- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
by Bowen You 24 Nov '25

24 Nov '25

From: Yuhao Jiang <danisjiang(a)gmail.com> mainline inclusion from mainline-v6.18-rc4 commit 8f067aa59430266386b83c18b983ca583faa6a11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID7X34 CVE: CVE-2025-40211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Yuhao Jiang <danisjiang(a)gmail.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c index a971770e24ff..841db33e9475 100644 --- a/drivers/acpi/acpi_video.c +++ b/drivers/acpi/acpi_video.c @@ -1952,8 +1952,10 @@ static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video) struct acpi_video_device *dev; mutex_lock(&video->device_list_lock); - list_for_each_entry(dev, &video->video_device_list, entry) + list_for_each_entry(dev, &video->video_device_list, entry) { acpi_video_dev_remove_notify_handler(dev); + cancel_delayed_work_sync(&dev->switch_brightness_work); + } mutex_unlock(&video->device_list_lock); acpi_video_bus_stop_devices(video); -- 2.34.1

2 1

[PATCH OLK-5.10] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
by Bowen You 24 Nov '25

24 Nov '25

From: Yuhao Jiang <danisjiang(a)gmail.com> mainline inclusion from mainline-v6.18-rc4 commit 8f067aa59430266386b83c18b983ca583faa6a11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID7X34 CVE: CVE-2025-40211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The switch_brightness_work delayed work accesses device->brightness and device->backlight, freed by acpi_video_dev_unregister_backlight() during device removal. If the work executes after acpi_video_bus_unregister_backlight() frees these resources, it causes a use-after-free when acpi_video_switch_brightness() dereferences device->brightness or device->backlight. Fix this by calling cancel_delayed_work_sync() for each device's switch_brightness_work in acpi_video_bus_remove_notify_handler() after removing the notify handler that queues the work. This ensures the work completes before the memory is freed. Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress") Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Yuhao Jiang <danisjiang(a)gmail.com> Reviewed-by: Hans de Goede <hansg(a)kernel.org> [ rjw: Changelog edit ] Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/acpi/acpi_video.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c index b2364ac455f3..f67871e8f383 100644 --- a/drivers/acpi/acpi_video.c +++ b/drivers/acpi/acpi_video.c @@ -2028,8 +2028,10 @@ static void acpi_video_bus_remove_notify_handler(struct acpi_video_bus *video) struct acpi_video_device *dev; mutex_lock(&video->device_list_lock); - list_for_each_entry(dev, &video->video_device_list, entry) + list_for_each_entry(dev, &video->video_device_list, entry) { acpi_video_dev_remove_notify_handler(dev); + cancel_delayed_work_sync(&dev->switch_brightness_work); + } mutex_unlock(&video->device_list_lock); acpi_video_bus_stop_devices(video); -- 2.34.1

2 1

[PATCH OLK-6.6] Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
by Cai Xinchen 24 Nov '25

24 Nov '25

From: Zhen Ni <zhen.ni(a)easystack.cn> stable inclusion from stable-v6.6.112 commit fd8a23ecbc602d00e47b27f20b07350867d0ebe5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WHX CVE: CVE-2025-40035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d3366a04770eea807f2826cbdb96934dd8c9bf79 upstream. Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, there is a hole after struct ff_replay to satisfy alignment requirements for the following union member. Without clearing the structure, copy_to_user() may leak stack data to userspace. Initialize ff_up_compat to zero before filling valid fields. Fixes: 2d56f3a32c0e ("Input: refactor evdev 32bit compat to be shareable with uinput") Cc: stable(a)vger.kernel.org Signed-off-by: Zhen Ni <zhen.ni(a)easystack.cn> Link: https://lore.kernel.org/r/20250928063737.74590-1-zhen.ni@easystack.cn Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/input/misc/uinput.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c index 2c973f15cab7..edb62a284548 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c @@ -775,6 +775,7 @@ static int uinput_ff_upload_to_user(char __user *buffer, if (in_compat_syscall()) { struct uinput_ff_upload_compat ff_up_compat; + memset(&ff_up_compat, 0, sizeof(ff_up_compat)); ff_up_compat.request_id = ff_up->request_id; ff_up_compat.retval = ff_up->retval; /* -- 2.34.1

