GPIOTXDIS ) && - (__intel_gpio_get_gpio_mode (value) ==PADCFG0_PMODE_GPIO )) +if (__intel_gpio_is_direct_irq (value))return true;return false;
@@ -1551,7 +1556,12 @@ int intel_pinctrl_resume(struct device *dev)void __iomem *padcfg;u32 val; -if (!intel_pinctrl_should_save (pctrl, desc->number)) +if (!(intel_pinctrl_should_save (pctrl, desc->number) || +/* +* If the firmware mangled the register contents too much, +* check the saved value for the Direct IRQ mode. +*/ +__intel_gpio_is_direct_irq (pads[i].padcfg0)))continue ; padcfg =intel_get_padcfg (pctrl, desc->number,PADCFG0 );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 56/89 net: USB: Fix wrong-direction WARNING in plusb.c
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 811d581194f7412eda97acc03d17fc77824b561f upstream.
The syzbot fuzzer detected a bug in the plusb network driver: A zero-length control-OUT transfer was treated as a read instead of a write. In modern kernels this error provokes a WARNING:
usb 1-1: BOGUS control dir, pipe 80000280 doesn't match bRequestType c0
WARNING: CPU: 0 PID: 4645 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 1 PID: 4645 Comm: dhcpcd Not tainted 6.2.0-rc6-syzkaller-00050-g9f266ccaa2f5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 ... Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 __usbnet_read_cmd+0xb9/0x390 drivers/net/usb/usbnet.c:2010 usbnet_read_cmd+0x96/0xf0 drivers/net/usb/usbnet.c:2068 pl_vendor_req drivers/net/usb/plusb.c:60 [inline] pl_set_QuickLink_features drivers/net/usb/plusb.c:75 [inline] pl_reset+0x2f/0xf0 drivers/net/usb/plusb.c:85 usbnet_open+0xcc/0x5d0 drivers/net/usb/usbnet.c:889 __dev_open+0x297/0x4d0 net/core/dev.c:1417 __dev_change_flags+0x587/0x750 net/core/dev.c:8530 dev_change_flags+0x97/0x170 net/core/dev.c:8602 devinet_ioctl+0x15a2/0x1d70 net/ipv4/devinet.c:1147 inet_ioctl+0x33f/0x380 net/ipv4/af_inet.c:979 sock_do_ioctl+0xcc/0x230 net/socket.c:1169 sock_ioctl+0x1f8/0x680 net/socket.c:1286 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The fix is to call usbnet_write_cmd() instead of usbnet_read_cmd() and remove the USB_DIR_IN flag.
--- drivers/net/usb/plusb.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/usb/plusb.c +1 -3
@@ -69,9 +69,7 @@static inline int pl_vendor_req (struct usbnet *dev,u8 req,u8 val,u8 index) { -return usbnet_read_cmd (dev, req, -USB_DIR_IN |USB_TYPE_VENDOR | -USB_RECIP_DEVICE , +return usbnet_write_cmd (dev, req,USB_TYPE_VENDOR |USB_RECIP_DEVICE , val, index,NULL ,0 ); }
Greg Kroah-Hartman
maintainerPATCH 57/89 usb: core: add quirk for Alcor Link AK9563 smartcard reader
In reply to Greg Kroah-HartmanFrom: Mark Pearson <[email protected]>
commit 303e724d7b1e1a0a93daf0b1ab5f7c4f53543b34 upstream.
The Alcor Link AK9563 smartcard reader used on some Lenovo platforms doesn't work. If LPM is enabled the reader will provide an invalid usb config descriptor. Added quirk to disable LPM.
Verified fix on Lenovo P16 G1 and T14 G3
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -527,6 +527,9 @@ static const struct usb_device_id usb_qu/* DJI CineSSD */ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, + /* Alcor Link AK9563 SC Reader used in 2022 Lenovo ThinkPads */ + { USB_DEVICE(0x2ce3, 0x9563), .driver_info = USB_QUIRK_NO_LPM }, + /* DELL USB GEN2 */ { USB_DEVICE(0x413c, 0xb062), .driver_info = USB_QUIRK_NO_LPM | USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 58/89 usb: typec: altmodes/displayport: Fix probe pin assign check
In reply to Greg Kroah-HartmanFrom: Prashant Malani <[email protected]>
commit 54e5c00a4eb0a4c663445b245f641bbfab142430 upstream.
While checking Pin Assignments of the port and partner during probe, we don't take into account whether the peripheral is a plug or receptacle.
This manifests itself in a mode entry failure on certain docks and dongles with captive cables. For instance, the Startech.com Type-C to DP dongle (Model #CDP2DP) advertises its DP VDO as 0x405. This would fail the Pin Assignment compatibility check, despite it supporting Pin Assignment C as a UFP.
Update the check to use the correct DP Pin Assign macros that take the peripheral's receptacle bit into account.
--- drivers/usb/typec/altmodes/displayport.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/typec/altmodes/displayport.c +4 -4
@@ -526,10 +526,10 @@ static int dp_altmode_probe(struct typec/* FIXME: Port can only be DFP_U. */ /* Make sure we have compatiple pin configurations */ -if (!(DP_CAP_DFP_D_PIN_ASSIGN (port->vdo) & -DP_CAP_UFP_D_PIN_ASSIGN (alt->vdo)) && - !(DP_CAP_UFP_D_PIN_ASSIGN (port->vdo) & -DP_CAP_DFP_D_PIN_ASSIGN (alt->vdo))) +if (!(DP_CAP_PIN_ASSIGN_DFP_D (port->vdo) & +DP_CAP_PIN_ASSIGN_UFP_D (alt->vdo)) && + !(DP_CAP_PIN_ASSIGN_UFP_D (port->vdo) & +DP_CAP_PIN_ASSIGN_DFP_D (alt->vdo)))return -ENODEV ; ret =sysfs_create_group (&alt->dev.kobj, &dp_altmode_group);
Greg Kroah-Hartman
maintainerPATCH 59/89 riscv: Fixup race condition on PG_dcache_clean in flush_icache_pte
In reply to Greg Kroah-HartmanFrom: Guo Ren <[email protected]>
commit 950b879b7f0251317d26bae0687e72592d607532 upstream.
In commit 588a513d3425 ("arm64: Fix race condition on PG_dcache_clean in __sync_icache_dcache()"), we found RISC-V has the same issue as the previous arm64. The previous implementation didn't guarantee the correct sequence of operations, which means flush_icache_all() hasn't been called when the PG_dcache_clean was set. That would cause a risk of page synchronization.
--- arch/riscv/mm/cacheflush.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/riscv/mm/cacheflush.c +3 -1
@@ -18,6 +18,8 @@ void flush_icache_pte(pte_t pte) {struct page *page =pte_page (pte); -if (!test_and_set_bit (PG_dcache_clean, &page->flags)) +if (!test_bit (PG_dcache_clean, &page->flags)) {flush_icache_all (); +set_bit (PG_dcache_clean, &page->flags); + } }
Greg Kroah-Hartman
maintainerPATCH 60/89 arm64: dts: meson-gx: Make mmc host controller interrupts level-sensitive
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
commit 66e45351f7d6798751f98001d1fcd572024d87f0 upstream.
The usage of edge-triggered interrupts lead to lost interrupts under load, see [0]. This was confirmed to be fixed by using level-triggered interrupts.
The report was about SDIO. However, as the host controller is the same for SD and MMC, apply the change to all mmc controller instances.
[0] https://www.spinics.net/lists/linux-mmc/msg73991.html
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +3 -3
@@ -470,21 +470,21 @@ sd_emmc_a: mmc@70000 { compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc"; reg = <0x0 0x70000 0x0 0x800>; - interrupts = <GIC_SPI 216 IRQ_TYPE_EDGE_RISING>; + interrupts = <GIC_SPI 216 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; }; sd_emmc_b: mmc@72000 { compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc"; reg = <0x0 0x72000 0x0 0x800>; - interrupts = <GIC_SPI 217 IRQ_TYPE_EDGE_RISING>; + interrupts = <GIC_SPI 217 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; }; sd_emmc_c: mmc@74000 { compatible = "amlogic,meson-gx-mmc", "amlogic,meson-gxbb-mmc"; reg = <0x0 0x74000 0x0 0x800>; - interrupts = <GIC_SPI 218 IRQ_TYPE_EDGE_RISING>; + interrupts = <GIC_SPI 218 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; }; };
Greg Kroah-Hartman
maintainerPATCH 61/89 arm64: dts: meson-axg: Make mmc host controller interrupts level-sensitive
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
commit d182bcf300772d8b2e5f43e47fa0ebda2b767cc4 upstream.
The usage of edge-triggered interrupts lead to lost interrupts under load, see [0]. This was confirmed to be fixed by using level-triggered interrupts.
The report was about SDIO. However, as the host controller is the same for SD and MMC, apply the change to all mmc controller instances.
[0] https://www.spinics.net/lists/linux-mmc/msg73991.html
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +2 -2
@@ -167,7 +167,7 @@ sd_emmc_b: sd@5000 { compatible = "amlogic,meson-axg-mmc"; reg = <0x0 0x5000 0x0 0x800>; - interrupts = <GIC_SPI 217 IRQ_TYPE_EDGE_RISING>; + interrupts = <GIC_SPI 217 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clocks = <&clkc CLKID_SD_EMMC_B>, <&clkc CLKID_SD_EMMC_B_CLK0>,
@@ -179,7 +179,7 @@ sd_emmc_c: mmc@7000 { compatible = "amlogic,meson-axg-mmc"; reg = <0x0 0x7000 0x0 0x800>; - interrupts = <GIC_SPI 218 IRQ_TYPE_EDGE_RISING>; + interrupts = <GIC_SPI 218 IRQ_TYPE_LEVEL_HIGH>; status = "disabled"; clocks = <&clkc CLKID_SD_EMMC_C>, <&clkc CLKID_SD_EMMC_C_CLK0>,
Greg Kroah-Hartman
maintainerPATCH 62/89 bpf: Always return target ifindex in bpf_fib_lookup
In reply to Greg Kroah-HartmanFrom: Toke Høiland-Jørgensen <[email protected]>
commit d1c362e1dd68a421cf9033404cf141a4ab734a5d upstream.
The bpf_fib_lookup() helper performs a neighbour lookup for the destination IP and returns BPF_FIB_LKUP_NO_NEIGH if this fails, with the expectation that the BPF program will pass the packet up the stack in this case. However, with the addition of bpf_redirect_neigh() that can be used instead to perform the neighbour lookup, at the cost of a bit of duplicated work.
For that we still need the target ifindex, and since bpf_fib_lookup() already has that at the time it performs the neighbour lookup, there is really no reason why it can't just return it in any case. So let's just always return the ifindex if the FIB lookup itself succeeds.
--- net/core/filter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/filter.c +2 -1
@@ -4235,7 +4235,6 @@ static int bpf_fib_set_fwd_params(structmemcpy (params->smac, dev->dev_addr,ETH_ALEN ); params->h_vlan_TCI =0 ; params->h_vlan_proto =0 ; - params->ifindex = dev->ifindex;return 0 ; }
@@ -4333,6 +4332,7 @@ static int bpf_ipv4_fib_lookup(struct ne params->ipv4_dst = nh->nh_gw; params->rt_metric = res.fi->fib_priority; + params->ifindex = dev->ifindex;/* xdp and cls_bpf programs are run in RCU-bh so * rcu_read_lock_bh is not needed here
@@ -4447,6 +4447,7 @@ static int bpf_ipv6_fib_lookup(struct ne dev = f6i->fib6_nh.nh_dev; params->rt_metric = f6i->fib6_metric; + params->ifindex = dev->ifindex;/* xdp and cls_bpf programs are run in RCU-bh so rcu_read_lock_bh is * not needed here. Can not use __ipv6_neigh_lookup_noref here
Greg Kroah-Hartman
maintainerPATCH 63/89 migrate: hugetlb: check for hugetlb shared PMD in node migration
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
commit 73bdf65ea74857d7fb2ec3067a3cec0e261b1462 upstream.
migrate_pages/mempolicy semantics state that CAP_SYS_NICE is required to move pages shared with another process to a different node. page_mapcount
Quoted 1 line
1 is being used to determine if a hugetlb page is shared. However, a
hugetlb page will have a mapcount of 1 if mapped by multiple processes via a shared PMD. As a result, hugetlb pages shared by multiple processes and mapped with a shared PMD can be moved by a process without CAP_SYS_NICE.
To fix, check for a shared PMD if mapcount is 1. If a shared PMD is found consider the page shared.
--- mm/mempolicy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/mempolicy.c +2 -1
@@ -571,7 +571,8 @@ static int queue_pages_hugetlb(pte_t *pt goto unlock;/* With MPOL_MF_MOVE, we migrate only unshared hugepage. */ if (flags & (MPOL_MF_MOVE_ALL ) || - (flags &MPOL_MF_MOVE &&page_mapcount (page) ==1 )) + (flags &MPOL_MF_MOVE &&page_mapcount (page) ==1 && + !hugetlb_pmd_shared (pte)))isolate_huge_page (page, qp->pagelist); unlock:spin_unlock (ptl);
Greg Kroah-Hartman
maintainerPATCH 64/89 ASoC: cs42l56: fix DT probe
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit e18c6da62edc780e4f4f3c9ce07bdacd69505182 ]
While looking through legacy platform data users, I noticed that the DT probing never uses data from the DT properties, as the platform_data structure gets overwritten directly after it is initialized.
There have never been any boards defining the platform_data in the mainline kernel either, so this driver so far only worked with patched kernels or with the default values.
For the benefit of possible downstream users, fix the DT probe by no longer overwriting the data.
--- sound/soc/codecs/cs42l56.c | 6 ------ 1 file changed, 6 deletions(-)
sound/soc/codecs/cs42l56.c +0 -6
@@ -1204,18 +1204,12 @@ static int cs42l56_i2c_probe(struct i2c_client *i2c_client,if (pdata) { cs42l56->pdata = *pdata; }else { - pdata =devm_kzalloc (&i2c_client->dev,sizeof (*pdata), -GFP_KERNEL ); -if (!pdata) -return -ENOMEM ; -if (i2c_client->dev.of_node) { ret =cs42l56_handle_of_data (i2c_client, &cs42l56->pdata);if (ret !=0 )return ret; } - cs42l56->pdata = *pdata; }if (cs42l56->pdata.gpio_nreset) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 65/89 tools/virtio: fix the vringh test for virtio ring changes
In reply to Greg Kroah-HartmanFrom: Shunsuke Mie <[email protected]>
[ Upstream commit 3f7b75abf41cc4143aa295f62acbb060a012868d ]
Fix the build caused by missing kmsan_handle_dma() and is_power_of_2() that are used in drivers/virtio/virtio_ring.c.