2 1

[openeuler:OLK-5.10 3304/3304] include/linux/sunrpc/xdr.h:606:10: warning: result of comparison of constant 4611686018427387903 with expression of type '__u32' (aka 'unsigned int') is always false
by kernel test robot 24 Nov '25

24 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 4a93a68b1fa420e5791d9f16414d427f8dd90fb4 commit: fd2b905e3179865f7a512dfcfe14f10b6067236d [3304/3304] NFSD: prevent integer overflow on 32 bit systems config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20251124/202511241524.zGjjHi86-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 9e9fe08b16ea2c4d9867fb4974edf2a3776d6ece) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251124/202511241524.zGjjHi86-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511241524.zGjjHi86-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from init/do_mounts.c:23: In file included from include/linux/nfs_fs.h:31: In file included from include/linux/sunrpc/auth.h:13: In file included from include/linux/sunrpc/sched.h:19: >> include/linux/sunrpc/xdr.h:606:10: warning: result of comparison of constant 4611686018427387903 with expression of type '__u32' (aka 'unsigned int') is always false [-Wtautological-constant-out-of-range-compare] 606 | if (len > SIZE_MAX / sizeof(*p)) | ~~~ ^ ~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. vim +606 include/linux/sunrpc/xdr.h 584 585 /** 586 * xdr_stream_decode_uint32_array - Decode variable length array of integers 587 * @xdr: pointer to xdr_stream 588 * @array: location to store the integer array or NULL 589 * @array_size: number of elements to store 590 * 591 * Return values: 592 * On success, returns number of elements stored in @array 593 * %-EBADMSG on XDR buffer overflow 594 * %-EMSGSIZE if the size of the array exceeds @array_size 595 */ 596 static inline ssize_t 597 xdr_stream_decode_uint32_array(struct xdr_stream *xdr, 598 __u32 *array, size_t array_size) 599 { 600 __be32 *p; 601 __u32 len; 602 ssize_t retval; 603 604 if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) 605 return -EBADMSG; > 606 if (len > SIZE_MAX / sizeof(*p)) 607 return -EBADMSG; 608 p = xdr_inline_decode(xdr, len * sizeof(*p)); 609 if (unlikely(!p)) 610 return -EBADMSG; 611 if (array == NULL) 612 return len; 613 if (len <= array_size) { 614 if (len < array_size) 615 memset(array+len, 0, (array_size-len)*sizeof(*array)); 616 array_size = len; 617 retval = len; 618 } else 619 retval = -EMSGSIZE; 620 for (; array_size > 0; p++, array++, array_size--) 621 *array = be32_to_cpup(p); 622 return retval; 623 } 624 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
by Ziming Du 24 Nov '25

24 Nov '25

From: I Viswanath <viswanathiyyappan(a)gmail.com> stable inclusion from stable-v6.6.112 commit 6394bade9daab8e318c165fe43bba012bf13cd8e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B6J CVE: CVE-2025-40140 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 958baf5eaee394e5fd976979b0791a875f14a179 ] syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); } rtl8150_set_multicast() { netif_stop_queue(); netif_wake_queue(); <-- wakes up TX queue before URB is done } rtl8150_start_xmit() { netif_stop_queue(); usb_submit_urb(dev->tx_urb); <-- double submission } rtl8150_set_multicast being the ndo_set_rx_mode callback should not be calling netif_stop_queue and notif_start_queue as these handle TX queue synchronization. The net core function dev_set_rx_mode handles the synchronization for rtl8150_set_multicast making it safe to remove these locks. Reported-and-tested-by: syzbot+78cae3f37c62ad092caa(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=78cae3f37c62ad092caa Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-by: Michal Pecio <michal.pecio(a)gmail.com> Signed-off-by: I Viswanath <viswanathiyyappan(a)gmail.com> Link: https://patch.msgid.link/20250924134350.264597-1-viswanathiyyappan@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/usb/rtl8150.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index ddff6f19ff98e..92add3daadbb1 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -664,7 +664,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rtl8150_t *dev = netdev_priv(netdev); u16 rx_creg = 0x9e; - netif_stop_queue(netdev); if (netdev->flags & IFF_PROMISC) { rx_creg |= 0x0001; dev_info(&netdev->dev, "%s: promiscuous mode\n", netdev->name); @@ -678,7 +677,6 @@ static void rtl8150_set_multicast(struct net_device *netdev) rx_creg &= 0x00fc; } async_set_registers(dev, RCR, sizeof(rx_creg), rx_creg); - netif_wake_queue(netdev); } static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, -- 2.43.0