Message-Id: <[email protected]>
--- tools/virtio/linux/bug.h | 8 +++----- tools/virtio/linux/build_bug.h | 7 +++++++ tools/virtio/linux/cpumask.h | 7 +++++++ tools/virtio/linux/gfp.h | 7 +++++++ tools/virtio/linux/kernel.h | 1 + tools/virtio/linux/kmsan.h | 12 ++++++++++++ tools/virtio/linux/scatterlist.h | 1 + tools/virtio/linux/topology.h | 7 +++++++ 8 files changed, 45 insertions(+), 5 deletions(-) create mode 100644 tools/virtio/linux/build_bug.h create mode 100644 tools/virtio/linux/cpumask.h create mode 100644 tools/virtio/linux/gfp.h create mode 100644 tools/virtio/linux/kmsan.h create mode 100644 tools/virtio/linux/topology.h
tools/virtio/linux/bug.h +3 -5
@@ -1,11 +1,9 @@/* SPDX-License-Identifier: GPL-2.0 */ -#ifndef BUG_H -#define BUG_H +#ifndef _LINUX_BUG_H +#define _LINUX_BUG_H#define BUG_ON (__BUG_ON_cond) assert(!(__BUG_ON_cond)) -#define BUILD_BUG_ON (x) -#define BUG () abort() -#endif /* BUG_H */ +#endif /* _LINUX_BUG_H */
tools/virtio/linux/build_bug.h new file +7 -0
@@ -0,0 +1,7 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_BUILD_BUG_H +#define _LINUX_BUILD_BUG_H + +#define BUILD_BUG_ON (x) + +#endif /* _LINUX_BUILD_BUG_H */
tools/virtio/linux/cpumask.h new file +7 -0
@@ -0,0 +1,7 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_CPUMASK_H +#define _LINUX_CPUMASK_H + +#include <linux/kernel.h> + +#endif /* _LINUX_CPUMASK_H */
tools/virtio/linux/gfp.h new file +7 -0
@@ -0,0 +1,7 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __LINUX_GFP_H +#define __LINUX_GFP_H + +#include <linux/topology.h> + +#endif
tools/virtio/linux/kernel.h +1 -0
@@ -10,6 +10,7 @@#include <stdarg.h> #include <linux/compiler.h> +#include <linux/log2.h> #include <linux/types.h> #include <linux/printk.h> #include <linux/bug.h>
tools/virtio/linux/kmsan.h new file +12 -0
@@ -0,0 +1,12 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_KMSAN_H +#define _LINUX_KMSAN_H + +#include <linux/gfp.h> + +inline void kmsan_handle_dma (struct page *page,size_t offset,size_t size, +enum dma_data_direction dir) +{ +} + +#endif /* _LINUX_KMSAN_H */
tools/virtio/linux/scatterlist.h +1 -0
@@ -2,6 +2,7 @@ #ifndef SCATTERLIST_H #define SCATTERLIST_H #include <linux/kernel.h> +#include <linux/bug.h> struct scatterlist { unsigned long page_link;
tools/virtio/linux/topology.h new file +7 -0
@@ -0,0 +1,7 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _LINUX_TOPOLOGY_H +#define _LINUX_TOPOLOGY_H + +#include <linux/cpumask.h> + +#endif /* _LINUX_TOPOLOGY_H */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 66/89 net/rose: Fix to not accept on connected socket
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
[ Upstream commit 14caefcf9837a2be765a566005ad82cd0d2a429f ]
If you call listen() and accept() on an already connect()ed rose socket, accept() can successfully connect. This is because when the peer socket sends data to sendmsg, the skb with its own sk stored in the connected socket's sk->sk_receive_queue is connected, and rose_accept() dequeues the skb waiting in the sk->sk_receive_queue.
This creates a child socket with the sk of the parent rose socket, which can cause confusion.
Fix rose_listen() to return -EINVAL if the socket has already been successfully connected, and add lock_sock to prevent this issue.
--- net/rose/af_rose.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/rose/af_rose.c +8 -0
@@ -490,6 +490,12 @@ static int rose_listen(struct socket *sock, int backlog) {struct sock *sk = sock->sk; +lock_sock (sk); +if (sock->state !=SS_UNCONNECTED ) { +release_sock (sk); +return -EINVAL ; + } +if (sk->sk_state !=TCP_LISTEN ) {struct rose_sock *rose =rose_sk (sk);
@@ -499,8 +505,10 @@ static int rose_listen(struct socket *sock, int backlog)memset (rose->dest_digis,0 ,AX25_ADDR_LEN *ROSE_MAX_DIGIS ); sk->sk_max_ack_backlog = backlog; sk->sk_state =TCP_LISTEN ; +release_sock (sk);return 0 ; } +release_sock (sk);return -EOPNOTSUPP ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 67/89 nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
In reply to Greg Kroah-HartmanFrom: Amit Engel <[email protected]>
[ Upstream commit 0cab4404874f2de52617de8400c844891c6ea1ce ]
As part of nvmet_fc_ls_create_association there is a case where nvmet_fc_alloc_target_queue fails right after a new association with an admin queue is created. In this case, no one releases the get taken in nvmet_fc_alloc_target_assoc. This fix is adding the missing put.
--- drivers/nvme/target/fc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/nvme/target/fc.c +3 -1
@@ -1325,8 +1325,10 @@ nvmet_fc_ls_create_association(struct nvmet_fc_tgtport *tgtport,else { queue =nvmet_fc_alloc_target_queue (iod->assoc,0 ,be16_to_cpu (rqst->assoc_cmd.sqsize)); -if (!queue) +if (!queue) { ret =VERR_QUEUE_ALLOC_FAIL ; +nvmet_fc_tgt_a_put (iod->assoc); + } } }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 68/89 aio: fix mremap after fork null-deref
In reply to Greg Kroah-HartmanFrom: Seth Jenkins <[email protected]>
commit 81e9d6f8647650a7bead74c5f926e29970e834d1 upstream.
Commit e4a0d3e720e7 ("aio: Make it possible to remap aio ring") introduced a null-deref if mremap is called on an old aio mapping after fork as mm->ioctx_table will be set to NULL.
--- fs/aio.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/aio.c +4 -0
@@ -332,6 +332,9 @@ static int aio_ring_mremap(struct vm_arespin_lock (&mm->ioctx_lock);rcu_read_lock (); table =rcu_dereference (mm->ioctx_table); +if (!table) + goto out_unlock; +for (i =0 ; i < table->nr; i++) {struct kioctx *ctx;
@@ -345,6 +348,7 @@ static int aio_ring_mremap(struct vm_are } } +out_unlock:rcu_read_unlock ();spin_unlock (&mm->ioctx_lock);return res;
Greg Kroah-Hartman
maintainerPATCH 69/89 netfilter: nft_tproxy: restrict to prerouting hook
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit 18bbc3213383a82b05383827f4b1b882e3f0a5a5 upstream.
TPROXY is only allowed from prerouting, but nft_tproxy doesn't check this. This fixes a crash (null dereference) when using tproxy from e.g. output.
--- net/netfilter/nft_tproxy.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/netfilter/nft_tproxy.c +8 -0
@@ -289,6 +289,13 @@ static int nft_tproxy_dump(struct sk_bufreturn 0 ; } +static int nft_tproxy_validate (const struct nft_ctx *ctx, +const struct nft_expr *expr, +const struct nft_data **data) +{ +return nft_chain_validate_hooks (ctx->chain,1 <<NF_INET_PRE_ROUTING ); +} +static struct nft_expr_type nft_tproxy_type;static const struct nft_expr_ops nft_tproxy_ops = { .type = &nft_tproxy_type,
@@ -296,6 +303,7 @@ static const struct nft_expr_ops nft_tpr .eval = nft_tproxy_eval, .init = nft_tproxy_init, .dump = nft_tproxy_dump, + .validate = nft_tproxy_validate, };static struct nft_expr_type nft_tproxy_type__read_mostly = {
Greg Kroah-Hartman
maintainerPATCH 70/89 Revert "x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
This reverts commit a00d020f18dbe0666e221d929846f1b591b27c20 which is commit 55228db2697c09abddcb9487c3d9fa5854a932cd upstream.
_Alignof is not in the gcc version that the 4.19.y kernel still supports (4.6), so this change needs to be reverted as it breaks the build on those older compiler versions.
--- arch/x86/kernel/fpu/init.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
arch/x86/kernel/fpu/init.c +5 -2
@@ -138,6 +138,9 @@ static void __init fpu__init_system_geneunsigned int fpu_kernel_xstate_size;EXPORT_SYMBOL_GPL (fpu_kernel_xstate_size); +/* Get alignment of the TYPE. */ +#define TYPE_ALIGN (TYPE ) offsetof(struct { char x; TYPE test; }, test) +/* * Enforce that 'MEMBER' is the last field of 'TYPE'. *
@@ -145,8 +148,8 @@ EXPORT_SYMBOL_GPL(fpu_kernel_xstate_size* because that's how C aligns structs. */ #define CHECK_MEMBER_AT_END_OF (TYPE ,MEMBER ) \ - BUILD_BUG_ON(sizeof(TYPE) != \ - ALIGN(offsetofend(TYPE, MEMBER), _Alignof(TYPE))) + BUILD_BUG_ON(sizeof(TYPE) != ALIGN(offsetofend(TYPE, MEMBER), \ + TYPE_ALIGN(TYPE)))/* * We append the 'struct fpu' to the task_struct:
Greg Kroah-Hartman
maintainerPATCH 71/89 mmc: sdio: fix possible resource leaks in some error paths
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit 605d9fb9556f8f5fb4566f4df1480f280f308ded upstream.
If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can not release the resources, because the sdio function is not presented in these two cases, it won't call of_node_put() or put_device().
To fix these leaks, make sdio_func_present() only control whether device_del() needs to be called or not, then always call of_node_put() and put_device().
In error case in sdio_init_func(), the reference of 'card->dev' is not get, to avoid redundant put in sdio_free_func_cis(), move the get_device() to sdio_alloc_func() and put_device() to sdio_release_func(), it can keep the get/put function be balanced.
Without this patch, while doing fault inject test, it can get the following leak reports, after this fix, the leak is gone.
unreferenced object 0xffff888112514000 (size 2048):
comm "kworker/3:2", pid 65, jiffies 4294741614 (age 124.774s) hex dump (first 32 bytes):
00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff ..o.....`X......
10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff .@Q......@Q.....
backtrace:
[<000000009e5931da>] kmalloc_trace+0x21/0x110
[<000000002f839ccb>] mmc_alloc_card+0x38/0xb0 [mmc_core]
[<0000000004adcbf6>] mmc_sdio_init_card+0xde/0x170 [mmc_core]
[<000000007538fea0>] mmc_attach_sdio+0xcb/0x1b0 [mmc_core]
[<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]unreferenced object 0xffff888112511000 (size 2048):
comm "kworker/3:2", pid 65, jiffies 4294741623 (age 124.766s) hex dump (first 32 bytes):
00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff [email protected]...... 10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff ..Q.......Q..... backtrace: [<000000009e5931da>] kmalloc_trace+0x21/0x110 [<00000000fcbe706c>] sdio_alloc_func+0x35/0x100 [mmc_core] [<00000000c68f4b50>] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core] [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]
--- drivers/mmc/core/sdio_bus.c | 17 ++++++++++++++--- drivers/mmc/core/sdio_cis.c | 12 ------------ 2 files changed, 14 insertions(+), 15 deletions(-)
drivers/mmc/core/sdio_bus.c +14 -3
@@ -267,6 +267,12 @@ static void sdio_release_func(struct devif (!(func->card->quirks &MMC_QUIRK_NONSTD_SDIO ))sdio_free_func_cis (func); +/* +* We have now removed the link to the tuples in the +* card structure, so remove the reference. +*/ +put_device (&func->card->dev); +kfree (func->info);kfree (func->tmpbuf);kfree (func);
@@ -297,6 +303,12 @@ struct sdio_func *sdio_alloc_func(structdevice_initialize (&func->dev); +/* +* We may link to tuples in the card structure, +* we need make sure we have a reference to it. +*/ +get_device (&func->card->dev); + func->dev.parent = &card->dev; func->dev.bus = &sdio_bus_type; func->dev.release = sdio_release_func;
@@ -350,10 +362,9 @@ int sdio_add_func(struct sdio_func *func*/ void sdio_remove_func (struct sdio_func *func) { -if (!sdio_func_present (func)) -return ; +if (sdio_func_present (func)) +device_del (&func->dev); -device_del (&func->dev);of_node_put (func->dev.of_node);put_device (&func->dev); }
drivers/mmc/core/sdio_cis.c +0 -12
@@ -388,12 +388,6 @@ int sdio_read_func_cis(struct sdio_funcreturn ret;/* -* Since we've linked to tuples in the card structure, -* we must make sure we have a reference to it. -*/ -get_device (&func->card->dev); - -/* * Vendor/device id is optional for function CIS, so * copy it from the card structure as needed. */
@@ -418,11 +412,5 @@ void sdio_free_func_cis(struct sdio_func } func->tuples =NULL ; - -/* -* We have now removed the link to the tuples in the -* card structure, so remove the reference. -*/ -put_device (&func->card->dev); }
Greg Kroah-Hartman
maintainerPATCH 72/89 ALSA: hda/conexant: add a new hda codec SN6180
In reply to Greg Kroah-HartmanFrom: Bo Liu <[email protected]>
commit 18d7e16c917a08f08778ecf2b780d63648d5d923 upstream.
The current kernel does not support the SN6180 codec chip. Add the SN6180 codec configuration item to kernel.
--- sound/pci/hda/patch_conexant.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_conexant.c +1 -0
@@ -1106,6 +1106,7 @@ static const struct hda_device_id snd_hdHDA_CODEC_ENTRY (0x14f11f86 ,"CX8070" , patch_conexant_auto),HDA_CODEC_ENTRY (0x14f12008 ,"CX8200" , patch_conexant_auto),HDA_CODEC_ENTRY (0x14f120d0 ,"CX11970" , patch_conexant_auto), +HDA_CODEC_ENTRY (0x14f120d1 ,"SN6180" , patch_conexant_auto),HDA_CODEC_ENTRY (0x14f15045 ,"CX20549 (Venice)" , patch_conexant_auto),HDA_CODEC_ENTRY (0x14f15047 ,"CX20551 (Waikiki)" , patch_conexant_auto), HDA_CODEC_ENTRY(0x14f15051, "CX20561 (Hermosa)", patch_conexant_auto),
Greg Kroah-Hartman
maintainerPATCH 73/89 ALSA: hda/realtek - fixed wrong gpio assigned
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
commit 2bdccfd290d421b50df4ec6a68d832dad1310748 upstream.
GPIO2 PIN use for output. Mask Dir and Data need to assign for 0x4. Not 0x3. This fixed was for Lenovo Desktop(0x17aa1056). GPIO2 use for AMP enable.