2 1

[PATCH OLK-6.6] net: dlink: handle copy_thresh allocation failure
by Ziming Du 24 Nov '25

24 Nov '25

From: Yeounsu Moon <yyyynoom(a)gmail.com> stable inclusion from stable-v6.6.112 commit ea87151df398d407a632c7bf63013290f01c5009 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WGB CVE: CVE-2025-40053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8169a6011c5fecc6cb1c3654c541c567d3318de8 ] The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon <yyyynoom(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20250928190124.1156-1-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/ethernet/dlink/dl2k.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c index db6615aa921b1..8fa9f7bf20abc 100644 --- a/drivers/net/ethernet/dlink/dl2k.c +++ b/drivers/net/ethernet/dlink/dl2k.c @@ -947,15 +947,18 @@ receive_packet (struct net_device *dev) } else { struct sk_buff *skb; + skb = NULL; /* Small skbuffs for short packets */ - if (pkt_len > copy_thresh) { + if (pkt_len <= copy_thresh) + skb = netdev_alloc_skb_ip_align(dev, pkt_len); + if (!skb) { dma_unmap_single(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, DMA_FROM_DEVICE); skb_put (skb = np->rx_skbuff[entry], pkt_len); np->rx_skbuff[entry] = NULL; - } else if ((skb = netdev_alloc_skb_ip_align(dev, pkt_len))) { + } else { dma_sync_single_for_cpu(&np->pdev->dev, desc_to_dma(desc), np->rx_buf_sz, -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-40202
by Yi Yang 24 Nov '25

24 Nov '25

CVE fix patch: ipmi: Rework user message limit handling new bugfix: ipmi: Fix handling of messages with provided receive message pointer Corey Minyard (1): ipmi: Rework user message limit handling Guenter Roeck (1): ipmi: Fix handling of messages with provided receive message pointer drivers/char/ipmi/ipmi_msghandler.c | 416 +++++++++++++--------------- 1 file changed, 200 insertions(+), 216 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/5] CVE-2022-49722
by Xiaomeng Zhang 24 Nov '25

24 Nov '25

Jacob Keller (2): ice: convert ice_reset_vf to standard error codes ice: convert ice_reset_vf to take flags Michal Jaron (1): ice: Fix call trace with null VSI during VF reset Norbert Zulinski (1): ice: Fix spurious interrupt during removal of trusted VF Przemyslaw Patynowski (1): ice: Fix memory corruption in VF driver drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 28 ++++++++++ drivers/net/ethernet/intel/ice/ice_lib.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 52 ++++++++++++++----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 17 ++++-- 6 files changed, 86 insertions(+), 18 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
by Zhang Yuwei 24 Nov '25

24 Nov '25

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Message-ID: <20250902171826.27329-4-tiwai(a)suse.de> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index a8289f74463e..f5bcf68841c3 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) @@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); static void log_quirks(struct device *dev) { - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) + int map; + + map = BYT_RT5651_MAP(byt_rt5651_quirk); + switch (map) { + case BYT_RT5651_DMIC_MAP: dev_info(dev, "quirk DMIC_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) + break; + case BYT_RT5651_IN1_MAP: dev_info(dev, "quirk IN1_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + break; + case BYT_RT5651_IN2_MAP: dev_info(dev, "quirk IN2_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) + break; + case BYT_RT5651_IN1_IN2_MAP: dev_info(dev, "quirk IN1_IN2_MAP enabled"); + break; + default: + dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; + byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; + break; + } + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { dev_info(dev, "quirk realtek,jack-detect-source %ld\n", BYT_RT5651_JDSRC(byt_rt5651_quirk)); -- 2.43.0

2 1

[PATCH OLK-6.6] uburma: add tp_type in urma ioctl operation.
by Bowen You 24 Nov '25