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -771,7 +771,7 @@ do_sku:alc_setup_gpio (codec,0x02 );break ;case 7 : -alc_setup_gpio (codec,0x03 ); +alc_setup_gpio (codec,0x04 );break ;case 5 :default :
Greg Kroah-Hartman
maintainerPATCH 74/89 hugetlb: check for undefined shift on 32 bit architectures
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
commit ec4288fe63966b26d53907212ecd05dfa81dd2cc upstream.
Users can specify the hugetlb page size in the mmap, shmget and memfd_create system calls. This is done by using 6 bits within the flags argument to encode the base-2 logarithm of the desired page size. The routine hstate_sizelog() uses the log2 value to find the corresponding hugetlb hstate structure. Converting the log2 value (page_size_log) to potential hugetlb page size is the simple statement:
1UL << page_size_log
Because only 6 bits are used for page_size_log, the left shift can not be greater than 63. This is fine on 64 bit architectures where a long is 64 bits. However, if a value greater than 31 is passed on a 32 bit architecture (where long is 32 bits) the shift will result in undefined behavior. This was generally not an issue as the result of the undefined shift had to exactly match hugetlb page size to proceed.
Recent improvements in runtime checking have resulted in this undefined behavior throwing errors such as reported below.
Fix by comparing page_size_log to BITS_PER_LONG before doing shift.
--- include/linux/hugetlb.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/hugetlb.h +4 -1
@@ -405,7 +405,10 @@ static inline struct hstate *hstate_sizeif (!page_size_log)return &default_hstate; -return size_to_hstate (1UL << page_size_log); +if (page_size_log <BITS_PER_LONG ) +return size_to_hstate (1UL << page_size_log); + +return NULL ; }static inline struct hstate *hstate_vma (struct vm_area_struct *vma)
Greg Kroah-Hartman
maintainerPATCH 75/89 revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
In reply to Greg Kroah-HartmanFrom: Andrew Morton <[email protected]>
commit a5b21d8d791cd4db609d0bbcaa9e0c7e019888d1 upstream.
This fix was nacked by Philip, for reasons identified in the email linked below.
--- fs/squashfs/xattr_id.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/squashfs/xattr_id.c +1 -1
@@ -89,7 +89,7 @@ __le64 *squashfs_read_xattr_id_table(str/* Sanity check values */ /* there is always at least one xattr id */ -if (*xattr_ids <=0 ) +if (*xattr_ids ==0 )return ERR_PTR (-EINVAL ); len =SQUASHFS_XATTR_BLOCK_BYTES (*xattr_ids);
Greg Kroah-Hartman
maintainerPATCH 76/89 i40e: add double of VLAN header when computing the max MTU
In reply to Greg Kroah-HartmanFrom: Jason Xing <[email protected]>
commit ce45ffb815e8e238f05de1630be3969b6bb15e4e upstream.
Include the second VLAN HLEN into account when computing the maximum MTU size as other drivers do.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -1
@@ -2671,7 +2671,7 @@ static int i40e_change_mtu(struct net_destruct i40e_pf *pf = vsi->back;if (i40e_enabled_xdp_vsi (vsi)) { -int frame_size = new_mtu +ETH_HLEN +ETH_FCS_LEN +VLAN_HLEN ; +int frame_size = new_mtu +I40E_PACKET_HDR_PAD ;if (frame_size >i40e_max_xdp_frame_size (vsi))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 77/89 net: bgmac: fix BCM5358 support by setting correct flags
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
commit d61615c366a489646a1bfe5b33455f916762d5f4 upstream.
Code blocks handling BCMA_CHIP_ID_BCM5357 and BCMA_CHIP_ID_BCM53572 were incorrectly unified. Chip package values are not unique and cannot be checked independently. They are meaningful only in a context of a given chip.
Packages BCM5358 and BCM47188 share the same value but then belong to different chips. Code unification resulted in treating BCM5358 as BCM47188 and broke its initialization.
--- drivers/net/ethernet/broadcom/bgmac-bcma.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bgmac-bcma.c +3 -3
@@ -228,12 +228,12 @@ static int bgmac_probe(struct bcma_devic bgmac->feature_flags |=BGMAC_FEAT_CLKCTLST ; bgmac->feature_flags |=BGMAC_FEAT_FLW_CTRL1 ; bgmac->feature_flags |=BGMAC_FEAT_SW_TYPE_PHY ; -if (ci->pkg ==BCMA_PKG_ID_BCM47188 || - ci->pkg ==BCMA_PKG_ID_BCM47186 ) { +if ((ci->id ==BCMA_CHIP_ID_BCM5357 && ci->pkg ==BCMA_PKG_ID_BCM47186 ) || + (ci->id ==BCMA_CHIP_ID_BCM53572 && ci->pkg ==BCMA_PKG_ID_BCM47188 )) { bgmac->feature_flags |=BGMAC_FEAT_SW_TYPE_RGMII ; bgmac->feature_flags |=BGMAC_FEAT_IOST_ATTACHED ; } -if (ci->pkg ==BCMA_PKG_ID_BCM5358 ) +if (ci->id ==BCMA_CHIP_ID_BCM5357 && ci->pkg ==BCMA_PKG_ID_BCM5358 ) bgmac->feature_flags |=BGMAC_FEAT_SW_TYPE_EPHYRMII ;break ;case BCMA_CHIP_ID_BCM53573 :
Greg Kroah-Hartman
maintainerPATCH 78/89 dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit ca43ccf41224b023fc290073d5603a755fd12eed upstream.
Eric Dumazet pointed out [0] that when we call skb_set_owner_r() for ipv6_pinfo.pktoptions, sk_rmem_schedule() has not been called, resulting in a negative sk_forward_alloc.
We add a new helper which clones a skb and sets its owner only when sk_rmem_schedule() succeeds.
Note that we move skb_set_owner_r() forward in (dccp|tcp)_v6_do_rcv() because tcp_send_synack() can make sk_forward_alloc negative before ipv6_opt_accepted() in the crossed SYN-ACK or self-connect() cases.
[0]: https://lore.kernel.org/netdev/CANn89iK9oc20Jdi_41jb9URdF210r7d1Y-+uypbMSbOfY6jqrg@mail.gmail.com/
--- include/net/sock.h | 13 +++++++++++++ net/dccp/ipv6.c | 7 ++----- net/ipv6/tcp_ipv6.c | 10 +++------- 3 files changed, 18 insertions(+), 12 deletions(-)
include/net/sock.h +13 -0
@@ -2134,6 +2134,19 @@ static inline void skb_set_owner_r(strucsk_mem_charge (sk, skb->truesize); } +static inline struct sk_buff *skb_clone_and_charge_r (struct sk_buff *skb,struct sock *sk) +{ + skb =skb_clone (skb,sk_gfp_mask (sk,GFP_ATOMIC )); +if (skb) { +if (sk_rmem_schedule (sk, skb, skb->truesize)) { +skb_set_owner_r (skb, sk); +return skb; + } +__kfree_skb (skb); + } +return NULL ; +} +void sk_reset_timer (struct sock *sk,struct timer_list *timer,unsigned long expires);
net/dccp/ipv6.c +2 -5
@@ -541,11 +541,9 @@ static struct sock *dccp_v6_request_recv *own_req =inet_ehash_nolisten (newsk,req_to_sk (req_unhash),NULL );/* Clone pktoptions received with SYN, if we own the req */ if (*own_req && ireq->pktopts) { - newnp->pktoptions =skb_clone (ireq->pktopts,GFP_ATOMIC ); + newnp->pktoptions =skb_clone_and_charge_r (ireq->pktopts, newsk);consume_skb (ireq->pktopts); ireq->pktopts =NULL ; -if (newnp->pktoptions) -skb_set_owner_r (newnp->pktoptions, newsk); }return newsk;
@@ -605,7 +603,7 @@ static int dccp_v6_do_rcv(struct sock *s--ANK (980728) */ if (np->rxopt.all) - opt_skb =skb_clone (skb,GFP_ATOMIC ); + opt_skb =skb_clone_and_charge_r (skb, sk);if (sk->sk_state ==DCCP_OPEN ) {/* Fast path */ if (dccp_rcv_established (sk, skb,dccp_hdr (skb), skb->len))
@@ -669,7 +667,6 @@ ipv6_pktoptions: np->flow_label =ip6_flowlabel (ipv6_hdr (opt_skb));if (ipv6_opt_accepted (sk, opt_skb, &DCCP_SKB_CB (opt_skb)->header.h6)) { -skb_set_owner_r (opt_skb, sk);memmove (IP6CB (opt_skb), &DCCP_SKB_CB (opt_skb)->header.h6,sizeof (struct inet6_skb_parm ));
net/ipv6/tcp_ipv6.c +3 -7
@@ -1268,14 +1268,11 @@ static struct sock *tcp_v6_syn_recv_sock/* Clone pktoptions received with SYN, if we own the req */ if (ireq->pktopts) { - newnp->pktoptions =skb_clone (ireq->pktopts, -sk_gfp_mask (sk,GFP_ATOMIC )); + newnp->pktoptions =skb_clone_and_charge_r (ireq->pktopts, newsk);consume_skb (ireq->pktopts); ireq->pktopts =NULL ; -if (newnp->pktoptions) { +if (newnp->pktoptions)tcp_v6_restore_cb (newnp->pktoptions); -skb_set_owner_r (newnp->pktoptions, newsk); - } } }else {if (!req_unhash && found_dup_sk) {
@@ -1343,7 +1340,7 @@ static int tcp_v6_do_rcv(struct sock *sk--ANK (980728) */ if (np->rxopt.all) - opt_skb =skb_clone (skb,sk_gfp_mask (sk,GFP_ATOMIC )); + opt_skb =skb_clone_and_charge_r (skb, sk);if (sk->sk_state ==TCP_ESTABLISHED ) {/* Fast path */ struct dst_entry *dst;
@@ -1425,7 +1422,6 @@ ipv6_pktoptions:if (np->repflow) np->flow_label =ip6_flowlabel (ipv6_hdr (opt_skb));if (ipv6_opt_accepted (sk, opt_skb, &TCP_SKB_CB (opt_skb)->header.h6)) { -skb_set_owner_r (opt_skb, sk);tcp_v6_restore_cb (opt_skb); opt_skb =xchg (&np->pktoptions, opt_skb); }else {
Greg Kroah-Hartman
maintainerPATCH 79/89 net/usb: kalmia: Dont pass act_len in usb_bulk_msg error path
In reply to Greg Kroah-HartmanFrom: Miko Larsson <[email protected]>
commit c68f345b7c425b38656e1791a0486769a8797016 upstream.
syzbot reported that act_len in kalmia_send_init_packet() is uninitialized when passing it to the first usb_bulk_msg error path. Jiri Pirko noted that it's pointless to pass it in the error path, and that the value that would be printed in the second error path would be the value of act_len from the first call to usb_bulk_msg.[1]
With this in mind, let's just not pass act_len to the usb_bulk_msg error paths.
1: https://lore.kernel.org/lkml/Y9pY61y1nwTuzMOa@nanopsycho/
--- drivers/net/usb/kalmia.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/usb/kalmia.c +4 -4
@@ -69,8 +69,8 @@ kalmia_send_init_packet(struct usbnet *d init_msg, init_msg_len, &act_len, KALMIA_USB_TIMEOUT);if (status !=0 ) {netdev_err (dev->net, -"Error sending init packet. Status %i, length %i\n" , - status, act_len); +"Error sending init packet. Status %i\n" , + status);return status; }else if (act_len != init_msg_len) {
@@ -87,8 +87,8 @@ kalmia_send_init_packet(struct usbnet *dif (status !=0 )netdev_err (dev->net, -"Error receiving init result. Status %i, length %i\n" , - status, act_len); +"Error receiving init result. Status %i\n" , + status);else if (act_len != expected_len)netdev_err (dev->net,"Unexpected init result length: %i\n" , act_len);
Greg Kroah-Hartman
maintainerPATCH 80/89 net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
In reply to Greg Kroah-HartmanFrom: Johannes Zink <[email protected]>
commit 4562c65ec852067c6196abdcf2d925f08841dcbc upstream.
So far changing the period by just setting new period values while running did not work.
The order as indicated by the publicly available reference manual of the i.MX8MP [1] indicates a sequence:
* initiate the programming sequence
* set the values for PPS period and start time
* start the pulse train generation.
This is currently not used in dwmac5_flex_pps_config(), which instead does:
* initiate the programming sequence and immediately start the pulse train generation
* set the values for PPS period and start time
This caused the period values written not to take effect until the FlexPPS output was disabled and re-enabled again.
This patch fix the order and allows the period to be set immediately.
[1] https://www.nxp.com/webapp/Download?colCode=IMX8MPRM
--- drivers/net/ethernet/stmicro/stmmac/dwmac5.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac5.c +2 -1
@@ -520,9 +520,9 @@ int dwmac5_flex_pps_config(void __iomemreturn 0 ; } - val |=PPSCMDx (index,0x2 ); val |=TRGTMODSELx (index,0x2 ); val |=PPSEN0 ; +writel (val, ioaddr +MAC_PPS_CONTROL );writel (cfg->start.tv_sec, ioaddr +MAC_PPSx_TARGET_TIME_SEC (index));
@@ -547,6 +547,7 @@ int dwmac5_flex_pps_config(void __iomemwritel (period -1 , ioaddr +MAC_PPSx_WIDTH (index));/* Finally, activate it */ + val |=PPSCMDx (index,0x2 );writel (val, ioaddr +MAC_PPS_CONTROL );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 81/89 bnxt_en: Fix mqprio and XDP ring checking logic
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
commit 2038cc592811209de20c4e094ca08bfb1e6fbc6c upstream.
In bnxt_reserve_rings(), there is logic to check that the number of TX rings reserved is enough to cover all the mqprio TCs, but it fails to account for the TX XDP rings. So the check will always fail if there are mqprio TCs and TX XDP rings. As a result, the driver always fails to initialize after the XDP program is attached and the device will be brought down. A subsequent ifconfig up will also fail because the number of TX rings is set to an inconsistent number. Fix the check to properly account for TX XDP rings. If the check fails, set the number of TX rings back to a consistent number after calling netdev_reset_tc().
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -2
@@ -6118,10 +6118,14 @@ int bnxt_reserve_rings(struct bnxt *bp)netdev_err (bp->dev,"ring reservation/IRQ init failure rc: %d\n" , rc);return rc; } -if (tcs && (bp->tx_nr_rings_per_tc * tcs != bp->tx_nr_rings)) { +if (tcs && (bp->tx_nr_rings_per_tc * tcs != + bp->tx_nr_rings - bp->tx_nr_rings_xdp)) {netdev_err (bp->dev,"tx ring reservation failure\n" );netdev_reset_tc (bp->dev); - bp->tx_nr_rings_per_tc = bp->tx_nr_rings; +if (bp->tx_nr_rings_xdp) + bp->tx_nr_rings_per_tc = bp->tx_nr_rings_xdp; +else + bp->tx_nr_rings_per_tc = bp->tx_nr_rings;return -ENOMEM ; } bp->num_stat_ctxs = bp->cp_nr_rings;
Greg Kroah-Hartman
maintainerPATCH 82/89 net: stmmac: Restrict warning on disabling DMA store and fwd mode
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
commit 05d7623a892a9da62da0e714428e38f09e4a64d8 upstream.