24 Nov '25

From: Yongqiang Guo <guoyongqiang12(a)huawei.com> urma inclusion category: feature bugzilla: https://gitee.com/openeuler/release-management/issues/ID3WJX ---------------------------------------------- This patch resolves the issue of the tp_type field being lost in ioctl call during the connection establishment between urma_import_jetty and urma_bind_jetty, which causes consistent RC connection establishment failures. Signed-off-by: Yongqiang Guo <guoyongqiang12(a)huawei.com> --- drivers/ub/urma/uburma/uburma_cmd.c | 4 ++++ drivers/ub/urma/uburma/uburma_cmd.h | 4 ++++ drivers/ub/urma/uburma/uburma_cmd_tlv.c | 4 ++++ drivers/ub/urma/uburma/uburma_cmd_tlv.h | 4 ++++ 4 files changed, 16 insertions(+) diff --git a/drivers/ub/urma/uburma/uburma_cmd.c b/drivers/ub/urma/uburma/uburma_cmd.c index 2c32cf62bddc..79cbb7a999dd 100644 --- a/drivers/ub/urma/uburma/uburma_cmd.c +++ b/drivers/ub/urma/uburma/uburma_cmd.c @@ -1668,6 +1668,7 @@ static int uburma_cmd_import_jfr(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.token_value.token = arg.in.token; cfg.trans_mode = arg.in.trans_mode; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; fill_udata(&udata, file->ucontext, &arg.udata); @@ -1724,6 +1725,7 @@ static int uburma_cmd_import_jfr_ex(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.token_value.token = arg.in.token; cfg.trans_mode = arg.in.trans_mode; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; active_tp_cfg.tp_handle.value = arg.in.tp_handle; @@ -1812,6 +1814,7 @@ static int uburma_cmd_import_jetty(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.policy = (enum ubcore_jetty_grp_policy)arg.in.policy; cfg.type = (enum ubcore_target_type)arg.in.type; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; fill_udata(&udata, file->ucontext, &arg.udata); @@ -3045,6 +3048,7 @@ static int uburma_cmd_import_jetty_ex(struct ubcore_device *ubc_dev, cfg.flag.value = arg.in.flag; cfg.policy = (enum ubcore_jetty_grp_policy)arg.in.policy; cfg.type = (enum ubcore_target_type)arg.in.type; + cfg.tp_type = (enum ubcore_tp_type)arg.in.tp_type; cfg.eid_index = file->ucontext->eid_index; active_tp_cfg.tp_handle.value = arg.in.tp_handle; diff --git a/drivers/ub/urma/uburma/uburma_cmd.h b/drivers/ub/urma/uburma/uburma_cmd.h index 547eb5a27266..ef5dc2db5e52 100644 --- a/drivers/ub/urma/uburma/uburma_cmd.h +++ b/drivers/ub/urma/uburma/uburma_cmd.h @@ -390,6 +390,7 @@ struct uburma_cmd_import_jfr { /* correspond to urma_token_t */ uint32_t token; uint32_t trans_mode; + uint32_t tp_type; } in; struct { uint32_t tpn; @@ -407,6 +408,7 @@ struct uburma_cmd_import_jfr_ex { /* correspond to ubcore_token */ uint32_t token; uint32_t trans_mode; + uint32_t tp_type; /* correspond to struct ubcore_active_tp_cfg */ uint64_t tp_handle; uint64_t peer_tp_handle; @@ -546,6 +548,7 @@ struct uburma_cmd_import_jetty { uint32_t trans_mode; uint32_t policy; uint32_t type; + uint32_t tp_type; } in; struct { uint32_t tpn; @@ -565,6 +568,7 @@ struct uburma_cmd_import_jetty_ex { uint32_t trans_mode; uint32_t policy; uint32_t type; + uint32_t tp_type; /* correspond to struct ubcore_active_tp_cfg */ uint64_t tp_handle; uint64_t peer_tp_handle; diff --git a/drivers/ub/urma/uburma/uburma_cmd_tlv.c b/drivers/ub/urma/uburma/uburma_cmd_tlv.c index 41df179f0654..028be3acc6a7 100644 --- a/drivers/ub/urma/uburma/uburma_cmd_tlv.c +++ b/drivers/ub/urma/uburma/uburma_cmd_tlv.c @@ -588,6 +588,7 @@ uburma_import_jfr_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JFR_IN_FLAG, arg->in.flag); SPEC(s++, IMPORT_JFR_IN_TOKEN, arg->in.token); SPEC(s++, IMPORT_JFR_IN_TRANS_MODE, arg->in.trans_mode); + SPEC(s++, IMPORT_JFR_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JFR_IN_UDATA, arg->udata); } @@ -805,6 +806,7 @@ uburma_import_jetty_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JETTY_IN_TRANS_MODE, arg->in.trans_mode); SPEC(s++, IMPORT_JETTY_IN_POLICY, arg->in.policy); SPEC(s++, IMPORT_JETTY_IN_TYPE, arg->in.type); + SPEC(s++, IMPORT_JETTY_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JETTY_IN_UDATA, arg->udata); } @@ -1287,6 +1289,7 @@ uburma_import_jetty_ex_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JETTY_EX_IN_TRANS_MODE, arg->in.trans_mode); SPEC(s++, IMPORT_JETTY_EX_IN_POLICY, arg->in.policy); SPEC(s++, IMPORT_JETTY_EX_IN_TYPE, arg->in.type); + SPEC(s++, IMPORT_JETTY_EX_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JETTY_EX_IN_TP_HANDLE, arg->in.tp_handle); SPEC(s++, IMPORT_JETTY_EX_IN_PEER_TP_HANDLE, arg->in.peer_tp_handle); @@ -1320,6 +1323,7 @@ uburma_import_jfr_ex_fill_spec_in(void *arg_addr, SPEC(s++, IMPORT_JFR_EX_IN_FLAG, arg->in.flag); SPEC(s++, IMPORT_JFR_EX_IN_TOKEN, arg->in.token); SPEC(s++, IMPORT_JFR_EX_IN_TRANS_MODE, arg->in.trans_mode); + SPEC(s++, IMPORT_JFR_EX_IN_TP_TYPE, arg->in.tp_type); SPEC(s++, IMPORT_JFR_EX_IN_TP_HANDLE, arg->in.tp_handle); SPEC(s++, IMPORT_JFR_EX_IN_PEER_TP_HANDLE, arg->in.peer_tp_handle); diff --git a/drivers/ub/urma/uburma/uburma_cmd_tlv.h b/drivers/ub/urma/uburma/uburma_cmd_tlv.h index c79cfc489e85..7dc179c70ded 100644 --- a/drivers/ub/urma/uburma/uburma_cmd_tlv.h +++ b/drivers/ub/urma/uburma/uburma_cmd_tlv.h @@ -382,6 +382,7 @@ enum uburma_cmd_import_jfr_type { IMPORT_JFR_IN_FLAG, IMPORT_JFR_IN_TOKEN, IMPORT_JFR_IN_TRANS_MODE, + IMPORT_JFR_IN_TP_TYPE, IMPORT_JFR_IN_UDATA, /* Consider udata as an ordinary member of in specs */ IMPORT_JFR_IN_NUM, /* Only for calculating number of types */ /* Out type */ @@ -399,6 +400,7 @@ enum uburma_cmd_import_jfr_ex_type { IMPORT_JFR_EX_IN_FLAG, IMPORT_JFR_EX_IN_TOKEN, IMPORT_JFR_EX_IN_TRANS_MODE, + IMPORT_JFR_EX_IN_TP_TYPE, IMPORT_JFR_EX_IN_TP_HANDLE, IMPORT_JFR_EX_IN_PEER_TP_HANDLE, IMPORT_JFR_EX_IN_TAG, @@ -539,6 +541,7 @@ enum uburma_cmd_import_jetty_type { IMPORT_JETTY_IN_TRANS_MODE, IMPORT_JETTY_IN_POLICY, IMPORT_JETTY_IN_TYPE, + IMPORT_JETTY_IN_TP_TYPE, IMPORT_JETTY_IN_UDATA, /* Consider udata as an in/out attr */ IMPORT_JETTY_IN_NUM, /* Only for calculating number of types */ /* Out type */ @@ -558,6 +561,7 @@ enum uburma_cmd_import_jetty_ex_type { IMPORT_JETTY_EX_IN_TRANS_MODE, IMPORT_JETTY_EX_IN_POLICY, IMPORT_JETTY_EX_IN_TYPE, + IMPORT_JETTY_EX_IN_TP_TYPE, IMPORT_JETTY_EX_IN_TP_HANDLE, IMPORT_JETTY_EX_IN_PEER_TP_HANDLE, IMPORT_JETTY_EX_IN_TAG, -- 2.34.1

2 1