When setting 'snps,force_thresh_dma_mode' DT property, the following warning is always emitted, regardless the status of force_sf_dma_mode:
dwmac-starfive 10020000.ethernet: force_sf_dma_mode is ignored if force_thresh_dma_mode is set.
Do not print the rather misleading message when DMA store and forward mode is already disabled.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +1 -1
@@ -518,7 +518,7 @@ stmmac_probe_config_dt(struct platform_d dma_cfg->mixed_burst =of_property_read_bool (np,"snps,mixed-burst" ); plat->force_thresh_dma_mode =of_property_read_bool (np,"snps,force_thresh_dma_mode" ); -if (plat->force_thresh_dma_mode) { +if (plat->force_thresh_dma_mode && plat->force_sf_dma_mode) { plat->force_sf_dma_mode =0 ;pr_warn ("force_sf_dma_mode is ignored if force_thresh_dma_mode is set." ); }
Greg Kroah-Hartman
maintainerPATCH 83/89 net: mpls: fix stale pointer if allocation fails during device rename
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit fda6c89fe3d9aca073495a664e1d5aea28cd4377 upstream.
lianhui reports that when MPLS fails to register the sysctl table under new location (during device rename) the old pointers won't get overwritten and may be freed again (double free).
Handle this gracefully. The best option would be unregistering the MPLS from the device completely on failure, but unfortunately mpls_ifdown() can fail. So failing fully is also unreliable.
Another option is to register the new table first then only remove old one if the new one succeeds. That requires more code, changes order of notifications and two tables may be visible at the same time.
sysctl point is not used in the rest of the code - set to NULL on failures and skip unregister if already NULL.
--- net/mpls/af_mpls.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mpls/af_mpls.c +4 -0
@@ -1375,6 +1375,7 @@ static int mpls_dev_sysctl_register(stru free:kfree (table); out: + mdev->sysctl =NULL ;return -ENOBUFS ; }
@@ -1384,6 +1385,9 @@ static void mpls_dev_sysctl_unregister(sstruct net *net =dev_net (dev);struct ctl_table *table; +if (!mdev->sysctl) +return ; + table = mdev->sysctl->ctl_table_arg;unregister_net_sysctl_table (mdev->sysctl);kfree (table);
Greg Kroah-Hartman
maintainerPATCH 84/89 ipv6: Fix datagram socket connection with DSCP.
In reply to Greg Kroah-HartmanFrom: Guillaume Nault <[email protected]>
commit e010ae08c71fda8be3d6bda256837795a0b3ea41 upstream.
Take into account the IPV6_TCLASS socket option (DSCP) in ip6_datagram_flow_key_init(). Otherwise fib6_rule_match() can't properly match the DSCP value, resulting in invalid route lookup.
For example:
ip route add unreachable table main 2001:db8::10/124
ip route add table 100 2001:db8::10/124 dev eth0 ip -6 rule add dsfield 0x04 table 100
echo test | socat - UDP6:[2001:db8::11]:54321,ipv6-tclass=0x04
Without this patch, socat fails at connect() time ("No route to host") because the fib-rule doesn't jump to table 100 and the lookup ends up being done in the main table.
--- net/ipv6/datagram.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/datagram.c +1 -1
@@ -54,7 +54,7 @@ static void ip6_datagram_flow_key_init(s fl6->flowi6_mark = sk->sk_mark; fl6->fl6_dport = inet->inet_dport; fl6->fl6_sport = inet->inet_sport; - fl6->flowlabel = np->flow_label; + fl6->flowlabel =ip6_make_flowinfo (np->tclass, np->flow_label); fl6->flowi6_uid = sk->sk_uid;if (!fl6->flowi6_oif)
Greg Kroah-Hartman
maintainerPATCH 85/89 ipv6: Fix tcp socket connection with DSCP.
In reply to Greg Kroah-HartmanFrom: Guillaume Nault <[email protected]>
commit 8230680f36fd1525303d1117768c8852314c488c upstream.
Take into account the IPV6_TCLASS socket option (DSCP) in tcp_v6_connect(). Otherwise fib6_rule_match() can't properly match the DSCP value, resulting in invalid route lookup.
For example:
ip route add unreachable table main 2001:db8::10/124
ip route add table 100 2001:db8::10/124 dev eth0 ip -6 rule add dsfield 0x04 table 100
echo test | socat - TCP6:[2001:db8::11]:54321,ipv6-tclass=0x04
Without this patch, socat fails at connect() time ("No route to host") because the fib-rule doesn't jump to table 100 and the lookup ends up being done in the main table.
--- net/ipv6/tcp_ipv6.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/tcp_ipv6.c +1 -0
@@ -257,6 +257,7 @@ static int tcp_v6_connect(struct sock *s fl6.flowi6_proto =IPPROTO_TCP ; fl6.daddr = sk->sk_v6_daddr; fl6.saddr = saddr ? *saddr : np->saddr; + fl6.flowlabel =ip6_make_flowinfo (np->tclass, np->flow_label); fl6.flowi6_oif = sk->sk_bound_dev_if; fl6.flowi6_mark = sk->sk_mark; fl6.fl6_dport = usin->sin6_port;
Greg Kroah-Hartman
maintainerPATCH 86/89 i40e: Add checking for null for nlmsg_find_attr()
In reply to Greg Kroah-HartmanFrom: Natalia Petrova <[email protected]>
[ Upstream commit 7fa0b526f865cb42aa33917fd02a92cb03746f4d ]
The result of nlmsg_find_attr() 'br_spec' is dereferenced in nla_for_each_nested(), but it can take NULL value in nla_find() function, which will result in an error.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/i40e/i40e_main.c +2 -0
@@ -11834,6 +11834,8 @@ static int i40e_ndo_bridge_setlink(struct net_device *dev, } br_spec =nlmsg_find_attr (nlh,sizeof (struct ifinfomsg ),IFLA_AF_SPEC ); +if (!br_spec) +return -EINVAL ;nla_for_each_nested (attr, br_spec, rem) {__u16 mode;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 87/89 kvm: initialize all of the kvm_debugregs structure before sending it to userspace
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 2c10b61421a28e95a46ab489fd56c0f442ff6952 upstream.
When calling the KVM_GET_DEBUGREGS ioctl, on some configurations, there might be some unitialized portions of the kvm_debugregs structure that could be copied to userspace. Prevent this as is done in the other kvm ioctls, by setting the whole structure to 0 before copying anything into it.
Bonus is that this reduces the lines of code as the explicit flag setting and reserved space zeroing out can be removed.
Message-Id: <[email protected]>
--- arch/x86/kvm/x86.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/kvm/x86.c +1 -2
@@ -3637,12 +3637,11 @@ static void kvm_vcpu_ioctl_x86_get_debug {unsigned long val; +memset (dbgregs,0 ,sizeof (*dbgregs));memcpy (dbgregs->db, vcpu->arch.db,sizeof (vcpu->arch.db));kvm_get_dr (vcpu,6 , &val); dbgregs->dr6 = val; dbgregs->dr7 = vcpu->arch.dr7; - dbgregs->flags =0 ; -memset (&dbgregs->reserved,0 ,sizeof (dbgregs->reserved)); } static int kvm_vcpu_ioctl_x86_set_debugregs(struct kvm_vcpu *vcpu,
Greg Kroah-Hartman
maintainerPATCH 88/89 nilfs2: fix underflow in second superblock position calculations
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 99b9402a36f0799f25feee4465bfa4b8dfa74b4d upstream.
Macro NILFS_SB2_OFFSET_BYTES, which computes the position of the second superblock, underflows when the argument device size is less than 4096 bytes. Therefore, when using this macro, it is necessary to check in advance that the device size is not less than a lower limit, or at least that underflow does not occur.
The current nilfs2 implementation lacks this check, causing out-of-bound block access when mounting devices smaller than 4096 bytes:
I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
NILFS (loop0): unable to read secondary superblock (blocksize = 1024)
In addition, when trying to resize the filesystem to a size below 4096 bytes, this underflow occurs in nilfs_resize_fs(), passing a huge number of segments to nilfs_sufile_resize(), corrupting parameters such as the number of segments in superblocks. This causes excessive loop iterations in nilfs_sufile_resize() during a subsequent resize ioctl, causing semaphore ns_segctor_sem to block for a long time and hang the writer thread:
INFO: task segctord:5067 blocked for more than 143 seconds.
Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:segctord state:D stack:23456 pid:5067 ppid:2
flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5293 [inline]
__schedule+0x1409/0x43f0 kernel/sched/core.c:6606
schedule+0xc3/0x190 kernel/sched/core.c:6682
rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190
nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]
nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570
kthread+0x270/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
...
Call Trace:
<TASK>
folio_mark_accessed+0x51c/0xf00 mm/swap.c:515
__nilfs_get_page_block fs/nilfs2/page.c:42 [inline]
nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61
nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121
nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176
nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251
nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]
nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]
nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777
nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422
nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]
nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301
...This fixes these issues by inserting appropriate minimum device size checks or anti-underflow checks, depending on where the macro is used.
--- fs/nilfs2/ioctl.c | 7 +++++++ fs/nilfs2/super.c | 9 +++++++++ fs/nilfs2/the_nilfs.c | 8 +++++++- 3 files changed, 23 insertions(+), 1 deletion(-)
fs/nilfs2/ioctl.c +7 -0
@@ -1135,7 +1135,14 @@ static int nilfs_ioctl_set_alloc_range(s minseg = range[0 ] + segbytes -1 ;do_div (minseg, segbytes); + +if (range[1 ] <4096 ) + goto out; + maxseg =NILFS_SB2_OFFSET_BYTES (range[1 ]); +if (maxseg < segbytes) + goto out; +do_div (maxseg, segbytes); maxseg--;
fs/nilfs2/super.c +9 -0
@@ -411,6 +411,15 @@ int nilfs_resize_fs(struct super_block * goto out;/* +* Prevent underflow in second superblock position calculation. +* The exact minimum size check is done in nilfs_sufile_resize(). +*/ +if (newsize <4096 ) { + ret = -ENOSPC ; + goto out; + } + +/* * Write lock is required to protect some functions depending * on the number of segments, the number of reserved segments, * and so forth.
fs/nilfs2/the_nilfs.c +7 -1
@@ -517,9 +517,15 @@ static int nilfs_load_super_block(struct {struct nilfs_super_block **sbp = nilfs->ns_sbp;struct buffer_head **sbh = nilfs->ns_sbh; -u64 sb2off =NILFS_SB2_OFFSET_BYTES (nilfs->ns_bdev->bd_inode->i_size); +u64 sb2off, devsize = nilfs->ns_bdev->bd_inode->i_size;int valid[2 ], swp =0 ; +if (devsize <NILFS_SEG_MIN_BLOCKS *NILFS_MIN_BLOCK_SIZE +4096 ) { +nilfs_msg (sb,KERN_ERR ,"device size too small" ); +return -EINVAL ; + } + sb2off =NILFS_SB2_OFFSET_BYTES (devsize); + sbp[0 ] =nilfs_read_super_block (sb,NILFS_SB_OFFSET_BYTES , blocksize, &sbh[0 ]); sbp[1 ] =nilfs_read_super_block (sb, sb2off, blocksize, &sbh[1 ]);
Greg Kroah-Hartman
maintainerPATCH 89/89 net: phy: meson-gxl: Add generic dummy stubs for MMD register access
In reply to Greg Kroah-HartmanFrom: Chris Healy <[email protected]>
commit afc2336f89dc0fc0ef25b92366814524b0fd90fb upstream.
The Meson G12A Internal PHY does not support standard IEEE MMD extended register access, therefore add generic dummy stubs to fail the read and write MMD calls. This is necessary to prevent the core PHY code from erroneously believing that EEE is supported by this PHY even though this PHY does not support EEE, as MMD register access returns all FFFFs.
--- drivers/net/phy/meson-gxl.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/phy/meson-gxl.c +2 -0
@@ -258,6 +258,8 @@ static struct phy_driver meson_gxl_phy[] .config_intr = meson_gxl_config_intr, .suspend = genphy_suspend, .resume = genphy_resume, + .read_mmd = genphy_read_mmd_unsupported, + .write_mmd = genphy_write_mmd_unsupported, }, };
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.19.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Feb 2023 13:35:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.273-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 4.19.273-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-4.19.y
* git commit: 717ab64d0adf6544c30105e64d851b388324c7ef
* git describe: v4.19.272-90-g717ab64d0adf
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.19.y/build/v4.19.272-90-g717ab64d0adf
## Test Regressions (compared to v4.19.272)
## Metric Regressions (compared to v4.19.272)
## Test Fixes (compared to v4.19.272)
## Metric Fixes (compared to v4.19.272)
## Test result summary
total: 108520, pass: 84162, fail: 3369, skip: 20591, xfail: 398
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 232 total, 230 passed, 2 failed
* arm64: 48 total, 47 passed, 1 failed
* i386: 29 total, 28 passed, 1 failed
* mips: 43 total, 43 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 57 total, 57 passed, 0 failed
* s390: 15 total, 15 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x86_64: 42 total, 41 passed, 1 failed
## Test suites summary
* boot
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* packetdrill
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Feb 2023 13:35:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.273-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.19:
10 builds: 10 pass, 0 fail
22 boots: 22 pass, 0 fail
40 tests: 40 pass, 0 failLinux version: 4.19.273-rc1-g717ab64d0adf
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Jon
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Feb 2023 13:35:35 +0000. Anything received after that time might be too late.
Build test (gcc version 11.3.1 20230210):
mips: 63 configs -> no failure
arm: 115 configs -> no failure
arm64: 2 configs -> no failurex86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
[1]. https://openqa.qa.codethink.co.uk/tests/2904
Signature · 2 lines
Regards Sudip
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Feb 2023 13:35:35 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 155 fail: 0 Qemu test results: total: 426 pass: 426 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Feb 2023 13:35:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.273-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 14 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Feb 2023 13:35:35 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.273-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.
Quoted 5 lines
thanks,
greg k-h
-------------
Tested on arm64 and x86 for 4.19.273-rc1,
Kernel repo:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-4.19.y
Version: 4.19.273-rc1
Commit: 717ab64d0adf6544c30105e64d851b388324c7ef
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8947
passed: 8947
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8947
passed: 8947
failed: 0
timeout: 0
--------------------------------------------------------------------
Hi!
Quoted 7 lines
This is the start of the stable review cycle for the 4.19.273 release. There are 89 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Toke Høiland-Jørgensen <[email protected]>
bpf: Always return target ifindex inbpf_fib_lookup
Changelog talks about bpf_redirect_neigh but we don't have that in 4.19. It is not clear what bug this fixes. Do we need it in 4.19?
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany