From: Sasha Levin Date: Sun, 25 Dec 2022 03:33:10 +0000 (-0500) Subject: Fixes for 4.19 X-Git-Tag: v5.15.86~77 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ef79d2c58ac4f4101bcc9cc20b0bfd73ea686b2a;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acct-fix-potential-integer-overflow-in-encode_comp_t.patch b/queue-4.19/acct-fix-potential-integer-overflow-in-encode_comp_t.patch new file mode 100644 index 00000000000..e90dea0bd0f --- /dev/null +++ b/queue-4.19/acct-fix-potential-integer-overflow-in-encode_comp_t.patch @@ -0,0 +1,51 @@ +From 99b535b239d341a30298205541499b5f45fbb265 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 22:06:31 +0800 +Subject: acct: fix potential integer overflow in encode_comp_t() + +From: Zheng Yejian + +[ Upstream commit c5f31c655bcc01b6da53b836ac951c1556245305 ] + +The integer overflow is descripted with following codes: + > 317 static comp_t encode_comp_t(u64 value) + > 318 { + > 319 int exp, rnd; + ...... + > 341 exp <<= MANTSIZE; + > 342 exp += value; + > 343 return exp; + > 344 } + +Currently comp_t is defined as type of '__u16', but the variable 'exp' is +type of 'int', so overflow would happen when variable 'exp' in line 343 is +greater than 65535. + +Link: https://lkml.kernel.org/r/20210515140631.369106-3-zhengyejian1@huawei.com +Signed-off-by: Zheng Yejian +Cc: Hanjun Guo +Cc: Randy Dunlap +Cc: Vlastimil Babka +Cc: Zhang Jinhao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/acct.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/acct.c b/kernel/acct.c +index 81f9831a7859..6d98aed403ba 100644 +--- a/kernel/acct.c ++++ b/kernel/acct.c +@@ -331,6 +331,8 @@ static comp_t encode_comp_t(unsigned long value) + exp++; + } + ++ if (exp > (((comp_t) ~0U) >> MANTSIZE)) ++ return (comp_t) ~0U; + /* + * Clean it up and polish it off. + */ +-- +2.35.1 + diff --git a/queue-4.19/acpica-fix-error-code-path-in-acpi_ds_call_control_m.patch b/queue-4.19/acpica-fix-error-code-path-in-acpi_ds_call_control_m.patch new file mode 100644 index 00000000000..360fa515876 --- /dev/null +++ b/queue-4.19/acpica-fix-error-code-path-in-acpi_ds_call_control_m.patch @@ -0,0 +1,68 @@ +From 79d955ea2bbd1968d64852390e8d9c7d136b71c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 18:42:36 +0100 +Subject: ACPICA: Fix error code path in acpi_ds_call_control_method() + +From: Rafael J. Wysocki + +[ Upstream commit 404ec60438add1afadaffaed34bb5fe4ddcadd40 ] + +A use-after-free in acpi_ps_parse_aml() after a failing invocaion of +acpi_ds_call_control_method() is reported by KASAN [1] and code +inspection reveals that next_walk_state pushed to the thread by +acpi_ds_create_walk_state() is freed on errors, but it is not popped +from the thread beforehand. Thus acpi_ds_get_current_walk_state() +called by acpi_ps_parse_aml() subsequently returns it as the new +walk state which is incorrect. + +To address this, make acpi_ds_call_control_method() call +acpi_ds_pop_walk_state() to pop next_walk_state from the thread before +returning an error. + +Link: https://lore.kernel.org/linux-acpi/20221019073443.248215-1-chenzhongjin@huawei.com/ # [1] +Reported-by: Chen Zhongjin +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Chen Zhongjin +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/dsmethod.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c +index dd4deb678d13..a00516d9538c 100644 +--- a/drivers/acpi/acpica/dsmethod.c ++++ b/drivers/acpi/acpica/dsmethod.c +@@ -517,7 +517,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, + info = ACPI_ALLOCATE_ZEROED(sizeof(struct acpi_evaluate_info)); + if (!info) { + status = AE_NO_MEMORY; +- goto cleanup; ++ goto pop_walk_state; + } + + info->parameters = &this_walk_state->operands[0]; +@@ -529,7 +529,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, + + ACPI_FREE(info); + if (ACPI_FAILURE(status)) { +- goto cleanup; ++ goto pop_walk_state; + } + + /* +@@ -561,6 +561,12 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread, + + return_ACPI_STATUS(status); + ++pop_walk_state: ++ ++ /* On error, pop the walk state to be deleted from thread */ ++ ++ acpi_ds_pop_walk_state(thread); ++ + cleanup: + + /* On error, we must terminate the method properly */ +-- +2.35.1 + diff --git a/queue-4.19/acpica-fix-use-after-free-in-acpi_ut_copy_ipackage_t.patch b/queue-4.19/acpica-fix-use-after-free-in-acpi_ut_copy_ipackage_t.patch new file mode 100644 index 00000000000..5ad91b0d2cb --- /dev/null +++ b/queue-4.19/acpica-fix-use-after-free-in-acpi_ut_copy_ipackage_t.patch @@ -0,0 +1,70 @@ +From 8c4134271d0a453211c45a3354c064e7a18e44e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 16:05:14 +0800 +Subject: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() + +From: Li Zetao + +[ Upstream commit 470188b09e92d83c5a997f25f0e8fb8cd2bc3469 ] + +There is an use-after-free reported by KASAN: + + BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 + Read of size 1 at addr ffff888112afc460 by task modprobe/2111 + CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), + Call Trace: + + kasan_report+0xae/0xe0 + acpi_ut_remove_reference+0x3b/0x82 + acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 + acpi_ds_store_object_to_local+0x15d/0x3a0 + acpi_ex_store+0x78d/0x7fd + acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b + acpi_ps_parse_aml+0x217/0x8d5 + ... + + +The root cause of the problem is that the acpi_operand_object +is freed when acpi_ut_walk_package_tree() fails in +acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in +acpi_ut_copy_iobject_to_iobject(). The problem was introduced +by "8aa5e56eeb61" commit, this commit is to fix memory leak in +acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove +operation, lead to "acpi_operand_object" used after free. + +Fix it by removing acpi_ut_remove_reference() in +acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() +is called to copy an internal package object into another internal +package object, when it fails, the memory of acpi_operand_object +should be freed by the caller. + +Fixes: 8aa5e56eeb61 ("ACPICA: Utilities: Fix memory leak in acpi_ut_copy_iobject_to_iobject") +Signed-off-by: Li Zetao +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/utcopy.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/acpi/acpica/utcopy.c b/drivers/acpi/acpica/utcopy.c +index a872ed7879ca..056c1741c1e3 100644 +--- a/drivers/acpi/acpica/utcopy.c ++++ b/drivers/acpi/acpica/utcopy.c +@@ -916,13 +916,6 @@ acpi_ut_copy_ipackage_to_ipackage(union acpi_operand_object *source_obj, + status = acpi_ut_walk_package_tree(source_obj, dest_obj, + acpi_ut_copy_ielement_to_ielement, + walk_state); +- if (ACPI_FAILURE(status)) { +- +- /* On failure, delete the destination package object */ +- +- acpi_ut_remove_reference(dest_obj); +- } +- + return_ACPI_STATUS(status); + } + +-- +2.35.1 + diff --git a/queue-4.19/alpha-fix-syscall-entry-in-audut_syscall-case.patch b/queue-4.19/alpha-fix-syscall-entry-in-audut_syscall-case.patch new file mode 100644 index 00000000000..e6e49053fb9 --- /dev/null +++ b/queue-4.19/alpha-fix-syscall-entry-in-audut_syscall-case.patch @@ -0,0 +1,40 @@ +From 4ec2741ced33d85e2156104ed18e063c758f3dbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Sep 2021 18:18:48 -0400 +Subject: alpha: fix syscall entry in !AUDUT_SYSCALL case + +From: Al Viro + +[ Upstream commit f7b2431a6d22f7a91c567708e071dfcd6d66db14 ] + +We only want to take the slow path if SYSCALL_TRACE or SYSCALL_AUDIT is +set; on !AUDIT_SYSCALL configs the current tree hits it whenever _any_ +thread flag (including NEED_RESCHED, NOTIFY_SIGNAL, etc.) happens to +be set. + +Fixes: a9302e843944 "alpha: Enable system-call auditing support" +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + arch/alpha/kernel/entry.S | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S +index c64806a2daf5..ebe52200a9dc 100644 +--- a/arch/alpha/kernel/entry.S ++++ b/arch/alpha/kernel/entry.S +@@ -469,8 +469,10 @@ entSys: + #ifdef CONFIG_AUDITSYSCALL + lda $6, _TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT + and $3, $6, $3 +-#endif + bne $3, strace ++#else ++ blbs $3, strace /* check for SYSCALL_TRACE in disguise */ ++#endif + beq $4, 1f + ldq $27, 0($5) + 1: jsr $26, ($27), alpha_ni_syscall +-- +2.35.1 + diff --git a/queue-4.19/alsa-asihpi-fix-missing-pci_disable_device.patch b/queue-4.19/alsa-asihpi-fix-missing-pci_disable_device.patch new file mode 100644 index 00000000000..0417a3f3a9b --- /dev/null +++ b/queue-4.19/alsa-asihpi-fix-missing-pci_disable_device.patch @@ -0,0 +1,37 @@ +From 5f6bfe8364665d585edbbd0a3f7d54b53e75af81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 10:14:29 +0800 +Subject: ALSA: asihpi: fix missing pci_disable_device() + +From: Liu Shixin + +[ Upstream commit 9d86515c3d4c0564a0c31a2df87d735353a1971e ] + +pci_disable_device() need be called while module exiting, switch to use +pcim_enable(), pci_disable_device() will be called in pcim_release(). + +Fixes: 3285ea10e9b0 ("ALSA: asihpi - Interrelated HPI tidy up.") +Signed-off-by: Liu Shixin +Link: https://lore.kernel.org/r/20221126021429.3029562-1-liushixin2@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/asihpi/hpioctl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c +index 3f06986fbecf..d8c244a5dce0 100644 +--- a/sound/pci/asihpi/hpioctl.c ++++ b/sound/pci/asihpi/hpioctl.c +@@ -359,7 +359,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev, + pci_dev->device, pci_dev->subsystem_vendor, + pci_dev->subsystem_device, pci_dev->devfn); + +- if (pci_enable_device(pci_dev) < 0) { ++ if (pcim_enable_device(pci_dev) < 0) { + dev_err(&pci_dev->dev, + "pci_enable_device failed, disabling device\n"); + return -EIO; +-- +2.35.1 + diff --git a/queue-4.19/alsa-mts64-fix-possible-null-ptr-defer-in-snd_mts64_.patch b/queue-4.19/alsa-mts64-fix-possible-null-ptr-defer-in-snd_mts64_.patch new file mode 100644 index 00000000000..cc02d5e61ca --- /dev/null +++ b/queue-4.19/alsa-mts64-fix-possible-null-ptr-defer-in-snd_mts64_.patch @@ -0,0 +1,103 @@ +From 995480609a34f690fb187851e01c2a7c71569097 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 14:10:04 +0800 +Subject: ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt + +From: Gaosheng Cui + +[ Upstream commit cf2ea3c86ad90d63d1c572b43e1ca9276b0357ad ] + +I got a null-ptr-defer error report when I do the following tests +on the qemu platform: + +make defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m, +CONFIG_SND_MTS64=m + +Then making test scripts: +cat>test_mod1.sh< + snd_mts64_interrupt+0x24/0xa0 [snd_mts64] + parport_irq_handler+0x37/0x50 [parport] + __handle_irq_event_percpu+0x39/0x190 + handle_irq_event_percpu+0xa/0x30 + handle_irq_event+0x2f/0x50 + handle_edge_irq+0x99/0x1b0 + __common_interrupt+0x5d/0x100 + common_interrupt+0xa0/0xc0 + + + asm_common_interrupt+0x22/0x40 + RIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30 + parport_claim+0xbd/0x230 [parport] + snd_mts64_probe+0x14a/0x465 [snd_mts64] + platform_probe+0x3f/0xa0 + really_probe+0x129/0x2c0 + __driver_probe_device+0x6d/0xc0 + driver_probe_device+0x1a/0xa0 + __device_attach_driver+0x7a/0xb0 + bus_for_each_drv+0x62/0xb0 + __device_attach+0xe4/0x180 + bus_probe_device+0x82/0xa0 + device_add+0x550/0x920 + platform_device_add+0x106/0x220 + snd_mts64_attach+0x2e/0x80 [snd_mts64] + port_check+0x14/0x20 [parport] + bus_for_each_dev+0x6e/0xc0 + __parport_register_driver+0x7c/0xb0 [parport] + snd_mts64_module_init+0x31/0x1000 [snd_mts64] + do_one_initcall+0x3c/0x1f0 + do_init_module+0x46/0x1c6 + load_module+0x1d8d/0x1e10 + __do_sys_finit_module+0xa2/0xf0 + do_syscall_64+0x37/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + + Kernel panic - not syncing: Fatal exception in interrupt + Rebooting in 1 seconds.. + +The mts wa not initialized during interrupt, we add check for +mts to fix this bug. + +Fixes: 68ab801e32bb ("[ALSA] Add snd-mts64 driver for ESI Miditerminal 4140") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221206061004.1222966-1-cuigaosheng1@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/drivers/mts64.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c +index b68e71ca7abd..7dceb1e1c3b4 100644 +--- a/sound/drivers/mts64.c ++++ b/sound/drivers/mts64.c +@@ -830,6 +830,9 @@ static void snd_mts64_interrupt(void *private) + u8 status, data; + struct snd_rawmidi_substream *substream; + ++ if (!mts) ++ return; ++ + spin_lock(&mts->lock); + ret = mts64_read(mts->pardev->port); + data = ret & 0x00ff; +-- +2.35.1 + diff --git a/queue-4.19/alsa-seq-fix-undefined-behavior-in-bit-shift-for-snd.patch b/queue-4.19/alsa-seq-fix-undefined-behavior-in-bit-shift-for-snd.patch new file mode 100644 index 00000000000..fdbebc5dc97 --- /dev/null +++ b/queue-4.19/alsa-seq-fix-undefined-behavior-in-bit-shift-for-snd.patch @@ -0,0 +1,66 @@ +From 59b0fa4e9662ebec7a4aa5c8d4b71f5e326000a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 19:16:30 +0800 +Subject: ALSA: seq: fix undefined behavior in bit shift for + SNDRV_SEQ_FILTER_USE_EVENT + +From: Baisong Zhong + +[ Upstream commit cf59e1e4c79bf741905484cdb13c130b53576a16 ] + +Shifting signed 32-bit value by 31 bits is undefined, so changing +significant bit to unsigned. The UBSAN warning calltrace like below: + +UBSAN: shift-out-of-bounds in sound/core/seq/seq_clientmgr.c:509:22 +left shift of 1 by 31 places cannot be represented in type 'int' +... +Call Trace: + + dump_stack_lvl+0x8d/0xcf + ubsan_epilogue+0xa/0x44 + __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 + snd_seq_deliver_single_event.constprop.21+0x191/0x2f0 + snd_seq_deliver_event+0x1a2/0x350 + snd_seq_kernel_client_dispatch+0x8b/0xb0 + snd_seq_client_notify_subscription+0x72/0xa0 + snd_seq_ioctl_subscribe_port+0x128/0x160 + snd_seq_kernel_client_ctl+0xce/0xf0 + snd_seq_oss_create_client+0x109/0x15b + alsa_seq_oss_init+0x11c/0x1aa + do_one_initcall+0x80/0x440 + kernel_init_freeable+0x370/0x3c3 + kernel_init+0x1b/0x190 + ret_from_fork+0x1f/0x30 + + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Baisong Zhong +Link: https://lore.kernel.org/r/20221121111630.3119259-1-zhongbaisong@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/uapi/sound/asequencer.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/include/uapi/sound/asequencer.h b/include/uapi/sound/asequencer.h +index a75e14edc957..dbd60f48b4b0 100644 +--- a/include/uapi/sound/asequencer.h ++++ b/include/uapi/sound/asequencer.h +@@ -344,10 +344,10 @@ typedef int __bitwise snd_seq_client_type_t; + #define KERNEL_CLIENT ((__force snd_seq_client_type_t) 2) + + /* event filter flags */ +-#define SNDRV_SEQ_FILTER_BROADCAST (1<<0) /* accept broadcast messages */ +-#define SNDRV_SEQ_FILTER_MULTICAST (1<<1) /* accept multicast messages */ +-#define SNDRV_SEQ_FILTER_BOUNCE (1<<2) /* accept bounce event in error */ +-#define SNDRV_SEQ_FILTER_USE_EVENT (1<<31) /* use event filter */ ++#define SNDRV_SEQ_FILTER_BROADCAST (1U<<0) /* accept broadcast messages */ ++#define SNDRV_SEQ_FILTER_MULTICAST (1U<<1) /* accept multicast messages */ ++#define SNDRV_SEQ_FILTER_BOUNCE (1U<<2) /* accept bounce event in error */ ++#define SNDRV_SEQ_FILTER_USE_EVENT (1U<<31) /* use event filter */ + + struct snd_seq_client_info { + int client; /* client number to inquire */ +-- +2.35.1 + diff --git a/queue-4.19/apparmor-fix-a-memleak-in-multi_transaction_new.patch b/queue-4.19/apparmor-fix-a-memleak-in-multi_transaction_new.patch new file mode 100644 index 00000000000..7f236e5aeb4 --- /dev/null +++ b/queue-4.19/apparmor-fix-a-memleak-in-multi_transaction_new.patch @@ -0,0 +1,42 @@ +From 06b8aa5cb1d37e9e21f120ce7727df61876bd3ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 09:15:03 +0800 +Subject: apparmor: fix a memleak in multi_transaction_new() + +From: Gaosheng Cui + +[ Upstream commit c73275cf6834787ca090317f1d20dbfa3b7f05aa ] + +In multi_transaction_new(), the variable t is not freed or passed out +on the failure of copy_from_user(t->data, buf, size), which could lead +to a memleak. + +Fix this bug by adding a put_multi_transaction(t) in the error path. + +Fixes: 1dea3b41e84c5 ("apparmor: speed up transactional queries") +Signed-off-by: Gaosheng Cui +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/apparmorfs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index 8868c475205f..80012d21f038 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -869,8 +869,10 @@ static struct multi_transaction *multi_transaction_new(struct file *file, + if (!t) + return ERR_PTR(-ENOMEM); + kref_init(&t->count); +- if (copy_from_user(t->data, buf, size)) ++ if (copy_from_user(t->data, buf, size)) { ++ put_multi_transaction(t); + return ERR_PTR(-EFAULT); ++ } + + return t; + } +-- +2.35.1 + diff --git a/queue-4.19/apparmor-fix-abi-check-to-include-v8-abi.patch b/queue-4.19/apparmor-fix-abi-check-to-include-v8-abi.patch new file mode 100644 index 00000000000..c9ea5d62689 --- /dev/null +++ b/queue-4.19/apparmor-fix-abi-check-to-include-v8-abi.patch @@ -0,0 +1,42 @@ +From c44baad2e9111dadbca3f793be365cfcd152b35c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 May 2022 18:57:12 -0700 +Subject: apparmor: Fix abi check to include v8 abi + +From: John Johansen + +[ Upstream commit 1b5a6198f5a9d0aa5497da0dc4bcd4fc166ee516 ] + +The v8 abi is supported by the kernel but the userspace supported +version check does not allow for it. This was missed when v8 was added +due to a bug in the userspace compiler which was setting an older abi +version for v8 encoding (which is forward compatible except on the +network encoding). However it is possible to detect the network +encoding by checking the policydb network support which the code +does. The end result was that missing the abi flag worked until +userspace was fixed and began correctly checking for the v8 abi +version. + +Fixes: 56974a6fcfef ("apparmor: add base infastructure for socket mediation") +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy_unpack.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c +index 612f737cee83..41da5ccc3f3e 100644 +--- a/security/apparmor/policy_unpack.c ++++ b/security/apparmor/policy_unpack.c +@@ -892,7 +892,7 @@ static int verify_header(struct aa_ext *e, int required, const char **ns) + * if not specified use previous version + * Mask off everything that is not kernel abi version + */ +- if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v7)) { ++ if (VERSION_LT(e->version, v5) || VERSION_GT(e->version, v8)) { + audit_iface(NULL, NULL, NULL, "unsupported interface version", + e, error); + return error; +-- +2.35.1 + diff --git a/queue-4.19/apparmor-fix-lockdep-warning-when-removing-a-namespa.patch b/queue-4.19/apparmor-fix-lockdep-warning-when-removing-a-namespa.patch new file mode 100644 index 00000000000..8255148ca2f --- /dev/null +++ b/queue-4.19/apparmor-fix-lockdep-warning-when-removing-a-namespa.patch @@ -0,0 +1,56 @@ +From a4327bf4f5841338d1f0cf23d5bfe6f4c176ccbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Sep 2022 03:39:55 -0700 +Subject: apparmor: fix lockdep warning when removing a namespace + +From: John Johansen + +[ Upstream commit 9c4557efc558a68e4cd973490fd936d6e3414db8 ] + +Fix the following lockdep warning + +[ 1119.158984] ============================================ +[ 1119.158988] WARNING: possible recursive locking detected +[ 1119.158996] 6.0.0-rc1+ #257 Tainted: G E N +[ 1119.158999] -------------------------------------------- +[ 1119.159001] bash/80100 is trying to acquire lock: +[ 1119.159007] ffff88803e79b4a0 (&ns->lock/1){+.+.}-{4:4}, at: destroy_ns.part.0+0x43/0x140 +[ 1119.159028] + but task is already holding lock: +[ 1119.159030] ffff8881009764a0 (&ns->lock/1){+.+.}-{4:4}, at: aa_remove_profiles+0x3f0/0x640 +[ 1119.159040] + other info that might help us debug this: +[ 1119.159042] Possible unsafe locking scenario: + +[ 1119.159043] CPU0 +[ 1119.159045] ---- +[ 1119.159047] lock(&ns->lock/1); +[ 1119.159051] lock(&ns->lock/1); +[ 1119.159055] + *** DEADLOCK *** + +Which is caused by an incorrect lockdep nesting notation + +Fixes: feb3c766a3ab ("apparmor: fix possible recursive lock warning in __aa_create_ns") +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/policy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c +index 3a4293c46ad5..c4b5d5e3a721 100644 +--- a/security/apparmor/policy.c ++++ b/security/apparmor/policy.c +@@ -1125,7 +1125,7 @@ ssize_t aa_remove_profiles(struct aa_ns *policy_ns, struct aa_label *subj, + + if (!name) { + /* remove namespace - can only happen if fqname[0] == ':' */ +- mutex_lock_nested(&ns->parent->lock, ns->level); ++ mutex_lock_nested(&ns->parent->lock, ns->parent->level); + __aa_bump_ns_revision(ns); + __aa_remove_ns(ns); + mutex_unlock(&ns->parent->lock); +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-armada-370-fix-assigned-addresses-for-every-.patch b/queue-4.19/arm-dts-armada-370-fix-assigned-addresses-for-every-.patch new file mode 100644 index 00000000000..47c42e26122 --- /dev/null +++ b/queue-4.19/arm-dts-armada-370-fix-assigned-addresses-for-every-.patch @@ -0,0 +1,40 @@ +From 721dfc7ceaef0cf70573b99cf107e0c681e2c571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 00:30:49 +0200 +Subject: ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit d9208b0fa2e803d16b28d91bf1d46b7ee9ea13c6 ] + +BDF of resource in DT assigned-addresses property of Marvell PCIe Root Port +(PCI-to-PCI bridge) should match BDF in address part in that DT node name +as specified resource belongs to Marvell PCIe Root Port itself. + +Fixes: a09a0b7c6ff1 ("arm: mvebu: add PCIe Device Tree informations for Armada 370") +Signed-off-by: Pali Rohár +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-370.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/armada-370.dtsi b/arch/arm/boot/dts/armada-370.dtsi +index 46e6d3ed8f35..c042c416a94a 100644 +--- a/arch/arm/boot/dts/armada-370.dtsi ++++ b/arch/arm/boot/dts/armada-370.dtsi +@@ -74,7 +74,7 @@ pcie0: pcie@1,0 { + + pcie2: pcie@2,0 { + device_type = "pci"; +- assigned-addresses = <0x82002800 0 0x80000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x80000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-armada-375-fix-assigned-addresses-for-every-.patch b/queue-4.19/arm-dts-armada-375-fix-assigned-addresses-for-every-.patch new file mode 100644 index 00000000000..06aa4b1da9a --- /dev/null +++ b/queue-4.19/arm-dts-armada-375-fix-assigned-addresses-for-every-.patch @@ -0,0 +1,40 @@ +From 085ea7db9b05db158eb12d70050a813a8263a2e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 00:30:51 +0200 +Subject: ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 823956d2436f70ced74c0fe8ab99facd8abfc060 ] + +BDF of resource in DT assigned-addresses property of Marvell PCIe Root Port +(PCI-to-PCI bridge) should match BDF in address part in that DT node name +as specified resource belongs to Marvell PCIe Root Port itself. + +Fixes: 4de59085091f ("ARM: mvebu: add Device Tree description of the Armada 375 SoC") +Signed-off-by: Pali Rohár +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-375.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi +index 2932a29ae272..230f6dd876a2 100644 +--- a/arch/arm/boot/dts/armada-375.dtsi ++++ b/arch/arm/boot/dts/armada-375.dtsi +@@ -584,7 +584,7 @@ pcie0: pcie@1,0 { + + pcie1: pcie@2,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x44000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-armada-38x-fix-assigned-addresses-for-every-.patch b/queue-4.19/arm-dts-armada-38x-fix-assigned-addresses-for-every-.patch new file mode 100644 index 00000000000..3236bd91866 --- /dev/null +++ b/queue-4.19/arm-dts-armada-38x-fix-assigned-addresses-for-every-.patch @@ -0,0 +1,81 @@ +From d02433d6589cd99bb0e2907cc8b315b10a0f3461 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 00:30:52 +0200 +Subject: ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 44f47b7a8fa4678ce4c38ea74837e4996b9df6d6 ] + +BDF of resource in DT assigned-addresses property of Marvell PCIe Root Port +(PCI-to-PCI bridge) should match BDF in address part in that DT node name +as specified resource belongs to Marvell PCIe Root Port itself. + +Fixes: 0d3d96ab0059 ("ARM: mvebu: add Device Tree description of the Armada 380/385 SoCs") +Signed-off-by: Pali Rohár +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-380.dtsi | 4 ++-- + arch/arm/boot/dts/armada-385.dtsi | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-380.dtsi b/arch/arm/boot/dts/armada-380.dtsi +index cff1269f3fbf..7146cc8f082a 100644 +--- a/arch/arm/boot/dts/armada-380.dtsi ++++ b/arch/arm/boot/dts/armada-380.dtsi +@@ -79,7 +79,7 @@ pcie@1,0 { + /* x1 port */ + pcie@2,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x40000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x40000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -98,7 +98,7 @@ pcie@2,0 { + /* x1 port */ + pcie@3,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>; ++ assigned-addresses = <0x82001800 0 0x44000 0 0x2000>; + reg = <0x1800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +diff --git a/arch/arm/boot/dts/armada-385.dtsi b/arch/arm/boot/dts/armada-385.dtsi +index f0022d10c715..f081f7cb66e5 100644 +--- a/arch/arm/boot/dts/armada-385.dtsi ++++ b/arch/arm/boot/dts/armada-385.dtsi +@@ -84,7 +84,7 @@ pcie1: pcie@1,0 { + /* x1 port */ + pcie2: pcie@2,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x40000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x40000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -103,7 +103,7 @@ pcie2: pcie@2,0 { + /* x1 port */ + pcie3: pcie@3,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>; ++ assigned-addresses = <0x82001800 0 0x44000 0 0x2000>; + reg = <0x1800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -125,7 +125,7 @@ pcie3: pcie@3,0 { + */ + pcie4: pcie@4,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>; ++ assigned-addresses = <0x82002000 0 0x48000 0 0x2000>; + reg = <0x2000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-armada-38x-fix-compatible-string-for-gpios.patch b/queue-4.19/arm-dts-armada-38x-fix-compatible-string-for-gpios.patch new file mode 100644 index 00000000000..3d6cfbf6c74 --- /dev/null +++ b/queue-4.19/arm-dts-armada-38x-fix-compatible-string-for-gpios.patch @@ -0,0 +1,56 @@ +From 1a0b7adbe4ad15fa1739ac786571e5247207b980 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 20:33:27 +0200 +Subject: ARM: dts: armada-38x: Fix compatible string for gpios +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit c4de4667f15d04ef5920bacf41e514ec7d1ef03d ] + +Armada 38x supports per CPU interrupts for gpios, like Armada XP. Pre-XP +variants like Armada 370 do not support per CPU interrupts for gpios. + +So change compatible string for Armada 38x from "marvell,armada-370-gpio" +which indicates pre-XP variant to "marvell,armadaxp-gpio" which indicates +XP variant or new. + +Driver gpio-mvebu.c which handles both pre-XP and XP variants already +provides support for per CPU interrupts on XP and newer variants. + +Signed-off-by: Pali Rohár +Fixes: 7cb2acb3fbae ("ARM: dts: mvebu: Add PWM properties for armada-38x") +Acked-by: Uwe Kleine-König +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-38x.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi +index 6f32f1233282..819fd66a5de0 100644 +--- a/arch/arm/boot/dts/armada-38x.dtsi ++++ b/arch/arm/boot/dts/armada-38x.dtsi +@@ -287,7 +287,7 @@ sata3_pins: sata-pins-3 { + }; + + gpio0: gpio@18100 { +- compatible = "marvell,armada-370-gpio", ++ compatible = "marvell,armadaxp-gpio", + "marvell,orion-gpio"; + reg = <0x18100 0x40>, <0x181c0 0x08>; + reg-names = "gpio", "pwm"; +@@ -305,7 +305,7 @@ gpio0: gpio@18100 { + }; + + gpio1: gpio@18140 { +- compatible = "marvell,armada-370-gpio", ++ compatible = "marvell,armadaxp-gpio", + "marvell,orion-gpio"; + reg = <0x18140 0x40>, <0x181c8 0x08>; + reg-names = "gpio", "pwm"; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-armada-39x-fix-assigned-addresses-for-every-.patch b/queue-4.19/arm-dts-armada-39x-fix-assigned-addresses-for-every-.patch new file mode 100644 index 00000000000..3a7e62180ea --- /dev/null +++ b/queue-4.19/arm-dts-armada-39x-fix-assigned-addresses-for-every-.patch @@ -0,0 +1,58 @@ +From b951db2361f436f97da0eaa76a4dd24f9fbd81f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 00:30:53 +0200 +Subject: ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 69236d2391b4d7324b11c3252921571577892e7b ] + +BDF of resource in DT assigned-addresses property of Marvell PCIe Root Port +(PCI-to-PCI bridge) should match BDF in address part in that DT node name +as specified resource belongs to Marvell PCIe Root Port itself. + +Fixes: 538da83ddbea ("ARM: mvebu: add Device Tree files for Armada 39x SoC and board") +Signed-off-by: Pali Rohár +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-39x.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-39x.dtsi b/arch/arm/boot/dts/armada-39x.dtsi +index f0c949831efb..f589112e7697 100644 +--- a/arch/arm/boot/dts/armada-39x.dtsi ++++ b/arch/arm/boot/dts/armada-39x.dtsi +@@ -456,7 +456,7 @@ pcie@1,0 { + /* x1 port */ + pcie@2,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x40000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x40000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -475,7 +475,7 @@ pcie@2,0 { + /* x1 port */ + pcie@3,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>; ++ assigned-addresses = <0x82001800 0 0x44000 0 0x2000>; + reg = <0x1800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -497,7 +497,7 @@ pcie@3,0 { + */ + pcie@4,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>; ++ assigned-addresses = <0x82002000 0 0x48000 0 0x2000>; + reg = <0x2000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-armada-39x-fix-compatible-string-for-gpios.patch b/queue-4.19/arm-dts-armada-39x-fix-compatible-string-for-gpios.patch new file mode 100644 index 00000000000..c0703b4c439 --- /dev/null +++ b/queue-4.19/arm-dts-armada-39x-fix-compatible-string-for-gpios.patch @@ -0,0 +1,52 @@ +From 3fdd76cf14b296585404ffa6c3541579dc623370 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jul 2022 20:33:28 +0200 +Subject: ARM: dts: armada-39x: Fix compatible string for gpios +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit d10886a4e6f85ee18d47a1066a52168461370ded ] + +Armada 39x supports per CPU interrupts for gpios, like Armada XP. + +So add compatible string "marvell,armadaxp-gpio" for Armada 39x GPIO nodes. + +Driver gpio-mvebu.c which handles both pre-XP and XP variants already +provides support for per CPU interrupts on XP and newer variants. + +Signed-off-by: Pali Rohár +Fixes: d81a914fc630 ("ARM: dts: mvebu: armada-39x: add missing nodes describing GPIO's") +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-39x.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-39x.dtsi b/arch/arm/boot/dts/armada-39x.dtsi +index f589112e7697..a880c8915a2c 100644 +--- a/arch/arm/boot/dts/armada-39x.dtsi ++++ b/arch/arm/boot/dts/armada-39x.dtsi +@@ -216,7 +216,7 @@ nand_pins: nand-pins { + }; + + gpio0: gpio@18100 { +- compatible = "marvell,orion-gpio"; ++ compatible = "marvell,armadaxp-gpio", "marvell,orion-gpio"; + reg = <0x18100 0x40>; + ngpios = <32>; + gpio-controller; +@@ -230,7 +230,7 @@ gpio0: gpio@18100 { + }; + + gpio1: gpio@18140 { +- compatible = "marvell,orion-gpio"; ++ compatible = "marvell,armadaxp-gpio", "marvell,orion-gpio"; + reg = <0x18140 0x40>; + ngpios = <28>; + gpio-controller; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-armada-xp-fix-assigned-addresses-for-every-p.patch b/queue-4.19/arm-dts-armada-xp-fix-assigned-addresses-for-every-p.patch new file mode 100644 index 00000000000..3a36aad600c --- /dev/null +++ b/queue-4.19/arm-dts-armada-xp-fix-assigned-addresses-for-every-p.patch @@ -0,0 +1,146 @@ +From 6ddd47aeb7ae89ae71bca3937267201d455810a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 00:30:50 +0200 +Subject: ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit eab276787f456cbea89fabea110fe0728673d308 ] + +BDF of resource in DT assigned-addresses property of Marvell PCIe Root Port +(PCI-to-PCI bridge) should match BDF in address part in that DT node name +as specified resource belongs to Marvell PCIe Root Port itself. + +Fixes: 9d8f44f02d4a ("arm: mvebu: add PCIe Device Tree informations for Armada XP") +Fixes: 12b69a599745 ("ARM: mvebu: second PCIe unit of Armada XP mv78230 is only x1 capable") +Fixes: 2163e61c92d9 ("ARM: mvebu: fix second and third PCIe unit of Armada XP mv78260") +Signed-off-by: Pali Rohár +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-xp-mv78230.dtsi | 8 ++++---- + arch/arm/boot/dts/armada-xp-mv78260.dtsi | 16 ++++++++-------- + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-xp-mv78230.dtsi b/arch/arm/boot/dts/armada-xp-mv78230.dtsi +index 8558bf6bb54c..d55fe162fc7f 100644 +--- a/arch/arm/boot/dts/armada-xp-mv78230.dtsi ++++ b/arch/arm/boot/dts/armada-xp-mv78230.dtsi +@@ -97,7 +97,7 @@ pcie1: pcie@1,0 { + + pcie2: pcie@2,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x44000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -115,7 +115,7 @@ pcie2: pcie@2,0 { + + pcie3: pcie@3,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>; ++ assigned-addresses = <0x82001800 0 0x48000 0 0x2000>; + reg = <0x1800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -133,7 +133,7 @@ pcie3: pcie@3,0 { + + pcie4: pcie@4,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x4c000 0 0x2000>; ++ assigned-addresses = <0x82002000 0 0x4c000 0 0x2000>; + reg = <0x2000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -151,7 +151,7 @@ pcie4: pcie@4,0 { + + pcie5: pcie@5,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x80000 0 0x2000>; ++ assigned-addresses = <0x82002800 0 0x80000 0 0x2000>; + reg = <0x2800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +diff --git a/arch/arm/boot/dts/armada-xp-mv78260.dtsi b/arch/arm/boot/dts/armada-xp-mv78260.dtsi +index 2d85fe8ac327..fdcc81819940 100644 +--- a/arch/arm/boot/dts/armada-xp-mv78260.dtsi ++++ b/arch/arm/boot/dts/armada-xp-mv78260.dtsi +@@ -112,7 +112,7 @@ pcie1: pcie@1,0 { + + pcie2: pcie@2,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x44000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x44000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -130,7 +130,7 @@ pcie2: pcie@2,0 { + + pcie3: pcie@3,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x48000 0 0x2000>; ++ assigned-addresses = <0x82001800 0 0x48000 0 0x2000>; + reg = <0x1800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -148,7 +148,7 @@ pcie3: pcie@3,0 { + + pcie4: pcie@4,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x4c000 0 0x2000>; ++ assigned-addresses = <0x82002000 0 0x4c000 0 0x2000>; + reg = <0x2000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -166,7 +166,7 @@ pcie4: pcie@4,0 { + + pcie5: pcie@5,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x80000 0 0x2000>; ++ assigned-addresses = <0x82002800 0 0x80000 0 0x2000>; + reg = <0x2800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -184,7 +184,7 @@ pcie5: pcie@5,0 { + + pcie6: pcie@6,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x84000 0 0x2000>; ++ assigned-addresses = <0x82003000 0 0x84000 0 0x2000>; + reg = <0x3000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -202,7 +202,7 @@ pcie6: pcie@6,0 { + + pcie7: pcie@7,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x88000 0 0x2000>; ++ assigned-addresses = <0x82003800 0 0x88000 0 0x2000>; + reg = <0x3800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -220,7 +220,7 @@ pcie7: pcie@7,0 { + + pcie8: pcie@8,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x8c000 0 0x2000>; ++ assigned-addresses = <0x82004000 0 0x8c000 0 0x2000>; + reg = <0x4000 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +@@ -238,7 +238,7 @@ pcie8: pcie@8,0 { + + pcie9: pcie@9,0 { + device_type = "pci"; +- assigned-addresses = <0x82000800 0 0x42000 0 0x2000>; ++ assigned-addresses = <0x82004800 0 0x42000 0 0x2000>; + reg = <0x4800 0 0 0 0>; + #address-cells = <3>; + #size-cells = <2>; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-dove-fix-assigned-addresses-for-every-pcie-r.patch b/queue-4.19/arm-dts-dove-fix-assigned-addresses-for-every-pcie-r.patch new file mode 100644 index 00000000000..d043e1d0dc2 --- /dev/null +++ b/queue-4.19/arm-dts-dove-fix-assigned-addresses-for-every-pcie-r.patch @@ -0,0 +1,40 @@ +From 4bf61d44d838b6b0d727e1d0e954031f8571826f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Aug 2022 00:30:48 +0200 +Subject: ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit dcc7d8c72b64a479b8017e4332d99179deb8802d ] + +BDF of resource in DT assigned-addresses property of Marvell PCIe Root Port +(PCI-to-PCI bridge) should match BDF in address part in that DT node name +as specified resource belongs to Marvell PCIe Root Port itself. + +Fixes: 74ecaa403a74 ("ARM: dove: add PCIe controllers to SoC DT") +Signed-off-by: Pali Rohár +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dove.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/dove.dtsi b/arch/arm/boot/dts/dove.dtsi +index 250ad0535e8c..c677d1a74a90 100644 +--- a/arch/arm/boot/dts/dove.dtsi ++++ b/arch/arm/boot/dts/dove.dtsi +@@ -129,7 +129,7 @@ pcie0: pcie@1 { + pcie1: pcie@2 { + device_type = "pci"; + status = "disabled"; +- assigned-addresses = <0x82002800 0 0x80000 0 0x2000>; ++ assigned-addresses = <0x82001000 0 0x80000 0 0x2000>; + reg = <0x1000 0 0 0 0>; + clocks = <&gate_clk 5>; + marvell,pcie-port = <1>; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-qcom-apq8064-fix-coresight-compatible.patch b/queue-4.19/arm-dts-qcom-apq8064-fix-coresight-compatible.patch new file mode 100644 index 00000000000..c05d3d81bdf --- /dev/null +++ b/queue-4.19/arm-dts-qcom-apq8064-fix-coresight-compatible.patch @@ -0,0 +1,39 @@ +From fb203d077d1c4226409384a8e54e3629189fe403 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 21:06:57 +0200 +Subject: ARM: dts: qcom: apq8064: fix coresight compatible + +From: Luca Weiss + +[ Upstream commit a42b1ee868361f1cb0492f1bdaefb43e0751e468 ] + +There's a typo missing the arm, prefix of arm,coresight-etb10. Fix it to +make devicetree validation happier. + +Signed-off-by: Luca Weiss +Fixes: 7a5c275fd821 ("ARM: dts: qcom: Add apq8064 CoreSight components") +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221013190657.48499-3-luca@z3ntu.xyz +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi +index 00daa844bf8c..3b9d70eadeb9 100644 +--- a/arch/arm/boot/dts/qcom-apq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi +@@ -1604,7 +1604,7 @@ wifi { + }; + + etb@1a01000 { +- compatible = "coresight-etb10", "arm,primecell"; ++ compatible = "arm,coresight-etb10", "arm,primecell"; + reg = <0x1a01000 0x1000>; + + clocks = <&rpmcc RPM_QDSS_CLK>; +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-spear600-fix-clcd-interrupt.patch b/queue-4.19/arm-dts-spear600-fix-clcd-interrupt.patch new file mode 100644 index 00000000000..9d909c8d0f7 --- /dev/null +++ b/queue-4.19/arm-dts-spear600-fix-clcd-interrupt.patch @@ -0,0 +1,37 @@ +From d63bd27fb43a0a2f7bc60027d7ecc356e836c081 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 18:10:06 +0100 +Subject: arm: dts: spear600: Fix clcd interrupt + +From: Kory Maincent + +[ Upstream commit 0336e2ce34e7a89832b6c214f924eb7bc58940be ] + +Interrupt 12 of the Interrupt controller belongs to the SMI controller, +the right one for the display controller is the interrupt 13. + +Fixes: 8113ba917dfa ("ARM: SPEAr: DT: Update device nodes") +Signed-off-by: Kory Maincent +Acked-by: Viresh Kumar +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/spear600.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi +index 00166eb9be86..ca07e73e1f27 100644 +--- a/arch/arm/boot/dts/spear600.dtsi ++++ b/arch/arm/boot/dts/spear600.dtsi +@@ -53,7 +53,7 @@ clcd: clcd@fc200000 { + compatible = "arm,pl110", "arm,primecell"; + reg = <0xfc200000 0x1000>; + interrupt-parent = <&vic1>; +- interrupts = <12>; ++ interrupts = <13>; + status = "disabled"; + }; + +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-turris-omnia-add-ethernet-aliases.patch b/queue-4.19/arm-dts-turris-omnia-add-ethernet-aliases.patch new file mode 100644 index 00000000000..7d229e4b93a --- /dev/null +++ b/queue-4.19/arm-dts-turris-omnia-add-ethernet-aliases.patch @@ -0,0 +1,43 @@ +From 6dfe7a59ada3442c7fcaf4b395914436dfd76f2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Jul 2022 15:09:26 +0200 +Subject: ARM: dts: turris-omnia: Add ethernet aliases +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit f1f3e530c59a7e8c5f06172f4c28b945a6b4bfb8 ] + +This allows bootloader to correctly pass MAC addresses used by bootloader +to individual interfaces into kernel device tree. + +Signed-off-by: Pali Rohár +Fixes: 26ca8b52d6e1 ("ARM: dts: add support for Turris Omnia") +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-385-turris-omnia.dts | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts +index 92e08486ec81..c0a026ac7be8 100644 +--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts ++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts +@@ -22,6 +22,12 @@ chosen { + stdout-path = &uart0; + }; + ++ aliases { ++ ethernet0 = ð0; ++ ethernet1 = ð1; ++ ethernet2 = ð2; ++ }; ++ + memory { + device_type = "memory"; + reg = <0x00000000 0x40000000>; /* 1024 MB */ +-- +2.35.1 + diff --git a/queue-4.19/arm-dts-turris-omnia-add-switch-port-6-node.patch b/queue-4.19/arm-dts-turris-omnia-add-switch-port-6-node.patch new file mode 100644 index 00000000000..ced4f245d55 --- /dev/null +++ b/queue-4.19/arm-dts-turris-omnia-add-switch-port-6-node.patch @@ -0,0 +1,49 @@ +From e9f56e2b01de623783ee38d0301fe1da0d2801b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Aug 2022 14:21:02 +0200 +Subject: ARM: dts: turris-omnia: Add switch port 6 node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit f87db2005f73876602211af0ee156817019b6bda ] + +Switch port 6 is connected to eth0, so add appropriate device tree node for it. + +Fixes: 26ca8b52d6e1 ("ARM: dts: add support for Turris Omnia") +Signed-off-by: Pali Rohár +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-385-turris-omnia.dts | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts +index c0a026ac7be8..320c759b4090 100644 +--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts ++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts +@@ -297,7 +297,17 @@ fixed-link { + }; + }; + +- /* port 6 is connected to eth0 */ ++ ports@6 { ++ reg = <6>; ++ label = "cpu"; ++ ethernet = <ð0>; ++ phy-mode = "rgmii-id"; ++ ++ fixed-link { ++ speed = <1000>; ++ full-duplex; ++ }; ++ }; + }; + }; + }; +-- +2.35.1 + diff --git a/queue-4.19/arm-mmp-fix-timer_read-delay.patch b/queue-4.19/arm-mmp-fix-timer_read-delay.patch new file mode 100644 index 00000000000..4495d175851 --- /dev/null +++ b/queue-4.19/arm-mmp-fix-timer_read-delay.patch @@ -0,0 +1,59 @@ +From 283d1a33a90db3d3219a4fb9fdf12abbe142ed94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Dec 2022 16:51:17 -0800 +Subject: ARM: mmp: fix timer_read delay + +From: Doug Brown + +[ Upstream commit e348b4014c31041e13ff370669ba3348c4d385e3 ] + +timer_read() was using an empty 100-iteration loop to wait for the +TMR_CVWR register to capture the latest timer counter value. The delay +wasn't long enough. This resulted in CPU idle time being extremely +underreported on PXA168 with CONFIG_NO_HZ_IDLE=y. + +Switch to the approach used in the vendor kernel, which implements the +capture delay by reading TMR_CVWR a few times instead. + +Fixes: 49cbe78637eb ("[ARM] pxa: add base support for Marvell's PXA168 processor line") +Signed-off-by: Doug Brown +Link: https://lore.kernel.org/r/20221204005117.53452-3-doug@schmorgal.com +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-mmp/time.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c +index 96ad1db0b04b..edd280e75546 100644 +--- a/arch/arm/mach-mmp/time.c ++++ b/arch/arm/mach-mmp/time.c +@@ -52,18 +52,21 @@ + static void __iomem *mmp_timer_base = TIMERS_VIRT_BASE; + + /* +- * FIXME: the timer needs some delay to stablize the counter capture ++ * Read the timer through the CVWR register. Delay is required after requesting ++ * a read. The CR register cannot be directly read due to metastability issues ++ * documented in the PXA168 software manual. + */ + static inline uint32_t timer_read(void) + { +- int delay = 100; ++ uint32_t val; ++ int delay = 3; + + __raw_writel(1, mmp_timer_base + TMR_CVWR(1)); + + while (delay--) +- cpu_relax(); ++ val = __raw_readl(mmp_timer_base + TMR_CVWR(1)); + +- return __raw_readl(mmp_timer_base + TMR_CVWR(1)); ++ return val; + } + + static u64 notrace mmp_read_sched_clock(void) +-- +2.35.1 + diff --git a/queue-4.19/arm64-dts-mediatek-mt6797-fix-26m-oscillator-unit-na.patch b/queue-4.19/arm64-dts-mediatek-mt6797-fix-26m-oscillator-unit-na.patch new file mode 100644 index 00000000000..d6abd443618 --- /dev/null +++ b/queue-4.19/arm64-dts-mediatek-mt6797-fix-26m-oscillator-unit-na.patch @@ -0,0 +1,37 @@ +From 5e7069b10ca14b46910ff6c7d78287e3c8846aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 17:22:12 +0200 +Subject: arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name + +From: AngeloGioacchino Del Regno + +[ Upstream commit 5f535cc583759c9c60d4cc9b8d221762e2d75387 ] + +Update its unit name to oscillator-26m and remove the unneeded unit +address to fix a unit_address_vs_reg warning. + +Fixes: 464c510f60c6 ("arm64: dts: mediatek: add mt6797 support") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221013152212.416661-9-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt6797.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt6797.dtsi b/arch/arm64/boot/dts/mediatek/mt6797.dtsi +index 4beaa71107d7..ebe1b5343966 100644 +--- a/arch/arm64/boot/dts/mediatek/mt6797.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt6797.dtsi +@@ -101,7 +101,7 @@ cpu9: cpu@201 { + }; + }; + +- clk26m: oscillator@0 { ++ clk26m: oscillator-26m { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <26000000>; +-- +2.35.1 + diff --git a/queue-4.19/arm64-dts-mt2712-evb-fix-vproc-fixed-regulators-unit.patch b/queue-4.19/arm64-dts-mt2712-evb-fix-vproc-fixed-regulators-unit.patch new file mode 100644 index 00000000000..8ee81991ec1 --- /dev/null +++ b/queue-4.19/arm64-dts-mt2712-evb-fix-vproc-fixed-regulators-unit.patch @@ -0,0 +1,45 @@ +From cc0b1a7e63e946180e4e888f648d37d7e5574068 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 17:22:09 +0200 +Subject: arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names + +From: AngeloGioacchino Del Regno + +[ Upstream commit 377063156893bf6c088309ac799fe5c6dce2822d ] + +Update the names to regulator-vproc-buck{0,1} to fix unit_addres_vs_reg +warnings for those. + +Fixes: f75dd8bdd344 ("arm64: dts: mediatek: add mt2712 cpufreq related device nodes") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221013152212.416661-6-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts +index 4ce9d6ca0bf7..424c22a266c4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts +@@ -25,14 +25,14 @@ chosen { + stdout-path = "serial0:921600n8"; + }; + +- cpus_fixed_vproc0: fixedregulator@0 { ++ cpus_fixed_vproc0: regulator-vproc-buck0 { + compatible = "regulator-fixed"; + regulator-name = "vproc_buck0"; + regulator-min-microvolt = <1000000>; + regulator-max-microvolt = <1000000>; + }; + +- cpus_fixed_vproc1: fixedregulator@1 { ++ cpus_fixed_vproc1: regulator-vproc-buck1 { + compatible = "regulator-fixed"; + regulator-name = "vproc_buck1"; + regulator-min-microvolt = <1000000>; +-- +2.35.1 + diff --git a/queue-4.19/arm64-dts-mt2712e-fix-unit-address-for-pinctrl-node.patch b/queue-4.19/arm64-dts-mt2712e-fix-unit-address-for-pinctrl-node.patch new file mode 100644 index 00000000000..ceb16d2b5b4 --- /dev/null +++ b/queue-4.19/arm64-dts-mt2712e-fix-unit-address-for-pinctrl-node.patch @@ -0,0 +1,42 @@ +From 34967372aee8be1dc5de827d693b6d7d85caecec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 17:22:08 +0200 +Subject: arm64: dts: mt2712e: Fix unit address for pinctrl node + +From: AngeloGioacchino Del Regno + +[ Upstream commit 1d4516f53a611b362db7ba7a8889923d469f57e1 ] + +The unit address for the pinctrl node is (0x)1000b000 and not +(0x)10005000, which is the syscfg_pctl_a address instead. + +This fixes the following warning: +arch/arm64/boot/dts/mediatek/mt2712e.dtsi:264.40-267.4: Warning +(unique_unit_address): /syscfg_pctl_a@10005000: duplicate +unit-address (also used in node /pinctrl@10005000) + +Fixes: f0c64340b748 ("arm64: dts: mt2712: add pintcrl device node.") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221013152212.416661-5-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +index b002bfd85be0..9acbd82fb44b 100644 +--- a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +@@ -264,7 +264,7 @@ syscfg_pctl_a: syscfg_pctl_a@10005000 { + reg = <0 0x10005000 0 0x1000>; + }; + +- pio: pinctrl@10005000 { ++ pio: pinctrl@1000b000 { + compatible = "mediatek,mt2712-pinctrl"; + reg = <0 0x1000b000 0 0x1000>; + mediatek,pctl-regmap = <&syscfg_pctl_a>; +-- +2.35.1 + diff --git a/queue-4.19/arm64-dts-mt2712e-fix-unit_address_vs_reg-warning-fo.patch b/queue-4.19/arm64-dts-mt2712e-fix-unit_address_vs_reg-warning-fo.patch new file mode 100644 index 00000000000..94156f9874d --- /dev/null +++ b/queue-4.19/arm64-dts-mt2712e-fix-unit_address_vs_reg-warning-fo.patch @@ -0,0 +1,110 @@ +From a11aa9a738c4ec12b118836b98f2a12ef2302cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 17:22:07 +0200 +Subject: arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators + +From: AngeloGioacchino Del Regno + +[ Upstream commit e4495a0a8b3d84816c9a46edf3ce060bbf267475 ] + +Rename the fixed-clock oscillators to remove the unit address. + +This solves unit_address_vs_reg warnings. + +Fixes: 5d4839709c8e ("arm64: dts: mt2712: Add clock controller device nodes") +Signed-off-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20221013152212.416661-4-angelogioacchino.delregno@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +index 75cc0f7cc088..b002bfd85be0 100644 +--- a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +@@ -158,70 +158,70 @@ sys_clk: dummyclk { + #clock-cells = <0>; + }; + +- clk26m: oscillator@0 { ++ clk26m: oscillator-26m { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <26000000>; + clock-output-names = "clk26m"; + }; + +- clk32k: oscillator@1 { ++ clk32k: oscillator-32k { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <32768>; + clock-output-names = "clk32k"; + }; + +- clkfpc: oscillator@2 { ++ clkfpc: oscillator-50m { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <50000000>; + clock-output-names = "clkfpc"; + }; + +- clkaud_ext_i_0: oscillator@3 { ++ clkaud_ext_i_0: oscillator-aud0 { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <6500000>; + clock-output-names = "clkaud_ext_i_0"; + }; + +- clkaud_ext_i_1: oscillator@4 { ++ clkaud_ext_i_1: oscillator-aud1 { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <196608000>; + clock-output-names = "clkaud_ext_i_1"; + }; + +- clkaud_ext_i_2: oscillator@5 { ++ clkaud_ext_i_2: oscillator-aud2 { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <180633600>; + clock-output-names = "clkaud_ext_i_2"; + }; + +- clki2si0_mck_i: oscillator@6 { ++ clki2si0_mck_i: oscillator-i2s0 { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <30000000>; + clock-output-names = "clki2si0_mck_i"; + }; + +- clki2si1_mck_i: oscillator@7 { ++ clki2si1_mck_i: oscillator-i2s1 { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <30000000>; + clock-output-names = "clki2si1_mck_i"; + }; + +- clki2si2_mck_i: oscillator@8 { ++ clki2si2_mck_i: oscillator-i2s2 { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <30000000>; + clock-output-names = "clki2si2_mck_i"; + }; + +- clktdmin_mclk_i: oscillator@9 { ++ clktdmin_mclk_i: oscillator-mclk { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <30000000>; +-- +2.35.1 + diff --git a/queue-4.19/asoc-codecs-rt298-add-quirk-for-kbl-r-rvp-platform.patch b/queue-4.19/asoc-codecs-rt298-add-quirk-for-kbl-r-rvp-platform.patch new file mode 100644 index 00000000000..b63a40a9bc6 --- /dev/null +++ b/queue-4.19/asoc-codecs-rt298-add-quirk-for-kbl-r-rvp-platform.patch @@ -0,0 +1,45 @@ +From 2b77e99a280ff85c537f08f6c37804a551d74e1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 14:19:43 +0200 +Subject: ASoC: codecs: rt298: Add quirk for KBL-R RVP platform +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +[ Upstream commit 953dbd1cef18ce9ac0d69c1bd735b929fe52a17e ] + +KBL-R RVP platforms also use combojack, so we need to enable that +configuration for them. + +Signed-off-by: Amadeusz Sławiński +Signed-off-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20221010121955.718168-4-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt298.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/sound/soc/codecs/rt298.c b/sound/soc/codecs/rt298.c +index 06cdba4edfe2..3181b91a025b 100644 +--- a/sound/soc/codecs/rt298.c ++++ b/sound/soc/codecs/rt298.c +@@ -1169,6 +1169,13 @@ static const struct dmi_system_id force_combo_jack_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Geminilake") + } + }, ++ { ++ .ident = "Intel Kabylake R RVP", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Kabylake Client platform") ++ } ++ }, + { } + }; + +-- +2.35.1 + diff --git a/queue-4.19/asoc-pcm512x-fix-pm-disable-depth-imbalance-in-pcm51.patch b/queue-4.19/asoc-pcm512x-fix-pm-disable-depth-imbalance-in-pcm51.patch new file mode 100644 index 00000000000..cbad13e3604 --- /dev/null +++ b/queue-4.19/asoc-pcm512x-fix-pm-disable-depth-imbalance-in-pcm51.patch @@ -0,0 +1,64 @@ +From 8c30a50420dae0be16ab194badfbc71b0c8c4d6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 00:04:02 +0800 +Subject: ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe + +From: Zhang Qilong + +[ Upstream commit 97b801be6f8e53676b9f2b105f54e35c745c1b22 ] + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. We fix it by going to +err_pm instead of err_clk. + +Fixes:f086ba9d5389c ("ASoC: pcm512x: Support mastering BCLK/LRCLK using the PLL") + +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20220928160402.126140-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/pcm512x.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c +index 5272c81641c1..310cfceab41f 100644 +--- a/sound/soc/codecs/pcm512x.c ++++ b/sound/soc/codecs/pcm512x.c +@@ -1471,7 +1471,7 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap) + if (val > 6) { + dev_err(dev, "Invalid pll-in\n"); + ret = -EINVAL; +- goto err_clk; ++ goto err_pm; + } + pcm512x->pll_in = val; + } +@@ -1480,7 +1480,7 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap) + if (val > 6) { + dev_err(dev, "Invalid pll-out\n"); + ret = -EINVAL; +- goto err_clk; ++ goto err_pm; + } + pcm512x->pll_out = val; + } +@@ -1489,12 +1489,12 @@ int pcm512x_probe(struct device *dev, struct regmap *regmap) + dev_err(dev, + "Error: both pll-in and pll-out, or none\n"); + ret = -EINVAL; +- goto err_clk; ++ goto err_pm; + } + if (pcm512x->pll_in && pcm512x->pll_in == pcm512x->pll_out) { + dev_err(dev, "Error: pll-in == pll-out\n"); + ret = -EINVAL; +- goto err_clk; ++ goto err_pm; + } + } + #endif +-- +2.35.1 + diff --git a/queue-4.19/asoc-pxa-fix-null-pointer-dereference-in-filter.patch b/queue-4.19/asoc-pxa-fix-null-pointer-dereference-in-filter.patch new file mode 100644 index 00000000000..552de4bd882 --- /dev/null +++ b/queue-4.19/asoc-pxa-fix-null-pointer-dereference-in-filter.patch @@ -0,0 +1,37 @@ +From 8cbcbea65196df77b7ee61965c7a28e735e39b02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 16:56:29 +0800 +Subject: ASoC: pxa: fix null-pointer dereference in filter() + +From: Zeng Heng + +[ Upstream commit ec7bf231aaa1bdbcb69d23bc50c753c80fb22429 ] + +kasprintf() would return NULL pointer when kmalloc() fail to allocate. +Need to check the return pointer before calling strcmp(). + +Fixes: 7a824e214e25 ("ASoC: mmp: add audio dma support") +Signed-off-by: Zeng Heng +Link: https://lore.kernel.org/r/20221114085629.1910435-1-zengheng4@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/pxa/mmp-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/pxa/mmp-pcm.c b/sound/soc/pxa/mmp-pcm.c +index d2d4652de32c..5969aa66410d 100644 +--- a/sound/soc/pxa/mmp-pcm.c ++++ b/sound/soc/pxa/mmp-pcm.c +@@ -90,7 +90,7 @@ static bool filter(struct dma_chan *chan, void *param) + + devname = kasprintf(GFP_KERNEL, "%s.%d", dma_data->dma_res->name, + dma_data->ssp_id); +- if ((strcmp(dev_name(chan->device->dev), devname) == 0) && ++ if (devname && (strcmp(dev_name(chan->device->dev), devname) == 0) && + (chan->chan_id == dma_data->dma_res->start)) { + found = true; + } +-- +2.35.1 + diff --git a/queue-4.19/binfmt_misc-fix-shift-out-of-bounds-in-check_special.patch b/queue-4.19/binfmt_misc-fix-shift-out-of-bounds-in-check_special.patch new file mode 100644 index 00000000000..71512728759 --- /dev/null +++ b/queue-4.19/binfmt_misc-fix-shift-out-of-bounds-in-check_special.patch @@ -0,0 +1,61 @@ +From a422917e30ed4f5eebc929450c9b77c73139a612 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 10:51:23 +0800 +Subject: binfmt_misc: fix shift-out-of-bounds in check_special_flags + +From: Liu Shixin + +[ Upstream commit 6a46bf558803dd2b959ca7435a5c143efe837217 ] + +UBSAN reported a shift-out-of-bounds warning: + + left shift of 1 by 31 places cannot be represented in type 'int' + Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106 + ubsan_epilogue+0xa/0x44 lib/ubsan.c:151 + __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322 + check_special_flags fs/binfmt_misc.c:241 [inline] + create_entry fs/binfmt_misc.c:456 [inline] + bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654 + vfs_write+0x11e/0x580 fs/read_write.c:582 + ksys_write+0xcf/0x120 fs/read_write.c:637 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + RIP: 0033:0x4194e1 + +Since the type of Node's flags is unsigned long, we should define these +macros with same type too. + +Signed-off-by: Liu Shixin +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20221102025123.1117184-1-liushixin2@huawei.com +Signed-off-by: Sasha Levin +--- + fs/binfmt_misc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c +index 27a04f492541..8fe7edd2b001 100644 +--- a/fs/binfmt_misc.c ++++ b/fs/binfmt_misc.c +@@ -42,10 +42,10 @@ static LIST_HEAD(entries); + static int enabled = 1; + + enum {Enabled, Magic}; +-#define MISC_FMT_PRESERVE_ARGV0 (1 << 31) +-#define MISC_FMT_OPEN_BINARY (1 << 30) +-#define MISC_FMT_CREDENTIALS (1 << 29) +-#define MISC_FMT_OPEN_FILE (1 << 28) ++#define MISC_FMT_PRESERVE_ARGV0 (1UL << 31) ++#define MISC_FMT_OPEN_BINARY (1UL << 30) ++#define MISC_FMT_CREDENTIALS (1UL << 29) ++#define MISC_FMT_OPEN_FILE (1UL << 28) + + typedef struct { + struct list_head list; +-- +2.35.1 + diff --git a/queue-4.19/blk-mq-fix-possible-memleak-when-register-hctx-faile.patch b/queue-4.19/blk-mq-fix-possible-memleak-when-register-hctx-faile.patch new file mode 100644 index 00000000000..8dbe17e07a6 --- /dev/null +++ b/queue-4.19/blk-mq-fix-possible-memleak-when-register-hctx-faile.patch @@ -0,0 +1,86 @@ +From b83bbf291f3cf9f6e48990a6084315bb2d1a5c51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 10:29:40 +0800 +Subject: blk-mq: fix possible memleak when register 'hctx' failed + +From: Ye Bin + +[ Upstream commit 4b7a21c57b14fbcd0e1729150189e5933f5088e9 ] + +There's issue as follows when do fault injection test: +unreferenced object 0xffff888132a9f400 (size 512): + comm "insmod", pid 308021, jiffies 4324277909 (age 509.733s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 08 f4 a9 32 81 88 ff ff ...........2.... + 08 f4 a9 32 81 88 ff ff 00 00 00 00 00 00 00 00 ...2............ + backtrace: + [<00000000e8952bb4>] kmalloc_node_trace+0x22/0xa0 + [<00000000f9980e0f>] blk_mq_alloc_and_init_hctx+0x3f1/0x7e0 + [<000000002e719efa>] blk_mq_realloc_hw_ctxs+0x1e6/0x230 + [<000000004f1fda40>] blk_mq_init_allocated_queue+0x27e/0x910 + [<00000000287123ec>] __blk_mq_alloc_disk+0x67/0xf0 + [<00000000a2a34657>] 0xffffffffa2ad310f + [<00000000b173f718>] 0xffffffffa2af824a + [<0000000095a1dabb>] do_one_initcall+0x87/0x2a0 + [<00000000f32fdf93>] do_init_module+0xdf/0x320 + [<00000000cbe8541e>] load_module+0x3006/0x3390 + [<0000000069ed1bdb>] __do_sys_finit_module+0x113/0x1b0 + [<00000000a1a29ae8>] do_syscall_64+0x35/0x80 + [<000000009cd878b0>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fault injection context as follows: + kobject_add + blk_mq_register_hctx + blk_mq_sysfs_register + blk_register_queue + device_add_disk + null_add_dev.part.0 [null_blk] + +As 'blk_mq_register_hctx' may already add some objects when failed halfway, +but there isn't do fallback, caller don't know which objects add failed. +To solve above issue just do fallback when add objects failed halfway in +'blk_mq_register_hctx'. + +Signed-off-by: Ye Bin +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20221117022940.873959-1-yebin@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 5e4b7ed1e897..ae03e63ffbfd 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -241,7 +241,7 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) + { + struct request_queue *q = hctx->queue; + struct blk_mq_ctx *ctx; +- int i, ret; ++ int i, j, ret; + + if (!hctx->nr_ctx) + return 0; +@@ -253,9 +253,16 @@ static int blk_mq_register_hctx(struct blk_mq_hw_ctx *hctx) + hctx_for_each_ctx(hctx, ctx, i) { + ret = kobject_add(&ctx->kobj, &hctx->kobj, "cpu%u", ctx->cpu); + if (ret) +- break; ++ goto out; + } + ++ return 0; ++out: ++ hctx_for_each_ctx(hctx, ctx, j) { ++ if (j < i) ++ kobject_del(&ctx->kobj); ++ } ++ kobject_del(&hctx->kobj); + return ret; + } + +-- +2.35.1 + diff --git a/queue-4.19/blktrace-fix-output-non-blktrace-event-when-blk_clas.patch b/queue-4.19/blktrace-fix-output-non-blktrace-event-when-blk_clas.patch new file mode 100644 index 00000000000..c9743ee8253 --- /dev/null +++ b/queue-4.19/blktrace-fix-output-non-blktrace-event-when-blk_clas.patch @@ -0,0 +1,47 @@ +From 78dc57c6a0fa3a2c1e4e294adde2283728db4a33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 12:04:10 +0800 +Subject: blktrace: Fix output non-blktrace event when blk_classic option + enabled + +From: Yang Jihong + +[ Upstream commit f596da3efaf4130ff61cd029558845808df9bf99 ] + +When the blk_classic option is enabled, non-blktrace events must be +filtered out. Otherwise, events of other types are output in the blktrace +classic format, which is unexpected. + +The problem can be triggered in the following ways: + + # echo 1 > /sys/kernel/debug/tracing/options/blk_classic + # echo 1 > /sys/kernel/debug/tracing/events/enable + # echo blk > /sys/kernel/debug/tracing/current_tracer + # cat /sys/kernel/debug/tracing/trace_pipe + +Fixes: c71a89615411 ("blktrace: add ftrace plugin") +Signed-off-by: Yang Jihong +Link: https://lore.kernel.org/r/20221122040410.85113-1-yangjihong1@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + kernel/trace/blktrace.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 75ea1a5be31a..113cbe1a20aa 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -1594,7 +1594,8 @@ blk_trace_event_print_binary(struct trace_iterator *iter, int flags, + + static enum print_line_t blk_tracer_print_line(struct trace_iterator *iter) + { +- if (!(blk_tracer_flags.val & TRACE_BLK_OPT_CLASSIC)) ++ if ((iter->ent->type != TRACE_BLK) || ++ !(blk_tracer_flags.val & TRACE_BLK_OPT_CLASSIC)) + return TRACE_TYPE_UNHANDLED; + + return print_one_line(iter, true); +-- +2.35.1 + diff --git a/queue-4.19/bluetooth-btusb-don-t-call-kfree_skb-under-spin_lock.patch b/queue-4.19/bluetooth-btusb-don-t-call-kfree_skb-under-spin_lock.patch new file mode 100644 index 00000000000..836f610f18b --- /dev/null +++ b/queue-4.19/bluetooth-btusb-don-t-call-kfree_skb-under-spin_lock.patch @@ -0,0 +1,45 @@ +From b8b5b4efdcff0ab29f1b1bb28a61523ad47fc2e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 20:59:10 +0800 +Subject: Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit b15a6bd3c80c77faec8317319b97f976b1a08332 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). + +Fixes: 803b58367ffb ("Bluetooth: btusb: Implement driver internal packet reassembly") +Signed-off-by: Yang Yingliang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 7188f0fb2e05..b6eb48e44e6b 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -501,13 +501,13 @@ static inline void btusb_free_frags(struct btusb_data *data) + + spin_lock_irqsave(&data->rxlock, flags); + +- kfree_skb(data->evt_skb); ++ dev_kfree_skb_irq(data->evt_skb); + data->evt_skb = NULL; + +- kfree_skb(data->acl_skb); ++ dev_kfree_skb_irq(data->acl_skb); + data->acl_skb = NULL; + +- kfree_skb(data->sco_skb); ++ dev_kfree_skb_irq(data->sco_skb); + data->sco_skb = NULL; + + spin_unlock_irqrestore(&data->rxlock, flags); +-- +2.35.1 + diff --git a/queue-4.19/bluetooth-hci_bcsp-don-t-call-kfree_skb-under-spin_l.patch b/queue-4.19/bluetooth-hci_bcsp-don-t-call-kfree_skb-under-spin_l.patch new file mode 100644 index 00000000000..af40478d144 --- /dev/null +++ b/queue-4.19/bluetooth-hci_bcsp-don-t-call-kfree_skb-under-spin_l.patch @@ -0,0 +1,37 @@ +From edb2ba45454cb55e3889c9fe4aeef517776d7b72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 10:18:33 +0800 +Subject: Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 7b503e339c1a80bf0051ec2d19c3bc777014ac61 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_bcsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c +index 27829273f3c9..f6fa0a40dc37 100644 +--- a/drivers/bluetooth/hci_bcsp.c ++++ b/drivers/bluetooth/hci_bcsp.c +@@ -393,7 +393,7 @@ static void bcsp_pkt_cull(struct bcsp_struct *bcsp) + i++; + + __skb_unlink(skb, &bcsp->unack); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + } + + if (skb_queue_empty(&bcsp->unack)) +-- +2.35.1 + diff --git a/queue-4.19/bluetooth-hci_core-don-t-call-kfree_skb-under-spin_l.patch b/queue-4.19/bluetooth-hci_core-don-t-call-kfree_skb-under-spin_l.patch new file mode 100644 index 00000000000..4c2f43142b6 --- /dev/null +++ b/queue-4.19/bluetooth-hci_core-don-t-call-kfree_skb-under-spin_l.patch @@ -0,0 +1,37 @@ +From 27cdc6e748f4f959159eba19ee50e850683abfba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 10:18:34 +0800 +Subject: Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 39c1eb6fcbae8ce9bb71b2ac5cb609355a2b181b ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). + +Fixes: 9238f36a5a50 ("Bluetooth: Add request cmd_complete and cmd_status functions") +Signed-off-by: Yang Yingliang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 3d780220e2d1..e87777255c47 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -4331,7 +4331,7 @@ void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status, + *req_complete_skb = bt_cb(skb)->hci.req_complete_skb; + else + *req_complete = bt_cb(skb)->hci.req_complete; +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + } + spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); + } +-- +2.35.1 + diff --git a/queue-4.19/bluetooth-hci_h5-don-t-call-kfree_skb-under-spin_loc.patch b/queue-4.19/bluetooth-hci_h5-don-t-call-kfree_skb-under-spin_loc.patch new file mode 100644 index 00000000000..14b2a948702 --- /dev/null +++ b/queue-4.19/bluetooth-hci_h5-don-t-call-kfree_skb-under-spin_loc.patch @@ -0,0 +1,37 @@ +From 9aa539ef93f7d67b4dff1af6dd6d861370f2328b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 10:18:32 +0800 +Subject: Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 383630cc6758d619874c2e8bb2f68a61f3f9ef6e ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). + +Fixes: 43eb12d78960 ("Bluetooth: Fix/implement Three-wire reliable packet sending") +Signed-off-by: Yang Yingliang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_h5.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index 79b96251de80..29c80e2acb05 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -311,7 +311,7 @@ static void h5_pkt_cull(struct h5 *h5) + break; + + __skb_unlink(skb, &h5->unack); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + } + + if (skb_queue_empty(&h5->unack)) +-- +2.35.1 + diff --git a/queue-4.19/bluetooth-hci_qca-don-t-call-kfree_skb-under-spin_lo.patch b/queue-4.19/bluetooth-hci_qca-don-t-call-kfree_skb-under-spin_lo.patch new file mode 100644 index 00000000000..4d02d71d50c --- /dev/null +++ b/queue-4.19/bluetooth-hci_qca-don-t-call-kfree_skb-under-spin_lo.patch @@ -0,0 +1,37 @@ +From 33b9a963b5e0b38369e061413ad79672a0c61a38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 10:18:30 +0800 +Subject: Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit df4cfc91208e0a98f078223793f5871b1a82cc54 ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). + +Fixes: 0ff252c1976d ("Bluetooth: hciuart: Add support QCA chipset for UART") +Signed-off-by: Yang Yingliang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_qca.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index f96e58de049b..f8b6823db04a 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -810,7 +810,7 @@ static int qca_enqueue(struct hci_uart *hu, struct sk_buff *skb) + default: + BT_ERR("Illegal tx state: %d (losing packet)", + qca->tx_ibs_state); +- kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + break; + } + +-- +2.35.1 + diff --git a/queue-4.19/bluetooth-rfcomm-don-t-call-kfree_skb-under-spin_loc.patch b/queue-4.19/bluetooth-rfcomm-don-t-call-kfree_skb-under-spin_loc.patch new file mode 100644 index 00000000000..dd6b76e7e74 --- /dev/null +++ b/queue-4.19/bluetooth-rfcomm-don-t-call-kfree_skb-under-spin_loc.patch @@ -0,0 +1,37 @@ +From c12a55167bcba0b03f1d1966f994cd9f869dcc11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 10:18:35 +0800 +Subject: Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 0ba18967d4544955b2eff2fbc4f2a8750c4df90a ] + +It is not allowed to call kfree_skb() from hardware interrupt +context or with interrupts being disabled. So replace kfree_skb() +with dev_kfree_skb_irq() under spin_lock_irqsave(). + +Fixes: 81be03e026dc ("Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg") +Signed-off-by: Yang Yingliang +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/rfcomm/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c +index e4eaf5d2acbd..86edf512d497 100644 +--- a/net/bluetooth/rfcomm/core.c ++++ b/net/bluetooth/rfcomm/core.c +@@ -593,7 +593,7 @@ int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb) + + ret = rfcomm_dlc_send_frag(d, frag); + if (ret < 0) { +- kfree_skb(frag); ++ dev_kfree_skb_irq(frag); + goto unlock; + } + +-- +2.35.1 + diff --git a/queue-4.19/bonding-export-skip-slave-logic-to-function.patch b/queue-4.19/bonding-export-skip-slave-logic-to-function.patch new file mode 100644 index 00000000000..abd0c7c36bd --- /dev/null +++ b/queue-4.19/bonding-export-skip-slave-logic-to-function.patch @@ -0,0 +1,90 @@ +From 695d8a4da66fd4e18971db38f818e4d9ebcd7dd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 22:21:32 +0300 +Subject: bonding: Export skip slave logic to function + +From: Maor Gottlieb + +[ Upstream commit 119d48fd4298594beccf4f2ecd00627826ce2646 ] + +As a preparation for following change that add array of +all slaves, extract code that skip slave to function. + +Signed-off-by: Maor Gottlieb +Reviewed-by: Jiri Pirko +Reviewed-by: Jay Vosburgh +Acked-by: David S. Miller +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 47 ++++++++++++++++++--------------- + 1 file changed, 26 insertions(+), 21 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index cab5c1cc9fe9..85efa0e0ee2c 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -3993,6 +3993,29 @@ static void bond_slave_arr_handler(struct work_struct *work) + bond_slave_arr_work_rearm(bond, 1); + } + ++static void bond_skip_slave(struct bond_up_slave *slaves, ++ struct slave *skipslave) ++{ ++ int idx; ++ ++ /* Rare situation where caller has asked to skip a specific ++ * slave but allocation failed (most likely!). BTW this is ++ * only possible when the call is initiated from ++ * __bond_release_one(). In this situation; overwrite the ++ * skipslave entry in the array with the last entry from the ++ * array to avoid a situation where the xmit path may choose ++ * this to-be-skipped slave to send a packet out. ++ */ ++ for (idx = 0; slaves && idx < slaves->count; idx++) { ++ if (skipslave == slaves->arr[idx]) { ++ slaves->arr[idx] = ++ slaves->arr[slaves->count - 1]; ++ slaves->count--; ++ break; ++ } ++ } ++} ++ + /* Build the usable slaves array in control path for modes that use xmit-hash + * to determine the slave interface - + * (a) BOND_MODE_8023AD +@@ -4063,27 +4086,9 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave) + if (old_arr) + kfree_rcu(old_arr, rcu); + out: +- if (ret != 0 && skipslave) { +- int idx; +- +- /* Rare situation where caller has asked to skip a specific +- * slave but allocation failed (most likely!). BTW this is +- * only possible when the call is initiated from +- * __bond_release_one(). In this situation; overwrite the +- * skipslave entry in the array with the last entry from the +- * array to avoid a situation where the xmit path may choose +- * this to-be-skipped slave to send a packet out. +- */ +- old_arr = rtnl_dereference(bond->slave_arr); +- for (idx = 0; old_arr != NULL && idx < old_arr->count; idx++) { +- if (skipslave == old_arr->arr[idx]) { +- old_arr->arr[idx] = +- old_arr->arr[old_arr->count-1]; +- old_arr->count--; +- break; +- } +- } +- } ++ if (ret != 0 && skipslave) ++ bond_skip_slave(rtnl_dereference(bond->slave_arr), skipslave); ++ + return ret; + } + +-- +2.35.1 + diff --git a/queue-4.19/bonding-uninitialized-variable-in-bond_miimon_inspec.patch b/queue-4.19/bonding-uninitialized-variable-in-bond_miimon_inspec.patch new file mode 100644 index 00000000000..9962ba78168 --- /dev/null +++ b/queue-4.19/bonding-uninitialized-variable-in-bond_miimon_inspec.patch @@ -0,0 +1,41 @@ +From d4736072cd50e00f8dc663b3b0576c7cf94dfd51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Nov 2022 14:06:14 +0300 +Subject: bonding: uninitialized variable in bond_miimon_inspect() + +From: Dan Carpenter + +[ Upstream commit e5214f363dabca240446272dac54d404501ad5e5 ] + +The "ignore_updelay" variable needs to be initialized to false. + +Fixes: f8a65ab2f3ff ("bonding: fix link recovery in mode 2 when updelay is nonzero") +Signed-off-by: Dan Carpenter +Reviewed-by: Pavan Chebbi +Acked-by: Jay Vosburgh +Link: https://lore.kernel.org/r/Y4SWJlh3ohJ6EPTL@kili +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 85efa0e0ee2c..4e4adacb5c2c 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2096,10 +2096,10 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in + /* called with rcu_read_lock() */ + static int bond_miimon_inspect(struct bonding *bond) + { ++ bool ignore_updelay = false; + int link_state, commit = 0; + struct list_head *iter; + struct slave *slave; +- bool ignore_updelay; + + ignore_updelay = !rcu_dereference(bond->curr_active_slave); + +-- +2.35.1 + diff --git a/queue-4.19/bpf-make-sure-skb-len-0-when-redirecting-to-a-tunnel.patch b/queue-4.19/bpf-make-sure-skb-len-0-when-redirecting-to-a-tunnel.patch new file mode 100644 index 00000000000..a7b02437f6a --- /dev/null +++ b/queue-4.19/bpf-make-sure-skb-len-0-when-redirecting-to-a-tunnel.patch @@ -0,0 +1,73 @@ +From 5b0c7d501e0f6a0453e2c6cbf0e8ffd5567dba82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 15:55:37 -0700 +Subject: bpf: make sure skb->len != 0 when redirecting to a tunneling device + +From: Stanislav Fomichev + +[ Upstream commit 07ec7b502800ba9f7b8b15cb01dd6556bb41aaca ] + +syzkaller managed to trigger another case where skb->len == 0 +when we enter __dev_queue_xmit: + +WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 skb_assert_len include/linux/skbuff.h:2576 [inline] +WARNING: CPU: 0 PID: 2470 at include/linux/skbuff.h:2576 __dev_queue_xmit+0x2069/0x35e0 net/core/dev.c:4295 + +Call Trace: + dev_queue_xmit+0x17/0x20 net/core/dev.c:4406 + __bpf_tx_skb net/core/filter.c:2115 [inline] + __bpf_redirect_no_mac net/core/filter.c:2140 [inline] + __bpf_redirect+0x5fb/0xda0 net/core/filter.c:2163 + ____bpf_clone_redirect net/core/filter.c:2447 [inline] + bpf_clone_redirect+0x247/0x390 net/core/filter.c:2419 + bpf_prog_48159a89cb4a9a16+0x59/0x5e + bpf_dispatcher_nop_func include/linux/bpf.h:897 [inline] + __bpf_prog_run include/linux/filter.h:596 [inline] + bpf_prog_run include/linux/filter.h:603 [inline] + bpf_test_run+0x46c/0x890 net/bpf/test_run.c:402 + bpf_prog_test_run_skb+0xbdc/0x14c0 net/bpf/test_run.c:1170 + bpf_prog_test_run+0x345/0x3c0 kernel/bpf/syscall.c:3648 + __sys_bpf+0x43a/0x6c0 kernel/bpf/syscall.c:5005 + __do_sys_bpf kernel/bpf/syscall.c:5091 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5089 [inline] + __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5089 + do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48 + entry_SYSCALL_64_after_hwframe+0x61/0xc6 + +The reproducer doesn't really reproduce outside of syzkaller +environment, so I'm taking a guess here. It looks like we +do generate correct ETH_HLEN-sized packet, but we redirect +the packet to the tunneling device. Before we do so, we +__skb_pull l2 header and arrive again at skb->len == 0. +Doesn't seem like we can do anything better than having +an explicit check after __skb_pull? + +Cc: Eric Dumazet +Reported-by: syzbot+f635e86ec3fa0a37e019@syzkaller.appspotmail.com +Signed-off-by: Stanislav Fomichev +Link: https://lore.kernel.org/r/20221027225537.353077-1-sdf@google.com +Signed-off-by: Martin KaFai Lau +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 5129e89f52bb..aa2e7baa13c4 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -2025,6 +2025,10 @@ static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev, + + if (mlen) { + __skb_pull(skb, mlen); ++ if (unlikely(!skb->len)) { ++ kfree_skb(skb); ++ return -ERANGE; ++ } + + /* At ingress, the mac header has already been pulled once. + * At egress, skb_pospull_rcsum has to be done in case that +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb-add-struct-kvaser_usb_busparams.patch b/queue-4.19/can-kvaser_usb-add-struct-kvaser_usb_busparams.patch new file mode 100644 index 00000000000..484cfd503a9 --- /dev/null +++ b/queue-4.19/can-kvaser_usb-add-struct-kvaser_usb_busparams.patch @@ -0,0 +1,142 @@ +From 01b4fd8ddc2a57185e9d40e071ba48be0a46154c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:36 +0200 +Subject: can: kvaser_usb: Add struct kvaser_usb_busparams + +From: Jimmy Assarsson + +[ Upstream commit 00e5786177649c1e3110f9454fdd34e336597265 ] + +Add struct kvaser_usb_busparams containing the busparameters used in +CMD_{SET,GET}_BUSPARAMS* commands. + +Tested-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-11-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 8 +++++ + .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 32 +++++++------------ + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 18 ++++------- + 3 files changed, 27 insertions(+), 31 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +index 1f4583f1dae2..cb8018723748 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +@@ -76,6 +76,14 @@ struct kvaser_usb_tx_urb_context { + int dlc; + }; + ++struct kvaser_usb_busparams { ++ __le32 bitrate; ++ u8 tseg1; ++ u8 tseg2; ++ u8 sjw; ++ u8 nsamples; ++} __packed; ++ + struct kvaser_usb { + struct usb_device *udev; + struct usb_interface *intf; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 9588efbfae71..72c37dc50b6b 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -193,17 +193,9 @@ struct kvaser_cmd_chip_state_event { + #define KVASER_USB_HYDRA_BUS_MODE_CANFD_ISO 0x01 + #define KVASER_USB_HYDRA_BUS_MODE_NONISO 0x02 + struct kvaser_cmd_set_busparams { +- __le32 bitrate; +- u8 tseg1; +- u8 tseg2; +- u8 sjw; +- u8 nsamples; ++ struct kvaser_usb_busparams busparams_arb; + u8 reserved0[4]; +- __le32 bitrate_d; +- u8 tseg1_d; +- u8 tseg2_d; +- u8 sjw_d; +- u8 nsamples_d; ++ struct kvaser_usb_busparams busparams_data; + u8 canfd_mode; + u8 reserved1[7]; + } __packed; +@@ -1515,11 +1507,11 @@ static int kvaser_usb_hydra_set_bittiming(struct net_device *netdev) + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_REQ; +- cmd->set_busparams_req.bitrate = cpu_to_le32(bt->bitrate); +- cmd->set_busparams_req.sjw = (u8)sjw; +- cmd->set_busparams_req.tseg1 = (u8)tseg1; +- cmd->set_busparams_req.tseg2 = (u8)tseg2; +- cmd->set_busparams_req.nsamples = 1; ++ cmd->set_busparams_req.busparams_arb.bitrate = cpu_to_le32(bt->bitrate); ++ cmd->set_busparams_req.busparams_arb.sjw = (u8)sjw; ++ cmd->set_busparams_req.busparams_arb.tseg1 = (u8)tseg1; ++ cmd->set_busparams_req.busparams_arb.tseg2 = (u8)tseg2; ++ cmd->set_busparams_req.busparams_arb.nsamples = 1; + + kvaser_usb_hydra_set_cmd_dest_he + (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); +@@ -1549,11 +1541,11 @@ static int kvaser_usb_hydra_set_data_bittiming(struct net_device *netdev) + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_FD_REQ; +- cmd->set_busparams_req.bitrate_d = cpu_to_le32(dbt->bitrate); +- cmd->set_busparams_req.sjw_d = (u8)sjw; +- cmd->set_busparams_req.tseg1_d = (u8)tseg1; +- cmd->set_busparams_req.tseg2_d = (u8)tseg2; +- cmd->set_busparams_req.nsamples_d = 1; ++ cmd->set_busparams_req.busparams_data.bitrate = cpu_to_le32(dbt->bitrate); ++ cmd->set_busparams_req.busparams_data.sjw = (u8)sjw; ++ cmd->set_busparams_req.busparams_data.tseg1 = (u8)tseg1; ++ cmd->set_busparams_req.busparams_data.tseg2 = (u8)tseg2; ++ cmd->set_busparams_req.busparams_data.nsamples = 1; + + if (priv->can.ctrlmode & CAN_CTRLMODE_FD) { + if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO) +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index d1877ff2ff71..1e2f727a1efb 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -163,11 +163,7 @@ struct usbcan_cmd_softinfo { + struct kvaser_cmd_busparams { + u8 tid; + u8 channel; +- __le32 bitrate; +- u8 tseg1; +- u8 tseg2; +- u8 sjw; +- u8 no_samp; ++ struct kvaser_usb_busparams busparams; + } __packed; + + struct kvaser_cmd_tx_can { +@@ -1703,15 +1699,15 @@ static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev) + cmd->len = CMD_HEADER_LEN + sizeof(struct kvaser_cmd_busparams); + cmd->u.busparams.channel = priv->channel; + cmd->u.busparams.tid = 0xff; +- cmd->u.busparams.bitrate = cpu_to_le32(bt->bitrate); +- cmd->u.busparams.sjw = bt->sjw; +- cmd->u.busparams.tseg1 = bt->prop_seg + bt->phase_seg1; +- cmd->u.busparams.tseg2 = bt->phase_seg2; ++ cmd->u.busparams.busparams.bitrate = cpu_to_le32(bt->bitrate); ++ cmd->u.busparams.busparams.sjw = bt->sjw; ++ cmd->u.busparams.busparams.tseg1 = bt->prop_seg + bt->phase_seg1; ++ cmd->u.busparams.busparams.tseg2 = bt->phase_seg2; + + if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) +- cmd->u.busparams.no_samp = 3; ++ cmd->u.busparams.busparams.nsamples = 3; + else +- cmd->u.busparams.no_samp = 1; ++ cmd->u.busparams.busparams.nsamples = 1; + + rc = kvaser_usb_send_cmd(dev, cmd, cmd->len); + +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb-compare-requested-bittiming-parameter.patch b/queue-4.19/can-kvaser_usb-compare-requested-bittiming-parameter.patch new file mode 100644 index 00000000000..df80b147525 --- /dev/null +++ b/queue-4.19/can-kvaser_usb-compare-requested-bittiming-parameter.patch @@ -0,0 +1,598 @@ +From a5823e098aa8f48aec42b3b87ff231b3a1849916 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:37 +0200 +Subject: can: kvaser_usb: Compare requested bittiming parameters with actual + parameters in do_set_{,data}_bittiming + +From: Jimmy Assarsson + +[ Upstream commit 39d3df6b0ea80f9b515c632ca07b39b1c156edee ] + +The device will respond with a CMD_ERROR_EVENT command, with error_code +KVASER_USB_{LEAF,HYDRA}_ERROR_EVENT_PARAM, if the CMD_SET_BUSPARAMS_REQ +contains invalid bittiming parameters. +However, this command does not contain any channel reference. + +To check if the CMD_SET_BUSPARAMS_REQ was successful, redback and compare +the requested bittiming parameters with the device reported parameters. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") +Tested-by: Anssi Hannula +Co-developed-by: Anssi Hannula +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-12-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 15 +- + .../net/can/usb/kvaser_usb/kvaser_usb_core.c | 96 ++++++++++- + .../net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 150 +++++++++++++++--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 64 ++++++-- + 4 files changed, 284 insertions(+), 41 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +index cb8018723748..5699531f8787 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +@@ -119,9 +119,12 @@ struct kvaser_usb_net_priv { + struct net_device *netdev; + int channel; + +- struct completion start_comp, stop_comp, flush_comp; ++ struct completion start_comp, stop_comp, flush_comp, ++ get_busparams_comp; + struct usb_anchor tx_submitted; + ++ struct kvaser_usb_busparams busparams_nominal, busparams_data; ++ + spinlock_t tx_contexts_lock; /* lock for active_tx_contexts */ + int active_tx_contexts; + struct kvaser_usb_tx_urb_context tx_contexts[]; +@@ -131,7 +134,9 @@ struct kvaser_usb_net_priv { + * struct kvaser_usb_dev_ops - Device specific functions + * @dev_set_mode: used for can.do_set_mode + * @dev_set_bittiming: used for can.do_set_bittiming ++ * @dev_get_busparams: readback arbitration busparams + * @dev_set_data_bittiming: used for can.do_set_data_bittiming ++ * @dev_get_data_busparams: readback data busparams + * @dev_get_berr_counter: used for can.do_get_berr_counter + * + * @dev_setup_endpoints: setup USB in and out endpoints +@@ -153,8 +158,12 @@ struct kvaser_usb_net_priv { + */ + struct kvaser_usb_dev_ops { + int (*dev_set_mode)(struct net_device *netdev, enum can_mode mode); +- int (*dev_set_bittiming)(struct net_device *netdev); +- int (*dev_set_data_bittiming)(struct net_device *netdev); ++ int (*dev_set_bittiming)(const struct net_device *netdev, ++ const struct kvaser_usb_busparams *busparams); ++ int (*dev_get_busparams)(struct kvaser_usb_net_priv *priv); ++ int (*dev_set_data_bittiming)(const struct net_device *netdev, ++ const struct kvaser_usb_busparams *busparams); ++ int (*dev_get_data_busparams)(struct kvaser_usb_net_priv *priv); + int (*dev_get_berr_counter)(const struct net_device *netdev, + struct can_berr_counter *bec); + int (*dev_setup_endpoints)(struct kvaser_usb *dev); +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +index e00afb94ec6c..da449d046905 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -416,10 +416,6 @@ static int kvaser_usb_open(struct net_device *netdev) + if (err) + return err; + +- err = kvaser_usb_setup_rx_urbs(dev); +- if (err) +- goto error; +- + err = ops->dev_set_opt_mode(priv); + if (err) + goto error; +@@ -510,6 +506,93 @@ static int kvaser_usb_close(struct net_device *netdev) + return 0; + } + ++static int kvaser_usb_set_bittiming(struct net_device *netdev) ++{ ++ struct kvaser_usb_net_priv *priv = netdev_priv(netdev); ++ struct kvaser_usb *dev = priv->dev; ++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops; ++ struct can_bittiming *bt = &priv->can.bittiming; ++ ++ struct kvaser_usb_busparams busparams; ++ int tseg1 = bt->prop_seg + bt->phase_seg1; ++ int tseg2 = bt->phase_seg2; ++ int sjw = bt->sjw; ++ int err = -EOPNOTSUPP; ++ ++ busparams.bitrate = cpu_to_le32(bt->bitrate); ++ busparams.sjw = (u8)sjw; ++ busparams.tseg1 = (u8)tseg1; ++ busparams.tseg2 = (u8)tseg2; ++ if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) ++ busparams.nsamples = 3; ++ else ++ busparams.nsamples = 1; ++ ++ err = ops->dev_set_bittiming(netdev, &busparams); ++ if (err) ++ return err; ++ ++ err = kvaser_usb_setup_rx_urbs(priv->dev); ++ if (err) ++ return err; ++ ++ err = ops->dev_get_busparams(priv); ++ if (err) { ++ /* Treat EOPNOTSUPP as success */ ++ if (err == -EOPNOTSUPP) ++ err = 0; ++ return err; ++ } ++ ++ if (memcmp(&busparams, &priv->busparams_nominal, ++ sizeof(priv->busparams_nominal)) != 0) ++ err = -EINVAL; ++ ++ return err; ++} ++ ++static int kvaser_usb_set_data_bittiming(struct net_device *netdev) ++{ ++ struct kvaser_usb_net_priv *priv = netdev_priv(netdev); ++ struct kvaser_usb *dev = priv->dev; ++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops; ++ struct can_bittiming *dbt = &priv->can.data_bittiming; ++ ++ struct kvaser_usb_busparams busparams; ++ int tseg1 = dbt->prop_seg + dbt->phase_seg1; ++ int tseg2 = dbt->phase_seg2; ++ int sjw = dbt->sjw; ++ int err; ++ ++ if (!ops->dev_set_data_bittiming || ++ !ops->dev_get_data_busparams) ++ return -EOPNOTSUPP; ++ ++ busparams.bitrate = cpu_to_le32(dbt->bitrate); ++ busparams.sjw = (u8)sjw; ++ busparams.tseg1 = (u8)tseg1; ++ busparams.tseg2 = (u8)tseg2; ++ busparams.nsamples = 1; ++ ++ err = ops->dev_set_data_bittiming(netdev, &busparams); ++ if (err) ++ return err; ++ ++ err = kvaser_usb_setup_rx_urbs(priv->dev); ++ if (err) ++ return err; ++ ++ err = ops->dev_get_data_busparams(priv); ++ if (err) ++ return err; ++ ++ if (memcmp(&busparams, &priv->busparams_data, ++ sizeof(priv->busparams_data)) != 0) ++ err = -EINVAL; ++ ++ return err; ++} ++ + static void kvaser_usb_write_bulk_callback(struct urb *urb) + { + struct kvaser_usb_tx_urb_context *context = urb->context; +@@ -696,6 +779,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel) + init_completion(&priv->start_comp); + init_completion(&priv->stop_comp); + init_completion(&priv->flush_comp); ++ init_completion(&priv->get_busparams_comp); + priv->can.ctrlmode_supported = 0; + + priv->dev = dev; +@@ -708,7 +792,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel) + priv->can.state = CAN_STATE_STOPPED; + priv->can.clock.freq = dev->cfg->clock.freq; + priv->can.bittiming_const = dev->cfg->bittiming_const; +- priv->can.do_set_bittiming = ops->dev_set_bittiming; ++ priv->can.do_set_bittiming = kvaser_usb_set_bittiming; + priv->can.do_set_mode = ops->dev_set_mode; + if ((driver_info->quirks & KVASER_USB_QUIRK_HAS_TXRX_ERRORS) || + (priv->dev->card_data.capabilities & KVASER_USB_CAP_BERR_CAP)) +@@ -720,7 +804,7 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel) + + if (priv->can.ctrlmode_supported & CAN_CTRLMODE_FD) { + priv->can.data_bittiming_const = dev->cfg->data_bittiming_const; +- priv->can.do_set_data_bittiming = ops->dev_set_data_bittiming; ++ priv->can.do_set_data_bittiming = kvaser_usb_set_data_bittiming; + } + + netdev->flags |= IFF_ECHO; +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 72c37dc50b6b..2764fdd7e84b 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -43,6 +43,8 @@ static const struct kvaser_usb_dev_cfg kvaser_usb_hydra_dev_cfg_flexc; + + /* Minihydra command IDs */ + #define CMD_SET_BUSPARAMS_REQ 16 ++#define CMD_GET_BUSPARAMS_REQ 17 ++#define CMD_GET_BUSPARAMS_RESP 18 + #define CMD_GET_CHIP_STATE_REQ 19 + #define CMD_CHIP_STATE_EVENT 20 + #define CMD_SET_DRIVERMODE_REQ 21 +@@ -193,13 +195,26 @@ struct kvaser_cmd_chip_state_event { + #define KVASER_USB_HYDRA_BUS_MODE_CANFD_ISO 0x01 + #define KVASER_USB_HYDRA_BUS_MODE_NONISO 0x02 + struct kvaser_cmd_set_busparams { +- struct kvaser_usb_busparams busparams_arb; ++ struct kvaser_usb_busparams busparams_nominal; + u8 reserved0[4]; + struct kvaser_usb_busparams busparams_data; + u8 canfd_mode; + u8 reserved1[7]; + } __packed; + ++/* Busparam type */ ++#define KVASER_USB_HYDRA_BUSPARAM_TYPE_CAN 0x00 ++#define KVASER_USB_HYDRA_BUSPARAM_TYPE_CANFD 0x01 ++struct kvaser_cmd_get_busparams_req { ++ u8 type; ++ u8 reserved[27]; ++} __packed; ++ ++struct kvaser_cmd_get_busparams_res { ++ struct kvaser_usb_busparams busparams; ++ u8 reserved[20]; ++} __packed; ++ + /* Ctrl modes */ + #define KVASER_USB_HYDRA_CTRLMODE_NORMAL 0x01 + #define KVASER_USB_HYDRA_CTRLMODE_LISTEN 0x02 +@@ -270,6 +285,8 @@ struct kvaser_cmd { + struct kvaser_cmd_error_event error_event; + + struct kvaser_cmd_set_busparams set_busparams_req; ++ struct kvaser_cmd_get_busparams_req get_busparams_req; ++ struct kvaser_cmd_get_busparams_res get_busparams_res; + + struct kvaser_cmd_chip_state_event chip_state_event; + +@@ -352,6 +369,10 @@ struct kvaser_cmd_ext { + } __packed; + } __packed; + ++struct kvaser_usb_net_hydra_priv { ++ int pending_get_busparams_type; ++}; ++ + static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = { + .name = "kvaser_usb_kcan", + .tseg1_min = 1, +@@ -805,6 +826,39 @@ static void kvaser_usb_hydra_flush_queue_reply(const struct kvaser_usb *dev, + complete(&priv->flush_comp); + } + ++static void kvaser_usb_hydra_get_busparams_reply(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ struct kvaser_usb_net_priv *priv; ++ struct kvaser_usb_net_hydra_priv *hydra; ++ ++ priv = kvaser_usb_hydra_net_priv_from_cmd(dev, cmd); ++ if (!priv) ++ return; ++ ++ hydra = priv->sub_priv; ++ if (!hydra) ++ return; ++ ++ switch (hydra->pending_get_busparams_type) { ++ case KVASER_USB_HYDRA_BUSPARAM_TYPE_CAN: ++ memcpy(&priv->busparams_nominal, &cmd->get_busparams_res.busparams, ++ sizeof(priv->busparams_nominal)); ++ break; ++ case KVASER_USB_HYDRA_BUSPARAM_TYPE_CANFD: ++ memcpy(&priv->busparams_data, &cmd->get_busparams_res.busparams, ++ sizeof(priv->busparams_nominal)); ++ break; ++ default: ++ dev_warn(&dev->intf->dev, "Unknown get_busparams_type %d\n", ++ hydra->pending_get_busparams_type); ++ break; ++ } ++ hydra->pending_get_busparams_type = -1; ++ ++ complete(&priv->get_busparams_comp); ++} ++ + static void + kvaser_usb_hydra_bus_status_to_can_state(const struct kvaser_usb_net_priv *priv, + u8 bus_status, +@@ -1291,6 +1345,10 @@ static void kvaser_usb_hydra_handle_cmd_std(const struct kvaser_usb *dev, + kvaser_usb_hydra_state_event(dev, cmd); + break; + ++ case CMD_GET_BUSPARAMS_RESP: ++ kvaser_usb_hydra_get_busparams_reply(dev, cmd); ++ break; ++ + case CMD_ERROR_EVENT: + kvaser_usb_hydra_error_event(dev, cmd); + break; +@@ -1491,15 +1549,58 @@ static int kvaser_usb_hydra_set_mode(struct net_device *netdev, + return err; + } + +-static int kvaser_usb_hydra_set_bittiming(struct net_device *netdev) ++static int kvaser_usb_hydra_get_busparams(struct kvaser_usb_net_priv *priv, ++ int busparams_type) ++{ ++ struct kvaser_usb *dev = priv->dev; ++ struct kvaser_usb_net_hydra_priv *hydra = priv->sub_priv; ++ struct kvaser_cmd *cmd; ++ int err; ++ ++ if (!hydra) ++ return -EINVAL; ++ ++ cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; ++ ++ cmd->header.cmd_no = CMD_GET_BUSPARAMS_REQ; ++ kvaser_usb_hydra_set_cmd_dest_he ++ (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); ++ kvaser_usb_hydra_set_cmd_transid ++ (cmd, kvaser_usb_hydra_get_next_transid(dev)); ++ cmd->get_busparams_req.type = busparams_type; ++ hydra->pending_get_busparams_type = busparams_type; ++ ++ reinit_completion(&priv->get_busparams_comp); ++ ++ err = kvaser_usb_send_cmd(dev, cmd, kvaser_usb_hydra_cmd_size(cmd)); ++ if (err) ++ return err; ++ ++ if (!wait_for_completion_timeout(&priv->get_busparams_comp, ++ msecs_to_jiffies(KVASER_USB_TIMEOUT))) ++ return -ETIMEDOUT; ++ ++ return err; ++} ++ ++static int kvaser_usb_hydra_get_nominal_busparams(struct kvaser_usb_net_priv *priv) ++{ ++ return kvaser_usb_hydra_get_busparams(priv, KVASER_USB_HYDRA_BUSPARAM_TYPE_CAN); ++} ++ ++static int kvaser_usb_hydra_get_data_busparams(struct kvaser_usb_net_priv *priv) ++{ ++ return kvaser_usb_hydra_get_busparams(priv, KVASER_USB_HYDRA_BUSPARAM_TYPE_CANFD); ++} ++ ++static int kvaser_usb_hydra_set_bittiming(const struct net_device *netdev, ++ const struct kvaser_usb_busparams *busparams) + { + struct kvaser_cmd *cmd; + struct kvaser_usb_net_priv *priv = netdev_priv(netdev); +- struct can_bittiming *bt = &priv->can.bittiming; + struct kvaser_usb *dev = priv->dev; +- int tseg1 = bt->prop_seg + bt->phase_seg1; +- int tseg2 = bt->phase_seg2; +- int sjw = bt->sjw; + int err; + + cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL); +@@ -1507,11 +1608,8 @@ static int kvaser_usb_hydra_set_bittiming(struct net_device *netdev) + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_REQ; +- cmd->set_busparams_req.busparams_arb.bitrate = cpu_to_le32(bt->bitrate); +- cmd->set_busparams_req.busparams_arb.sjw = (u8)sjw; +- cmd->set_busparams_req.busparams_arb.tseg1 = (u8)tseg1; +- cmd->set_busparams_req.busparams_arb.tseg2 = (u8)tseg2; +- cmd->set_busparams_req.busparams_arb.nsamples = 1; ++ memcpy(&cmd->set_busparams_req.busparams_nominal, busparams, ++ sizeof(cmd->set_busparams_req.busparams_nominal)); + + kvaser_usb_hydra_set_cmd_dest_he + (cmd, dev->card_data.hydra.channel_to_he[priv->channel]); +@@ -1525,15 +1623,12 @@ static int kvaser_usb_hydra_set_bittiming(struct net_device *netdev) + return err; + } + +-static int kvaser_usb_hydra_set_data_bittiming(struct net_device *netdev) ++static int kvaser_usb_hydra_set_data_bittiming(const struct net_device *netdev, ++ const struct kvaser_usb_busparams *busparams) + { + struct kvaser_cmd *cmd; + struct kvaser_usb_net_priv *priv = netdev_priv(netdev); +- struct can_bittiming *dbt = &priv->can.data_bittiming; + struct kvaser_usb *dev = priv->dev; +- int tseg1 = dbt->prop_seg + dbt->phase_seg1; +- int tseg2 = dbt->phase_seg2; +- int sjw = dbt->sjw; + int err; + + cmd = kcalloc(1, sizeof(struct kvaser_cmd), GFP_KERNEL); +@@ -1541,11 +1636,8 @@ static int kvaser_usb_hydra_set_data_bittiming(struct net_device *netdev) + return -ENOMEM; + + cmd->header.cmd_no = CMD_SET_BUSPARAMS_FD_REQ; +- cmd->set_busparams_req.busparams_data.bitrate = cpu_to_le32(dbt->bitrate); +- cmd->set_busparams_req.busparams_data.sjw = (u8)sjw; +- cmd->set_busparams_req.busparams_data.tseg1 = (u8)tseg1; +- cmd->set_busparams_req.busparams_data.tseg2 = (u8)tseg2; +- cmd->set_busparams_req.busparams_data.nsamples = 1; ++ memcpy(&cmd->set_busparams_req.busparams_data, busparams, ++ sizeof(cmd->set_busparams_req.busparams_data)); + + if (priv->can.ctrlmode & CAN_CTRLMODE_FD) { + if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO) +@@ -1652,6 +1744,19 @@ static int kvaser_usb_hydra_init_card(struct kvaser_usb *dev) + return 0; + } + ++static int kvaser_usb_hydra_init_channel(struct kvaser_usb_net_priv *priv) ++{ ++ struct kvaser_usb_net_hydra_priv *hydra; ++ ++ hydra = devm_kzalloc(&priv->dev->intf->dev, sizeof(*hydra), GFP_KERNEL); ++ if (!hydra) ++ return -ENOMEM; ++ ++ priv->sub_priv = hydra; ++ ++ return 0; ++} ++ + static int kvaser_usb_hydra_get_software_info(struct kvaser_usb *dev) + { + struct kvaser_cmd cmd; +@@ -1994,10 +2099,13 @@ kvaser_usb_hydra_frame_to_cmd(const struct kvaser_usb_net_priv *priv, + const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops = { + .dev_set_mode = kvaser_usb_hydra_set_mode, + .dev_set_bittiming = kvaser_usb_hydra_set_bittiming, ++ .dev_get_busparams = kvaser_usb_hydra_get_nominal_busparams, + .dev_set_data_bittiming = kvaser_usb_hydra_set_data_bittiming, ++ .dev_get_data_busparams = kvaser_usb_hydra_get_data_busparams, + .dev_get_berr_counter = kvaser_usb_hydra_get_berr_counter, + .dev_setup_endpoints = kvaser_usb_hydra_setup_endpoints, + .dev_init_card = kvaser_usb_hydra_init_card, ++ .dev_init_channel = kvaser_usb_hydra_init_channel, + .dev_get_software_info = kvaser_usb_hydra_get_software_info, + .dev_get_software_details = kvaser_usb_hydra_get_software_details, + .dev_get_card_info = kvaser_usb_hydra_get_card_info, +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 1e2f727a1efb..f06d63db9077 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -56,6 +56,8 @@ + #define CMD_RX_EXT_MESSAGE 14 + #define CMD_TX_EXT_MESSAGE 15 + #define CMD_SET_BUS_PARAMS 16 ++#define CMD_GET_BUS_PARAMS 17 ++#define CMD_GET_BUS_PARAMS_REPLY 18 + #define CMD_GET_CHIP_STATE 19 + #define CMD_CHIP_STATE_EVENT 20 + #define CMD_SET_CTRL_MODE 21 +@@ -375,6 +377,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.can_error_event), + [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res), ++ [CMD_GET_BUS_PARAMS_REPLY] = kvaser_fsize(u.busparams), + [CMD_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, +@@ -1467,6 +1470,25 @@ static void kvaser_usb_leaf_stop_chip_reply(const struct kvaser_usb *dev, + complete(&priv->stop_comp); + } + ++static void kvaser_usb_leaf_get_busparams_reply(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ struct kvaser_usb_net_priv *priv; ++ u8 channel = cmd->u.busparams.channel; ++ ++ if (channel >= dev->nchannels) { ++ dev_err(&dev->intf->dev, ++ "Invalid channel number (%d)\n", channel); ++ return; ++ } ++ ++ priv = dev->nets[channel]; ++ memcpy(&priv->busparams_nominal, &cmd->u.busparams.busparams, ++ sizeof(priv->busparams_nominal)); ++ ++ complete(&priv->get_busparams_comp); ++} ++ + static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { +@@ -1509,6 +1531,10 @@ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, + kvaser_usb_leaf_error_event(dev, cmd); + break; + ++ case CMD_GET_BUS_PARAMS_REPLY: ++ kvaser_usb_leaf_get_busparams_reply(dev, cmd); ++ break; ++ + /* Ignored commands */ + case CMD_USBCAN_CLOCK_OVERFLOW_EVENT: + if (dev->driver_info->family != KVASER_USBCAN) +@@ -1683,10 +1709,10 @@ static void kvaser_usb_leaf_remove_channel(struct kvaser_usb_net_priv *priv) + cancel_delayed_work_sync(&leaf->chip_state_req_work); + } + +-static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev) ++static int kvaser_usb_leaf_set_bittiming(const struct net_device *netdev, ++ const struct kvaser_usb_busparams *busparams) + { + struct kvaser_usb_net_priv *priv = netdev_priv(netdev); +- struct can_bittiming *bt = &priv->can.bittiming; + struct kvaser_usb *dev = priv->dev; + struct kvaser_cmd *cmd; + int rc; +@@ -1699,15 +1725,8 @@ static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev) + cmd->len = CMD_HEADER_LEN + sizeof(struct kvaser_cmd_busparams); + cmd->u.busparams.channel = priv->channel; + cmd->u.busparams.tid = 0xff; +- cmd->u.busparams.busparams.bitrate = cpu_to_le32(bt->bitrate); +- cmd->u.busparams.busparams.sjw = bt->sjw; +- cmd->u.busparams.busparams.tseg1 = bt->prop_seg + bt->phase_seg1; +- cmd->u.busparams.busparams.tseg2 = bt->phase_seg2; +- +- if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES) +- cmd->u.busparams.busparams.nsamples = 3; +- else +- cmd->u.busparams.busparams.nsamples = 1; ++ memcpy(&cmd->u.busparams.busparams, busparams, ++ sizeof(cmd->u.busparams.busparams)); + + rc = kvaser_usb_send_cmd(dev, cmd, cmd->len); + +@@ -1715,6 +1734,27 @@ static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev) + return rc; + } + ++static int kvaser_usb_leaf_get_busparams(struct kvaser_usb_net_priv *priv) ++{ ++ int err; ++ ++ if (priv->dev->driver_info->family == KVASER_USBCAN) ++ return -EOPNOTSUPP; ++ ++ reinit_completion(&priv->get_busparams_comp); ++ ++ err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_GET_BUS_PARAMS, ++ priv->channel); ++ if (err) ++ return err; ++ ++ if (!wait_for_completion_timeout(&priv->get_busparams_comp, ++ msecs_to_jiffies(KVASER_USB_TIMEOUT))) ++ return -ETIMEDOUT; ++ ++ return 0; ++} ++ + static int kvaser_usb_leaf_set_mode(struct net_device *netdev, + enum can_mode mode) + { +@@ -1776,7 +1816,9 @@ static int kvaser_usb_leaf_setup_endpoints(struct kvaser_usb *dev) + const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops = { + .dev_set_mode = kvaser_usb_leaf_set_mode, + .dev_set_bittiming = kvaser_usb_leaf_set_bittiming, ++ .dev_get_busparams = kvaser_usb_leaf_get_busparams, + .dev_set_data_bittiming = NULL, ++ .dev_get_data_busparams = NULL, + .dev_get_berr_counter = kvaser_usb_leaf_get_berr_counter, + .dev_setup_endpoints = kvaser_usb_leaf_setup_endpoints, + .dev_init_card = kvaser_usb_leaf_init_card, +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb-do-not-increase-tx-statistics-when-se.patch b/queue-4.19/can-kvaser_usb-do-not-increase-tx-statistics-when-se.patch new file mode 100644 index 00000000000..b1bb318a000 --- /dev/null +++ b/queue-4.19/can-kvaser_usb-do-not-increase-tx-statistics-when-se.patch @@ -0,0 +1,75 @@ +From de2ff2e198e3a0ec2a722eb766cdb96b5584a124 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Dec 2021 21:15:28 +0900 +Subject: can: kvaser_usb: do not increase tx statistics when sending error + message frames + +From: Vincent Mailhol + +[ Upstream commit 0b0ce2c67795672115ac6ca28351a78799cd114b ] + +The CAN error message frames (i.e. error skb) are an interface +specific to socket CAN. The payload of the CAN error message frames +does not correspond to any actual data sent on the wire. Only an error +flag and a delimiter are transmitted when an error occurs (c.f. ISO +11898-1 section 10.4.4.2 "Error flag"). + +For this reason, it makes no sense to increment the tx_packets and +tx_bytes fields of struct net_device_stats when sending an error +message frame because no actual payload will be transmitted on the +wire. + +N.B. Sending error message frames is a very specific feature which, at +the moment, is only supported by the Kvaser Hydra hardware. Please +refer to [1] for more details on the topic. + +[1] https://lore.kernel.org/linux-can/CAMZ6RqK0rTNg3u3mBpZOoY51jLZ-et-J01tY6-+mWsM4meVw-A@mail.gmail.com/t/#u + +Link: https://lore.kernel.org/all/20211207121531.42941-3-mailhol.vincent@wanadoo.fr +Co-developed-by: Jimmy Assarsson +Signed-off-by: Jimmy Assarsson +Signed-off-by: Vincent Mailhol +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 45d278724883..9588efbfae71 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -293,6 +293,7 @@ struct kvaser_cmd { + #define KVASER_USB_HYDRA_CF_FLAG_OVERRUN BIT(1) + #define KVASER_USB_HYDRA_CF_FLAG_REMOTE_FRAME BIT(4) + #define KVASER_USB_HYDRA_CF_FLAG_EXTENDED_ID BIT(5) ++#define KVASER_USB_HYDRA_CF_FLAG_TX_ACK BIT(6) + /* CAN frame flags. Used in ext_rx_can and ext_tx_can */ + #define KVASER_USB_HYDRA_CF_FLAG_OSM_NACK BIT(12) + #define KVASER_USB_HYDRA_CF_FLAG_ABL BIT(13) +@@ -1099,6 +1100,7 @@ static void kvaser_usb_hydra_tx_acknowledge(const struct kvaser_usb *dev, + struct kvaser_usb_net_priv *priv; + unsigned long irq_flags; + bool one_shot_fail = false; ++ bool is_err_frame = false; + u16 transid = kvaser_usb_hydra_get_cmd_transid(cmd); + + priv = kvaser_usb_hydra_net_priv_from_cmd(dev, cmd); +@@ -1117,10 +1119,13 @@ static void kvaser_usb_hydra_tx_acknowledge(const struct kvaser_usb *dev, + kvaser_usb_hydra_one_shot_fail(priv, cmd_ext); + one_shot_fail = true; + } ++ ++ is_err_frame = flags & KVASER_USB_HYDRA_CF_FLAG_TX_ACK && ++ flags & KVASER_USB_HYDRA_CF_FLAG_ERROR_FRAME; + } + + context = &priv->tx_contexts[transid % dev->max_tx_urbs]; +- if (!one_shot_fail) { ++ if (!one_shot_fail && !is_err_frame) { + struct net_device_stats *stats = &priv->netdev->stats; + + stats->tx_packets++; +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-get-capabilities-from.patch b/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-get-capabilities-from.patch new file mode 100644 index 00000000000..e7461f6718b --- /dev/null +++ b/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-get-capabilities-from.patch @@ -0,0 +1,231 @@ +From 2dd782195a6aadd9ad81fe4ddfd8aed0f9735096 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:28 +0200 +Subject: can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device + +From: Jimmy Assarsson + +[ Upstream commit 35364f5b41a4917fe94a3f393d149b63ec583297 ] + +Use the CMD_GET_CAPABILITIES_REQ command to query the device for certain +capabilities. We are only interested in LISTENONLY mode and wither the +device reports CAN error counters. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Reported-by: Anssi Hannula +Tested-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-3-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 144 +++++++++++++++++- + 1 file changed, 143 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 15380cc08ee6..26f32828f905 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -73,6 +73,8 @@ + #define CMD_TX_ACKNOWLEDGE 50 + #define CMD_CAN_ERROR_EVENT 51 + #define CMD_FLUSH_QUEUE_REPLY 68 ++#define CMD_GET_CAPABILITIES_REQ 95 ++#define CMD_GET_CAPABILITIES_RESP 96 + + #define CMD_LEAF_LOG_MESSAGE 106 + +@@ -82,6 +84,8 @@ + #define KVASER_USB_LEAF_SWOPTION_FREQ_32_MHZ_CLK BIT(5) + #define KVASER_USB_LEAF_SWOPTION_FREQ_24_MHZ_CLK BIT(6) + ++#define KVASER_USB_LEAF_SWOPTION_EXT_CAP BIT(12) ++ + /* error factors */ + #define M16C_EF_ACKE BIT(0) + #define M16C_EF_CRCE BIT(1) +@@ -277,6 +281,28 @@ struct leaf_cmd_log_message { + u8 data[8]; + } __packed; + ++/* Sub commands for cap_req and cap_res */ ++#define KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE 0x02 ++#define KVASER_USB_LEAF_CAP_CMD_ERR_REPORT 0x05 ++struct kvaser_cmd_cap_req { ++ __le16 padding0; ++ __le16 cap_cmd; ++ __le16 padding1; ++ __le16 channel; ++} __packed; ++ ++/* Status codes for cap_res */ ++#define KVASER_USB_LEAF_CAP_STAT_OK 0x00 ++#define KVASER_USB_LEAF_CAP_STAT_NOT_IMPL 0x01 ++#define KVASER_USB_LEAF_CAP_STAT_UNAVAIL 0x02 ++struct kvaser_cmd_cap_res { ++ __le16 padding; ++ __le16 cap_cmd; ++ __le16 status; ++ __le32 mask; ++ __le32 value; ++} __packed; ++ + struct kvaser_cmd { + u8 len; + u8 id; +@@ -294,6 +320,8 @@ struct kvaser_cmd { + struct leaf_cmd_chip_state_event chip_state_event; + struct leaf_cmd_error_event error_event; + struct leaf_cmd_log_message log_message; ++ struct kvaser_cmd_cap_req cap_req; ++ struct kvaser_cmd_cap_res cap_res; + } __packed leaf; + + union { +@@ -323,6 +351,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), ++ [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, + }; +@@ -607,6 +636,9 @@ static void kvaser_usb_leaf_get_software_info_leaf(struct kvaser_usb *dev, + dev->fw_version = le32_to_cpu(softinfo->fw_version); + dev->max_tx_urbs = le16_to_cpu(softinfo->max_outstanding_tx); + ++ if (sw_options & KVASER_USB_LEAF_SWOPTION_EXT_CAP) ++ dev->card_data.capabilities |= KVASER_USB_CAP_EXT_CAP; ++ + if (dev->driver_info->quirks & KVASER_USB_QUIRK_IGNORE_CLK_FREQ) { + /* Firmware expects bittiming parameters calculated for 16MHz + * clock, regardless of the actual clock +@@ -694,6 +726,116 @@ static int kvaser_usb_leaf_get_card_info(struct kvaser_usb *dev) + return 0; + } + ++static int kvaser_usb_leaf_get_single_capability(struct kvaser_usb *dev, ++ u16 cap_cmd_req, u16 *status) ++{ ++ struct kvaser_usb_dev_card_data *card_data = &dev->card_data; ++ struct kvaser_cmd *cmd; ++ u32 value = 0; ++ u32 mask = 0; ++ u16 cap_cmd_res; ++ int err; ++ int i; ++ ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; ++ ++ cmd->id = CMD_GET_CAPABILITIES_REQ; ++ cmd->u.leaf.cap_req.cap_cmd = cpu_to_le16(cap_cmd_req); ++ cmd->len = CMD_HEADER_LEN + sizeof(struct kvaser_cmd_cap_req); ++ ++ err = kvaser_usb_send_cmd(dev, cmd, cmd->len); ++ if (err) ++ goto end; ++ ++ err = kvaser_usb_leaf_wait_cmd(dev, CMD_GET_CAPABILITIES_RESP, cmd); ++ if (err) ++ goto end; ++ ++ *status = le16_to_cpu(cmd->u.leaf.cap_res.status); ++ ++ if (*status != KVASER_USB_LEAF_CAP_STAT_OK) ++ goto end; ++ ++ cap_cmd_res = le16_to_cpu(cmd->u.leaf.cap_res.cap_cmd); ++ switch (cap_cmd_res) { ++ case KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE: ++ case KVASER_USB_LEAF_CAP_CMD_ERR_REPORT: ++ value = le32_to_cpu(cmd->u.leaf.cap_res.value); ++ mask = le32_to_cpu(cmd->u.leaf.cap_res.mask); ++ break; ++ default: ++ dev_warn(&dev->intf->dev, "Unknown capability command %u\n", ++ cap_cmd_res); ++ break; ++ } ++ ++ for (i = 0; i < dev->nchannels; i++) { ++ if (BIT(i) & (value & mask)) { ++ switch (cap_cmd_res) { ++ case KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE: ++ card_data->ctrlmode_supported |= ++ CAN_CTRLMODE_LISTENONLY; ++ break; ++ case KVASER_USB_LEAF_CAP_CMD_ERR_REPORT: ++ card_data->capabilities |= ++ KVASER_USB_CAP_BERR_CAP; ++ break; ++ } ++ } ++ } ++ ++end: ++ kfree(cmd); ++ ++ return err; ++} ++ ++static int kvaser_usb_leaf_get_capabilities_leaf(struct kvaser_usb *dev) ++{ ++ int err; ++ u16 status; ++ ++ if (!(dev->card_data.capabilities & KVASER_USB_CAP_EXT_CAP)) { ++ dev_info(&dev->intf->dev, ++ "No extended capability support. Upgrade device firmware.\n"); ++ return 0; ++ } ++ ++ err = kvaser_usb_leaf_get_single_capability(dev, ++ KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE, ++ &status); ++ if (err) ++ return err; ++ if (status) ++ dev_info(&dev->intf->dev, ++ "KVASER_USB_LEAF_CAP_CMD_LISTEN_MODE failed %u\n", ++ status); ++ ++ err = kvaser_usb_leaf_get_single_capability(dev, ++ KVASER_USB_LEAF_CAP_CMD_ERR_REPORT, ++ &status); ++ if (err) ++ return err; ++ if (status) ++ dev_info(&dev->intf->dev, ++ "KVASER_USB_LEAF_CAP_CMD_ERR_REPORT failed %u\n", ++ status); ++ ++ return 0; ++} ++ ++static int kvaser_usb_leaf_get_capabilities(struct kvaser_usb *dev) ++{ ++ int err = 0; ++ ++ if (dev->driver_info->family == KVASER_LEAF) ++ err = kvaser_usb_leaf_get_capabilities_leaf(dev); ++ ++ return err; ++} ++ + static void kvaser_usb_leaf_tx_acknowledge(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { +@@ -1490,7 +1632,7 @@ const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops = { + .dev_get_software_info = kvaser_usb_leaf_get_software_info, + .dev_get_software_details = NULL, + .dev_get_card_info = kvaser_usb_leaf_get_card_info, +- .dev_get_capabilities = NULL, ++ .dev_get_capabilities = kvaser_usb_leaf_get_capabilities, + .dev_set_opt_mode = kvaser_usb_leaf_set_opt_mode, + .dev_start_chip = kvaser_usb_leaf_start_chip, + .dev_stop_chip = kvaser_usb_leaf_stop_chip, +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-handle-cmd_error_even.patch b/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-handle-cmd_error_even.patch new file mode 100644 index 00000000000..7a91f85c5ca --- /dev/null +++ b/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-handle-cmd_error_even.patch @@ -0,0 +1,186 @@ +From b7d1e63b366e54262ad0276bce38f67ef8a018ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:30 +0200 +Subject: can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT + +From: Jimmy Assarsson + +[ Upstream commit b24cb2d169e0c9dce664a959e1f2aa9781285dc9 ] + +The device will send an error event command, to indicate certain errors. +This indicates a misbehaving driver, and should never occur. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Anssi Hannula +Co-developed-by: Anssi Hannula +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-5-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 99 +++++++++++++++++++ + 1 file changed, 99 insertions(+) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 4f3d1150b2b2..3c3e78992b55 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -69,6 +69,7 @@ + #define CMD_GET_CARD_INFO_REPLY 35 + #define CMD_GET_SOFTWARE_INFO 38 + #define CMD_GET_SOFTWARE_INFO_REPLY 39 ++#define CMD_ERROR_EVENT 45 + #define CMD_FLUSH_QUEUE 48 + #define CMD_TX_ACKNOWLEDGE 50 + #define CMD_CAN_ERROR_EVENT 51 +@@ -257,6 +258,28 @@ struct usbcan_cmd_can_error_event { + __le16 time; + } __packed; + ++/* CMD_ERROR_EVENT error codes */ ++#define KVASER_USB_LEAF_ERROR_EVENT_TX_QUEUE_FULL 0x8 ++#define KVASER_USB_LEAF_ERROR_EVENT_PARAM 0x9 ++ ++struct leaf_cmd_error_event { ++ u8 tid; ++ u8 error_code; ++ __le16 timestamp[3]; ++ __le16 padding; ++ __le16 info1; ++ __le16 info2; ++} __packed; ++ ++struct usbcan_cmd_error_event { ++ u8 tid; ++ u8 error_code; ++ __le16 info1; ++ __le16 info2; ++ __le16 timestamp; ++ __le16 padding; ++} __packed; ++ + struct kvaser_cmd_ctrl_mode { + u8 tid; + u8 channel; +@@ -320,6 +343,7 @@ struct kvaser_cmd { + struct leaf_cmd_chip_state_event chip_state_event; + struct leaf_cmd_can_error_event can_error_event; + struct leaf_cmd_log_message log_message; ++ struct leaf_cmd_error_event error_event; + struct kvaser_cmd_cap_req cap_req; + struct kvaser_cmd_cap_res cap_res; + } __packed leaf; +@@ -329,6 +353,7 @@ struct kvaser_cmd { + struct usbcan_cmd_rx_can rx_can; + struct usbcan_cmd_chip_state_event chip_state_event; + struct usbcan_cmd_can_error_event can_error_event; ++ struct usbcan_cmd_error_event error_event; + } __packed usbcan; + + struct kvaser_cmd_tx_can tx_can; +@@ -352,6 +377,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.can_error_event), + [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res), ++ [CMD_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, + }; +@@ -366,6 +392,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { + [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event), + [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.can_error_event), ++ [CMD_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event), + /* ignored events: */ + [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY, + }; +@@ -1308,6 +1335,74 @@ static void kvaser_usb_leaf_rx_can_msg(const struct kvaser_usb *dev, + netif_rx(skb); + } + ++static void kvaser_usb_leaf_error_event_parameter(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ u16 info1 = 0; ++ ++ switch (dev->driver_info->family) { ++ case KVASER_LEAF: ++ info1 = le16_to_cpu(cmd->u.leaf.error_event.info1); ++ break; ++ case KVASER_USBCAN: ++ info1 = le16_to_cpu(cmd->u.usbcan.error_event.info1); ++ break; ++ } ++ ++ /* info1 will contain the offending cmd_no */ ++ switch (info1) { ++ case CMD_SET_CTRL_MODE: ++ dev_warn(&dev->intf->dev, ++ "CMD_SET_CTRL_MODE error in parameter\n"); ++ break; ++ ++ case CMD_SET_BUS_PARAMS: ++ dev_warn(&dev->intf->dev, ++ "CMD_SET_BUS_PARAMS error in parameter\n"); ++ break; ++ ++ default: ++ dev_warn(&dev->intf->dev, ++ "Unhandled parameter error event cmd_no (%u)\n", ++ info1); ++ break; ++ } ++} ++ ++static void kvaser_usb_leaf_error_event(const struct kvaser_usb *dev, ++ const struct kvaser_cmd *cmd) ++{ ++ u8 error_code = 0; ++ ++ switch (dev->driver_info->family) { ++ case KVASER_LEAF: ++ error_code = cmd->u.leaf.error_event.error_code; ++ break; ++ case KVASER_USBCAN: ++ error_code = cmd->u.usbcan.error_event.error_code; ++ break; ++ } ++ ++ switch (error_code) { ++ case KVASER_USB_LEAF_ERROR_EVENT_TX_QUEUE_FULL: ++ /* Received additional CAN message, when firmware TX queue is ++ * already full. Something is wrong with the driver. ++ * This should never happen! ++ */ ++ dev_err(&dev->intf->dev, ++ "Received error event TX_QUEUE_FULL\n"); ++ break; ++ case KVASER_USB_LEAF_ERROR_EVENT_PARAM: ++ kvaser_usb_leaf_error_event_parameter(dev, cmd); ++ break; ++ ++ default: ++ dev_warn(&dev->intf->dev, ++ "Unhandled error event (%d)\n", error_code); ++ break; ++ } ++} ++ + static void kvaser_usb_leaf_start_chip_reply(const struct kvaser_usb *dev, + const struct kvaser_cmd *cmd) + { +@@ -1386,6 +1481,10 @@ static void kvaser_usb_leaf_handle_command(const struct kvaser_usb *dev, + kvaser_usb_leaf_tx_acknowledge(dev, cmd); + break; + ++ case CMD_ERROR_EVENT: ++ kvaser_usb_leaf_error_event(dev, cmd); ++ break; ++ + /* Ignored commands */ + case CMD_USBCAN_CLOCK_OVERFLOW_EVENT: + if (dev->driver_info->family != KVASER_USBCAN) +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-rename-leaf-usbcan-_c.patch b/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-rename-leaf-usbcan-_c.patch new file mode 100644 index 00000000000..da82f124575 --- /dev/null +++ b/queue-4.19/can-kvaser_usb-kvaser_usb_leaf-rename-leaf-usbcan-_c.patch @@ -0,0 +1,136 @@ +From c3dccaa0905fdf037d027c511ede5c21f2fa2d52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:29 +0200 +Subject: can: kvaser_usb: kvaser_usb_leaf: Rename + {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event + +From: Jimmy Assarsson + +[ Upstream commit 7ea56128dbf904a3359bcf9289cccdfa3c85c7e8 ] + +Prepare for handling CMD_ERROR_EVENT. Rename struct +{leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Reported-by: Anssi Hannula +Tested-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-4-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 38 +++++++++---------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 26f32828f905..4f3d1150b2b2 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -233,7 +233,7 @@ struct kvaser_cmd_tx_acknowledge_header { + u8 tid; + } __packed; + +-struct leaf_cmd_error_event { ++struct leaf_cmd_can_error_event { + u8 tid; + u8 flags; + __le16 time[3]; +@@ -245,7 +245,7 @@ struct leaf_cmd_error_event { + u8 error_factor; + } __packed; + +-struct usbcan_cmd_error_event { ++struct usbcan_cmd_can_error_event { + u8 tid; + u8 padding; + u8 tx_errors_count_ch0; +@@ -318,7 +318,7 @@ struct kvaser_cmd { + struct leaf_cmd_softinfo softinfo; + struct leaf_cmd_rx_can rx_can; + struct leaf_cmd_chip_state_event chip_state_event; +- struct leaf_cmd_error_event error_event; ++ struct leaf_cmd_can_error_event can_error_event; + struct leaf_cmd_log_message log_message; + struct kvaser_cmd_cap_req cap_req; + struct kvaser_cmd_cap_res cap_res; +@@ -328,7 +328,7 @@ struct kvaser_cmd { + struct usbcan_cmd_softinfo softinfo; + struct usbcan_cmd_rx_can rx_can; + struct usbcan_cmd_chip_state_event chip_state_event; +- struct usbcan_cmd_error_event error_event; ++ struct usbcan_cmd_can_error_event can_error_event; + } __packed usbcan; + + struct kvaser_cmd_tx_can tx_can; +@@ -350,7 +350,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.leaf.rx_can), + [CMD_LEAF_LOG_MESSAGE] = kvaser_fsize(u.leaf.log_message), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.leaf.chip_state_event), +- [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.error_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.leaf.can_error_event), + [CMD_GET_CAPABILITIES_RESP] = kvaser_fsize(u.leaf.cap_res), + /* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY] = CMD_SIZE_ANY, +@@ -365,7 +365,7 @@ static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { + [CMD_RX_STD_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), + [CMD_RX_EXT_MESSAGE] = kvaser_fsize(u.usbcan.rx_can), + [CMD_CHIP_STATE_EVENT] = kvaser_fsize(u.usbcan.chip_state_event), +- [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.error_event), ++ [CMD_CAN_ERROR_EVENT] = kvaser_fsize(u.usbcan.can_error_event), + /* ignored events: */ + [CMD_USBCAN_CLOCK_OVERFLOW_EVENT] = CMD_SIZE_ANY, + }; +@@ -1137,11 +1137,11 @@ static void kvaser_usb_leaf_usbcan_rx_error(const struct kvaser_usb *dev, + + case CMD_CAN_ERROR_EVENT: + es.channel = 0; +- es.status = cmd->u.usbcan.error_event.status_ch0; +- es.txerr = cmd->u.usbcan.error_event.tx_errors_count_ch0; +- es.rxerr = cmd->u.usbcan.error_event.rx_errors_count_ch0; ++ es.status = cmd->u.usbcan.can_error_event.status_ch0; ++ es.txerr = cmd->u.usbcan.can_error_event.tx_errors_count_ch0; ++ es.rxerr = cmd->u.usbcan.can_error_event.rx_errors_count_ch0; + es.usbcan.other_ch_status = +- cmd->u.usbcan.error_event.status_ch1; ++ cmd->u.usbcan.can_error_event.status_ch1; + kvaser_usb_leaf_usbcan_conditionally_rx_error(dev, &es); + + /* The USBCAN firmware supports up to 2 channels. +@@ -1149,13 +1149,13 @@ static void kvaser_usb_leaf_usbcan_rx_error(const struct kvaser_usb *dev, + */ + if (dev->nchannels == MAX_USBCAN_NET_DEVICES) { + es.channel = 1; +- es.status = cmd->u.usbcan.error_event.status_ch1; ++ es.status = cmd->u.usbcan.can_error_event.status_ch1; + es.txerr = +- cmd->u.usbcan.error_event.tx_errors_count_ch1; ++ cmd->u.usbcan.can_error_event.tx_errors_count_ch1; + es.rxerr = +- cmd->u.usbcan.error_event.rx_errors_count_ch1; ++ cmd->u.usbcan.can_error_event.rx_errors_count_ch1; + es.usbcan.other_ch_status = +- cmd->u.usbcan.error_event.status_ch0; ++ cmd->u.usbcan.can_error_event.status_ch0; + kvaser_usb_leaf_usbcan_conditionally_rx_error(dev, &es); + } + break; +@@ -1172,11 +1172,11 @@ static void kvaser_usb_leaf_leaf_rx_error(const struct kvaser_usb *dev, + + switch (cmd->id) { + case CMD_CAN_ERROR_EVENT: +- es.channel = cmd->u.leaf.error_event.channel; +- es.status = cmd->u.leaf.error_event.status; +- es.txerr = cmd->u.leaf.error_event.tx_errors_count; +- es.rxerr = cmd->u.leaf.error_event.rx_errors_count; +- es.leaf.error_factor = cmd->u.leaf.error_event.error_factor; ++ es.channel = cmd->u.leaf.can_error_event.channel; ++ es.status = cmd->u.leaf.can_error_event.status; ++ es.txerr = cmd->u.leaf.can_error_event.tx_errors_count; ++ es.rxerr = cmd->u.leaf.can_error_event.rx_errors_count; ++ es.leaf.error_factor = cmd->u.leaf.can_error_event.error_factor; + break; + case CMD_LEAF_LOG_MESSAGE: + es.channel = cmd->u.leaf.log_message.channel; +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb_leaf-fix-bogus-restart-events.patch b/queue-4.19/can-kvaser_usb_leaf-fix-bogus-restart-events.patch new file mode 100644 index 00000000000..1a16ba6f952 --- /dev/null +++ b/queue-4.19/can-kvaser_usb_leaf-fix-bogus-restart-events.patch @@ -0,0 +1,66 @@ +From e79de62249fd0599b09d1b5125507f108b1f4192 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:35 +0200 +Subject: can: kvaser_usb_leaf: Fix bogus restart events + +From: Anssi Hannula + +[ Upstream commit 90904d326269a38fe5dd895fb2db7c03199654c4 ] + +When auto-restart is enabled, the kvaser_usb_leaf driver considers +transition from any state >= CAN_STATE_BUS_OFF as a bus-off recovery +event (restart). + +However, these events may occur at interface startup time before +kvaser_usb_open() has set the state to CAN_STATE_ERROR_ACTIVE, causing +restarts counter to increase and CAN_ERR_RESTARTED to be sent despite no +actual restart having occurred. + +Fix that by making the auto-restart condition checks more strict so that +they only trigger when the interface was actually in the BUS_OFF state. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-10-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 52ac6446634d..d1877ff2ff71 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -899,7 +899,7 @@ static void kvaser_usb_leaf_tx_acknowledge(const struct kvaser_usb *dev, + context = &priv->tx_contexts[tid % dev->max_tx_urbs]; + + /* Sometimes the state change doesn't come after a bus-off event */ +- if (priv->can.restart_ms && priv->can.state >= CAN_STATE_BUS_OFF) { ++ if (priv->can.restart_ms && priv->can.state == CAN_STATE_BUS_OFF) { + struct sk_buff *skb; + struct can_frame *cf; + +@@ -1002,7 +1002,7 @@ kvaser_usb_leaf_rx_error_update_can_state(struct kvaser_usb_net_priv *priv, + } + + if (priv->can.restart_ms && +- cur_state >= CAN_STATE_BUS_OFF && ++ cur_state == CAN_STATE_BUS_OFF && + new_state < CAN_STATE_BUS_OFF) + priv->can.can_stats.restarts++; + +@@ -1092,7 +1092,7 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + } + + if (priv->can.restart_ms && +- old_state >= CAN_STATE_BUS_OFF && ++ old_state == CAN_STATE_BUS_OFF && + new_state < CAN_STATE_BUS_OFF) { + cf->can_id |= CAN_ERR_RESTARTED; + netif_carrier_on(priv->netdev); +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb_leaf-fix-improved-state-not-being-rep.patch b/queue-4.19/can-kvaser_usb_leaf-fix-improved-state-not-being-rep.patch new file mode 100644 index 00000000000..d3747bd2dcc --- /dev/null +++ b/queue-4.19/can-kvaser_usb_leaf-fix-improved-state-not-being-rep.patch @@ -0,0 +1,259 @@ +From 1764302645c66422d0d4c2bfb1e2cb5ecac8d6a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:32 +0200 +Subject: can: kvaser_usb_leaf: Fix improved state not being reported + +From: Anssi Hannula + +[ Upstream commit 8d21f5927ae604881f98587fabf6753f88730968 ] + +The tested 0bfd:0017 Kvaser Memorator Professional HS/HS FW 2.0.50 and +0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778 do not seem to send +any unsolicited events when error counters decrease or when the device +transitions from ERROR_PASSIVE to ERROR_ACTIVE (or WARNING). + +This causes the interface to e.g. indefinitely stay in the ERROR_PASSIVE +state. + +Fix that by asking for chip state (inc. counters) event every 0.5 secs +when error counters are non-zero. + +Since there are non-error-counter devices, also always poll in +ERROR_PASSIVE even if the counters show zero. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-7-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 7 +++ + .../net/can/usb/kvaser_usb/kvaser_usb_core.c | 19 +++++- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 58 +++++++++++++++++++ + 3 files changed, 81 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +index 62958f04a2f2..1f4583f1dae2 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb.h ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb.h +@@ -104,6 +104,9 @@ struct kvaser_usb_net_priv { + struct can_priv can; + struct can_berr_counter bec; + ++ /* subdriver-specific data */ ++ void *sub_priv; ++ + struct kvaser_usb *dev; + struct net_device *netdev; + int channel; +@@ -125,6 +128,8 @@ struct kvaser_usb_net_priv { + * + * @dev_setup_endpoints: setup USB in and out endpoints + * @dev_init_card: initialize card ++ * @dev_init_channel: initialize channel ++ * @dev_remove_channel: uninitialize channel + * @dev_get_software_info: get software info + * @dev_get_software_details: get software details + * @dev_get_card_info: get card info +@@ -146,6 +151,8 @@ struct kvaser_usb_dev_ops { + struct can_berr_counter *bec); + int (*dev_setup_endpoints)(struct kvaser_usb *dev); + int (*dev_init_card)(struct kvaser_usb *dev); ++ int (*dev_init_channel)(struct kvaser_usb_net_priv *priv); ++ void (*dev_remove_channel)(struct kvaser_usb_net_priv *priv); + int (*dev_get_software_info)(struct kvaser_usb *dev); + int (*dev_get_software_details)(struct kvaser_usb *dev); + int (*dev_get_card_info)(struct kvaser_usb *dev); +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +index 379df22d5123..e00afb94ec6c 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +@@ -645,6 +645,7 @@ static const struct net_device_ops kvaser_usb_netdev_ops = { + + static void kvaser_usb_remove_interfaces(struct kvaser_usb *dev) + { ++ const struct kvaser_usb_dev_ops *ops = dev->driver_info->ops; + int i; + + for (i = 0; i < dev->nchannels; i++) { +@@ -660,6 +661,9 @@ static void kvaser_usb_remove_interfaces(struct kvaser_usb *dev) + if (!dev->nets[i]) + continue; + ++ if (ops->dev_remove_channel) ++ ops->dev_remove_channel(dev->nets[i]); ++ + free_candev(dev->nets[i]->netdev); + } + } +@@ -728,17 +732,26 @@ static int kvaser_usb_init_one(struct kvaser_usb *dev, int channel) + + dev->nets[channel] = priv; + ++ if (ops->dev_init_channel) { ++ err = ops->dev_init_channel(priv); ++ if (err) ++ goto err; ++ } ++ + err = register_candev(netdev); + if (err) { + dev_err(&dev->intf->dev, "Failed to register CAN device\n"); +- free_candev(netdev); +- dev->nets[channel] = NULL; +- return err; ++ goto err; + } + + netdev_dbg(netdev, "device registered\n"); + + return 0; ++ ++err: ++ free_candev(netdev); ++ dev->nets[channel] = NULL; ++ return err; + } + + static int kvaser_usb_probe(struct usb_interface *intf, +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index b43631eaccf1..6d45ae6f2a08 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -55,6 +56,7 @@ + #define CMD_RX_EXT_MESSAGE 14 + #define CMD_TX_EXT_MESSAGE 15 + #define CMD_SET_BUS_PARAMS 16 ++#define CMD_GET_CHIP_STATE 19 + #define CMD_CHIP_STATE_EVENT 20 + #define CMD_SET_CTRL_MODE 21 + #define CMD_RESET_CHIP 24 +@@ -420,6 +422,12 @@ struct kvaser_usb_err_summary { + }; + }; + ++struct kvaser_usb_net_leaf_priv { ++ struct kvaser_usb_net_priv *net; ++ ++ struct delayed_work chip_state_req_work; ++}; ++ + static const struct can_bittiming_const kvaser_usb_leaf_m16c_bittiming_const = { + .name = "kvaser_usb_ucii", + .tseg1_min = 4, +@@ -947,6 +955,16 @@ static int kvaser_usb_leaf_simple_cmd_async(struct kvaser_usb_net_priv *priv, + return err; + } + ++static void kvaser_usb_leaf_chip_state_req_work(struct work_struct *work) ++{ ++ struct kvaser_usb_net_leaf_priv *leaf = ++ container_of(work, struct kvaser_usb_net_leaf_priv, ++ chip_state_req_work.work); ++ struct kvaser_usb_net_priv *priv = leaf->net; ++ ++ kvaser_usb_leaf_simple_cmd_async(priv, CMD_GET_CHIP_STATE); ++} ++ + static void + kvaser_usb_leaf_rx_error_update_can_state(struct kvaser_usb_net_priv *priv, + const struct kvaser_usb_err_summary *es, +@@ -1018,6 +1036,7 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + struct sk_buff *skb; + struct net_device_stats *stats; + struct kvaser_usb_net_priv *priv; ++ struct kvaser_usb_net_leaf_priv *leaf; + enum can_state old_state, new_state; + + if (es->channel >= dev->nchannels) { +@@ -1027,6 +1046,7 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + } + + priv = dev->nets[es->channel]; ++ leaf = priv->sub_priv; + stats = &priv->netdev->stats; + + /* Update all of the CAN interface's state and error counters before +@@ -1043,6 +1063,14 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + kvaser_usb_leaf_rx_error_update_can_state(priv, es, &tmp_cf); + new_state = priv->can.state; + ++ /* If there are errors, request status updates periodically as we do ++ * not get automatic notifications of improved state. ++ */ ++ if (new_state < CAN_STATE_BUS_OFF && ++ (es->rxerr || es->txerr || new_state == CAN_STATE_ERROR_PASSIVE)) ++ schedule_delayed_work(&leaf->chip_state_req_work, ++ msecs_to_jiffies(500)); ++ + skb = alloc_can_err_skb(priv->netdev, &cf); + if (!skb) { + stats->rx_dropped++; +@@ -1577,10 +1605,13 @@ static int kvaser_usb_leaf_start_chip(struct kvaser_usb_net_priv *priv) + + static int kvaser_usb_leaf_stop_chip(struct kvaser_usb_net_priv *priv) + { ++ struct kvaser_usb_net_leaf_priv *leaf = priv->sub_priv; + int err; + + reinit_completion(&priv->stop_comp); + ++ cancel_delayed_work(&leaf->chip_state_req_work); ++ + err = kvaser_usb_leaf_send_simple_cmd(priv->dev, CMD_STOP_CHIP, + priv->channel); + if (err) +@@ -1627,6 +1658,31 @@ static int kvaser_usb_leaf_init_card(struct kvaser_usb *dev) + return 0; + } + ++static int kvaser_usb_leaf_init_channel(struct kvaser_usb_net_priv *priv) ++{ ++ struct kvaser_usb_net_leaf_priv *leaf; ++ ++ leaf = devm_kzalloc(&priv->dev->intf->dev, sizeof(*leaf), GFP_KERNEL); ++ if (!leaf) ++ return -ENOMEM; ++ ++ leaf->net = priv; ++ INIT_DELAYED_WORK(&leaf->chip_state_req_work, ++ kvaser_usb_leaf_chip_state_req_work); ++ ++ priv->sub_priv = leaf; ++ ++ return 0; ++} ++ ++static void kvaser_usb_leaf_remove_channel(struct kvaser_usb_net_priv *priv) ++{ ++ struct kvaser_usb_net_leaf_priv *leaf = priv->sub_priv; ++ ++ if (leaf) ++ cancel_delayed_work_sync(&leaf->chip_state_req_work); ++} ++ + static int kvaser_usb_leaf_set_bittiming(struct net_device *netdev) + { + struct kvaser_usb_net_priv *priv = netdev_priv(netdev); +@@ -1724,6 +1780,8 @@ const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops = { + .dev_get_berr_counter = kvaser_usb_leaf_get_berr_counter, + .dev_setup_endpoints = kvaser_usb_leaf_setup_endpoints, + .dev_init_card = kvaser_usb_leaf_init_card, ++ .dev_init_channel = kvaser_usb_leaf_init_channel, ++ .dev_remove_channel = kvaser_usb_leaf_remove_channel, + .dev_get_software_info = kvaser_usb_leaf_get_software_info, + .dev_get_software_details = NULL, + .dev_get_card_info = kvaser_usb_leaf_get_card_info, +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb_leaf-fix-wrong-can-state-after-stoppi.patch b/queue-4.19/can-kvaser_usb_leaf-fix-wrong-can-state-after-stoppi.patch new file mode 100644 index 00000000000..085fa28541d --- /dev/null +++ b/queue-4.19/can-kvaser_usb_leaf-fix-wrong-can-state-after-stoppi.patch @@ -0,0 +1,45 @@ +From bc8b6c970fad77efd0e968c055f784ae5e2a2af6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:33 +0200 +Subject: can: kvaser_usb_leaf: Fix wrong CAN state after stopping + +From: Anssi Hannula + +[ Upstream commit a11249acf802341294557895d8e5f6aef080253f ] + +0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778 sends a +CMD_CHIP_STATE_EVENT indicating bus-off after stopping the device, +causing a stopped device to appear as CAN_STATE_BUS_OFF instead of +CAN_STATE_STOPPED. + +Fix that by not handling error events on stopped devices. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-8-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 6d45ae6f2a08..52ac6446634d 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -1049,6 +1049,10 @@ static void kvaser_usb_leaf_rx_error(const struct kvaser_usb *dev, + leaf = priv->sub_priv; + stats = &priv->netdev->stats; + ++ /* Ignore e.g. state change to bus-off reported just after stopping */ ++ if (!netif_running(priv->netdev)) ++ return; ++ + /* Update all of the CAN interface's state and error counters before + * trying any memory allocation that can actually fail with -ENOMEM. + * +-- +2.35.1 + diff --git a/queue-4.19/can-kvaser_usb_leaf-set-warning-state-even-without-b.patch b/queue-4.19/can-kvaser_usb_leaf-set-warning-state-even-without-b.patch new file mode 100644 index 00000000000..0ebbbb798a3 --- /dev/null +++ b/queue-4.19/can-kvaser_usb_leaf-set-warning-state-even-without-b.patch @@ -0,0 +1,76 @@ +From 3148f8b7230ac5412b756150dc8d2994e248787a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 20:52:31 +0200 +Subject: can: kvaser_usb_leaf: Set Warning state even without bus errors + +From: Anssi Hannula + +[ Upstream commit df1b7af2761b935f63b4a53e789d41ed859edf61 ] + +kvaser_usb_leaf_rx_error_update_can_state() sets error state according +to error counters when the hardware does not indicate a specific state +directly. + +However, this is currently gated behind a check for +M16C_STATE_BUS_ERROR which does not always seem to be set when error +counters are increasing, and may not be set when error counters are +decreasing. + +This causes the CAN_STATE_ERROR_WARNING state to not be set in some +cases even when appropriate. + +Change the code to set error state from counters even without +M16C_STATE_BUS_ERROR. + +The Error-Passive case seems superfluous as it is already set via +M16C_STATE_BUS_PASSIVE flag above, but it is kept for now. + +Tested with 0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778. + +Fixes: 080f40a6fa28 ("can: kvaser_usb: Add support for Kvaser CAN/USB devices") +Tested-by: Jimmy Assarsson +Signed-off-by: Anssi Hannula +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/all/20221010185237.319219-6-extja@kvaser.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + .../net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 20 ++++++++----------- + 1 file changed, 8 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +index 3c3e78992b55..b43631eaccf1 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +@@ -965,20 +965,16 @@ kvaser_usb_leaf_rx_error_update_can_state(struct kvaser_usb_net_priv *priv, + new_state = CAN_STATE_BUS_OFF; + } else if (es->status & M16C_STATE_BUS_PASSIVE) { + new_state = CAN_STATE_ERROR_PASSIVE; +- } else if (es->status & M16C_STATE_BUS_ERROR) { ++ } else if ((es->status & M16C_STATE_BUS_ERROR) && ++ cur_state >= CAN_STATE_BUS_OFF) { + /* Guard against spurious error events after a busoff */ +- if (cur_state < CAN_STATE_BUS_OFF) { +- if (es->txerr >= 128 || es->rxerr >= 128) +- new_state = CAN_STATE_ERROR_PASSIVE; +- else if (es->txerr >= 96 || es->rxerr >= 96) +- new_state = CAN_STATE_ERROR_WARNING; +- else if (cur_state > CAN_STATE_ERROR_ACTIVE) +- new_state = CAN_STATE_ERROR_ACTIVE; +- } +- } +- +- if (!es->status) ++ } else if (es->txerr >= 128 || es->rxerr >= 128) { ++ new_state = CAN_STATE_ERROR_PASSIVE; ++ } else if (es->txerr >= 96 || es->rxerr >= 96) { ++ new_state = CAN_STATE_ERROR_WARNING; ++ } else { + new_state = CAN_STATE_ERROR_ACTIVE; ++ } + + if (new_state != cur_state) { + tx_state = (es->txerr >= es->rxerr) ? new_state : 0; +-- +2.35.1 + diff --git a/queue-4.19/chardev-fix-error-handling-in-cdev_device_add.patch b/queue-4.19/chardev-fix-error-handling-in-cdev_device_add.patch new file mode 100644 index 00000000000..030bb98c3bd --- /dev/null +++ b/queue-4.19/chardev-fix-error-handling-in-cdev_device_add.patch @@ -0,0 +1,54 @@ +From 30cf36a564d1a77663e4ed2c903fe10e2d50bd06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 11:02:37 +0800 +Subject: chardev: fix error handling in cdev_device_add() + +From: Yang Yingliang + +[ Upstream commit 11fa7fefe3d8fac7da56bc9aa3dd5fb3081ca797 ] + +While doing fault injection test, I got the following report: + +------------[ cut here ]------------ +kobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called. +WARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0 +CPU: 3 PID: 6306 Comm: 283 Tainted: G W 6.1.0-rc2-00005-g307c1086d7c9 #1253 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 +RIP: 0010:kobject_put+0x23d/0x4e0 +Call Trace: + + cdev_device_add+0x15e/0x1b0 + __iio_device_register+0x13b4/0x1af0 [industrialio] + __devm_iio_device_register+0x22/0x90 [industrialio] + max517_probe+0x3d8/0x6b4 [max517] + i2c_device_probe+0xa81/0xc00 + +When device_add() is injected fault and returns error, if dev->devt is not set, +cdev_add() is not called, cdev_del() is not needed. Fix this by checking dev->devt +in error path. + +Fixes: 233ed09d7fda ("chardev: add helper function to register char devs with a struct device") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221202030237.520280-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/char_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/char_dev.c b/fs/char_dev.c +index 5fffd5050fb7..2c3d519b21c2 100644 +--- a/fs/char_dev.c ++++ b/fs/char_dev.c +@@ -553,7 +553,7 @@ int cdev_device_add(struct cdev *cdev, struct device *dev) + } + + rc = device_add(dev); +- if (rc) ++ if (rc && dev->devt) + cdev_del(cdev); + + return rc; +-- +2.35.1 + diff --git a/queue-4.19/class-fix-possible-memory-leak-in-__class_register.patch b/queue-4.19/class-fix-possible-memory-leak-in-__class_register.patch new file mode 100644 index 00000000000..ca0f8d18550 --- /dev/null +++ b/queue-4.19/class-fix-possible-memory-leak-in-__class_register.patch @@ -0,0 +1,71 @@ +From 45f7e8c966ede7ec428c1ba27857d6d35068f715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Oct 2022 16:28:03 +0800 +Subject: class: fix possible memory leak in __class_register() + +From: Yang Yingliang + +[ Upstream commit 8c3e8a6bdb5253b97ad532570f8b5db5f7a06407 ] + +If class_add_groups() returns error, the 'cp->subsys' need be +unregister, and the 'cp' need be freed. + +We can not call kset_unregister() here, because the 'cls' will +be freed in callback function class_release() and it's also +freed in caller's error path, it will cause double free. + +So fix this by calling kobject_del() and kfree_const(name) to +cleanup kobject. Besides, call kfree() to free the 'cp'. + +Fault injection test can trigger this: + +unreferenced object 0xffff888102fa8190 (size 8): + comm "modprobe", pid 502, jiffies 4294906074 (age 49.296s) + hex dump (first 8 bytes): + 70 6b 74 63 64 76 64 00 pktcdvd. + backtrace: + [<00000000e7c7703d>] __kmalloc_track_caller+0x1ae/0x320 + [<000000005e4d70bc>] kstrdup+0x3a/0x70 + [<00000000c2e5e85a>] kstrdup_const+0x68/0x80 + [<000000000049a8c7>] kvasprintf_const+0x10b/0x190 + [<0000000029123163>] kobject_set_name_vargs+0x56/0x150 + [<00000000747219c9>] kobject_set_name+0xab/0xe0 + [<0000000005f1ea4e>] __class_register+0x15c/0x49a + +unreferenced object 0xffff888037274000 (size 1024): + comm "modprobe", pid 502, jiffies 4294906074 (age 49.296s) + hex dump (first 32 bytes): + 00 40 27 37 80 88 ff ff 00 40 27 37 80 88 ff ff .@'7.....@'7.... + 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... + backtrace: + [<00000000151f9600>] kmem_cache_alloc_trace+0x17c/0x2f0 + [<00000000ecf3dd95>] __class_register+0x86/0x49a + +Fixes: ced6473e7486 ("driver core: class: add class_groups support") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221026082803.3458760-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/class.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/base/class.c b/drivers/base/class.c +index 54def4e02f00..d36cdbeaa2c8 100644 +--- a/drivers/base/class.c ++++ b/drivers/base/class.c +@@ -185,6 +185,11 @@ int __class_register(struct class *cls, struct lock_class_key *key) + } + error = class_add_groups(class_get(cls), cls->class_groups); + class_put(cls); ++ if (error) { ++ kobject_del(&cp->subsys.kobj); ++ kfree_const(cp->subsys.kobj.name); ++ kfree(cp); ++ } + return error; + } + EXPORT_SYMBOL_GPL(__class_register); +-- +2.35.1 + diff --git a/queue-4.19/clk-rockchip-fix-memory-leak-in-rockchip_clk_registe.patch b/queue-4.19/clk-rockchip-fix-memory-leak-in-rockchip_clk_registe.patch new file mode 100644 index 00000000000..42d65883613 --- /dev/null +++ b/queue-4.19/clk-rockchip-fix-memory-leak-in-rockchip_clk_registe.patch @@ -0,0 +1,37 @@ +From 5aa437ef8d712ce864543d735f57a2e9ce50bf75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 17:12:01 +0800 +Subject: clk: rockchip: Fix memory leak in rockchip_clk_register_pll() + +From: Xiu Jianfeng + +[ Upstream commit 739a6a6bbdb793bd57938cb24aa5a6df89983546 ] + +If clk_register() fails, @pll->rate_table may have allocated memory by +kmemdup(), so it needs to be freed, otherwise will cause memory leak +issue, this patch fixes it. + +Fixes: 90c590254051 ("clk: rockchip: add clock type for pll clocks and pll used on rk3066") +Signed-off-by: Xiu Jianfeng +Link: https://lore.kernel.org/r/20221123091201.199819-1-xiujianfeng@huawei.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-pll.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/rockchip/clk-pll.c b/drivers/clk/rockchip/clk-pll.c +index dd0433d4753e..77aff5defac6 100644 +--- a/drivers/clk/rockchip/clk-pll.c ++++ b/drivers/clk/rockchip/clk-pll.c +@@ -972,6 +972,7 @@ struct clk *rockchip_clk_register_pll(struct rockchip_clk_provider *ctx, + return mux_clk; + + err_pll: ++ kfree(pll->rate_table); + clk_unregister(mux_clk); + mux_clk = pll_clk; + err_mux: +-- +2.35.1 + diff --git a/queue-4.19/clk-samsung-fix-memory-leak-in-_samsung_clk_register.patch b/queue-4.19/clk-samsung-fix-memory-leak-in-_samsung_clk_register.patch new file mode 100644 index 00000000000..0ba76f0b108 --- /dev/null +++ b/queue-4.19/clk-samsung-fix-memory-leak-in-_samsung_clk_register.patch @@ -0,0 +1,38 @@ +From d883be6509ac1635a104b17cca43429ba4bd074d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 11:20:15 +0800 +Subject: clk: samsung: Fix memory leak in _samsung_clk_register_pll() + +From: Xiu Jianfeng + +[ Upstream commit 5174e5b0d1b669a489524192b6adcbb3c54ebc72 ] + +If clk_register() fails, @pll->rate_table may have allocated memory by +kmemdup(), so it needs to be freed, otherwise will cause memory leak +issue, this patch fixes it. + +Fixes: 3ff6e0d8d64d ("clk: samsung: Add support to register rate_table for samsung plls") +Signed-off-by: Xiu Jianfeng +Link: https://lore.kernel.org/r/20221123032015.63980-1-xiujianfeng@huawei.com +Reviewed-by: Alim Akhtar +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-pll.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/samsung/clk-pll.c b/drivers/clk/samsung/clk-pll.c +index 1c4c7a3039f1..8cbf0f2cf196 100644 +--- a/drivers/clk/samsung/clk-pll.c ++++ b/drivers/clk/samsung/clk-pll.c +@@ -1392,6 +1392,7 @@ static void __init _samsung_clk_register_pll(struct samsung_clk_provider *ctx, + if (ret) { + pr_err("%s: failed to register pll clock %s : %d\n", + __func__, pll_clk->name, ret); ++ kfree(pll->rate_table); + kfree(pll); + return; + } +-- +2.35.1 + diff --git a/queue-4.19/clk-socfpga-clk-pll-remove-unused-variable-rc.patch b/queue-4.19/clk-socfpga-clk-pll-remove-unused-variable-rc.patch new file mode 100644 index 00000000000..6612fe3cc64 --- /dev/null +++ b/queue-4.19/clk-socfpga-clk-pll-remove-unused-variable-rc.patch @@ -0,0 +1,54 @@ +From 6be1558ac9d775d119d2802bd38dba38f430f00c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Jan 2021 09:30:27 +0000 +Subject: clk: socfpga: clk-pll: Remove unused variable 'rc' +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lee Jones + +[ Upstream commit 75fddccbca32349570b2d53955982b4117fa5515 ] + +Fixes the following W=1 kernel build warning(s): + + drivers/clk/socfpga/clk-pll.c: In function ‘__socfpga_pll_init’: + drivers/clk/socfpga/clk-pll.c:83:6: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] + +Cc: Dinh Nguyen +Cc: Michael Turquette +Cc: Stephen Boyd +Cc: linux-clk@vger.kernel.org +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20210120093040.1719407-8-lee.jones@linaro.org +Acked-by: Dinh Nguyen +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/socfpga/clk-pll.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c +index b4b44e9b5901..973c4713d085 100644 +--- a/drivers/clk/socfpga/clk-pll.c ++++ b/drivers/clk/socfpga/clk-pll.c +@@ -90,7 +90,6 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node, + const char *parent_name[SOCFPGA_MAX_PARENTS]; + struct clk_init_data init; + struct device_node *clkmgr_np; +- int rc; + + of_property_read_u32(node, "reg", ®); + +@@ -123,7 +122,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node, + kfree(pll_clk); + return NULL; + } +- rc = of_clk_add_provider(node, of_clk_src_simple_get, clk); ++ of_clk_add_provider(node, of_clk_src_simple_get, clk); + return clk; + } + +-- +2.35.1 + diff --git a/queue-4.19/clk-socfpga-use-clk_hw_register-for-a5-c5.patch b/queue-4.19/clk-socfpga-use-clk_hw_register-for-a5-c5.patch new file mode 100644 index 00000000000..9a8a1b94a00 --- /dev/null +++ b/queue-4.19/clk-socfpga-use-clk_hw_register-for-a5-c5.patch @@ -0,0 +1,139 @@ +From f06902542203dad2e329f2476d326a21fd905a41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 15:41:49 -0600 +Subject: clk: socfpga: use clk_hw_register for a5/c5 + +From: Dinh Nguyen + +[ Upstream commit 2c2b9c6067170de2a63e7e3d9f5bb205b870de7c ] + +As recommended by Stephen Boyd, convert the cyclone5/arria5 clock driver +to use the clk_hw registration method. + +Suggested-by: Stephen Boyd +Signed-off-by: Dinh Nguyen +Link: https://lore.kernel.org/r/20210302214151.1333447-1-dinguyen@kernel.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/socfpga/clk-gate.c | 11 +++++++---- + drivers/clk/socfpga/clk-periph.c | 8 ++++---- + drivers/clk/socfpga/clk-pll.c | 18 +++++++++++------- + 3 files changed, 22 insertions(+), 15 deletions(-) + +diff --git a/drivers/clk/socfpga/clk-gate.c b/drivers/clk/socfpga/clk-gate.c +index 14918896811d..139b009eda82 100644 +--- a/drivers/clk/socfpga/clk-gate.c ++++ b/drivers/clk/socfpga/clk-gate.c +@@ -183,12 +183,13 @@ static void __init __socfpga_gate_init(struct device_node *node, + u32 div_reg[3]; + u32 clk_phase[2]; + u32 fixed_div; +- struct clk *clk; ++ struct clk_hw *hw_clk; + struct socfpga_gate_clk *socfpga_clk; + const char *clk_name = node->name; + const char *parent_name[SOCFPGA_MAX_PARENTS]; + struct clk_init_data init; + int rc; ++ int err; + + socfpga_clk = kzalloc(sizeof(*socfpga_clk), GFP_KERNEL); + if (WARN_ON(!socfpga_clk)) +@@ -237,12 +238,14 @@ static void __init __socfpga_gate_init(struct device_node *node, + init.parent_names = parent_name; + socfpga_clk->hw.hw.init = &init; + +- clk = clk_register(NULL, &socfpga_clk->hw.hw); +- if (WARN_ON(IS_ERR(clk))) { ++ hw_clk = &socfpga_clk->hw.hw; ++ ++ err = clk_hw_register(NULL, hw_clk); ++ if (err) { + kfree(socfpga_clk); + return; + } +- rc = of_clk_add_provider(node, of_clk_src_simple_get, clk); ++ rc = of_clk_add_provider(node, of_clk_src_simple_get, hw_clk); + if (WARN_ON(rc)) + return; + } +diff --git a/drivers/clk/socfpga/clk-periph.c b/drivers/clk/socfpga/clk-periph.c +index 52c883ea7706..912c3059cbe4 100644 +--- a/drivers/clk/socfpga/clk-periph.c ++++ b/drivers/clk/socfpga/clk-periph.c +@@ -61,7 +61,7 @@ static __init void __socfpga_periph_init(struct device_node *node, + const struct clk_ops *ops) + { + u32 reg; +- struct clk *clk; ++ struct clk_hw *hw_clk; + struct socfpga_periph_clk *periph_clk; + const char *clk_name = node->name; + const char *parent_name[SOCFPGA_MAX_PARENTS]; +@@ -104,13 +104,13 @@ static __init void __socfpga_periph_init(struct device_node *node, + init.parent_names = parent_name; + + periph_clk->hw.hw.init = &init; ++ hw_clk = &periph_clk->hw.hw; + +- clk = clk_register(NULL, &periph_clk->hw.hw); +- if (WARN_ON(IS_ERR(clk))) { ++ if (clk_hw_register(NULL, hw_clk)) { + kfree(periph_clk); + return; + } +- rc = of_clk_add_provider(node, of_clk_src_simple_get, clk); ++ rc = of_clk_add_provider(node, of_clk_src_simple_get, hw_clk); + } + + void __init socfpga_periph_init(struct device_node *node) +diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c +index 973c4713d085..7bde8ca45d4b 100644 +--- a/drivers/clk/socfpga/clk-pll.c ++++ b/drivers/clk/socfpga/clk-pll.c +@@ -80,16 +80,18 @@ static struct clk_ops clk_pll_ops = { + .get_parent = clk_pll_get_parent, + }; + +-static __init struct clk *__socfpga_pll_init(struct device_node *node, ++static __init struct clk_hw *__socfpga_pll_init(struct device_node *node, + const struct clk_ops *ops) + { + u32 reg; +- struct clk *clk; ++ struct clk_hw *hw_clk; + struct socfpga_pll *pll_clk; + const char *clk_name = node->name; + const char *parent_name[SOCFPGA_MAX_PARENTS]; + struct clk_init_data init; + struct device_node *clkmgr_np; ++ int rc; ++ int err; + + of_property_read_u32(node, "reg", ®); + +@@ -117,13 +119,15 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node, + clk_pll_ops.enable = clk_gate_ops.enable; + clk_pll_ops.disable = clk_gate_ops.disable; + +- clk = clk_register(NULL, &pll_clk->hw.hw); +- if (WARN_ON(IS_ERR(clk))) { ++ hw_clk = &pll_clk->hw.hw; ++ ++ err = clk_hw_register(NULL, hw_clk); ++ if (err) { + kfree(pll_clk); +- return NULL; ++ return ERR_PTR(err); + } +- of_clk_add_provider(node, of_clk_src_simple_get, clk); +- return clk; ++ rc = of_clk_add_provider(node, of_clk_src_simple_get, hw_clk); ++ return hw_clk; + } + + void __init socfpga_pll_init(struct device_node *node) +-- +2.35.1 + diff --git a/queue-4.19/clk-st-fix-memory-leak-in-st_of_quadfs_setup.patch b/queue-4.19/clk-st-fix-memory-leak-in-st_of_quadfs_setup.patch new file mode 100644 index 00000000000..2759627cc8f --- /dev/null +++ b/queue-4.19/clk-st-fix-memory-leak-in-st_of_quadfs_setup.patch @@ -0,0 +1,41 @@ +From f0a180ba639cb8a834255281b510b6ccb8e42e39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 21:36:14 +0800 +Subject: clk: st: Fix memory leak in st_of_quadfs_setup() + +From: Xiu Jianfeng + +[ Upstream commit cfd3ffb36f0d566846163118651d868e607300ba ] + +If st_clk_register_quadfs_pll() fails, @lock should be freed before goto +@err_exit, otherwise will cause meory leak issue, fix it. + +Signed-off-by: Xiu Jianfeng +Link: https://lore.kernel.org/r/20221122133614.184910-1-xiujianfeng@huawei.com +Reviewed-by: Patrice Chotard +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/st/clkgen-fsyn.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c +index a79d81985c4e..bbe113159bc6 100644 +--- a/drivers/clk/st/clkgen-fsyn.c ++++ b/drivers/clk/st/clkgen-fsyn.c +@@ -948,9 +948,10 @@ static void __init st_of_quadfs_setup(struct device_node *np, + + clk = st_clk_register_quadfs_pll(pll_name, clk_parent_name, data, + reg, lock); +- if (IS_ERR(clk)) ++ if (IS_ERR(clk)) { ++ kfree(lock); + goto err_exit; +- else ++ } else + pr_debug("%s: parent %s rate %u\n", + __clk_get_name(clk), + __clk_get_name(clk_get_parent(clk)), +-- +2.35.1 + diff --git a/queue-4.19/clocksource-drivers-sh_cmt-make-sure-channel-clock-s.patch b/queue-4.19/clocksource-drivers-sh_cmt-make-sure-channel-clock-s.patch new file mode 100644 index 00000000000..9910d067727 --- /dev/null +++ b/queue-4.19/clocksource-drivers-sh_cmt-make-sure-channel-clock-s.patch @@ -0,0 +1,107 @@ +From 259ae1302939c022dff87838c833dae7cd74f885 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Dec 2020 20:46:48 +0100 +Subject: clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 2a97d55333e4299f32c98cca6dc5c4db1c5855fc ] + +The Renesas Compare Match Timer 0 and 1 (CMT0/1) variants have a +register to control the clock supply to the individual channels. +Currently the driver does not touch this register, and relies on the +documented initial value, which has the clock supply enabled for all +channels present. + +However, when Linux starts on the APE6-EVM development board, only the +clock supply to the first CMT1 channel is enabled. Hence the first +channel (used as a clockevent) works, while the second channel (used as +a clocksource) does not. Note that the default system clocksource is +the Cortex-A15 architectured timer, and the user needs to manually +switch to the CMT1 clocksource to trigger the broken behavior. + +Fix this by removing the fragile dependency on implicit reset and/or +boot loader state, and by enabling the clock supply explicitly for all +channels used instead. This requires postponing the clk_disable() call, +else the timer's registers cannot be accessed in sh_cmt_setup_channel(). + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Niklas Söderlund +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20201210194648.2901899-1-geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/clocksource/sh_cmt.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c +index 7a6d4c4c0feb..0ca8819acc4d 100644 +--- a/drivers/clocksource/sh_cmt.c ++++ b/drivers/clocksource/sh_cmt.c +@@ -239,6 +239,8 @@ static const struct sh_cmt_info sh_cmt_info[] = { + #define CMCNT 1 /* channel register */ + #define CMCOR 2 /* channel register */ + ++#define CMCLKE 0x1000 /* CLK Enable Register (R-Car Gen2) */ ++ + static inline u32 sh_cmt_read_cmstr(struct sh_cmt_channel *ch) + { + if (ch->iostart) +@@ -856,6 +858,7 @@ static int sh_cmt_setup_channel(struct sh_cmt_channel *ch, unsigned int index, + unsigned int hwidx, bool clockevent, + bool clocksource, struct sh_cmt_device *cmt) + { ++ u32 value; + int ret; + + /* Skip unused channels. */ +@@ -885,6 +888,11 @@ static int sh_cmt_setup_channel(struct sh_cmt_channel *ch, unsigned int index, + ch->iostart = cmt->mapbase + ch->hwidx * 0x100; + ch->ioctrl = ch->iostart + 0x10; + ch->timer_bit = 0; ++ ++ /* Enable the clock supply to the channel */ ++ value = ioread32(cmt->mapbase + CMCLKE); ++ value |= BIT(hwidx); ++ iowrite32(value, cmt->mapbase + CMCLKE); + break; + } + +@@ -991,12 +999,10 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev) + else + cmt->rate = clk_get_rate(cmt->clk) / 8; + +- clk_disable(cmt->clk); +- + /* Map the memory resource(s). */ + ret = sh_cmt_map_memory(cmt); + if (ret < 0) +- goto err_clk_unprepare; ++ goto err_clk_disable; + + /* Allocate and setup the channels. */ + cmt->num_channels = hweight8(cmt->hw_channels); +@@ -1024,6 +1030,8 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev) + mask &= ~(1 << hwidx); + } + ++ clk_disable(cmt->clk); ++ + platform_set_drvdata(pdev, cmt); + + return 0; +@@ -1031,6 +1039,8 @@ static int sh_cmt_setup(struct sh_cmt_device *cmt, struct platform_device *pdev) + err_unmap: + kfree(cmt->channels); + iounmap(cmt->mapbase); ++err_clk_disable: ++ clk_disable(cmt->clk); + err_clk_unprepare: + clk_unprepare(cmt->clk); + err_clk_put: +-- +2.35.1 + diff --git a/queue-4.19/cpufreq-amd_freq_sensitivity-add-missing-pci_dev_put.patch b/queue-4.19/cpufreq-amd_freq_sensitivity-add-missing-pci_dev_put.patch new file mode 100644 index 00000000000..8712fb431e9 --- /dev/null +++ b/queue-4.19/cpufreq-amd_freq_sensitivity-add-missing-pci_dev_put.patch @@ -0,0 +1,37 @@ +From d9ea82866c73bd32343d80538e830d58dea96528 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 19:33:39 +0800 +Subject: cpufreq: amd_freq_sensitivity: Add missing pci_dev_put() + +From: Xiongfeng Wang + +[ Upstream commit 91fda1f88c0968f1491ab150bb01690525af150a ] + +pci_get_device() will increase the reference count for the returned +pci_dev. We need to use pci_dev_put() to decrease the reference count +after using pci_get_device(). Let's add it. + +Fixes: 59a3b3a8db16 ("cpufreq: AMD: Ignore the check for ProcFeedback in ST/CZ") +Signed-off-by: Xiongfeng Wang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/amd_freq_sensitivity.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpufreq/amd_freq_sensitivity.c b/drivers/cpufreq/amd_freq_sensitivity.c +index 4b4f128c3488..cacd4c67d9be 100644 +--- a/drivers/cpufreq/amd_freq_sensitivity.c ++++ b/drivers/cpufreq/amd_freq_sensitivity.c +@@ -122,6 +122,8 @@ static int __init amd_freq_sensitivity_init(void) + if (!pcidev) { + if (!static_cpu_has(X86_FEATURE_PROC_FEEDBACK)) + return -ENODEV; ++ } else { ++ pci_dev_put(pcidev); + } + + if (rdmsrl_safe(MSR_AMD64_FREQ_SENSITIVITY_ACTUAL, &val)) +-- +2.35.1 + diff --git a/queue-4.19/cpuidle-dt-return-the-correct-numbers-of-parsed-idle.patch b/queue-4.19/cpuidle-dt-return-the-correct-numbers-of-parsed-idle.patch new file mode 100644 index 00000000000..4e2ca1d4940 --- /dev/null +++ b/queue-4.19/cpuidle-dt-return-the-correct-numbers-of-parsed-idle.patch @@ -0,0 +1,44 @@ +From 8bdb2a9870da66b2287491204cbf06c05b254fe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 17:10:12 +0200 +Subject: cpuidle: dt: Return the correct numbers of parsed idle states + +From: Ulf Hansson + +[ Upstream commit ee3c2c8ad6ba6785f14a60e4081d7c82e88162a2 ] + +While we correctly skips to initialize an idle state from a disabled idle +state node in DT, the returned value from dt_init_idle_driver() don't get +adjusted accordingly. Instead the number of found idle state nodes are +returned, while the callers are expecting the number of successfully +initialized idle states from DT. + +This leads to cpuidle drivers unnecessarily continues to initialize their +idle state specific data. Moreover, in the case when all idle states have +been disabled in DT, we would end up registering a cpuidle driver, rather +than relying on the default arch specific idle call. + +Fixes: 9f14da345599 ("drivers: cpuidle: implement DT based idle states infrastructure") +Signed-off-by: Ulf Hansson +Reviewed-by: Sudeep Holla +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/dt_idle_states.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpuidle/dt_idle_states.c b/drivers/cpuidle/dt_idle_states.c +index 53342b7f1010..ea3c59d3fdad 100644 +--- a/drivers/cpuidle/dt_idle_states.c ++++ b/drivers/cpuidle/dt_idle_states.c +@@ -224,6 +224,6 @@ int dt_init_idle_driver(struct cpuidle_driver *drv, + * also be 0 on platforms with missing DT idle states or legacy DT + * configuration predating the DT idle states bindings. + */ +- return i; ++ return state_idx - start_idx; + } + EXPORT_SYMBOL_GPL(dt_init_idle_driver); +-- +2.35.1 + diff --git a/queue-4.19/crypto-ccree-make-cc_debugfs_global_fini-available-f.patch b/queue-4.19/crypto-ccree-make-cc_debugfs_global_fini-available-f.patch new file mode 100644 index 00000000000..ee43ff727b9 --- /dev/null +++ b/queue-4.19/crypto-ccree-make-cc_debugfs_global_fini-available-f.patch @@ -0,0 +1,46 @@ +From 7f0abbda5c669969b6a5632fd691d23980aef3e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 18:22:36 +0100 +Subject: crypto: ccree - Make cc_debugfs_global_fini() available for module + init function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 8e96729fc26c8967db45a3fb7a60387619f77a22 ] + +ccree_init() calls cc_debugfs_global_fini(), the former is an init +function and the latter an exit function though. + +A modular build emits: + + WARNING: modpost: drivers/crypto/ccree/ccree.o: section mismatch in reference: init_module (section: .init.text) -> cc_debugfs_global_fini (section: .exit.text) + +(with CONFIG_DEBUG_SECTION_MISMATCH=y). + +Fixes: 4f1c596df706 ("crypto: ccree - Remove debugfs when platform_driver_register failed") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccree/cc_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccree/cc_debugfs.c b/drivers/crypto/ccree/cc_debugfs.c +index 5ca184e42483..3879f33fb59e 100644 +--- a/drivers/crypto/ccree/cc_debugfs.c ++++ b/drivers/crypto/ccree/cc_debugfs.c +@@ -46,7 +46,7 @@ int __init cc_debugfs_global_init(void) + return !cc_debugfs_dir; + } + +-void __exit cc_debugfs_global_fini(void) ++void cc_debugfs_global_fini(void) + { + debugfs_remove(cc_debugfs_dir); + } +-- +2.35.1 + diff --git a/queue-4.19/crypto-img-hash-fix-variable-dereferenced-before-che.patch b/queue-4.19/crypto-img-hash-fix-variable-dereferenced-before-che.patch new file mode 100644 index 00000000000..e767a51f6d1 --- /dev/null +++ b/queue-4.19/crypto-img-hash-fix-variable-dereferenced-before-che.patch @@ -0,0 +1,52 @@ +From e585a745108449c58f4b3eedad7fa54df0a8f771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 14:25:26 +0800 +Subject: crypto: img-hash - Fix variable dereferenced before check 'hdev->req' + +From: Gaosheng Cui + +[ Upstream commit 04ba54e5af8f8f0137b08cb51a0b3a2e1ea46c94 ] + +Smatch report warning as follows: + +drivers/crypto/img-hash.c:366 img_hash_dma_task() warn: variable +dereferenced before check 'hdev->req' + +Variable dereferenced should be done after check 'hdev->req', +fix it. + +Fixes: d358f1abbf71 ("crypto: img-hash - Add Imagination Technologies hw hash accelerator") +Fixes: 10badea259fa ("crypto: img-hash - Fix null pointer exception") +Signed-off-by: Gaosheng Cui +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/img-hash.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/img-hash.c b/drivers/crypto/img-hash.c +index b87000a0a01c..f70923643a97 100644 +--- a/drivers/crypto/img-hash.c ++++ b/drivers/crypto/img-hash.c +@@ -359,12 +359,16 @@ static int img_hash_dma_init(struct img_hash_dev *hdev) + static void img_hash_dma_task(unsigned long d) + { + struct img_hash_dev *hdev = (struct img_hash_dev *)d; +- struct img_hash_request_ctx *ctx = ahash_request_ctx(hdev->req); ++ struct img_hash_request_ctx *ctx; + u8 *addr; + size_t nbytes, bleft, wsend, len, tbc; + struct scatterlist tsg; + +- if (!hdev->req || !ctx->sg) ++ if (!hdev->req) ++ return; ++ ++ ctx = ahash_request_ctx(hdev->req); ++ if (!ctx->sg) + return; + + addr = sg_virt(ctx->sg); +-- +2.35.1 + diff --git a/queue-4.19/crypto-tcrypt-fix-multibuffer-skcipher-speed-test-me.patch b/queue-4.19/crypto-tcrypt-fix-multibuffer-skcipher-speed-test-me.patch new file mode 100644 index 00000000000..d7355e80fac --- /dev/null +++ b/queue-4.19/crypto-tcrypt-fix-multibuffer-skcipher-speed-test-me.patch @@ -0,0 +1,45 @@ +From 4110f26292c83988d29c122a2c3848c4098a514e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 17:24:11 +0800 +Subject: crypto: tcrypt - Fix multibuffer skcipher speed test mem leak + +From: Zhang Yiqun + +[ Upstream commit 1aa33fc8d4032227253ceb736f47c52b859d9683 ] + +In the past, the data for mb-skcipher test has been allocated +twice, that means the first allcated memory area is without +free, which may cause a potential memory leakage. So this +patch is to remove one allocation to fix this error. + +Fixes: e161c5930c15 ("crypto: tcrypt - add multibuf skcipher...") +Signed-off-by: Zhang Yiqun +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/tcrypt.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c +index bf797c613ba2..366f4510acbe 100644 +--- a/crypto/tcrypt.c ++++ b/crypto/tcrypt.c +@@ -1285,15 +1285,6 @@ static void test_mb_skcipher_speed(const char *algo, int enc, int secs, + goto out_free_tfm; + } + +- +- for (i = 0; i < num_mb; ++i) +- if (testmgr_alloc_buf(data[i].xbuf)) { +- while (i--) +- testmgr_free_buf(data[i].xbuf); +- goto out_free_tfm; +- } +- +- + for (i = 0; i < num_mb; ++i) { + data[i].req = skcipher_request_alloc(tfm, GFP_KERNEL); + if (!data[i].req) { +-- +2.35.1 + diff --git a/queue-4.19/cxl-fix-possible-null-ptr-deref-in-cxl_guest_init_af.patch b/queue-4.19/cxl-fix-possible-null-ptr-deref-in-cxl_guest_init_af.patch new file mode 100644 index 00000000000..a0eec22ae6f --- /dev/null +++ b/queue-4.19/cxl-fix-possible-null-ptr-deref-in-cxl_guest_init_af.patch @@ -0,0 +1,99 @@ +From e94e1ded7e4650139d1a617f129685e123fb190c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 22:54:39 +0800 +Subject: cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter() + +From: Yang Yingliang + +[ Upstream commit 61c80d1c3833e196256fb060382db94f24d3d9a7 ] + +If device_register() fails in cxl_register_afu|adapter(), the device +is not added, device_unregister() can not be called in the error path, +otherwise it will cause a null-ptr-deref because of removing not added +device. + +As comment of device_register() says, it should use put_device() to give +up the reference in the error path. So split device_unregister() into +device_del() and put_device(), then goes to put dev when register fails. + +Fixes: 14baf4d9c739 ("cxl: Add guest-specific code") +Signed-off-by: Yang Yingliang +Acked-by: Andrew Donnellan +Acked-by: Frederic Barrat +Link: https://lore.kernel.org/r/20221111145440.2426970-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/guest.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c +index 08f4a512afad..3153cf1651a2 100644 +--- a/drivers/misc/cxl/guest.c ++++ b/drivers/misc/cxl/guest.c +@@ -963,10 +963,10 @@ int cxl_guest_init_afu(struct cxl *adapter, int slice, struct device_node *afu_n + * if it returns an error! + */ + if ((rc = cxl_register_afu(afu))) +- goto err_put1; ++ goto err_put_dev; + + if ((rc = cxl_sysfs_afu_add(afu))) +- goto err_put1; ++ goto err_del_dev; + + /* + * pHyp doesn't expose the programming models supported by the +@@ -982,7 +982,7 @@ int cxl_guest_init_afu(struct cxl *adapter, int slice, struct device_node *afu_n + afu->modes_supported = CXL_MODE_DIRECTED; + + if ((rc = cxl_afu_select_best_mode(afu))) +- goto err_put2; ++ goto err_remove_sysfs; + + adapter->afu[afu->slice] = afu; + +@@ -1002,10 +1002,12 @@ int cxl_guest_init_afu(struct cxl *adapter, int slice, struct device_node *afu_n + + return 0; + +-err_put2: ++err_remove_sysfs: + cxl_sysfs_afu_remove(afu); +-err_put1: +- device_unregister(&afu->dev); ++err_del_dev: ++ device_del(&afu->dev); ++err_put_dev: ++ put_device(&afu->dev); + free = false; + guest_release_serr_irq(afu); + err2: +@@ -1139,18 +1141,20 @@ struct cxl *cxl_guest_init_adapter(struct device_node *np, struct platform_devic + * even if it returns an error! + */ + if ((rc = cxl_register_adapter(adapter))) +- goto err_put1; ++ goto err_put_dev; + + if ((rc = cxl_sysfs_adapter_add(adapter))) +- goto err_put1; ++ goto err_del_dev; + + /* release the context lock as the adapter is configured */ + cxl_adapter_context_unlock(adapter); + + return adapter; + +-err_put1: +- device_unregister(&adapter->dev); ++err_del_dev: ++ device_del(&adapter->dev); ++err_put_dev: ++ put_device(&adapter->dev); + free = false; + cxl_guest_remove_chardev(adapter); + err1: +-- +2.35.1 + diff --git a/queue-4.19/cxl-fix-possible-null-ptr-deref-in-cxl_pci_init_afu-.patch b/queue-4.19/cxl-fix-possible-null-ptr-deref-in-cxl_pci_init_afu-.patch new file mode 100644 index 00000000000..938235fdf65 --- /dev/null +++ b/queue-4.19/cxl-fix-possible-null-ptr-deref-in-cxl_pci_init_afu-.patch @@ -0,0 +1,94 @@ +From 99d66e4b1e774c6ea337efb96f922189017544c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 22:54:40 +0800 +Subject: cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter() + +From: Yang Yingliang + +[ Upstream commit 02cd3032b154fa02fdf90e7467abaeed889330b2 ] + +If device_register() fails in cxl_pci_afu|adapter(), the device +is not added, device_unregister() can not be called in the error +path, otherwise it will cause a null-ptr-deref because of removing +not added device. + +As comment of device_register() says, it should use put_device() to give +up the reference in the error path. So split device_unregister() into +device_del() and put_device(), then goes to put dev when register fails. + +Fixes: f204e0b8cedd ("cxl: Driver code for powernv PCIe based cards for userspace access") +Signed-off-by: Yang Yingliang +Acked-by: Frederic Barrat +Acked-by: Andrew Donnellan +Link: https://lore.kernel.org/r/20221111145440.2426970-2-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/pci.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c +index b9d3c87e9318..acb4a339f5fe 100644 +--- a/drivers/misc/cxl/pci.c ++++ b/drivers/misc/cxl/pci.c +@@ -1168,10 +1168,10 @@ static int pci_init_afu(struct cxl *adapter, int slice, struct pci_dev *dev) + * if it returns an error! + */ + if ((rc = cxl_register_afu(afu))) +- goto err_put1; ++ goto err_put_dev; + + if ((rc = cxl_sysfs_afu_add(afu))) +- goto err_put1; ++ goto err_del_dev; + + adapter->afu[afu->slice] = afu; + +@@ -1180,10 +1180,12 @@ static int pci_init_afu(struct cxl *adapter, int slice, struct pci_dev *dev) + + return 0; + +-err_put1: ++err_del_dev: ++ device_del(&afu->dev); ++err_put_dev: + pci_deconfigure_afu(afu); + cxl_debugfs_afu_remove(afu); +- device_unregister(&afu->dev); ++ put_device(&afu->dev); + return rc; + + err_free_native: +@@ -1671,23 +1673,25 @@ static struct cxl *cxl_pci_init_adapter(struct pci_dev *dev) + * even if it returns an error! + */ + if ((rc = cxl_register_adapter(adapter))) +- goto err_put1; ++ goto err_put_dev; + + if ((rc = cxl_sysfs_adapter_add(adapter))) +- goto err_put1; ++ goto err_del_dev; + + /* Release the context lock as adapter is configured */ + cxl_adapter_context_unlock(adapter); + + return adapter; + +-err_put1: ++err_del_dev: ++ device_del(&adapter->dev); ++err_put_dev: + /* This should mirror cxl_remove_adapter, except without the + * sysfs parts + */ + cxl_debugfs_adapter_remove(adapter); + cxl_deconfigure_adapter(adapter); +- device_unregister(&adapter->dev); ++ put_device(&adapter->dev); + return ERR_PTR(rc); + + err_release: +-- +2.35.1 + diff --git a/queue-4.19/cxl-fix-refcount-leak-in-cxl_calc_capp_routing.patch b/queue-4.19/cxl-fix-refcount-leak-in-cxl_calc_capp_routing.patch new file mode 100644 index 00000000000..f5b32aeb224 --- /dev/null +++ b/queue-4.19/cxl-fix-refcount-leak-in-cxl_calc_capp_routing.patch @@ -0,0 +1,41 @@ +From 8d6eb9531b4a2cfafaa15d988500db808e208818 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Jun 2022 10:00:38 +0400 +Subject: cxl: Fix refcount leak in cxl_calc_capp_routing + +From: Miaoqian Lin + +[ Upstream commit 1d09697ff22908ae487fc8c4fbde1811732be523 ] + +of_get_next_parent() returns a node pointer with refcount incremented, +we should use of_node_put() on it when not need anymore. +This function only calls of_node_put() in normal path, +missing it in the error path. +Add missing of_node_put() to avoid refcount leak. + +Fixes: f24be42aab37 ("cxl: Add psl9 specific code") +Signed-off-by: Miaoqian Lin +Acked-by: Andrew Donnellan +Acked-by: Frederic Barrat +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220605060038.62217-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c +index acb4a339f5fe..8dbb1998c312 100644 +--- a/drivers/misc/cxl/pci.c ++++ b/drivers/misc/cxl/pci.c +@@ -391,6 +391,7 @@ int cxl_calc_capp_routing(struct pci_dev *dev, u64 *chipid, + rc = get_phb_index(np, phb_index); + if (rc) { + pr_err("cxl: invalid phb index\n"); ++ of_node_put(np); + return rc; + } + +-- +2.35.1 + diff --git a/queue-4.19/debugfs-fix-error-when-writing-negative-value-to-ato.patch b/queue-4.19/debugfs-fix-error-when-writing-negative-value-to-ato.patch new file mode 100644 index 00000000000..fa1da5aaef8 --- /dev/null +++ b/queue-4.19/debugfs-fix-error-when-writing-negative-value-to-ato.patch @@ -0,0 +1,171 @@ +From e81208aaf80c535154af1f584c3903acb296be55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 02:24:18 +0900 +Subject: debugfs: fix error when writing negative value to atomic_t debugfs + file + +From: Akinobu Mita + +[ Upstream commit d472cf797c4e268613dbce5ec9b95d0bcae19ecb ] + +The simple attribute files do not accept a negative value since the commit +488dac0c9237 ("libfs: fix error cast of negative value in +simple_attr_write()"), so we have to use a 64-bit value to write a +negative value for a debugfs file created by debugfs_create_atomic_t(). + +This restores the previous behaviour by introducing +DEFINE_DEBUGFS_ATTRIBUTE_SIGNED for a signed value. + +Link: https://lkml.kernel.org/r/20220919172418.45257-4-akinobu.mita@gmail.com +Fixes: 488dac0c9237 ("libfs: fix error cast of negative value in simple_attr_write()") +Signed-off-by: Akinobu Mita +Reported-by: Zhao Gongyi +Reviewed-by: David Hildenbrand +Reviewed-by: Greg Kroah-Hartman +Cc: Alexander Viro +Cc: Jonathan Corbet +Cc: Oscar Salvador +Cc: Rafael J. Wysocki +Cc: Shuah Khan +Cc: Wei Yongjun +Cc: Yicong Yang +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + .../fault-injection/fault-injection.txt | 4 +-- + fs/debugfs/file.c | 28 +++++++++++++++---- + include/linux/debugfs.h | 19 +++++++++++-- + 3 files changed, 41 insertions(+), 10 deletions(-) + +diff --git a/Documentation/fault-injection/fault-injection.txt b/Documentation/fault-injection/fault-injection.txt +index 4d1b7b4ccfaf..b2b86147bafe 100644 +--- a/Documentation/fault-injection/fault-injection.txt ++++ b/Documentation/fault-injection/fault-injection.txt +@@ -71,8 +71,8 @@ configuration of fault-injection capabilities. + + - /sys/kernel/debug/fail*/times: + +- specifies how many times failures may happen at most. +- A value of -1 means "no limit". ++ specifies how many times failures may happen at most. A value of -1 ++ means "no limit". + + - /sys/kernel/debug/fail*/space: + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index 4fce1da7db23..a57d080d2ba5 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -330,8 +330,8 @@ ssize_t debugfs_attr_read(struct file *file, char __user *buf, + } + EXPORT_SYMBOL_GPL(debugfs_attr_read); + +-ssize_t debugfs_attr_write(struct file *file, const char __user *buf, +- size_t len, loff_t *ppos) ++static ssize_t debugfs_attr_write_xsigned(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos, bool is_signed) + { + struct dentry *dentry = F_DENTRY(file); + ssize_t ret; +@@ -339,12 +339,28 @@ ssize_t debugfs_attr_write(struct file *file, const char __user *buf, + ret = debugfs_file_get(dentry); + if (unlikely(ret)) + return ret; +- ret = simple_attr_write(file, buf, len, ppos); ++ if (is_signed) ++ ret = simple_attr_write_signed(file, buf, len, ppos); ++ else ++ ret = simple_attr_write(file, buf, len, ppos); + debugfs_file_put(dentry); + return ret; + } ++ ++ssize_t debugfs_attr_write(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos) ++{ ++ return debugfs_attr_write_xsigned(file, buf, len, ppos, false); ++} + EXPORT_SYMBOL_GPL(debugfs_attr_write); + ++ssize_t debugfs_attr_write_signed(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos) ++{ ++ return debugfs_attr_write_xsigned(file, buf, len, ppos, true); ++} ++EXPORT_SYMBOL_GPL(debugfs_attr_write_signed); ++ + static struct dentry *debugfs_create_mode_unsafe(const char *name, umode_t mode, + struct dentry *parent, void *value, + const struct file_operations *fops, +@@ -742,11 +758,11 @@ static int debugfs_atomic_t_get(void *data, u64 *val) + *val = atomic_read((atomic_t *)data); + return 0; + } +-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t, debugfs_atomic_t_get, ++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t, debugfs_atomic_t_get, + debugfs_atomic_t_set, "%lld\n"); +-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t_ro, debugfs_atomic_t_get, NULL, ++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t_ro, debugfs_atomic_t_get, NULL, + "%lld\n"); +-DEFINE_DEBUGFS_ATTRIBUTE(fops_atomic_t_wo, NULL, debugfs_atomic_t_set, ++DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(fops_atomic_t_wo, NULL, debugfs_atomic_t_set, + "%lld\n"); + + /** +diff --git a/include/linux/debugfs.h b/include/linux/debugfs.h +index 2a4638bb4033..6ebc269e48ac 100644 +--- a/include/linux/debugfs.h ++++ b/include/linux/debugfs.h +@@ -39,7 +39,7 @@ struct debugfs_regset32 { + + extern struct dentry *arch_debugfs_dir; + +-#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \ ++#define DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, __is_signed) \ + static int __fops ## _open(struct inode *inode, struct file *file) \ + { \ + __simple_attr_check_format(__fmt, 0ull); \ +@@ -50,10 +50,16 @@ static const struct file_operations __fops = { \ + .open = __fops ## _open, \ + .release = simple_attr_release, \ + .read = debugfs_attr_read, \ +- .write = debugfs_attr_write, \ ++ .write = (__is_signed) ? debugfs_attr_write_signed : debugfs_attr_write, \ + .llseek = no_llseek, \ + } + ++#define DEFINE_DEBUGFS_ATTRIBUTE(__fops, __get, __set, __fmt) \ ++ DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, false) ++ ++#define DEFINE_DEBUGFS_ATTRIBUTE_SIGNED(__fops, __get, __set, __fmt) \ ++ DEFINE_DEBUGFS_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, true) ++ + typedef struct vfsmount *(*debugfs_automount_t)(struct dentry *, void *); + + #if defined(CONFIG_DEBUG_FS) +@@ -96,6 +102,8 @@ ssize_t debugfs_attr_read(struct file *file, char __user *buf, + size_t len, loff_t *ppos); + ssize_t debugfs_attr_write(struct file *file, const char __user *buf, + size_t len, loff_t *ppos); ++ssize_t debugfs_attr_write_signed(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos); + + struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry, + struct dentry *new_dir, const char *new_name); +@@ -246,6 +254,13 @@ static inline ssize_t debugfs_attr_write(struct file *file, + return -ENODEV; + } + ++static inline ssize_t debugfs_attr_write_signed(struct file *file, ++ const char __user *buf, ++ size_t len, loff_t *ppos) ++{ ++ return -ENODEV; ++} ++ + static inline struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry, + struct dentry *new_dir, char *new_name) + { +-- +2.35.1 + diff --git a/queue-4.19/drbd-remove-call-to-memset-before-free-device-resour.patch b/queue-4.19/drbd-remove-call-to-memset-before-free-device-resour.patch new file mode 100644 index 00000000000..6b44f09e3ba --- /dev/null +++ b/queue-4.19/drbd-remove-call-to-memset-before-free-device-resour.patch @@ -0,0 +1,52 @@ +From 3c83f0bd1781d8184ac1117435a007319b361992 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 09:58:16 +0800 +Subject: drbd: remove call to memset before free device/resource/connection + +From: Wang ShaoBo + +[ Upstream commit 6e7b854e4c1b02dba00760dfa79d8dbf6cce561e ] + +This revert c2258ffc56f2 ("drbd: poison free'd device, resource and +connection structs"), add memset is odd here for debugging, there are +some methods to accurately show what happened, such as kdump. + +Signed-off-by: Wang ShaoBo +Link: https://lore.kernel.org/r/20221124015817.2729789-2-bobo.shaobowang@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 3ae718aa6b39..1ff5af6c4f3f 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -2258,7 +2258,6 @@ void drbd_destroy_device(struct kref *kref) + kref_put(&peer_device->connection->kref, drbd_destroy_connection); + kfree(peer_device); + } +- memset(device, 0xfd, sizeof(*device)); + kfree(device); + kref_put(&resource->kref, drbd_destroy_resource); + } +@@ -2351,7 +2350,6 @@ void drbd_destroy_resource(struct kref *kref) + idr_destroy(&resource->devices); + free_cpumask_var(resource->cpu_mask); + kfree(resource->name); +- memset(resource, 0xf2, sizeof(*resource)); + kfree(resource); + } + +@@ -2748,7 +2746,6 @@ void drbd_destroy_connection(struct kref *kref) + drbd_free_socket(&connection->data); + kfree(connection->int_dig_in); + kfree(connection->int_dig_vv); +- memset(connection, 0xfc, sizeof(*connection)); + kfree(connection); + kref_put(&resource->kref, drbd_destroy_resource); + } +-- +2.35.1 + diff --git a/queue-4.19/drivers-dio-fix-possible-memory-leak-in-dio_init.patch b/queue-4.19/drivers-dio-fix-possible-memory-leak-in-dio_init.patch new file mode 100644 index 00000000000..677c8483373 --- /dev/null +++ b/queue-4.19/drivers-dio-fix-possible-memory-leak-in-dio_init.patch @@ -0,0 +1,60 @@ +From bdf1642705379afeba78e1946e9b76904d351e10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 14:40:36 +0800 +Subject: drivers: dio: fix possible memory leak in dio_init() + +From: Yang Yingliang + +[ Upstream commit e63e99397b2613d50a5f4f02ed07307e67a190f1 ] + +If device_register() returns error, the 'dev' and name needs be +freed. Add a release function, and then call put_device() in the +error path, so the name is freed in kobject_cleanup() and to the +'dev' is freed in release function. + +Fixes: 2e4c77bea3d8 ("m68k: dio - Kill warn_unused_result warnings") +Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221109064036.1835346-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/dio/dio.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/dio/dio.c b/drivers/dio/dio.c +index 92e78d16b476..fcde602f4902 100644 +--- a/drivers/dio/dio.c ++++ b/drivers/dio/dio.c +@@ -110,6 +110,12 @@ static char dio_no_name[] = { 0 }; + + #endif /* CONFIG_DIO_CONSTANTS */ + ++static void dio_dev_release(struct device *dev) ++{ ++ struct dio_dev *ddev = container_of(dev, typeof(struct dio_dev), dev); ++ kfree(ddev); ++} ++ + int __init dio_find(int deviceid) + { + /* Called to find a DIO device before the full bus scan has run. +@@ -222,6 +228,7 @@ static int __init dio_init(void) + dev->bus = &dio_bus; + dev->dev.parent = &dio_bus.dev; + dev->dev.bus = &dio_bus_type; ++ dev->dev.release = dio_dev_release; + dev->scode = scode; + dev->resource.start = pa; + dev->resource.end = pa + DIO_SIZE(scode, va); +@@ -249,6 +256,7 @@ static int __init dio_init(void) + if (error) { + pr_err("DIO: Error registering device %s\n", + dev->name); ++ put_device(&dev->dev); + continue; + } + error = dio_create_sysfs_dev_files(dev); +-- +2.35.1 + diff --git a/queue-4.19/drivers-mcb-fix-resource-leak-in-mcb_probe.patch b/queue-4.19/drivers-mcb-fix-resource-leak-in-mcb_probe.patch new file mode 100644 index 00000000000..ab049a21e2b --- /dev/null +++ b/queue-4.19/drivers-mcb-fix-resource-leak-in-mcb_probe.patch @@ -0,0 +1,41 @@ +From 64d3db916332cbfe31d674527db844ada4d41271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 01:38:49 -0800 +Subject: drivers: mcb: fix resource leak in mcb_probe() + +From: Zhengchao Shao + +[ Upstream commit d7237462561fcd224fa687c56ccb68629f50fc0d ] + +When probe hook function failed in mcb_probe(), it doesn't put the device. +Compiled test only. + +Fixes: 7bc364097a89 ("mcb: Acquire reference to device in probe") +Signed-off-by: Zhengchao Shao +Signed-off-by: Johannes Thumshirn +Link: https://lore.kernel.org/r/9f87de36bfb85158b506cb78c6fc9db3f6a3bad1.1669624063.git.johannes.thumshirn@wdc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/mcb/mcb-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mcb/mcb-core.c b/drivers/mcb/mcb-core.c +index 118d27ee31c2..7fd32b0183dc 100644 +--- a/drivers/mcb/mcb-core.c ++++ b/drivers/mcb/mcb-core.c +@@ -74,8 +74,10 @@ static int mcb_probe(struct device *dev) + + get_device(dev); + ret = mdrv->probe(mdev, found_id); +- if (ret) ++ if (ret) { + module_put(carrier_mod); ++ put_device(dev); ++ } + + return ret; + } +-- +2.35.1 + diff --git a/queue-4.19/drivers-md-md-bitmap-check-the-return-value-of-md_bi.patch b/queue-4.19/drivers-md-md-bitmap-check-the-return-value-of-md_bi.patch new file mode 100644 index 00000000000..164a02fa79b --- /dev/null +++ b/queue-4.19/drivers-md-md-bitmap-check-the-return-value-of-md_bi.patch @@ -0,0 +1,65 @@ +From 3a8b38b1dac2a9d290e7a89232ea1de0cc978a65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 16:33:05 -0700 +Subject: drivers/md/md-bitmap: check the return value of + md_bitmap_get_counter() + +From: Li Zhong + +[ Upstream commit 3bd548e5b819b8c0f2c9085de775c5c7bff9052f ] + +Check the return value of md_bitmap_get_counter() in case it returns +NULL pointer, which will result in a null pointer dereference. + +v2: update the check to include other dereference + +Signed-off-by: Li Zhong +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 7cf9d34ce20e..157a1735d7b7 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2191,20 +2191,23 @@ int md_bitmap_resize(struct bitmap *bitmap, sector_t blocks, + + if (set) { + bmc_new = md_bitmap_get_counter(&bitmap->counts, block, &new_blocks, 1); +- if (*bmc_new == 0) { +- /* need to set on-disk bits too. */ +- sector_t end = block + new_blocks; +- sector_t start = block >> chunkshift; +- start <<= chunkshift; +- while (start < end) { +- md_bitmap_file_set_bit(bitmap, block); +- start += 1 << chunkshift; ++ if (bmc_new) { ++ if (*bmc_new == 0) { ++ /* need to set on-disk bits too. */ ++ sector_t end = block + new_blocks; ++ sector_t start = block >> chunkshift; ++ ++ start <<= chunkshift; ++ while (start < end) { ++ md_bitmap_file_set_bit(bitmap, block); ++ start += 1 << chunkshift; ++ } ++ *bmc_new = 2; ++ md_bitmap_count_page(&bitmap->counts, block, 1); ++ md_bitmap_set_pending(&bitmap->counts, block); + } +- *bmc_new = 2; +- md_bitmap_count_page(&bitmap->counts, block, 1); +- md_bitmap_set_pending(&bitmap->counts, block); ++ *bmc_new |= NEEDED_MASK; + } +- *bmc_new |= NEEDED_MASK; + if (new_blocks < old_blocks) + old_blocks = new_blocks; + } +-- +2.35.1 + diff --git a/queue-4.19/drivers-net-qlcnic-fix-potential-memory-leak-in-qlcn.patch b/queue-4.19/drivers-net-qlcnic-fix-potential-memory-leak-in-qlcn.patch new file mode 100644 index 00000000000..260b986549f --- /dev/null +++ b/queue-4.19/drivers-net-qlcnic-fix-potential-memory-leak-in-qlcn.patch @@ -0,0 +1,38 @@ +From deeecc5d732548a78cf5efcdc809e9c2fa901363 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 08:54:10 +0000 +Subject: drivers: net: qlcnic: Fix potential memory leak in + qlcnic_sriov_init() + +From: Yuan Can + +[ Upstream commit 01de1123322e4fe1bbd0fcdf0982511b55519c03 ] + +If vp alloc failed in qlcnic_sriov_init(), all previously allocated vp +needs to be freed. + +Fixes: f197a7aa6288 ("qlcnic: VF-PF communication channel implementation") +Signed-off-by: Yuan Can +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index 98275f18a87b..d28c4436f965 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -222,6 +222,8 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs) + return 0; + + qlcnic_destroy_async_wq: ++ while (i--) ++ kfree(sriov->vf_info[i].vp); + destroy_workqueue(bc->bc_async_wq); + + qlcnic_destroy_trans_wq: +-- +2.35.1 + diff --git a/queue-4.19/drivers-provide-devm_platform_get_and_ioremap_resour.patch b/queue-4.19/drivers-provide-devm_platform_get_and_ioremap_resour.patch new file mode 100644 index 00000000000..97d8830f589 --- /dev/null +++ b/queue-4.19/drivers-provide-devm_platform_get_and_ioremap_resour.patch @@ -0,0 +1,80 @@ +From fd7faf5cca8a179c583b5138eb6565e59d24bfb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Mar 2020 00:06:08 +0800 +Subject: drivers: provide devm_platform_get_and_ioremap_resource() + +From: Dejin Zheng + +[ Upstream commit 890cc39a879906b63912482dfc41944579df2dc6 ] + +Since commit "drivers: provide devm_platform_ioremap_resource()", +it was wrap platform_get_resource() and devm_ioremap_resource() as +single helper devm_platform_ioremap_resource(). but now, many drivers +still used platform_get_resource() and devm_ioremap_resource() +together in the kernel tree. The reason can not be replaced is they +still need use the resource variables obtained by platform_get_resource(). +so provide this helper. + +Suggested-by: Geert Uytterhoeven +Suggested-by: Sergei Shtylyov +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Dejin Zheng +Link: https://lore.kernel.org/r/20200323160612.17277-2-zhengdejin5@gmail.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 2d47b79d2bd3 ("i2c: mux: reg: check return value after calling platform_get_resource()") +Signed-off-by: Sasha Levin +--- + drivers/base/platform.c | 22 ++++++++++++++++++++++ + include/linux/platform_device.h | 3 +++ + 2 files changed, 25 insertions(+) + +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index ea83c279b8a3..c4e398f3de50 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -80,6 +80,28 @@ struct resource *platform_get_resource(struct platform_device *dev, + } + EXPORT_SYMBOL_GPL(platform_get_resource); + ++/** ++ * devm_platform_get_and_ioremap_resource - call devm_ioremap_resource() for a ++ * platform device and get resource ++ * ++ * @pdev: platform device to use both for memory resource lookup as well as ++ * resource management ++ * @index: resource index ++ * @res: optional output parameter to store a pointer to the obtained resource. ++ */ ++void __iomem * ++devm_platform_get_and_ioremap_resource(struct platform_device *pdev, ++ unsigned int index, struct resource **res) ++{ ++ struct resource *r; ++ ++ r = platform_get_resource(pdev, IORESOURCE_MEM, index); ++ if (res) ++ *res = r; ++ return devm_ioremap_resource(&pdev->dev, r); ++} ++EXPORT_SYMBOL_GPL(devm_platform_get_and_ioremap_resource); ++ + /** + * devm_platform_ioremap_resource - call devm_ioremap_resource() for a platform + * device +diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h +index 9e5c98fcea8c..1de7ea6efdc9 100644 +--- a/include/linux/platform_device.h ++++ b/include/linux/platform_device.h +@@ -52,6 +52,9 @@ extern void arch_setup_pdev_archdata(struct platform_device *); + extern struct resource *platform_get_resource(struct platform_device *, + unsigned int, unsigned int); + extern void __iomem * ++devm_platform_get_and_ioremap_resource(struct platform_device *pdev, ++ unsigned int index, struct resource **res); ++extern void __iomem * + devm_platform_ioremap_resource(struct platform_device *pdev, + unsigned int index); + extern int platform_get_irq(struct platform_device *, unsigned int); +-- +2.35.1 + diff --git a/queue-4.19/drivers-provide-devm_platform_ioremap_resource.patch b/queue-4.19/drivers-provide-devm_platform_ioremap_resource.patch new file mode 100644 index 00000000000..306e8f662a0 --- /dev/null +++ b/queue-4.19/drivers-provide-devm_platform_ioremap_resource.patch @@ -0,0 +1,74 @@ +From 69aa702acf2e53552007e5cb0c96226301ad0971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Feb 2019 11:12:39 +0000 +Subject: drivers: provide devm_platform_ioremap_resource() + +From: Bartosz Golaszewski + +[ Upstream commit 7945f929f1a77a1c8887a97ca07f87626858ff42 ] + +There are currently 1200+ instances of using platform_get_resource() +and devm_ioremap_resource() together in the kernel tree. + +This patch wraps these two calls in a single helper. Thanks to that +we don't have to declare a local variable for struct resource * and can +omit the redundant argument for resource type. We also have one +function call less. + +Signed-off-by: Bartosz Golaszewski +Acked-by: Greg Kroah-Hartman +Reviewed-by: Andy Shevchenko +Signed-off-by: Linus Walleij +Stable-dep-of: 2d47b79d2bd3 ("i2c: mux: reg: check return value after calling platform_get_resource()") +Signed-off-by: Sasha Levin +--- + drivers/base/platform.c | 18 ++++++++++++++++++ + include/linux/platform_device.h | 3 +++ + 2 files changed, 21 insertions(+) + +diff --git a/drivers/base/platform.c b/drivers/base/platform.c +index 349c2754eed7..ea83c279b8a3 100644 +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -80,6 +80,24 @@ struct resource *platform_get_resource(struct platform_device *dev, + } + EXPORT_SYMBOL_GPL(platform_get_resource); + ++/** ++ * devm_platform_ioremap_resource - call devm_ioremap_resource() for a platform ++ * device ++ * ++ * @pdev: platform device to use both for memory resource lookup as well as ++ * resource managemend ++ * @index: resource index ++ */ ++void __iomem *devm_platform_ioremap_resource(struct platform_device *pdev, ++ unsigned int index) ++{ ++ struct resource *res; ++ ++ res = platform_get_resource(pdev, IORESOURCE_MEM, index); ++ return devm_ioremap_resource(&pdev->dev, res); ++} ++EXPORT_SYMBOL_GPL(devm_platform_ioremap_resource); ++ + /** + * platform_get_irq - get an IRQ for a device + * @dev: platform device +diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h +index 1a9f38f27f65..9e5c98fcea8c 100644 +--- a/include/linux/platform_device.h ++++ b/include/linux/platform_device.h +@@ -51,6 +51,9 @@ extern struct device platform_bus; + extern void arch_setup_pdev_archdata(struct platform_device *); + extern struct resource *platform_get_resource(struct platform_device *, + unsigned int, unsigned int); ++extern void __iomem * ++devm_platform_ioremap_resource(struct platform_device *pdev, ++ unsigned int index); + extern int platform_get_irq(struct platform_device *, unsigned int); + extern int platform_irq_count(struct platform_device *); + extern struct resource *platform_get_resource_byname(struct platform_device *, +-- +2.35.1 + diff --git a/queue-4.19/drivers-soc-ti-knav_qmss_queue-mark-knav_acc_firmwar.patch b/queue-4.19/drivers-soc-ti-knav_qmss_queue-mark-knav_acc_firmwar.patch new file mode 100644 index 00000000000..d8b7b14c0b1 --- /dev/null +++ b/queue-4.19/drivers-soc-ti-knav_qmss_queue-mark-knav_acc_firmwar.patch @@ -0,0 +1,42 @@ +From 45b3b6e4d13b81c515cd7b6b71a4ad727e96b9ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 23:32:12 +0800 +Subject: drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static + +From: Chen Jiahao + +[ Upstream commit adf85adc2a7199b41e7a4da083bd17274a3d6969 ] + +There is a sparse warning shown below: + +drivers/soc/ti/knav_qmss_queue.c:70:12: warning: symbol +'knav_acc_firmwares' was not declared. Should it be static? + +Since 'knav_acc_firmwares' is only called within knav_qmss_queue.c, +mark it as static to fix the warning. + +Fixes: 96ee19becc3b ("soc: ti: add firmware file name as part of the driver") +Signed-off-by: Chen Jiahao +Signed-off-by: Nishanth Menon +Link: https://lore.kernel.org/r/20221019153212.72350-1-chenjiahao16@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/knav_qmss_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index 9f5ce52e6c16..b264c36b2c0e 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -72,7 +72,7 @@ static DEFINE_MUTEX(knav_dev_lock); + * Newest followed by older ones. Search is done from start of the array + * until a firmware file is found. + */ +-const char *knav_acc_firmwares[] = {"ks2_qmss_pdsp_acc48.bin"}; ++static const char * const knav_acc_firmwares[] = {"ks2_qmss_pdsp_acc48.bin"}; + + static bool device_ready; + bool knav_qmss_device_ready(void) +-- +2.35.1 + diff --git a/queue-4.19/drm-amdgpu-fix-pci-device-refcount-leak-in-amdgpu_at.patch b/queue-4.19/drm-amdgpu-fix-pci-device-refcount-leak-in-amdgpu_at.patch new file mode 100644 index 00000000000..b5dfd640636 --- /dev/null +++ b/queue-4.19/drm-amdgpu-fix-pci-device-refcount-leak-in-amdgpu_at.patch @@ -0,0 +1,40 @@ +From d025190cf5d48bcad8fe1e6ad2a8c57ef1c3655d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 19:30:43 +0800 +Subject: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() + +From: Xiongfeng Wang + +[ Upstream commit ca54639c7752edf1304d92ff4d0c049d4efc9ba0 ] + +As comment of pci_get_class() says, it returns a pci_device with its +refcount increased and decreased the refcount for the input parameter +@from if it is not NULL. + +If we break the loop in amdgpu_atrm_get_bios() with 'pdev' not NULL, we +need to call pci_dev_put() to decrease the refcount. Add the missing +pci_dev_put() to avoid refcount leak. + +Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") +Signed-off-by: Xiongfeng Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c +index 6cf3dd5edffd..c1e2e9912bf0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c +@@ -312,6 +312,7 @@ static bool amdgpu_atrm_get_bios(struct amdgpu_device *adev) + + if (!found) + return false; ++ pci_dev_put(pdev); + + adev->bios = kmalloc(size, GFP_KERNEL); + if (!adev->bios) { +-- +2.35.1 + diff --git a/queue-4.19/drm-amdgpu-fix-type-of-second-parameter-in-trans_msg.patch b/queue-4.19/drm-amdgpu-fix-type-of-second-parameter-in-trans_msg.patch new file mode 100644 index 00000000000..ab1137dcdc6 --- /dev/null +++ b/queue-4.19/drm-amdgpu-fix-type-of-second-parameter-in-trans_msg.patch @@ -0,0 +1,66 @@ +From 23c922668b17bb9bf608c0a6d2979ac1b3c441c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 08:25:39 -0700 +Subject: drm/amdgpu: Fix type of second parameter in trans_msg() callback + +From: Nathan Chancellor + +[ Upstream commit f0d0f1087333714ee683cc134a95afe331d7ddd9 ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c:412:15: error: incompatible function pointer types initializing 'void (*)(struct amdgpu_device *, u32, u32, u32, u32)' (aka 'void (*)(struct amdgpu_device *, unsigned int, unsigned int, unsigned int, unsigned int)') with an expression of type 'void (struct amdgpu_device *, enum idh_request, u32, u32, u32)' (aka 'void (struct amdgpu_device *, enum idh_request, unsigned int, unsigned int, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict] + .trans_msg = xgpu_ai_mailbox_trans_msg, + ^~~~~~~~~~~~~~~~~~~~~~~~~ + 1 error generated. + + drivers/gpu/drm/amd/amdgpu/mxgpu_nv.c:435:15: error: incompatible function pointer types initializing 'void (*)(struct amdgpu_device *, u32, u32, u32, u32)' (aka 'void (*)(struct amdgpu_device *, unsigned int, unsigned int, unsigned int, unsigned int)') with an expression of type 'void (struct amdgpu_device *, enum idh_request, u32, u32, u32)' (aka 'void (struct amdgpu_device *, enum idh_request, unsigned int, unsigned int, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict] + .trans_msg = xgpu_nv_mailbox_trans_msg, + ^~~~~~~~~~~~~~~~~~~~~~~~~ + 1 error generated. + +The type of the second parameter in the prototype should be 'enum +idh_request' instead of 'u32'. Update it to clear up the warnings. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Reported-by: Sami Tolvanen +Reviewed-by: Kees Cook +Signed-off-by: Nathan Chancellor +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +index 880ac113a3a9..d26b6e36be02 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h +@@ -48,6 +48,8 @@ struct amdgpu_vf_error_buffer { + uint64_t data[AMDGPU_VF_ERROR_ENTRY_SIZE]; + }; + ++enum idh_request; ++ + /** + * struct amdgpu_virt_ops - amdgpu device virt operations + */ +@@ -56,7 +58,8 @@ struct amdgpu_virt_ops { + int (*rel_full_gpu)(struct amdgpu_device *adev, bool init); + int (*reset_gpu)(struct amdgpu_device *adev); + int (*wait_reset)(struct amdgpu_device *adev); +- void (*trans_msg)(struct amdgpu_device *adev, u32 req, u32 data1, u32 data2, u32 data3); ++ void (*trans_msg)(struct amdgpu_device *adev, enum idh_request req, ++ u32 data1, u32 data2, u32 data3); + }; + + /* +-- +2.35.1 + diff --git a/queue-4.19/drm-fsl-dcu-fix-return-type-of-fsl_dcu_drm_connector.patch b/queue-4.19/drm-fsl-dcu-fix-return-type-of-fsl_dcu_drm_connector.patch new file mode 100644 index 00000000000..5beb38e78d2 --- /dev/null +++ b/queue-4.19/drm-fsl-dcu-fix-return-type-of-fsl_dcu_drm_connector.patch @@ -0,0 +1,57 @@ +From 40bb5534143e3e2bc6d78c8f52e0a061b98d66d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 08:42:15 -0700 +Subject: drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid() + +From: Nathan Chancellor + +[ Upstream commit 96d845a67b7e406cfed7880a724c8ca6121e022e ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c:74:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .mode_valid = fsl_dcu_drm_connector_mode_valid, + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 1 error generated. + +->mode_valid() in 'struct drm_connector_helper_funcs' expects a return +type of 'enum drm_mode_status', not 'int'. Adjust the return type of +fsl_dcu_drm_connector_mode_valid() to match the prototype's to resolve +the warning and CFI failure. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Reported-by: Sami Tolvanen +Signed-off-by: Nathan Chancellor +Reviewed-by: Kees Cook +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20221102154215.78059-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c +index 2298ed2a9e1c..3c8c4a820e95 100644 +--- a/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_dcu_drm_rgb.c +@@ -83,8 +83,9 @@ static int fsl_dcu_drm_connector_get_modes(struct drm_connector *connector) + return num_modes; + } + +-static int fsl_dcu_drm_connector_mode_valid(struct drm_connector *connector, +- struct drm_display_mode *mode) ++static enum drm_mode_status ++fsl_dcu_drm_connector_mode_valid(struct drm_connector *connector, ++ struct drm_display_mode *mode) + { + if (mode->hdisplay & 0xf) + return MODE_ERROR; +-- +2.35.1 + diff --git a/queue-4.19/drm-radeon-add-the-missed-acpi_put_table-to-fix-memo.patch b/queue-4.19/drm-radeon-add-the-missed-acpi_put_table-to-fix-memo.patch new file mode 100644 index 00000000000..3fc3318b5cd --- /dev/null +++ b/queue-4.19/drm-radeon-add-the-missed-acpi_put_table-to-fix-memo.patch @@ -0,0 +1,86 @@ +From 2918817c59565eee9f9b1f67913a464c7d36167f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 17:50:02 +0800 +Subject: drm/radeon: Add the missed acpi_put_table() to fix memory leak + +From: Hanjun Guo + +[ Upstream commit 10276a20be1115e1f76c189330da2992df980eee ] + +When the radeon driver reads the bios information from ACPI +table in radeon_acpi_vfct_bios(), it misses to call acpi_put_table() +to release the ACPI memory after the init, so add acpi_put_table() +properly to fix the memory leak. + +v2: fix text formatting (Alex) + +Fixes: 268ba0a99f89 ("drm/radeon: implement ACPI VFCT vbios fetch (v3)") +Signed-off-by: Hanjun Guo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_bios.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c +index dd0528cf9818..8154d2d7fe9e 100644 +--- a/drivers/gpu/drm/radeon/radeon_bios.c ++++ b/drivers/gpu/drm/radeon/radeon_bios.c +@@ -608,13 +608,14 @@ static bool radeon_acpi_vfct_bios(struct radeon_device *rdev) + acpi_size tbl_size; + UEFI_ACPI_VFCT *vfct; + unsigned offset; ++ bool r = false; + + if (!ACPI_SUCCESS(acpi_get_table("VFCT", 1, &hdr))) + return false; + tbl_size = hdr->length; + if (tbl_size < sizeof(UEFI_ACPI_VFCT)) { + DRM_ERROR("ACPI VFCT table present but broken (too short #1)\n"); +- return false; ++ goto out; + } + + vfct = (UEFI_ACPI_VFCT *)hdr; +@@ -627,13 +628,13 @@ static bool radeon_acpi_vfct_bios(struct radeon_device *rdev) + offset += sizeof(VFCT_IMAGE_HEADER); + if (offset > tbl_size) { + DRM_ERROR("ACPI VFCT image header truncated\n"); +- return false; ++ goto out; + } + + offset += vhdr->ImageLength; + if (offset > tbl_size) { + DRM_ERROR("ACPI VFCT image truncated\n"); +- return false; ++ goto out; + } + + if (vhdr->ImageLength && +@@ -645,15 +646,18 @@ static bool radeon_acpi_vfct_bios(struct radeon_device *rdev) + rdev->bios = kmemdup(&vbios->VbiosContent, + vhdr->ImageLength, + GFP_KERNEL); ++ if (rdev->bios) ++ r = true; + +- if (!rdev->bios) +- return false; +- return true; ++ goto out; + } + } + + DRM_ERROR("ACPI VFCT table present but broken (too short #2)\n"); +- return false; ++ ++out: ++ acpi_put_table(hdr); ++ return r; + } + #else + static inline bool radeon_acpi_vfct_bios(struct radeon_device *rdev) +-- +2.35.1 + diff --git a/queue-4.19/drm-radeon-fix-pci-device-refcount-leak-in-radeon_at.patch b/queue-4.19/drm-radeon-fix-pci-device-refcount-leak-in-radeon_at.patch new file mode 100644 index 00000000000..0ab9780ad02 --- /dev/null +++ b/queue-4.19/drm-radeon-fix-pci-device-refcount-leak-in-radeon_at.patch @@ -0,0 +1,41 @@ +From 62f5aaeeb2a9a8d38f182db37a3335a75e72c264 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 19:30:42 +0800 +Subject: drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() + +From: Xiongfeng Wang + +[ Upstream commit 725a521a18734f65de05b8d353b5bd0d3ca4c37a ] + +As comment of pci_get_class() says, it returns a pci_device with its +refcount increased and decreased the refcount for the input parameter +@from if it is not NULL. + +If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we +need to call pci_dev_put() to decrease the refcount. Add the missing +pci_dev_put() to avoid refcount leak. + +Fixes: d8ade3526b2a ("drm/radeon: handle non-VGA class pci devices with ATRM") +Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)") +Signed-off-by: Xiongfeng Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_bios.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c +index 8154d2d7fe9e..0246edecc61f 100644 +--- a/drivers/gpu/drm/radeon/radeon_bios.c ++++ b/drivers/gpu/drm/radeon/radeon_bios.c +@@ -223,6 +223,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev) + + if (!found) + return false; ++ pci_dev_put(pdev); + + rdev->bios = kmalloc(size, GFP_KERNEL); + if (!rdev->bios) { +-- +2.35.1 + diff --git a/queue-4.19/drm-sti-fix-return-type-of-sti_-dvo-hda-hdmi-_connec.patch b/queue-4.19/drm-sti-fix-return-type-of-sti_-dvo-hda-hdmi-_connec.patch new file mode 100644 index 00000000000..7bd1e46b416 --- /dev/null +++ b/queue-4.19/drm-sti-fix-return-type-of-sti_-dvo-hda-hdmi-_connec.patch @@ -0,0 +1,95 @@ +From 7d68dede43f722102d4bb1532a94c179b233467b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 08:56:23 -0700 +Subject: drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() + +From: Nathan Chancellor + +[ Upstream commit 0ad811cc08a937d875cbad0149c1bab17f84ba05 ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/gpu/drm/sti/sti_hda.c:637:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .mode_valid = sti_hda_connector_mode_valid, + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/gpu/drm/sti/sti_dvo.c:376:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .mode_valid = sti_dvo_connector_mode_valid, + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/gpu/drm/sti/sti_hdmi.c:1035:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .mode_valid = sti_hdmi_connector_mode_valid, + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +->mode_valid() in 'struct drm_connector_helper_funcs' expects a return +type of 'enum drm_mode_status', not 'int'. Adjust the return type of +sti_{dvo,hda,hdmi}_connector_mode_valid() to match the prototype's to +resolve the warning and CFI failure. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Signed-off-by: Nathan Chancellor +Reviewed-by: Kees Cook +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20221102155623.3042869-1-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sti/sti_dvo.c | 5 +++-- + drivers/gpu/drm/sti/sti_hda.c | 5 +++-- + drivers/gpu/drm/sti/sti_hdmi.c | 5 +++-- + 3 files changed, 9 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/sti/sti_dvo.c b/drivers/gpu/drm/sti/sti_dvo.c +index a3f01721c552..794ac057a55c 100644 +--- a/drivers/gpu/drm/sti/sti_dvo.c ++++ b/drivers/gpu/drm/sti/sti_dvo.c +@@ -346,8 +346,9 @@ static int sti_dvo_connector_get_modes(struct drm_connector *connector) + + #define CLK_TOLERANCE_HZ 50 + +-static int sti_dvo_connector_mode_valid(struct drm_connector *connector, +- struct drm_display_mode *mode) ++static enum drm_mode_status ++sti_dvo_connector_mode_valid(struct drm_connector *connector, ++ struct drm_display_mode *mode) + { + int target = mode->clock * 1000; + int target_min = target - CLK_TOLERANCE_HZ; +diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c +index 33c9efa06f68..cf5b6dbe86b0 100644 +--- a/drivers/gpu/drm/sti/sti_hda.c ++++ b/drivers/gpu/drm/sti/sti_hda.c +@@ -596,8 +596,9 @@ static int sti_hda_connector_get_modes(struct drm_connector *connector) + + #define CLK_TOLERANCE_HZ 50 + +-static int sti_hda_connector_mode_valid(struct drm_connector *connector, +- struct drm_display_mode *mode) ++static enum drm_mode_status ++sti_hda_connector_mode_valid(struct drm_connector *connector, ++ struct drm_display_mode *mode) + { + int target = mode->clock * 1000; + int target_min = target - CLK_TOLERANCE_HZ; +diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c +index 3acf044ba366..c4bc09c9d0b5 100644 +--- a/drivers/gpu/drm/sti/sti_hdmi.c ++++ b/drivers/gpu/drm/sti/sti_hdmi.c +@@ -989,8 +989,9 @@ static int sti_hdmi_connector_get_modes(struct drm_connector *connector) + + #define CLK_TOLERANCE_HZ 50 + +-static int sti_hdmi_connector_mode_valid(struct drm_connector *connector, +- struct drm_display_mode *mode) ++static enum drm_mode_status ++sti_hdmi_connector_mode_valid(struct drm_connector *connector, ++ struct drm_display_mode *mode) + { + int target = mode->clock * 1000; + int target_min = target - CLK_TOLERANCE_HZ; +-- +2.35.1 + diff --git a/queue-4.19/drm-sti-use-drm_mode_copy.patch b/queue-4.19/drm-sti-use-drm_mode_copy.patch new file mode 100644 index 00000000000..4ab6efbee8c --- /dev/null +++ b/queue-4.19/drm-sti-use-drm_mode_copy.patch @@ -0,0 +1,121 @@ +From e54c80e31f19d3b2acc04047a0bca304d8961b10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 21:25:45 +0200 +Subject: drm/sti: Use drm_mode_copy() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +[ Upstream commit 442cf8e22ba25a77cb9092d78733fdbac9844e50 ] + +struct drm_display_mode embeds a list head, so overwriting +the full struct with another one will corrupt the list +(if the destination mode is on a list). Use drm_mode_copy() +instead which explicitly preserves the list head of +the destination mode. + +Even if we know the destination mode is not on any list +using drm_mode_copy() seems decent as it sets a good +example. Bad examples of not using it might eventually +get copied into code where preserving the list head +actually matters. + +Obviously one case not covered here is when the mode +itself is embedded in a larger structure and the whole +structure is copied. But if we are careful when copying +into modes embedded in structures I think we can be a +little more reassured that bogus list heads haven't been +propagated in. + +@is_mode_copy@ +@@ +drm_mode_copy(...) +{ +... +} + +@depends on !is_mode_copy@ +struct drm_display_mode *mode; +expression E, S; +@@ +( +- *mode = E ++ drm_mode_copy(mode, &E) +| +- memcpy(mode, E, S) ++ drm_mode_copy(mode, E) +) + +@depends on !is_mode_copy@ +struct drm_display_mode mode; +expression E; +@@ +( +- mode = E ++ drm_mode_copy(&mode, &E) +| +- memcpy(&mode, E, S) ++ drm_mode_copy(&mode, E) +) + +@@ +struct drm_display_mode *mode; +@@ +- &*mode ++ mode + +Cc: Alain Volmat +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20221107192545.9896-8-ville.syrjala@linux.intel.com +Reviewed-by: Daniel Vetter +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sti/sti_dvo.c | 2 +- + drivers/gpu/drm/sti/sti_hda.c | 2 +- + drivers/gpu/drm/sti/sti_hdmi.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/sti/sti_dvo.c b/drivers/gpu/drm/sti/sti_dvo.c +index b08376b7611b..a3f01721c552 100644 +--- a/drivers/gpu/drm/sti/sti_dvo.c ++++ b/drivers/gpu/drm/sti/sti_dvo.c +@@ -288,7 +288,7 @@ static void sti_dvo_set_mode(struct drm_bridge *bridge, + + DRM_DEBUG_DRIVER("\n"); + +- memcpy(&dvo->mode, mode, sizeof(struct drm_display_mode)); ++ drm_mode_copy(&dvo->mode, mode); + + /* According to the path used (main or aux), the dvo clocks should + * have a different parent clock. */ +diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c +index 19b9b5ed1297..33c9efa06f68 100644 +--- a/drivers/gpu/drm/sti/sti_hda.c ++++ b/drivers/gpu/drm/sti/sti_hda.c +@@ -518,7 +518,7 @@ static void sti_hda_set_mode(struct drm_bridge *bridge, + + DRM_DEBUG_DRIVER("\n"); + +- memcpy(&hda->mode, mode, sizeof(struct drm_display_mode)); ++ drm_mode_copy(&hda->mode, mode); + + if (!hda_get_mode_idx(hda->mode, &mode_idx)) { + DRM_ERROR("Undefined mode\n"); +diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c +index ccf718404a1c..3acf044ba366 100644 +--- a/drivers/gpu/drm/sti/sti_hdmi.c ++++ b/drivers/gpu/drm/sti/sti_hdmi.c +@@ -926,7 +926,7 @@ static void sti_hdmi_set_mode(struct drm_bridge *bridge, + DRM_DEBUG_DRIVER("\n"); + + /* Copy the drm display mode in the connector local structure */ +- memcpy(&hdmi->mode, mode, sizeof(struct drm_display_mode)); ++ drm_mode_copy(&hdmi->mode, mode); + + /* Update clock framerate according to the selected mode */ + ret = clk_set_rate(hdmi->clk_pix, mode->clock * 1000); +-- +2.35.1 + diff --git a/queue-4.19/drm-tegra-add-missing-clk_disable_unprepare-in-tegra.patch b/queue-4.19/drm-tegra-add-missing-clk_disable_unprepare-in-tegra.patch new file mode 100644 index 00000000000..4f050c566de --- /dev/null +++ b/queue-4.19/drm-tegra-add-missing-clk_disable_unprepare-in-tegra.patch @@ -0,0 +1,39 @@ +From 72fa317b1729af43bf53befaaacf65951e9ab7f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 08:50:50 +0000 +Subject: drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe() + +From: Zhang Zekun + +[ Upstream commit 7ad4384d53c67672a8720cdc2ef638d7d1710ab8 ] + +Add the missing clk_disable_unprepare() before return from +tegra_dc_probe() in the error handling path. + +Fixes: f68ba6912bd2 ("drm/tegra: dc: Link DC1 to DC0 on Tegra20") +Signed-off-by: Zhang Zekun +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/dc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c +index 03adb4cf325b..6c8b59a26675 100644 +--- a/drivers/gpu/drm/tegra/dc.c ++++ b/drivers/gpu/drm/tegra/dc.c +@@ -2376,8 +2376,10 @@ static int tegra_dc_probe(struct platform_device *pdev) + usleep_range(2000, 4000); + + err = reset_control_assert(dc->rst); +- if (err < 0) ++ if (err < 0) { ++ clk_disable_unprepare(dc->clk); + return err; ++ } + + usleep_range(2000, 4000); + +-- +2.35.1 + diff --git a/queue-4.19/ethernet-s2io-don-t-call-dev_kfree_skb-under-spin_lo.patch b/queue-4.19/ethernet-s2io-don-t-call-dev_kfree_skb-under-spin_lo.patch new file mode 100644 index 00000000000..74b371dcf5a --- /dev/null +++ b/queue-4.19/ethernet-s2io-don-t-call-dev_kfree_skb-under-spin_lo.patch @@ -0,0 +1,45 @@ +From 88450cab37947d76fa332dec1ca039f273fa3813 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 20:01:21 +0800 +Subject: ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 6cee96e09df54ae17784c0f38a49e0ed8229b825 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called in free_tx_buffers() to drop +the SKBs in tx buffers, when the card is down, so replace it with +dev_kfree_skb_irq() here. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/neterion/s2io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/neterion/s2io.c b/drivers/net/ethernet/neterion/s2io.c +index 0a8483c615d4..b42f81d0c6f0 100644 +--- a/drivers/net/ethernet/neterion/s2io.c ++++ b/drivers/net/ethernet/neterion/s2io.c +@@ -2375,7 +2375,7 @@ static void free_tx_buffers(struct s2io_nic *nic) + skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j); + if (skb) { + swstats->mem_freed += skb->truesize; +- dev_kfree_skb(skb); ++ dev_kfree_skb_irq(skb); + cnt++; + } + } +-- +2.35.1 + diff --git a/queue-4.19/eventfd-change-int-to-__u64-in-eventfd_signal-ifndef.patch b/queue-4.19/eventfd-change-int-to-__u64-in-eventfd_signal-ifndef.patch new file mode 100644 index 00000000000..cfb99ae93d3 --- /dev/null +++ b/queue-4.19/eventfd-change-int-to-__u64-in-eventfd_signal-ifndef.patch @@ -0,0 +1,41 @@ +From 094e8831794119591e2620a7b36468da2915ef6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 22:01:54 +0800 +Subject: eventfd: change int to __u64 in eventfd_signal() ifndef + CONFIG_EVENTFD + +From: Zhang Qilong + +[ Upstream commit fd4e60bf0ef8eb9edcfa12dda39e8b6ee9060492 ] + +Commit ee62c6b2dc93 ("eventfd: change int to __u64 in eventfd_signal()") +forgot to change int to __u64 in the CONFIG_EVENTFD=n stub function. + +Link: https://lkml.kernel.org/r/20221124140154.104680-1-zhangqilong3@huawei.com +Fixes: ee62c6b2dc93 ("eventfd: change int to __u64 in eventfd_signal()") +Signed-off-by: Zhang Qilong +Cc: Dylan Yudaken +Cc: Jens Axboe +Cc: Sha Zhengju +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/linux/eventfd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h +index dc4fd8a6644d..3482f9365a4d 100644 +--- a/include/linux/eventfd.h ++++ b/include/linux/eventfd.h +@@ -61,7 +61,7 @@ static inline struct eventfd_ctx *eventfd_ctx_fdget(int fd) + return ERR_PTR(-ENOSYS); + } + +-static inline int eventfd_signal(struct eventfd_ctx *ctx, int n) ++static inline int eventfd_signal(struct eventfd_ctx *ctx, __u64 n) + { + return -ENOSYS; + } +-- +2.35.1 + diff --git a/queue-4.19/f2fs-fix-normal-discard-process.patch b/queue-4.19/f2fs-fix-normal-discard-process.patch new file mode 100644 index 00000000000..743e6ce7b7c --- /dev/null +++ b/queue-4.19/f2fs-fix-normal-discard-process.patch @@ -0,0 +1,43 @@ +From a38f86d0281d6816b2d8e08b1705bbcabc0078f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 17:40:36 +0800 +Subject: f2fs: fix normal discard process + +From: Dongdong Zhang + +[ Upstream commit b5f1a218ae5e4339130d6e733f0e63d623e09a2c ] + +In the DPOLICY_BG mode, there is a conflict between +the two conditions "i + 1 < dpolicy->granularity" and +"i < DEFAULT_DISCARD_GRANULARITY". If i = 15, the first +condition is false, it will enter the second condition +and dispatch all small granularity discards in function + __issue_discard_cmd_orderly. The restrictive effect +of the first condition to small discards will be +invalidated. These two conditions should align. + +Fixes: 20ee4382322c ("f2fs: issue small discard by LBA order") +Signed-off-by: Dongdong Zhang +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 6fbf0471323e..7596fce92bef 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -1382,7 +1382,7 @@ static int __issue_discard_cmd(struct f2fs_sb_info *sbi, + if (i + 1 < dpolicy->granularity) + break; + +- if (i < DEFAULT_DISCARD_GRANULARITY && dpolicy->ordered) ++ if (i + 1 < DEFAULT_DISCARD_GRANULARITY && dpolicy->ordered) + return __issue_discard_cmd_orderly(sbi, dpolicy); + + pend_list = &dcc->pend_list[i]; +-- +2.35.1 + diff --git a/queue-4.19/fbdev-pm2fb-fix-missing-pci_disable_device.patch b/queue-4.19/fbdev-pm2fb-fix-missing-pci_disable_device.patch new file mode 100644 index 00000000000..0e0d294a2a2 --- /dev/null +++ b/queue-4.19/fbdev-pm2fb-fix-missing-pci_disable_device.patch @@ -0,0 +1,56 @@ +From d0b38c7add2d712b087fa665073ae03387134f7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Nov 2022 17:55:10 +0800 +Subject: fbdev: pm2fb: fix missing pci_disable_device() + +From: Yang Yingliang + +[ Upstream commit ed359a464846b48f76ea6cc5cd8257e545ac97f4 ] + +Add missing pci_disable_device() in error path of probe() and remove() path. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/pm2fb.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c +index 8ae010f07d7d..0ec4be2f2e8c 100644 +--- a/drivers/video/fbdev/pm2fb.c ++++ b/drivers/video/fbdev/pm2fb.c +@@ -1529,8 +1529,10 @@ static int pm2fb_probe(struct pci_dev *pdev, const struct pci_device_id *id) + } + + info = framebuffer_alloc(sizeof(struct pm2fb_par), &pdev->dev); +- if (!info) +- return -ENOMEM; ++ if (!info) { ++ err = -ENOMEM; ++ goto err_exit_disable; ++ } + default_par = info->par; + + switch (pdev->device) { +@@ -1711,6 +1713,8 @@ static int pm2fb_probe(struct pci_dev *pdev, const struct pci_device_id *id) + release_mem_region(pm2fb_fix.mmio_start, pm2fb_fix.mmio_len); + err_exit_neither: + framebuffer_release(info); ++ err_exit_disable: ++ pci_disable_device(pdev); + return retval; + } + +@@ -1737,6 +1741,7 @@ static void pm2fb_remove(struct pci_dev *pdev) + fb_dealloc_cmap(&info->cmap); + kfree(info->pixmap.addr); + framebuffer_release(info); ++ pci_disable_device(pdev); + } + + static const struct pci_device_id pm2fb_id_table[] = { +-- +2.35.1 + diff --git a/queue-4.19/fbdev-ssd1307fb-drop-optional-dependency.patch b/queue-4.19/fbdev-ssd1307fb-drop-optional-dependency.patch new file mode 100644 index 00000000000..3532b4e44d7 --- /dev/null +++ b/queue-4.19/fbdev-ssd1307fb-drop-optional-dependency.patch @@ -0,0 +1,38 @@ +From 51ee520918e7b992d6bc529bdada0d5f33219859 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 17:09:46 +0200 +Subject: fbdev: ssd1307fb: Drop optional dependency + +From: Andy Shevchenko + +[ Upstream commit 025e3b507a3a8e1ee96a3112bb67495c77d6cdb6 ] + +Only a single out of three devices need a PWM, so from driver it's +optional. Moreover it's a single driver in the entire kernel that +currently selects PWM. Unfortunately this selection is a root cause +of the circular dependencies when we want to enable optional PWM +for some other drivers that select GPIOLIB. + +Fixes: a2ed00da5047 ("drivers/video: add support for the Solomon SSD1307 OLED Controller") +Signed-off-by: Andy Shevchenko +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig +index 97c4319797d5..afb0c9e4d738 100644 +--- a/drivers/video/fbdev/Kconfig ++++ b/drivers/video/fbdev/Kconfig +@@ -2316,7 +2316,6 @@ config FB_SSD1307 + select FB_SYS_COPYAREA + select FB_SYS_IMAGEBLIT + select FB_DEFERRED_IO +- select PWM + select FB_BACKLIGHT + help + This driver implements support for the Solomon SSD1307 +-- +2.35.1 + diff --git a/queue-4.19/fbdev-uvesafb-fixes-an-error-handling-path-in-uvesaf.patch b/queue-4.19/fbdev-uvesafb-fixes-an-error-handling-path-in-uvesaf.patch new file mode 100644 index 00000000000..eef0f4eb59b --- /dev/null +++ b/queue-4.19/fbdev-uvesafb-fixes-an-error-handling-path-in-uvesaf.patch @@ -0,0 +1,39 @@ +From 997b4302941e778f6db114ce3bb3ef68322ad371 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Dec 2022 12:35:22 +0100 +Subject: fbdev: uvesafb: Fixes an error handling path in uvesafb_probe() + +From: Christophe JAILLET + +[ Upstream commit a94371040712031ba129c7e9d8ff04a06a2f8207 ] + +If an error occurs after a successful uvesafb_init_mtrr() call, it must be +undone by a corresponding arch_phys_wc_del() call, as already done in the +remove function. + +This has been added in the remove function in commit 63e28a7a5ffc +("uvesafb: Clean up MTRR code") + +Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core") +Signed-off-by: Christophe JAILLET +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/uvesafb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c +index 440a6636d8f0..f6ebca883912 100644 +--- a/drivers/video/fbdev/uvesafb.c ++++ b/drivers/video/fbdev/uvesafb.c +@@ -1755,6 +1755,7 @@ static int uvesafb_probe(struct platform_device *dev) + out_unmap: + iounmap(info->screen_base); + out_mem: ++ arch_phys_wc_del(par->mtrr_handle); + release_mem_region(info->fix.smem_start, info->fix.smem_len); + out_reg: + release_region(0x3c0, 32); +-- +2.35.1 + diff --git a/queue-4.19/fbdev-vermilion-decrease-reference-count-in-error-pa.patch b/queue-4.19/fbdev-vermilion-decrease-reference-count-in-error-pa.patch new file mode 100644 index 00000000000..110840b8f62 --- /dev/null +++ b/queue-4.19/fbdev-vermilion-decrease-reference-count-in-error-pa.patch @@ -0,0 +1,40 @@ +From 65c5628625fd4f63136fbe3ebc7ff4c941051271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 16:56:54 +0800 +Subject: fbdev: vermilion: decrease reference count in error path + +From: Xiongfeng Wang + +[ Upstream commit 001f2cdb952a9566c77fb4b5470cc361db5601bb ] + +pci_get_device() will increase the reference count for the returned +pci_dev. For the error path, we need to use pci_dev_put() to decrease +the reference count. + +Fixes: dbe7e429fedb ("vmlfb: framebuffer driver for Intel Vermilion Range") +Signed-off-by: Xiongfeng Wang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/vermilion/vermilion.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/vermilion/vermilion.c b/drivers/video/fbdev/vermilion/vermilion.c +index 5172fa581147..be5e43be528a 100644 +--- a/drivers/video/fbdev/vermilion/vermilion.c ++++ b/drivers/video/fbdev/vermilion/vermilion.c +@@ -291,8 +291,10 @@ static int vmlfb_get_gpu(struct vml_par *par) + + mutex_unlock(&vml_mutex); + +- if (pci_enable_device(par->gpu) < 0) ++ if (pci_enable_device(par->gpu) < 0) { ++ pci_dev_put(par->gpu); + return -ENODEV; ++ } + + return 0; + } +-- +2.35.1 + diff --git a/queue-4.19/fbdev-via-fix-error-in-via_core_init.patch b/queue-4.19/fbdev-via-fix-error-in-via_core_init.patch new file mode 100644 index 00000000000..4d6a7f42faa --- /dev/null +++ b/queue-4.19/fbdev-via-fix-error-in-via_core_init.patch @@ -0,0 +1,47 @@ +From 724623a43cf7da037a9a3a44b7e1a1fa04a0144b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 09:08:52 +0800 +Subject: fbdev: via: Fix error in via_core_init() + +From: Shang XiaoJing + +[ Upstream commit 5886b130de953cfb8826f7771ec8640a79934a7f ] + +via_core_init() won't exit the driver when pci_register_driver() failed. +Exit the viafb-i2c and the viafb-gpio in failed path to prevent error. + +VIA Graphics Integration Chipset framebuffer 2.4 initializing +Error: Driver 'viafb-i2c' is already registered, aborting... +Error: Driver 'viafb-gpio' is already registered, aborting... + +Fixes: 7582eb9be85f ("viafb: Turn GPIO and i2c into proper platform devices") +Signed-off-by: Shang XiaoJing +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/via/via-core.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/via/via-core.c b/drivers/video/fbdev/via/via-core.c +index b041eb27a9bf..3f74bc8af7b3 100644 +--- a/drivers/video/fbdev/via/via-core.c ++++ b/drivers/video/fbdev/via/via-core.c +@@ -774,7 +774,14 @@ static int __init via_core_init(void) + return ret; + viafb_i2c_init(); + viafb_gpio_init(); +- return pci_register_driver(&via_driver); ++ ret = pci_register_driver(&via_driver); ++ if (ret) { ++ viafb_gpio_exit(); ++ viafb_i2c_exit(); ++ return ret; ++ } ++ ++ return 0; + } + + static void __exit via_core_exit(void) +-- +2.35.1 + diff --git a/queue-4.19/fs-don-t-audit-the-capability-check-in-simple_xattr_.patch b/queue-4.19/fs-don-t-audit-the-capability-check-in-simple_xattr_.patch new file mode 100644 index 00000000000..95f8633f854 --- /dev/null +++ b/queue-4.19/fs-don-t-audit-the-capability-check-in-simple_xattr_.patch @@ -0,0 +1,54 @@ +From 4f1713a17db5ec867ad35dd5b07e763bb40d3150 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 16:12:05 +0100 +Subject: fs: don't audit the capability check in simple_xattr_list() + +From: Ondrej Mosnacek + +[ Upstream commit e7eda157c4071cd1e69f4b1687b0fbe1ae5e6f46 ] + +The check being unconditional may lead to unwanted denials reported by +LSMs when a process has the capability granted by DAC, but denied by an +LSM. In the case of SELinux such denials are a problem, since they can't +be effectively filtered out via the policy and when not silenced, they +produce noise that may hide a true problem or an attack. + +Checking for the capability only if any trusted xattr is actually +present wouldn't really address the issue, since calling listxattr(2) on +such node on its own doesn't indicate an explicit attempt to see the +trusted xattrs. Additionally, it could potentially leak the presence of +trusted xattrs to an unprivileged user if they can check for the denials +(e.g. through dmesg). + +Therefore, it's best (and simplest) to keep the check unconditional and +instead use ns_capable_noaudit() that will silence any associated LSM +denials. + +Fixes: 38f38657444d ("xattr: extract simple_xattr code from tmpfs") +Reported-by: Martin Pitt +Suggested-by: Christian Brauner (Microsoft) +Signed-off-by: Ondrej Mosnacek +Reviewed-by: Christian Brauner (Microsoft) +Reviewed-by: Paul Moore +Signed-off-by: Christian Brauner (Microsoft) +Signed-off-by: Sasha Levin +--- + fs/xattr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xattr.c b/fs/xattr.c +index 470ee0af3200..5c3407e18e15 100644 +--- a/fs/xattr.c ++++ b/fs/xattr.c +@@ -1012,7 +1012,7 @@ static int xattr_list_one(char **buffer, ssize_t *remaining_size, + ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, + char *buffer, size_t size) + { +- bool trusted = capable(CAP_SYS_ADMIN); ++ bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); + struct simple_xattr *xattr; + ssize_t remaining_size = size; + int err = 0; +-- +2.35.1 + diff --git a/queue-4.19/fs-jfs-fix-shift-out-of-bounds-in-dballocag.patch b/queue-4.19/fs-jfs-fix-shift-out-of-bounds-in-dballocag.patch new file mode 100644 index 00000000000..dc73767284c --- /dev/null +++ b/queue-4.19/fs-jfs-fix-shift-out-of-bounds-in-dballocag.patch @@ -0,0 +1,90 @@ +From 9608aa3f1dccfbb6954b96e1a3d75a2a78ef400c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 08:48:07 -0500 +Subject: fs: jfs: fix shift-out-of-bounds in dbAllocAG + +From: Dongliang Mu + +[ Upstream commit 898f706695682b9954f280d95e49fa86ffa55d08 ] + +Syzbot found a crash : UBSAN: shift-out-of-bounds in dbAllocAG. The +underlying bug is the missing check of bmp->db_agl2size. The field can +be greater than 64 and trigger the shift-out-of-bounds. + +Fix this bug by adding a check of bmp->db_agl2size in dbMount since this +field is used in many following functions. The upper bound for this +field is L2MAXL2SIZE - L2MAXAG, thanks for the help of Dave Kleikamp. +Note that, for maintenance, I reorganized error handling code of dbMount. + +Reported-by: syzbot+15342c1aa6a00fb7a438@syzkaller.appspotmail.com +Signed-off-by: Dongliang Mu +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 1014f2a24697..4f72f7dee78b 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -168,7 +168,7 @@ int dbMount(struct inode *ipbmap) + struct bmap *bmp; + struct dbmap_disk *dbmp_le; + struct metapage *mp; +- int i; ++ int i, err; + + /* + * allocate/initialize the in-memory bmap descriptor +@@ -183,8 +183,8 @@ int dbMount(struct inode *ipbmap) + BMAPBLKNO << JFS_SBI(ipbmap->i_sb)->l2nbperpage, + PSIZE, 0); + if (mp == NULL) { +- kfree(bmp); +- return -EIO; ++ err = -EIO; ++ goto err_kfree_bmp; + } + + /* copy the on-disk bmap descriptor to its in-memory version. */ +@@ -194,9 +194,8 @@ int dbMount(struct inode *ipbmap) + bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); + bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); + if (!bmp->db_numag) { +- release_metapage(mp); +- kfree(bmp); +- return -EINVAL; ++ err = -EINVAL; ++ goto err_release_metapage; + } + + bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); +@@ -207,6 +206,11 @@ int dbMount(struct inode *ipbmap) + bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth); + bmp->db_agstart = le32_to_cpu(dbmp_le->dn_agstart); + bmp->db_agl2size = le32_to_cpu(dbmp_le->dn_agl2size); ++ if (bmp->db_agl2size > L2MAXL2SIZE - L2MAXAG) { ++ err = -EINVAL; ++ goto err_release_metapage; ++ } ++ + for (i = 0; i < MAXAG; i++) + bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]); + bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize); +@@ -227,6 +231,12 @@ int dbMount(struct inode *ipbmap) + BMAP_LOCK_INIT(bmp); + + return (0); ++ ++err_release_metapage: ++ release_metapage(mp); ++err_kfree_bmp: ++ kfree(bmp); ++ return err; + } + + +-- +2.35.1 + diff --git a/queue-4.19/fs-jfs-fix-shift-out-of-bounds-in-dbdiscardag.patch b/queue-4.19/fs-jfs-fix-shift-out-of-bounds-in-dbdiscardag.patch new file mode 100644 index 00000000000..8ddca9a0c8b --- /dev/null +++ b/queue-4.19/fs-jfs-fix-shift-out-of-bounds-in-dbdiscardag.patch @@ -0,0 +1,39 @@ +From 3d338801e30ddef66e66b6120b88a534411a402b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Oct 2022 23:20:45 +0800 +Subject: fs: jfs: fix shift-out-of-bounds in dbDiscardAG + +From: Hoi Pok Wu + +[ Upstream commit 25e70c6162f207828dd405b432d8f2a98dbf7082 ] + +This should be applied to most URSAN bugs found recently by syzbot, +by guarding the dbMount. As syzbot feeding rubbish into the bmap +descriptor. + +Signed-off-by: Hoi Pok Wu +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 4f72f7dee78b..f06796cad9aa 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -211,6 +211,11 @@ int dbMount(struct inode *ipbmap) + goto err_release_metapage; + } + ++ if (((bmp->db_mapsize - 1) >> bmp->db_agl2size) > MAXAG) { ++ err = -EINVAL; ++ goto err_release_metapage; ++ } ++ + for (i = 0; i < MAXAG; i++) + bmp->db_agfree[i] = le64_to_cpu(dbmp_le->dn_agfree[i]); + bmp->db_agsize = le64_to_cpu(dbmp_le->dn_agsize); +-- +2.35.1 + diff --git a/queue-4.19/fs-sysv-fix-sysv_nblocks-returns-wrong-value.patch b/queue-4.19/fs-sysv-fix-sysv_nblocks-returns-wrong-value.patch new file mode 100644 index 00000000000..4b336befc76 --- /dev/null +++ b/queue-4.19/fs-sysv-fix-sysv_nblocks-returns-wrong-value.patch @@ -0,0 +1,42 @@ +From 6819caa251b3fd7a7ff80dab6dcc042ae5915d34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 18:04:48 +0800 +Subject: fs: sysv: Fix sysv_nblocks() returns wrong value + +From: Chen Zhongjin + +[ Upstream commit e0c49bd2b4d3cd1751491eb2d940bce968ac65e9 ] + +sysv_nblocks() returns 'blocks' rather than 'res', which only counting +the number of triple-indirect blocks and causing sysv_getattr() gets a +wrong result. + +[AV: this is actually a sysv counterpart of minixfs fix - +0fcd426de9d0 "[PATCH] minix block usage counting fix" in +historical tree; mea culpa, should've thought to check +fs/sysv back then...] + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Chen Zhongjin +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/sysv/itree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/sysv/itree.c b/fs/sysv/itree.c +index bcb67b0cabe7..31f66053e239 100644 +--- a/fs/sysv/itree.c ++++ b/fs/sysv/itree.c +@@ -438,7 +438,7 @@ static unsigned sysv_nblocks(struct super_block *s, loff_t size) + res += blocks; + direct = 1; + } +- return blocks; ++ return res; + } + + int sysv_getattr(const struct path *path, struct kstat *stat, +-- +2.35.1 + diff --git a/queue-4.19/hamradio-baycom_epp-fix-return-type-of-baycom_send_p.patch b/queue-4.19/hamradio-baycom_epp-fix-return-type-of-baycom_send_p.patch new file mode 100644 index 00000000000..0dc7e0c580b --- /dev/null +++ b/queue-4.19/hamradio-baycom_epp-fix-return-type-of-baycom_send_p.patch @@ -0,0 +1,52 @@ +From 763684053035814b37ca14904ba68d597de1e42e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 09:06:10 -0700 +Subject: hamradio: baycom_epp: Fix return type of baycom_send_packet() + +From: Nathan Chancellor + +[ Upstream commit c5733e5b15d91ab679646ec3149e192996a27d5d ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/net/hamradio/baycom_epp.c:1119:25: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .ndo_start_xmit = baycom_send_packet, + ^~~~~~~~~~~~~~~~~~ + 1 error generated. + +->ndo_start_xmit() in 'struct net_device_ops' expects a return type of +'netdev_tx_t', not 'int'. Adjust the return type of baycom_send_packet() +to match the prototype's to resolve the warning and CFI failure. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Signed-off-by: Nathan Chancellor +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20221102160610.1186145-1-nathan@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/hamradio/baycom_epp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/hamradio/baycom_epp.c b/drivers/net/hamradio/baycom_epp.c +index 1e62d00732f2..787eaf3f4f13 100644 +--- a/drivers/net/hamradio/baycom_epp.c ++++ b/drivers/net/hamradio/baycom_epp.c +@@ -772,7 +772,7 @@ static void epp_bh(struct work_struct *work) + * ===================== network driver interface ========================= + */ + +-static int baycom_send_packet(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t baycom_send_packet(struct sk_buff *skb, struct net_device *dev) + { + struct baycom_state *bc = netdev_priv(dev); + +-- +2.35.1 + diff --git a/queue-4.19/hamradio-don-t-call-dev_kfree_skb-under-spin_lock_ir.patch b/queue-4.19/hamradio-don-t-call-dev_kfree_skb-under-spin_lock_ir.patch new file mode 100644 index 00000000000..27585567595 --- /dev/null +++ b/queue-4.19/hamradio-don-t-call-dev_kfree_skb-under-spin_lock_ir.patch @@ -0,0 +1,62 @@ +From 20f2c94a044322eb11c1208891681414494249ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 22:21:46 +0800 +Subject: hamradio: don't call dev_kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 3727f742915f04f6fc550b80cf406999bd4e90d0 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In scc_discard_buffers(), dev_kfree_skb() is called to discard the SKBs, +so replace it with dev_kfree_skb_irq(). + +In scc_net_tx(), dev_kfree_skb() is called to drop the SKB that exceed +queue length, so replace it with dev_kfree_skb_irq(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hamradio/scc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c +index 6c03932d8a6b..3dc4eb841aa1 100644 +--- a/drivers/net/hamradio/scc.c ++++ b/drivers/net/hamradio/scc.c +@@ -300,12 +300,12 @@ static inline void scc_discard_buffers(struct scc_channel *scc) + spin_lock_irqsave(&scc->lock, flags); + if (scc->tx_buff != NULL) + { +- dev_kfree_skb(scc->tx_buff); ++ dev_kfree_skb_irq(scc->tx_buff); + scc->tx_buff = NULL; + } + + while (!skb_queue_empty(&scc->tx_queue)) +- dev_kfree_skb(skb_dequeue(&scc->tx_queue)); ++ dev_kfree_skb_irq(skb_dequeue(&scc->tx_queue)); + + spin_unlock_irqrestore(&scc->lock, flags); + } +@@ -1667,7 +1667,7 @@ static netdev_tx_t scc_net_tx(struct sk_buff *skb, struct net_device *dev) + if (skb_queue_len(&scc->tx_queue) > scc->dev->tx_queue_len) { + struct sk_buff *skb_del; + skb_del = skb_dequeue(&scc->tx_queue); +- dev_kfree_skb(skb_del); ++ dev_kfree_skb_irq(skb_del); + } + skb_queue_tail(&scc->tx_queue, skb); + netif_trans_update(dev); +-- +2.35.1 + diff --git a/queue-4.19/hfs-fix-oob-read-in-__hfs_brec_find.patch b/queue-4.19/hfs-fix-oob-read-in-__hfs_brec_find.patch new file mode 100644 index 00000000000..5239a0ac985 --- /dev/null +++ b/queue-4.19/hfs-fix-oob-read-in-__hfs_brec_find.patch @@ -0,0 +1,81 @@ +From dadd81a48f49331c8e371d40548879a9c54cf1fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 06:59:59 +0000 +Subject: hfs: fix OOB Read in __hfs_brec_find + +From: ZhangPeng + +[ Upstream commit 8d824e69d9f3fa3121b2dda25053bae71e2460d2 ] + +Syzbot reported a OOB read bug: + +================================================================== +BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 +fs/hfs/string.c:84 +Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 +CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted +6.1.0-rc6-syzkaller-00308-g644e9524388a #0 +Workqueue: writeback wb_workfn (flush-7:0) +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 + print_address_description+0x74/0x340 mm/kasan/report.c:284 + print_report+0x107/0x1f0 mm/kasan/report.c:395 + kasan_report+0xcd/0x100 mm/kasan/report.c:495 + hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 + __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75 + hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138 + hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462 + write_inode fs/fs-writeback.c:1440 [inline] + +If the input inode of hfs_write_inode() is incorrect: +struct inode + struct hfs_inode_info + struct hfs_cat_key + struct hfs_name + u8 len # len is greater than HFS_NAMELEN(31) which is the +maximum length of an HFS filename + +OOB read occurred: +hfs_write_inode() + hfs_brec_find() + __hfs_brec_find() + hfs_cat_keycmp() + hfs_strcmp() # OOB read occurred due to len is too large + +Fix this by adding a Check on len in hfs_write_inode() before calling +hfs_brec_find(). + +Link: https://lkml.kernel.org/r/20221130065959.2168236-1-zhangpeng362@huawei.com +Signed-off-by: ZhangPeng +Reported-by: +Cc: Damien Le Moal +Cc: Ira Weiny +Cc: Jeff Layton +Cc: Kefeng Wang +Cc: Matthew Wilcox +Cc: Nanyong Sun +Cc: Viacheslav Dubeyko +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/hfs/inode.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/hfs/inode.c b/fs/hfs/inode.c +index da243c84e93b..9c5badc9db00 100644 +--- a/fs/hfs/inode.c ++++ b/fs/hfs/inode.c +@@ -453,6 +453,8 @@ int hfs_write_inode(struct inode *inode, struct writeback_control *wbc) + /* panic? */ + return -EIO; + ++ if (HFS_I(main_inode)->cat_key.CName.len > HFS_NAMELEN) ++ return -EIO; + fd.search_key->cat = HFS_I(main_inode)->cat_key; + if (hfs_brec_find(&fd)) + /* panic? */ +-- +2.35.1 + diff --git a/queue-4.19/hfs-fix-oob-write-in-hfs_asc2mac.patch b/queue-4.19/hfs-fix-oob-write-in-hfs_asc2mac.patch new file mode 100644 index 00000000000..cf446c669e1 --- /dev/null +++ b/queue-4.19/hfs-fix-oob-write-in-hfs_asc2mac.patch @@ -0,0 +1,66 @@ +From c1951d9abeacbde4b8683600ffb681c89e4767f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 03:00:38 +0000 +Subject: hfs: Fix OOB Write in hfs_asc2mac + +From: ZhangPeng + +[ Upstream commit c53ed55cb275344086e32a7080a6b19cb183650b ] + +Syzbot reported a OOB Write bug: + +loop0: detected capacity change from 0 to 64 +================================================================== +BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0 +fs/hfs/trans.c:133 +Write of size 1 at addr ffff88801848314e by task syz-executor391/3632 + +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 + print_address_description+0x74/0x340 mm/kasan/report.c:284 + print_report+0x107/0x1f0 mm/kasan/report.c:395 + kasan_report+0xcd/0x100 mm/kasan/report.c:495 + hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 + hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28 + hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31 + lookup_open fs/namei.c:3391 [inline] + open_last_lookups fs/namei.c:3481 [inline] + path_openat+0x10e6/0x2df0 fs/namei.c:3710 + do_filp_open+0x264/0x4f0 fs/namei.c:3740 + +If in->len is much larger than HFS_NAMELEN(31) which is the maximum +length of an HFS filename, a OOB write could occur in hfs_asc2mac(). In +that case, when the dst reaches the boundary, the srclen is still +greater than 0, which causes a OOB write. +Fix this by adding a check on dstlen in while() before writing to dst +address. + +Link: https://lkml.kernel.org/r/20221202030038.1391945-1-zhangpeng362@huawei.com +Fixes: 328b92278650 ("[PATCH] hfs: NLS support") +Signed-off-by: ZhangPeng +Reviewed-by: Viacheslav Dubeyko +Reported-by: +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/hfs/trans.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/hfs/trans.c b/fs/hfs/trans.c +index 39f5e343bf4d..fdb0edb8a607 100644 +--- a/fs/hfs/trans.c ++++ b/fs/hfs/trans.c +@@ -109,7 +109,7 @@ void hfs_asc2mac(struct super_block *sb, struct hfs_name *out, const struct qstr + if (nls_io) { + wchar_t ch; + +- while (srclen > 0) { ++ while (srclen > 0 && dstlen > 0) { + size = nls_io->char2uni(src, srclen, &ch); + if (size < 0) { + ch = '?'; +-- +2.35.1 + diff --git a/queue-4.19/hid-hid-sensor-custom-set-fixed-size-for-custom-attr.patch b/queue-4.19/hid-hid-sensor-custom-set-fixed-size-for-custom-attr.patch new file mode 100644 index 00000000000..cd0e389cff9 --- /dev/null +++ b/queue-4.19/hid-hid-sensor-custom-set-fixed-size-for-custom-attr.patch @@ -0,0 +1,48 @@ +From 0985bbe6909a0ffd7cef5ccb77911ec3ded9e5e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 13:13:26 +0100 +Subject: HID: hid-sensor-custom: set fixed size for custom attributes + +From: Marcus Folkesson + +[ Upstream commit 9d013910df22de91333a0acc81d1dbb115bd76f6 ] + +This is no bugfix (so no Fixes: tag is necessary) as it is +taken care of in hid_sensor_custom_add_attributes(). + +The motivation for this patch is that: +hid_sensor_custom_field.attr_name and +hid_sensor_custom_field.attrs +has the size of HID_CUSTOM_TOTAL_ATTRS and used in same context. + +We compare against HID_CUSTOM_TOTAL_ATTRS when +looping through hid_custom_attrs. + +We will silent the smatch error: +hid_sensor_custom_add_attributes() error: buffer overflow +'hid_custom_attrs' 8 <= 10 + +Signed-off-by: Marcus Folkesson +Acked-by: Jonathan Cameron +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-sensor-custom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c +index bb012bc032e0..a0c30863e1e0 100644 +--- a/drivers/hid/hid-sensor-custom.c ++++ b/drivers/hid/hid-sensor-custom.c +@@ -67,7 +67,7 @@ struct hid_sensor_sample { + u32 raw_len; + } __packed; + +-static struct attribute hid_custom_attrs[] = { ++static struct attribute hid_custom_attrs[HID_CUSTOM_TOTAL_ATTRS] = { + {.name = "name", .mode = S_IRUGO}, + {.name = "units", .mode = S_IRUGO}, + {.name = "unit-expo", .mode = S_IRUGO}, +-- +2.35.1 + diff --git a/queue-4.19/hsi-omap_ssi_core-fix-error-handling-in-ssi_init.patch b/queue-4.19/hsi-omap_ssi_core-fix-error-handling-in-ssi_init.patch new file mode 100644 index 00000000000..7bc7a714072 --- /dev/null +++ b/queue-4.19/hsi-omap_ssi_core-fix-error-handling-in-ssi_init.patch @@ -0,0 +1,45 @@ +From 90c8adf0089cd5088b9aeb37cc8022c435a4164c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 11:33:32 +0000 +Subject: HSI: omap_ssi_core: Fix error handling in ssi_init() + +From: Yuan Can + +[ Upstream commit 3ffa9f713c39a213a08d9ff13ab983a8aa5d8b5d ] + +The ssi_init() returns the platform_driver_register() directly without +checking its return value, if platform_driver_register() failed, the +ssi_pdriver is not unregistered. +Fix by unregister ssi_pdriver when the last platform_driver_register() +failed. + +Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module") +Signed-off-by: Yuan Can +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/controllers/omap_ssi_core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c +index 2f1a576fa8b7..6595f34e51aa 100644 +--- a/drivers/hsi/controllers/omap_ssi_core.c ++++ b/drivers/hsi/controllers/omap_ssi_core.c +@@ -667,7 +667,13 @@ static int __init ssi_init(void) { + if (ret) + return ret; + +- return platform_driver_register(&ssi_port_pdriver); ++ ret = platform_driver_register(&ssi_port_pdriver); ++ if (ret) { ++ platform_driver_unregister(&ssi_pdriver); ++ return ret; ++ } ++ ++ return 0; + } + module_init(ssi_init); + +-- +2.35.1 + diff --git a/queue-4.19/hsi-omap_ssi_core-fix-possible-memory-leak-in-ssi_pr.patch b/queue-4.19/hsi-omap_ssi_core-fix-possible-memory-leak-in-ssi_pr.patch new file mode 100644 index 00000000000..cd18ce6d7eb --- /dev/null +++ b/queue-4.19/hsi-omap_ssi_core-fix-possible-memory-leak-in-ssi_pr.patch @@ -0,0 +1,41 @@ +From cd2d1600f6b7bee04c2ae5e0a116780789bac216 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Oct 2022 15:43:37 +0800 +Subject: HSI: omap_ssi_core: fix possible memory leak in ssi_probe() + +From: Yang Yingliang + +[ Upstream commit 1aff514e1d2bd47854dbbdf867970b9d463d4c57 ] + +If ssi_add_controller() returns error, it should call hsi_put_controller() +to give up the reference that was set in hsi_alloc_controller(), so that +it can call hsi_controller_release() to free controller and ports that +allocated in hsi_alloc_controller(). + +Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver") +Signed-off-by: Yang Yingliang +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/controllers/omap_ssi_core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c +index b91a6b6c0d7a..2f1a576fa8b7 100644 +--- a/drivers/hsi/controllers/omap_ssi_core.c ++++ b/drivers/hsi/controllers/omap_ssi_core.c +@@ -538,8 +538,10 @@ static int ssi_probe(struct platform_device *pd) + platform_set_drvdata(pd, ssi); + + err = ssi_add_controller(ssi, pd); +- if (err < 0) ++ if (err < 0) { ++ hsi_put_controller(ssi); + goto out1; ++ } + + pm_runtime_enable(&pd->dev); + +-- +2.35.1 + diff --git a/queue-4.19/hsi-omap_ssi_core-fix-unbalanced-pm_runtime_disable.patch b/queue-4.19/hsi-omap_ssi_core-fix-unbalanced-pm_runtime_disable.patch new file mode 100644 index 00000000000..eeb22fe91f2 --- /dev/null +++ b/queue-4.19/hsi-omap_ssi_core-fix-unbalanced-pm_runtime_disable.patch @@ -0,0 +1,38 @@ +From 3de7b4ae30bcbdaeff018cbeadb7219a638362ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 11:41:18 +0800 +Subject: HSI: omap_ssi_core: fix unbalanced pm_runtime_disable() + +From: Yang Yingliang + +[ Upstream commit f5181c35ed7ba0ceb6e42872aad1334d994b0175 ] + +In error label 'out1' path in ssi_probe(), the pm_runtime_enable() +has not been called yet, so pm_runtime_disable() is not needed. + +Fixes: b209e047bc74 ("HSI: Introduce OMAP SSI driver") +Signed-off-by: Yang Yingliang +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/controllers/omap_ssi_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c +index 15ecc4bc8de6..b91a6b6c0d7a 100644 +--- a/drivers/hsi/controllers/omap_ssi_core.c ++++ b/drivers/hsi/controllers/omap_ssi_core.c +@@ -572,9 +572,9 @@ static int ssi_probe(struct platform_device *pd) + device_for_each_child(&pd->dev, NULL, ssi_remove_ports); + out2: + ssi_remove_controller(ssi); ++ pm_runtime_disable(&pd->dev); + out1: + platform_set_drvdata(pd, NULL); +- pm_runtime_disable(&pd->dev); + + return err; + } +-- +2.35.1 + diff --git a/queue-4.19/hwrng-amd-fix-pci-device-refcount-leak.patch b/queue-4.19/hwrng-amd-fix-pci-device-refcount-leak.patch new file mode 100644 index 00000000000..e886e9a4dfa --- /dev/null +++ b/queue-4.19/hwrng-amd-fix-pci-device-refcount-leak.patch @@ -0,0 +1,76 @@ +From 6811e0c4de12e7c52241c0fac7b58fede631ea67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 21:22:33 +0800 +Subject: hwrng: amd - Fix PCI device refcount leak + +From: Xiongfeng Wang + +[ Upstream commit ecadb5b0111ea19fc7c240bb25d424a94471eb7d ] + +for_each_pci_dev() is implemented by pci_get_device(). The comment of +pci_get_device() says that it will increase the reference count for the +returned pci_dev and also decrease the reference count for the input +pci_dev @from if it is not NULL. + +If we break for_each_pci_dev() loop with pdev not NULL, we need to call +pci_dev_put() to decrease the reference count. Add the missing +pci_dev_put() for the normal and error path. + +Fixes: 96d63c0297cc ("[PATCH] Add AMD HW RNG driver") +Signed-off-by: Xiongfeng Wang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/amd-rng.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/char/hw_random/amd-rng.c b/drivers/char/hw_random/amd-rng.c +index 9959c762da2f..db3dd467194c 100644 +--- a/drivers/char/hw_random/amd-rng.c ++++ b/drivers/char/hw_random/amd-rng.c +@@ -143,15 +143,19 @@ static int __init mod_init(void) + found: + err = pci_read_config_dword(pdev, 0x58, &pmbase); + if (err) +- return err; ++ goto put_dev; + + pmbase &= 0x0000FF00; +- if (pmbase == 0) +- return -EIO; ++ if (pmbase == 0) { ++ err = -EIO; ++ goto put_dev; ++ } + + priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; ++ if (!priv) { ++ err = -ENOMEM; ++ goto put_dev; ++ } + + if (!request_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE, DRV_NAME)) { + dev_err(&pdev->dev, DRV_NAME " region 0x%x already in use!\n", +@@ -185,6 +189,8 @@ static int __init mod_init(void) + release_region(pmbase + PMBASE_OFFSET, PMBASE_SIZE); + out: + kfree(priv); ++put_dev: ++ pci_dev_put(pdev); + return err; + } + +@@ -200,6 +206,8 @@ static void __exit mod_exit(void) + + release_region(priv->pmbase + PMBASE_OFFSET, PMBASE_SIZE); + ++ pci_dev_put(priv->pcidev); ++ + kfree(priv); + } + +-- +2.35.1 + diff --git a/queue-4.19/hwrng-geode-fix-pci-device-refcount-leak.patch b/queue-4.19/hwrng-geode-fix-pci-device-refcount-leak.patch new file mode 100644 index 00000000000..6a68c2ae775 --- /dev/null +++ b/queue-4.19/hwrng-geode-fix-pci-device-refcount-leak.patch @@ -0,0 +1,115 @@ +From 0832cef9bf94f423fb71aedcdb9ea7bdef668cf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 21:22:34 +0800 +Subject: hwrng: geode - Fix PCI device refcount leak + +From: Xiongfeng Wang + +[ Upstream commit 9f6ec8dc574efb7f4f3d7ee9cd59ae307e78f445 ] + +for_each_pci_dev() is implemented by pci_get_device(). The comment of +pci_get_device() says that it will increase the reference count for the +returned pci_dev and also decrease the reference count for the input +pci_dev @from if it is not NULL. + +If we break for_each_pci_dev() loop with pdev not NULL, we need to call +pci_dev_put() to decrease the reference count. We add a new struct +'amd_geode_priv' to record pointer of the pci_dev and membase, and then +add missing pci_dev_put() for the normal and error path. + +Fixes: ef5d862734b8 ("[PATCH] Add Geode HW RNG driver") +Signed-off-by: Xiongfeng Wang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/geode-rng.c | 36 +++++++++++++++++++++++------- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/char/hw_random/geode-rng.c b/drivers/char/hw_random/geode-rng.c +index e1d421a36a13..207272979f23 100644 +--- a/drivers/char/hw_random/geode-rng.c ++++ b/drivers/char/hw_random/geode-rng.c +@@ -51,6 +51,10 @@ static const struct pci_device_id pci_tbl[] = { + }; + MODULE_DEVICE_TABLE(pci, pci_tbl); + ++struct amd_geode_priv { ++ struct pci_dev *pcidev; ++ void __iomem *membase; ++}; + + static int geode_rng_data_read(struct hwrng *rng, u32 *data) + { +@@ -90,6 +94,7 @@ static int __init mod_init(void) + const struct pci_device_id *ent; + void __iomem *mem; + unsigned long rng_base; ++ struct amd_geode_priv *priv; + + for_each_pci_dev(pdev) { + ent = pci_match_id(pci_tbl, pdev); +@@ -97,17 +102,26 @@ static int __init mod_init(void) + goto found; + } + /* Device not found. */ +- goto out; ++ return err; + + found: ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) { ++ err = -ENOMEM; ++ goto put_dev; ++ } ++ + rng_base = pci_resource_start(pdev, 0); + if (rng_base == 0) +- goto out; ++ goto free_priv; + err = -ENOMEM; + mem = ioremap(rng_base, 0x58); + if (!mem) +- goto out; +- geode_rng.priv = (unsigned long)mem; ++ goto free_priv; ++ ++ geode_rng.priv = (unsigned long)priv; ++ priv->membase = mem; ++ priv->pcidev = pdev; + + pr_info("AMD Geode RNG detected\n"); + err = hwrng_register(&geode_rng); +@@ -116,20 +130,26 @@ static int __init mod_init(void) + err); + goto err_unmap; + } +-out: + return err; + + err_unmap: + iounmap(mem); +- goto out; ++free_priv: ++ kfree(priv); ++put_dev: ++ pci_dev_put(pdev); ++ return err; + } + + static void __exit mod_exit(void) + { +- void __iomem *mem = (void __iomem *)geode_rng.priv; ++ struct amd_geode_priv *priv; + ++ priv = (struct amd_geode_priv *)geode_rng.priv; + hwrng_unregister(&geode_rng); +- iounmap(mem); ++ iounmap(priv->membase); ++ pci_dev_put(priv->pcidev); ++ kfree(priv); + } + + module_init(mod_init); +-- +2.35.1 + diff --git a/queue-4.19/i2c-ismt-fix-an-out-of-bounds-bug-in-ismt_access.patch b/queue-4.19/i2c-ismt-fix-an-out-of-bounds-bug-in-ismt_access.patch new file mode 100644 index 00000000000..cc83658589e --- /dev/null +++ b/queue-4.19/i2c-ismt-fix-an-out-of-bounds-bug-in-ismt_access.patch @@ -0,0 +1,54 @@ +From 3cea67ab16b1a370900580898ba9714585d12017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Jul 2022 19:02:16 +0800 +Subject: i2c: ismt: Fix an out-of-bounds bug in ismt_access() + +From: Zheyu Ma + +[ Upstream commit 39244cc754829bf707dccd12e2ce37510f5b1f8d ] + +When the driver does not check the data from the user, the variable +'data->block[0]' may be very large to cause an out-of-bounds bug. + +The following log can reveal it: + +[ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 +[ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE +[ 33.996475] ================================================================== +[ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b +[ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 +[ 33.999450] Call Trace: +[ 34.001849] memcpy+0x20/0x60 +[ 34.002077] ismt_access.cold+0x374/0x214b +[ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 +[ 34.004007] i2c_smbus_xfer+0x10a/0x390 +[ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 +[ 34.005196] i2cdev_ioctl+0x5ec/0x74c + +Fix this bug by checking the size of 'data->block[0]' first. + +Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller") +Signed-off-by: Zheyu Ma +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-ismt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c +index 80796061102f..9f5915d5f7e7 100644 +--- a/drivers/i2c/busses/i2c-ismt.c ++++ b/drivers/i2c/busses/i2c-ismt.c +@@ -504,6 +504,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr, + if (read_write == I2C_SMBUS_WRITE) { + /* Block Write */ + dev_dbg(dev, "I2C_SMBUS_BLOCK_DATA: WRITE\n"); ++ if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) ++ return -EINVAL; ++ + dma_size = data->block[0] + 1; + dma_direction = DMA_TO_DEVICE; + desc->wr_len_cmd = dma_size; +-- +2.35.1 + diff --git a/queue-4.19/i2c-mux-reg-check-return-value-after-calling-platfor.patch b/queue-4.19/i2c-mux-reg-check-return-value-after-calling-platfor.patch new file mode 100644 index 00000000000..ccb493dd88d --- /dev/null +++ b/queue-4.19/i2c-mux-reg-check-return-value-after-calling-platfor.patch @@ -0,0 +1,46 @@ +From 7b1c424a567bad0e21426656127727e0b0b1ba72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Oct 2022 17:38:25 +0800 +Subject: i2c: mux: reg: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit 2d47b79d2bd39cc6369eccf94a06568d84c906ae ] + +It will cause null-ptr-deref in resource_size(), if platform_get_resource() +returns NULL, move calling resource_size() after devm_ioremap_resource() that +will check 'res' to avoid null-ptr-deref. +And use devm_platform_get_and_ioremap_resource() to simplify code. + +Fixes: b3fdd32799d8 ("i2c: mux: Add register-based mux i2c-mux-reg") +Signed-off-by: Yang Yingliang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/muxes/i2c-mux-reg.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/muxes/i2c-mux-reg.c b/drivers/i2c/muxes/i2c-mux-reg.c +index 5653295b01cd..6d5cb40bfc96 100644 +--- a/drivers/i2c/muxes/i2c-mux-reg.c ++++ b/drivers/i2c/muxes/i2c-mux-reg.c +@@ -191,13 +191,12 @@ static int i2c_mux_reg_probe(struct platform_device *pdev) + if (!mux->data.reg) { + dev_info(&pdev->dev, + "Register not set, using platform resource\n"); +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- mux->data.reg_size = resource_size(res); +- mux->data.reg = devm_ioremap_resource(&pdev->dev, res); ++ mux->data.reg = devm_platform_get_and_ioremap_resource(pdev, 0, &res); + if (IS_ERR(mux->data.reg)) { + ret = PTR_ERR(mux->data.reg); + goto err_put_parent; + } ++ mux->data.reg_size = resource_size(res); + } + + if (mux->data.reg_size != 4 && mux->data.reg_size != 2 && +-- +2.35.1 + diff --git a/queue-4.19/i2c-pxa-pci-fix-missing-pci_disable_device-on-error-.patch b/queue-4.19/i2c-pxa-pci-fix-missing-pci_disable_device-on-error-.patch new file mode 100644 index 00000000000..4691dd7d5e4 --- /dev/null +++ b/queue-4.19/i2c-pxa-pci-fix-missing-pci_disable_device-on-error-.patch @@ -0,0 +1,58 @@ +From 12f4a14dc21fe13d594fee450502f8de384ef362 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 17:25:40 +0800 +Subject: i2c: pxa-pci: fix missing pci_disable_device() on error in + ce4100_i2c_probe + +From: Hui Tang + +[ Upstream commit d78a167332e1ca8113268ed922c1212fd71b73ad ] + +Using pcim_enable_device() to avoid missing pci_disable_device(). + +Fixes: 7e94dd154e93 ("i2c-pxa2xx: Add PCI support for PXA I2C controller") +Signed-off-by: Hui Tang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-pxa-pci.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-pxa-pci.c b/drivers/i2c/busses/i2c-pxa-pci.c +index 72ea8f4c61aa..883937c8408b 100644 +--- a/drivers/i2c/busses/i2c-pxa-pci.c ++++ b/drivers/i2c/busses/i2c-pxa-pci.c +@@ -105,7 +105,7 @@ static int ce4100_i2c_probe(struct pci_dev *dev, + int i; + struct ce4100_devices *sds; + +- ret = pci_enable_device_mem(dev); ++ ret = pcim_enable_device(dev); + if (ret) + return ret; + +@@ -114,10 +114,8 @@ static int ce4100_i2c_probe(struct pci_dev *dev, + return -EINVAL; + } + sds = kzalloc(sizeof(*sds), GFP_KERNEL); +- if (!sds) { +- ret = -ENOMEM; +- goto err_mem; +- } ++ if (!sds) ++ return -ENOMEM; + + for (i = 0; i < ARRAY_SIZE(sds->pdev); i++) { + sds->pdev[i] = add_i2c_device(dev, i); +@@ -133,8 +131,6 @@ static int ce4100_i2c_probe(struct pci_dev *dev, + + err_dev_add: + kfree(sds); +-err_mem: +- pci_disable_device(dev); + return ret; + } + +-- +2.35.1 + diff --git a/queue-4.19/ib-ipoib-fix-queue-count-inconsistency-for-pkey-chil.patch b/queue-4.19/ib-ipoib-fix-queue-count-inconsistency-for-pkey-chil.patch new file mode 100644 index 00000000000..1e8357c682e --- /dev/null +++ b/queue-4.19/ib-ipoib-fix-queue-count-inconsistency-for-pkey-chil.patch @@ -0,0 +1,61 @@ +From e87afb78c0a476b71872129ab21473b8d5c4243c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 09:52:54 +0200 +Subject: IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces + +From: Dragos Tatulea + +[ Upstream commit dbc94a0fb81771a38733c0e8f2ea8c4fa6934dc1 ] + +There are 2 ways to create IPoIB PKEY child interfaces: +1) Writing a PKEY to /sys/class/net//create_child. +2) Using netlink with iproute. + +While with sysfs the child interface has the same number of tx and +rx queues as the parent, with netlink there will always be 1 tx +and 1 rx queue for the child interface. That's because the +get_num_tx/rx_queues() netlink ops are missing and the default value +of 1 is taken for the number of queues (in rtnl_create_link()). + +This change adds the get_num_tx/rx_queues() ops which allows for +interfaces with multiple queues to be created over netlink. This +constant only represents the max number of tx and rx queues on that +net device. + +Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support") +Signed-off-by: Dragos Tatulea +Link: https://lore.kernel.org/r/f4a42c8aa43c02d5ae5559a60c3e5e0f18c82531.1670485816.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c +index d4d553a51fa9..285cb28bf14a 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c +@@ -42,6 +42,11 @@ static const struct nla_policy ipoib_policy[IFLA_IPOIB_MAX + 1] = { + [IFLA_IPOIB_UMCAST] = { .type = NLA_U16 }, + }; + ++static unsigned int ipoib_get_max_num_queues(void) ++{ ++ return min_t(unsigned int, num_possible_cpus(), 128); ++} ++ + static int ipoib_fill_info(struct sk_buff *skb, const struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); +@@ -147,6 +152,8 @@ static struct rtnl_link_ops ipoib_link_ops __read_mostly = { + .changelink = ipoib_changelink, + .get_size = ipoib_get_size, + .fill_info = ipoib_fill_info, ++ .get_num_rx_queues = ipoib_get_max_num_queues, ++ .get_num_tx_queues = ipoib_get_max_num_queues, + }; + + int __init ipoib_netlink_init(void) +-- +2.35.1 + diff --git a/queue-4.19/igb-do-not-free-q_vector-unless-new-one-was-allocate.patch b/queue-4.19/igb-do-not-free-q_vector-unless-new-one-was-allocate.patch new file mode 100644 index 00000000000..70c2f06ff27 --- /dev/null +++ b/queue-4.19/igb-do-not-free-q_vector-unless-new-one-was-allocate.patch @@ -0,0 +1,53 @@ +From 08fcb24a4e311d89644e6eb5e7ed3bbaa33d1951 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 02:25:24 -0700 +Subject: igb: Do not free q_vector unless new one was allocated + +From: Kees Cook + +[ Upstream commit 0668716506ca66f90d395f36ccdaebc3e0e84801 ] + +Avoid potential use-after-free condition under memory pressure. If the +kzalloc() fails, q_vector will be freed but left in the original +adapter->q_vector[v_idx] array position. + +Cc: Jesse Brandeburg +Cc: Tony Nguyen +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: intel-wired-lan@lists.osuosl.org +Cc: netdev@vger.kernel.org +Signed-off-by: Kees Cook +Reviewed-by: Michael J. Ruhl +Reviewed-by: Jacob Keller +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 3d2dd15859cb..87f98170ac93 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -1211,8 +1211,12 @@ static int igb_alloc_q_vector(struct igb_adapter *adapter, + if (!q_vector) { + q_vector = kzalloc(size, GFP_KERNEL); + } else if (size > ksize(q_vector)) { +- kfree_rcu(q_vector, rcu); +- q_vector = kzalloc(size, GFP_KERNEL); ++ struct igb_q_vector *new_q_vector; ++ ++ new_q_vector = kzalloc(size, GFP_KERNEL); ++ if (new_q_vector) ++ kfree_rcu(q_vector, rcu); ++ q_vector = new_q_vector; + } else { + memset(q_vector, 0, size); + } +-- +2.35.1 + diff --git a/queue-4.19/ima-fix-misuse-of-dereference-of-pointer-in-template.patch b/queue-4.19/ima-fix-misuse-of-dereference-of-pointer-in-template.patch new file mode 100644 index 00000000000..480a2156c8b --- /dev/null +++ b/queue-4.19/ima-fix-misuse-of-dereference-of-pointer-in-template.patch @@ -0,0 +1,47 @@ +From 88e787e7c4cdb33db18858f11c06f94c6352030c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Nov 2022 17:27:19 +0800 +Subject: ima: Fix misuse of dereference of pointer in + template_desc_init_fields() + +From: Xiu Jianfeng + +[ Upstream commit 25369175ce84813dd99d6604e710dc2491f68523 ] + +The input parameter @fields is type of struct ima_template_field ***, so +when allocates array memory for @fields, the size of element should be +sizeof(**field) instead of sizeof(*field). + +Actually the original code would not cause any runtime error, but it's +better to make it logically right. + +Fixes: adf53a778a0a ("ima: new templates management mechanism") +Signed-off-by: Xiu Jianfeng +Reviewed-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_template.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/ima/ima_template.c b/security/integrity/ima/ima_template.c +index 4dfdccce497b..13567e555130 100644 +--- a/security/integrity/ima/ima_template.c ++++ b/security/integrity/ima/ima_template.c +@@ -196,11 +196,11 @@ static int template_desc_init_fields(const char *template_fmt, + } + + if (fields && num_fields) { +- *fields = kmalloc_array(i, sizeof(*fields), GFP_KERNEL); ++ *fields = kmalloc_array(i, sizeof(**fields), GFP_KERNEL); + if (*fields == NULL) + return -ENOMEM; + +- memcpy(*fields, found_fields, i * sizeof(*fields)); ++ memcpy(*fields, found_fields, i * sizeof(**fields)); + *num_fields = i; + } + +-- +2.35.1 + diff --git a/queue-4.19/include-uapi-linux-swab-fix-potentially-missing-__al.patch b/queue-4.19/include-uapi-linux-swab-fix-potentially-missing-__al.patch new file mode 100644 index 00000000000..12bf89cac37 --- /dev/null +++ b/queue-4.19/include-uapi-linux-swab-fix-potentially-missing-__al.patch @@ -0,0 +1,64 @@ +From c3a0a41d16e01d53065e6a78a8e8f34d94da6fb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Sep 2022 14:52:56 -0700 +Subject: include/uapi/linux/swab: Fix potentially missing __always_inline +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matt Redfearn + +[ Upstream commit defbab270d45e32b068e7e73c3567232d745c60f ] + +Commit bc27fb68aaad ("include/uapi/linux/byteorder, swab: force inlining +of some byteswap operations") added __always_inline to swab functions +and commit 283d75737837 ("uapi/linux/stddef.h: Provide __always_inline to +userspace headers") added a definition of __always_inline for use in +exported headers when the kernel's compiler.h is not available. + +However, since swab.h does not include stddef.h, if the header soup does +not indirectly include it, the definition of __always_inline is missing, +resulting in a compilation failure, which was observed compiling the +perf tool using exported headers containing this commit: + +In file included from /usr/include/linux/byteorder/little_endian.h:12:0, + from /usr/include/asm/byteorder.h:14, + from tools/include/uapi/linux/perf_event.h:20, + from perf.h:8, + from builtin-bench.c:18: +/usr/include/linux/swab.h:160:8: error: unknown type name `__always_inline' + static __always_inline __u16 __swab16p(const __u16 *p) + +Fix this by replacing the inclusion of linux/compiler.h with +linux/stddef.h to ensure that we pick up that definition if required, +without relying on it's indirect inclusion. compiler.h is then included +indirectly, via stddef.h. + +Fixes: 283d75737837 ("uapi/linux/stddef.h: Provide __always_inline to userspace headers") +Signed-off-by: Matt Redfearn +Signed-off-by: Florian Fainelli +Signed-off-by: Arnd Bergmann +Tested-by: Nathan Chancellor +Reviewed-by: Petr Vaněk +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + include/uapi/linux/swab.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/swab.h b/include/uapi/linux/swab.h +index 7272f85d6d6a..3736f2fe1541 100644 +--- a/include/uapi/linux/swab.h ++++ b/include/uapi/linux/swab.h +@@ -3,7 +3,7 @@ + #define _UAPI_LINUX_SWAB_H + + #include +-#include ++#include + #include + #include + +-- +2.35.1 + diff --git a/queue-4.19/input-elants_i2c-properly-handle-the-reset-gpio-when.patch b/queue-4.19/input-elants_i2c-properly-handle-the-reset-gpio-when.patch new file mode 100644 index 00000000000..0d00cf82542 --- /dev/null +++ b/queue-4.19/input-elants_i2c-properly-handle-the-reset-gpio-when.patch @@ -0,0 +1,90 @@ +From 342c26c36923388adaf4ba2cffdf95d46b385636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 21:49:19 -0800 +Subject: Input: elants_i2c - properly handle the reset GPIO when power is off + +From: Douglas Anderson + +[ Upstream commit a85fbd6498441694475716a4d5c65f9d3e073faf ] + +As can be seen in elants_i2c_power_off(), we want the reset GPIO +asserted when power is off. The reset GPIO is active low so we need +the reset line logic low when power is off to avoid leakage. + +We have a problem, though, at probe time. At probe time we haven't +powered the regulators on yet but we have: + + devm_gpiod_get(&client->dev, "reset", GPIOD_OUT_LOW); + +While that _looks_ right, it turns out that it's not. The +GPIOD_OUT_LOW doesn't mean to init the GPIO to low. It means init the +GPIO to "not asserted". Since this is an active low GPIO that inits it +to be high. + +Let's fix this to properly init the GPIO. Now after both probe and +power off the state of the GPIO is consistent (it's "asserted" or +level low). + +Once we fix this, we can see that at power on time we no longer to +assert the reset GPIO as the first thing. The reset GPIO is _always_ +asserted before powering on. Let's fix powering on to account for +this. + +Fixes: afe10358e47a ("Input: elants_i2c - wire up regulator support") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20221117123805.1.I9959ac561dd6e1e8e1ce7085e4de6167b27c574f@changeid +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/elants_i2c.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c +index adfae2d88707..83e9bded87d9 100644 +--- a/drivers/input/touchscreen/elants_i2c.c ++++ b/drivers/input/touchscreen/elants_i2c.c +@@ -1082,14 +1082,12 @@ static int elants_i2c_power_on(struct elants_data *ts) + if (IS_ERR_OR_NULL(ts->reset_gpio)) + return 0; + +- gpiod_set_value_cansleep(ts->reset_gpio, 1); +- + error = regulator_enable(ts->vcc33); + if (error) { + dev_err(&ts->client->dev, + "failed to enable vcc33 regulator: %d\n", + error); +- goto release_reset_gpio; ++ return error; + } + + error = regulator_enable(ts->vccio); +@@ -1098,7 +1096,7 @@ static int elants_i2c_power_on(struct elants_data *ts) + "failed to enable vccio regulator: %d\n", + error); + regulator_disable(ts->vcc33); +- goto release_reset_gpio; ++ return error; + } + + /* +@@ -1107,7 +1105,6 @@ static int elants_i2c_power_on(struct elants_data *ts) + */ + udelay(ELAN_POWERON_DELAY_USEC); + +-release_reset_gpio: + gpiod_set_value_cansleep(ts->reset_gpio, 0); + if (error) + return error; +@@ -1215,7 +1212,7 @@ static int elants_i2c_probe(struct i2c_client *client, + return error; + } + +- ts->reset_gpio = devm_gpiod_get(&client->dev, "reset", GPIOD_OUT_LOW); ++ ts->reset_gpio = devm_gpiod_get(&client->dev, "reset", GPIOD_OUT_HIGH); + if (IS_ERR(ts->reset_gpio)) { + error = PTR_ERR(ts->reset_gpio); + +-- +2.35.1 + diff --git a/queue-4.19/iommu-amd-fix-pci-device-refcount-leak-in-ppr_notifi.patch b/queue-4.19/iommu-amd-fix-pci-device-refcount-leak-in-ppr_notifi.patch new file mode 100644 index 00000000000..6164eabe783 --- /dev/null +++ b/queue-4.19/iommu-amd-fix-pci-device-refcount-leak-in-ppr_notifi.patch @@ -0,0 +1,39 @@ +From 3946060a5debae3da86b2c18d85699fc470c703f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 17:36:04 +0800 +Subject: iommu/amd: Fix pci device refcount leak in ppr_notifier() + +From: Yang Yingliang + +[ Upstream commit 6cf0981c2233f97d56938d9d61845383d6eb227c ] + +As comment of pci_get_domain_bus_and_slot() says, it returns +a pci device with refcount increment, when finish using it, +the caller must decrement the reference count by calling +pci_dev_put(). So call it before returning from ppr_notifier() +to avoid refcount leak. + +Fixes: daae2d25a477 ("iommu/amd: Don't copy GCR3 table root pointer") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221118093604.216371-1-yangyingliang@huawei.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_v2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c +index 7a59a8ebac10..387b72b7e7b3 100644 +--- a/drivers/iommu/amd_iommu_v2.c ++++ b/drivers/iommu/amd_iommu_v2.c +@@ -626,6 +626,7 @@ static int ppr_notifier(struct notifier_block *nb, unsigned long e, void *data) + put_device_state(dev_state); + + out: ++ pci_dev_put(pdev); + return ret; + } + +-- +2.35.1 + diff --git a/queue-4.19/iommu-fsl_pamu-fix-resource-leak-in-fsl_pamu_probe.patch b/queue-4.19/iommu-fsl_pamu-fix-resource-leak-in-fsl_pamu_probe.patch new file mode 100644 index 00000000000..a982d402d78 --- /dev/null +++ b/queue-4.19/iommu-fsl_pamu-fix-resource-leak-in-fsl_pamu_probe.patch @@ -0,0 +1,38 @@ +From 3bed82877b6880510be2c804b1cd428268b731de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 08:20:22 +0000 +Subject: iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe() + +From: Yuan Can + +[ Upstream commit 73f5fc5f884ad0c5f7d57f66303af64f9f002526 ] + +The fsl_pamu_probe() returns directly when create_csd() failed, leaving +irq and memories unreleased. +Fix by jumping to error if create_csd() returns error. + +Fixes: 695093e38c3e ("iommu/fsl: Freescale PAMU driver and iommu implementation.") +Signed-off-by: Yuan Can +Link: https://lore.kernel.org/r/20221121082022.19091-1-yuancan@huawei.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/fsl_pamu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/fsl_pamu.c b/drivers/iommu/fsl_pamu.c +index 8540625796a1..b6a0c6d3b204 100644 +--- a/drivers/iommu/fsl_pamu.c ++++ b/drivers/iommu/fsl_pamu.c +@@ -1134,7 +1134,7 @@ static int fsl_pamu_probe(struct platform_device *pdev) + ret = create_csd(ppaact_phys, mem_size, csd_port_id); + if (ret) { + dev_err(dev, "could not create coherence subdomain\n"); +- return ret; ++ goto error; + } + } + +-- +2.35.1 + diff --git a/queue-4.19/ipmi-fix-memleak-when-unload-ipmi-driver.patch b/queue-4.19/ipmi-fix-memleak-when-unload-ipmi-driver.patch new file mode 100644 index 00000000000..6430613cf7b --- /dev/null +++ b/queue-4.19/ipmi-fix-memleak-when-unload-ipmi-driver.patch @@ -0,0 +1,64 @@ +From c31f834a21186ee744428c0e112f63c10b6ba306 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Oct 2022 17:26:17 +0800 +Subject: ipmi: fix memleak when unload ipmi driver + +From: Zhang Yuchen + +[ Upstream commit 36992eb6b9b83f7f9cdc8e74fb5799d7b52e83e9 ] + +After the IPMI disconnect problem, the memory kept rising and we tried +to unload the driver to free the memory. However, only part of the +free memory is recovered after the driver is uninstalled. Using +ebpf to hook free functions, we find that neither ipmi_user nor +ipmi_smi_msg is free, only ipmi_recv_msg is free. + +We find that the deliver_smi_err_response call in clean_smi_msgs does +the destroy processing on each message from the xmit_msg queue without +checking the return value and free ipmi_smi_msg. + +deliver_smi_err_response is called only at this location. Adding the +free handling has no effect. + +To verify, try using ebpf to trace the free function. + + $ bpftrace -e 'kretprobe:ipmi_alloc_recv_msg {printf("alloc rcv + %p\n",retval);} kprobe:free_recv_msg {printf("free recv %p\n", + arg0)} kretprobe:ipmi_alloc_smi_msg {printf("alloc smi %p\n", + retval);} kprobe:free_smi_msg {printf("free smi %p\n",arg0)}' + +Signed-off-by: Zhang Yuchen +Message-Id: <20221007092617.87597-4-zhangyuchen.lcr@bytedance.com> +[Fixed the comment above handle_one_recv_msg().] +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_msghandler.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c +index 4cf3ef4ddec3..8cfc7e6ab645 100644 +--- a/drivers/char/ipmi/ipmi_msghandler.c ++++ b/drivers/char/ipmi/ipmi_msghandler.c +@@ -3461,12 +3461,16 @@ static void deliver_smi_err_response(struct ipmi_smi *intf, + struct ipmi_smi_msg *msg, + unsigned char err) + { ++ int rv; + msg->rsp[0] = msg->data[0] | 4; + msg->rsp[1] = msg->data[1]; + msg->rsp[2] = err; + msg->rsp_size = 3; +- /* It's an error, so it will never requeue, no need to check return. */ +- handle_one_recv_msg(intf, msg); ++ ++ /* This will never requeue, but it may ask us to free the message. */ ++ rv = handle_one_recv_msg(intf, msg); ++ if (rv == 0) ++ ipmi_free_smi_msg(msg); + } + + static void cleanup_smi_msgs(struct ipmi_smi *intf) +-- +2.35.1 + diff --git a/queue-4.19/irqchip-gic-pm-use-pm_runtime_resume_and_get-in-gic_.patch b/queue-4.19/irqchip-gic-pm-use-pm_runtime_resume_and_get-in-gic_.patch new file mode 100644 index 00000000000..04a12746db1 --- /dev/null +++ b/queue-4.19/irqchip-gic-pm-use-pm_runtime_resume_and_get-in-gic_.patch @@ -0,0 +1,39 @@ +From a12c85dd313c706e894b94cf46e327465b8dd5c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:51:50 +0800 +Subject: irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe() + +From: Shang XiaoJing + +[ Upstream commit f9ee20c85b3a3ba0afd3672630ec4f93d339f015 ] + +gic_probe() calls pm_runtime_get_sync() and added fail path as +rpm_put to put usage_counter. However, pm_runtime_get_sync() +will increment usage_counter even it failed. Fix it by replacing it with +pm_runtime_resume_and_get() to keep usage counter balanced. + +Fixes: 9c8edddfc992 ("irqchip/gic: Add platform driver for non-root GICs that require RPM") +Signed-off-by: Shang XiaoJing +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20221124065150.22809-1-shangxiaojing@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-pm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-pm.c b/drivers/irqchip/irq-gic-pm.c +index ecafd295c31c..21c5decfc55b 100644 +--- a/drivers/irqchip/irq-gic-pm.c ++++ b/drivers/irqchip/irq-gic-pm.c +@@ -112,7 +112,7 @@ static int gic_probe(struct platform_device *pdev) + + pm_runtime_enable(dev); + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + goto rpm_disable; + +-- +2.35.1 + diff --git a/queue-4.19/lib-notifier-error-inject-fix-error-when-writing-err.patch b/queue-4.19/lib-notifier-error-inject-fix-error-when-writing-err.patch new file mode 100644 index 00000000000..d313163dd44 --- /dev/null +++ b/queue-4.19/lib-notifier-error-inject-fix-error-when-writing-err.patch @@ -0,0 +1,52 @@ +From 5a0f4c2ea0b51dd59685d5e9cf0830479a516bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 02:24:17 +0900 +Subject: lib/notifier-error-inject: fix error when writing -errno to debugfs + file + +From: Akinobu Mita + +[ Upstream commit f883c3edd2c432a2931ec8773c70a570115a50fe ] + +The simple attribute files do not accept a negative value since the commit +488dac0c9237 ("libfs: fix error cast of negative value in +simple_attr_write()"). + +This restores the previous behaviour by using newly introduced +DEFINE_SIMPLE_ATTRIBUTE_SIGNED instead of DEFINE_SIMPLE_ATTRIBUTE. + +Link: https://lkml.kernel.org/r/20220919172418.45257-3-akinobu.mita@gmail.com +Fixes: 488dac0c9237 ("libfs: fix error cast of negative value in simple_attr_write()") +Signed-off-by: Akinobu Mita +Reported-by: Zhao Gongyi +Reviewed-by: David Hildenbrand +Reviewed-by: Greg Kroah-Hartman +Cc: Alexander Viro +Cc: Jonathan Corbet +Cc: Oscar Salvador +Cc: Rafael J. Wysocki +Cc: Shuah Khan +Cc: Wei Yongjun +Cc: Yicong Yang +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + lib/notifier-error-inject.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/notifier-error-inject.c b/lib/notifier-error-inject.c +index eb4a04afea80..125ea8ce23a4 100644 +--- a/lib/notifier-error-inject.c ++++ b/lib/notifier-error-inject.c +@@ -14,7 +14,7 @@ static int debugfs_errno_get(void *data, u64 *val) + return 0; + } + +-DEFINE_SIMPLE_ATTRIBUTE(fops_errno, debugfs_errno_get, debugfs_errno_set, ++DEFINE_SIMPLE_ATTRIBUTE_SIGNED(fops_errno, debugfs_errno_get, debugfs_errno_set, + "%lld\n"); + + static struct dentry *debugfs_create_errno(const char *name, umode_t mode, +-- +2.35.1 + diff --git a/queue-4.19/libfs-add-define_simple_attribute_signed-for-signed-.patch b/queue-4.19/libfs-add-define_simple_attribute_signed-for-signed-.patch new file mode 100644 index 00000000000..a884c751010 --- /dev/null +++ b/queue-4.19/libfs-add-define_simple_attribute_signed-for-signed-.patch @@ -0,0 +1,139 @@ +From 1c61d8aaaa17703214572597c1d611e12a4ed113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 02:24:16 +0900 +Subject: libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value + +From: Akinobu Mita + +[ Upstream commit 2e41f274f9aa71cdcc69dc1f26a3f9304a651804 ] + +Patch series "fix error when writing negative value to simple attribute +files". + +The simple attribute files do not accept a negative value since the commit +488dac0c9237 ("libfs: fix error cast of negative value in +simple_attr_write()"), but some attribute files want to accept a negative +value. + +This patch (of 3): + +The simple attribute files do not accept a negative value since the commit +488dac0c9237 ("libfs: fix error cast of negative value in +simple_attr_write()"), so we have to use a 64-bit value to write a +negative value. + +This adds DEFINE_SIMPLE_ATTRIBUTE_SIGNED for a signed value. + +Link: https://lkml.kernel.org/r/20220919172418.45257-1-akinobu.mita@gmail.com +Link: https://lkml.kernel.org/r/20220919172418.45257-2-akinobu.mita@gmail.com +Fixes: 488dac0c9237 ("libfs: fix error cast of negative value in simple_attr_write()") +Signed-off-by: Akinobu Mita +Reported-by: Zhao Gongyi +Reviewed-by: David Hildenbrand +Reviewed-by: Greg Kroah-Hartman +Cc: Alexander Viro +Cc: Jonathan Corbet +Cc: Oscar Salvador +Cc: Rafael J. Wysocki +Cc: Shuah Khan +Cc: Wei Yongjun +Cc: Yicong Yang +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/libfs.c | 22 +++++++++++++++++++--- + include/linux/fs.h | 12 ++++++++++-- + 2 files changed, 29 insertions(+), 5 deletions(-) + +diff --git a/fs/libfs.c b/fs/libfs.c +index be57e64834e5..fd5f6c106059 100644 +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -864,8 +864,8 @@ ssize_t simple_attr_read(struct file *file, char __user *buf, + EXPORT_SYMBOL_GPL(simple_attr_read); + + /* interpret the buffer as a number to call the set function with */ +-ssize_t simple_attr_write(struct file *file, const char __user *buf, +- size_t len, loff_t *ppos) ++static ssize_t simple_attr_write_xsigned(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos, bool is_signed) + { + struct simple_attr *attr; + unsigned long long val; +@@ -886,7 +886,10 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + goto out; + + attr->set_buf[size] = '\0'; +- ret = kstrtoull(attr->set_buf, 0, &val); ++ if (is_signed) ++ ret = kstrtoll(attr->set_buf, 0, &val); ++ else ++ ret = kstrtoull(attr->set_buf, 0, &val); + if (ret) + goto out; + ret = attr->set(attr->data, val); +@@ -896,8 +899,21 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + mutex_unlock(&attr->mutex); + return ret; + } ++ ++ssize_t simple_attr_write(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos) ++{ ++ return simple_attr_write_xsigned(file, buf, len, ppos, false); ++} + EXPORT_SYMBOL_GPL(simple_attr_write); + ++ssize_t simple_attr_write_signed(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos) ++{ ++ return simple_attr_write_xsigned(file, buf, len, ppos, true); ++} ++EXPORT_SYMBOL_GPL(simple_attr_write_signed); ++ + /** + * generic_fh_to_dentry - generic helper for the fh_to_dentry export operation + * @sb: filesystem to do the file handle conversion on +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 86f884e78b6b..95b8ef09b76c 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -3353,7 +3353,7 @@ void simple_transaction_set(struct file *file, size_t n); + * All attributes contain a text representation of a numeric value + * that are accessed with the get() and set() functions. + */ +-#define DEFINE_SIMPLE_ATTRIBUTE(__fops, __get, __set, __fmt) \ ++#define DEFINE_SIMPLE_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, __is_signed) \ + static int __fops ## _open(struct inode *inode, struct file *file) \ + { \ + __simple_attr_check_format(__fmt, 0ull); \ +@@ -3364,10 +3364,16 @@ static const struct file_operations __fops = { \ + .open = __fops ## _open, \ + .release = simple_attr_release, \ + .read = simple_attr_read, \ +- .write = simple_attr_write, \ ++ .write = (__is_signed) ? simple_attr_write_signed : simple_attr_write, \ + .llseek = generic_file_llseek, \ + } + ++#define DEFINE_SIMPLE_ATTRIBUTE(__fops, __get, __set, __fmt) \ ++ DEFINE_SIMPLE_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, false) ++ ++#define DEFINE_SIMPLE_ATTRIBUTE_SIGNED(__fops, __get, __set, __fmt) \ ++ DEFINE_SIMPLE_ATTRIBUTE_XSIGNED(__fops, __get, __set, __fmt, true) ++ + static inline __printf(1, 2) + void __simple_attr_check_format(const char *fmt, ...) + { +@@ -3382,6 +3388,8 @@ ssize_t simple_attr_read(struct file *file, char __user *buf, + size_t len, loff_t *ppos); + ssize_t simple_attr_write(struct file *file, const char __user *buf, + size_t len, loff_t *ppos); ++ssize_t simple_attr_write_signed(struct file *file, const char __user *buf, ++ size_t len, loff_t *ppos); + + struct ctl_table; + int proc_nr_files(struct ctl_table *table, int write, +-- +2.35.1 + diff --git a/queue-4.19/macintosh-fix-possible-memory-leak-in-macio_add_one_.patch b/queue-4.19/macintosh-fix-possible-memory-leak-in-macio_add_one_.patch new file mode 100644 index 00000000000..4fa075b3eb4 --- /dev/null +++ b/queue-4.19/macintosh-fix-possible-memory-leak-in-macio_add_one_.patch @@ -0,0 +1,43 @@ +From d5feb4324a86e4fe38201c6ded72f211791ef8b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 11:25:51 +0800 +Subject: macintosh: fix possible memory leak in macio_add_one_device() + +From: Yang Yingliang + +[ Upstream commit 5ca86eae55a2f006e6c1edd2029b2cacb6979515 ] + +Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's +bus_id string array"), the name of device is allocated dynamically. It +needs to be freed when of_device_register() fails. Call put_device() to +give up the reference that's taken in device_initialize(), so that it +can be freed in kobject_cleanup() when the refcount hits 0. + +macio device is freed in macio_release_dev(), so the kfree() can be +removed. + +Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") +Signed-off-by: Yang Yingliang +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221104032551.1075335-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/macintosh/macio_asic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/macintosh/macio_asic.c b/drivers/macintosh/macio_asic.c +index 07074820a167..12c360ebd7e9 100644 +--- a/drivers/macintosh/macio_asic.c ++++ b/drivers/macintosh/macio_asic.c +@@ -427,7 +427,7 @@ static struct macio_dev * macio_add_one_device(struct macio_chip *chip, + if (of_device_register(&dev->ofdev) != 0) { + printk(KERN_DEBUG"macio: device registration error for %s!\n", + dev_name(&dev->ofdev.dev)); +- kfree(dev); ++ put_device(&dev->ofdev.dev); + return NULL; + } + +-- +2.35.1 + diff --git a/queue-4.19/macintosh-macio-adb-check-the-return-value-of-iorema.patch b/queue-4.19/macintosh-macio-adb-check-the-return-value-of-iorema.patch new file mode 100644 index 00000000000..f4ce766620e --- /dev/null +++ b/queue-4.19/macintosh-macio-adb-check-the-return-value-of-iorema.patch @@ -0,0 +1,40 @@ +From 99ede9ae90e3a946de3169168243be74d30167fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Aug 2022 15:41:48 +0800 +Subject: macintosh/macio-adb: check the return value of ioremap() + +From: Xie Shaowen + +[ Upstream commit dbaa3105736d4d73063ea0a3b01cd7fafce924e6 ] + +The function ioremap() in macio_init() can fail, so its return value +should be checked. + +Fixes: 36874579dbf4c ("[PATCH] powerpc: macio-adb build fix") +Reported-by: Hacash Robot +Signed-off-by: Xie Shaowen +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220802074148.3213659-1-studentxswpy@163.com +Signed-off-by: Sasha Levin +--- + drivers/macintosh/macio-adb.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/macintosh/macio-adb.c b/drivers/macintosh/macio-adb.c +index eb3adfb7f88d..172a8b18c579 100644 +--- a/drivers/macintosh/macio-adb.c ++++ b/drivers/macintosh/macio-adb.c +@@ -106,6 +106,10 @@ int macio_init(void) + return -ENXIO; + } + adb = ioremap(r.start, sizeof(struct adb_regs)); ++ if (!adb) { ++ of_node_put(adbs); ++ return -ENOMEM; ++ } + + out_8(&adb->ctrl.r, 0); + out_8(&adb->intr.r, 0); +-- +2.35.1 + diff --git a/queue-4.19/mcb-mcb-parse-fix-error-handing-in-chameleon_parse_g.patch b/queue-4.19/mcb-mcb-parse-fix-error-handing-in-chameleon_parse_g.patch new file mode 100644 index 00000000000..b454003b268 --- /dev/null +++ b/queue-4.19/mcb-mcb-parse-fix-error-handing-in-chameleon_parse_g.patch @@ -0,0 +1,40 @@ +From 64035365d694d0bad5918c291d6a9a204b675ab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 01:38:50 -0800 +Subject: mcb: mcb-parse: fix error handing in chameleon_parse_gdd() + +From: Yang Yingliang + +[ Upstream commit 728ac3389296caf68638628c987aeae6c8851e2d ] + +If mcb_device_register() returns error in chameleon_parse_gdd(), the refcount +of bus and device name are leaked. Fix this by calling put_device() to give up +the reference, so they can be released in mcb_release_dev() and kobject_cleanup(). + +Fixes: 3764e82e5150 ("drivers: Introduce MEN Chameleon Bus") +Reviewed-by: Johannes Thumshirn +Signed-off-by: Yang Yingliang +Signed-off-by: Johannes Thumshirn +Link: https://lore.kernel.org/r/ebfb06e39b19272f0197fa9136b5e4b6f34ad732.1669624063.git.johannes.thumshirn@wdc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/mcb/mcb-parse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c +index 7369bda3442f..3636349648b4 100644 +--- a/drivers/mcb/mcb-parse.c ++++ b/drivers/mcb/mcb-parse.c +@@ -107,7 +107,7 @@ static int chameleon_parse_gdd(struct mcb_bus *bus, + return 0; + + err: +- mcb_free_dev(mdev); ++ put_device(&mdev->dev); + + return ret; + } +-- +2.35.1 + diff --git a/queue-4.19/md-raid1-stop-mdx_raid1-thread-when-raid1-array-run-.patch b/queue-4.19/md-raid1-stop-mdx_raid1-thread-when-raid1-array-run-.patch new file mode 100644 index 00000000000..66c9a3df372 --- /dev/null +++ b/queue-4.19/md-raid1-stop-mdx_raid1-thread-when-raid1-array-run-.patch @@ -0,0 +1,71 @@ +From e11d1b739e049b52f7a2932a284fbc15e7862953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 22:16:59 +0800 +Subject: md/raid1: stop mdx_raid1 thread when raid1 array run failed + +From: Jiang Li + +[ Upstream commit b611ad14006e5be2170d9e8e611bf49dff288911 ] + +fail run raid1 array when we assemble array with the inactive disk only, +but the mdx_raid1 thread were not stop, Even if the associated resources +have been released. it will caused a NULL dereference when we do poweroff. + +This causes the following Oops: + [ 287.587787] BUG: kernel NULL pointer dereference, address: 0000000000000070 + [ 287.594762] #PF: supervisor read access in kernel mode + [ 287.599912] #PF: error_code(0x0000) - not-present page + [ 287.605061] PGD 0 P4D 0 + [ 287.607612] Oops: 0000 [#1] SMP NOPTI + [ 287.611287] CPU: 3 PID: 5265 Comm: md0_raid1 Tainted: G U 5.10.146 #0 + [ 287.619029] Hardware name: xxxxxxx/To be filled by O.E.M, BIOS 5.19 06/16/2022 + [ 287.626775] RIP: 0010:md_check_recovery+0x57/0x500 [md_mod] + [ 287.632357] Code: fe 01 00 00 48 83 bb 10 03 00 00 00 74 08 48 89 ...... + [ 287.651118] RSP: 0018:ffffc90000433d78 EFLAGS: 00010202 + [ 287.656347] RAX: 0000000000000000 RBX: ffff888105986800 RCX: 0000000000000000 + [ 287.663491] RDX: ffffc90000433bb0 RSI: 00000000ffffefff RDI: ffff888105986800 + [ 287.670634] RBP: ffffc90000433da0 R08: 0000000000000000 R09: c0000000ffffefff + [ 287.677771] R10: 0000000000000001 R11: ffffc90000433ba8 R12: ffff888105986800 + [ 287.684907] R13: 0000000000000000 R14: fffffffffffffe00 R15: ffff888100b6b500 + [ 287.692052] FS: 0000000000000000(0000) GS:ffff888277f80000(0000) knlGS:0000000000000000 + [ 287.700149] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 287.705897] CR2: 0000000000000070 CR3: 000000000320a000 CR4: 0000000000350ee0 + [ 287.713033] Call Trace: + [ 287.715498] raid1d+0x6c/0xbbb [raid1] + [ 287.719256] ? __schedule+0x1ff/0x760 + [ 287.722930] ? schedule+0x3b/0xb0 + [ 287.726260] ? schedule_timeout+0x1ed/0x290 + [ 287.730456] ? __switch_to+0x11f/0x400 + [ 287.734219] md_thread+0xe9/0x140 [md_mod] + [ 287.738328] ? md_thread+0xe9/0x140 [md_mod] + [ 287.742601] ? wait_woken+0x80/0x80 + [ 287.746097] ? md_register_thread+0xe0/0xe0 [md_mod] + [ 287.751064] kthread+0x11a/0x140 + [ 287.754300] ? kthread_park+0x90/0x90 + [ 287.757974] ret_from_fork+0x1f/0x30 + +In fact, when raid1 array run fail, we need to do +md_unregister_thread() before raid1_free(). + +Signed-off-by: Jiang Li +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/raid1.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 876d3e1339d1..0f8b1fb3d051 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -3110,6 +3110,7 @@ static int raid1_run(struct mddev *mddev) + * RAID1 needs at least one disk in active + */ + if (conf->raid_disks - mddev->degraded < 1) { ++ md_unregister_thread(&conf->thread); + ret = -EINVAL; + goto abort; + } +-- +2.35.1 + diff --git a/queue-4.19/media-c8sectpfe-add-of_node_put-when-breaking-out-of.patch b/queue-4.19/media-c8sectpfe-add-of_node_put-when-breaking-out-of.patch new file mode 100644 index 00000000000..d52ce2ff38c --- /dev/null +++ b/queue-4.19/media-c8sectpfe-add-of_node_put-when-breaking-out-of.patch @@ -0,0 +1,36 @@ +From 71c13e4f116e443afae72bbdb262037e22ed7352 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jul 2022 22:10:23 +0800 +Subject: media: c8sectpfe: Add of_node_put() when breaking out of loop + +From: Liang He + +[ Upstream commit 63ff05a1ad242a5a0f897921c87b70d601bda59c ] + +In configure_channels(), we should call of_node_put() when breaking +out of for_each_child_of_node() which will automatically increase +and decrease the refcount. + +Fixes: c5f5d0f99794 ("[media] c8sectpfe: STiH407/10 Linux DVB demux support") +Signed-off-by: Liang He +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +index 3c05b3dc49ec..98c14565bbfd 100644 +--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c ++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +@@ -943,6 +943,7 @@ static int configure_channels(struct c8sectpfei *fei) + if (ret) { + dev_err(fei->dev, + "configure_memdma_and_inputblock failed\n"); ++ of_node_put(child); + goto err_unmap; + } + index++; +-- +2.35.1 + diff --git a/queue-4.19/media-camss-clean-up-received-buffers-on-failed-star.patch b/queue-4.19/media-camss-clean-up-received-buffers-on-failed-star.patch new file mode 100644 index 00000000000..7b77d160942 --- /dev/null +++ b/queue-4.19/media-camss-clean-up-received-buffers-on-failed-star.patch @@ -0,0 +1,62 @@ +From 7b25279034b306f88b193bfacfdee0ba31c316bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Jul 2022 10:44:37 +0100 +Subject: media: camss: Clean up received buffers on failed start of streaming + +From: Vladimir Zapolskiy + +[ Upstream commit c8f3582345e6a69da65ab588f7c4c2d1685b0e80 ] + +It is required to return the received buffers, if streaming can not be +started. For instance media_pipeline_start() may fail with EPIPE, if +a link validation between entities is not passed, and in such a case +a user gets a kernel warning: + + WARNING: CPU: 1 PID: 520 at drivers/media/common/videobuf2/videobuf2-core.c:1592 vb2_start_streaming+0xec/0x160 + + Call trace: + vb2_start_streaming+0xec/0x160 + vb2_core_streamon+0x9c/0x1a0 + vb2_ioctl_streamon+0x68/0xbc + v4l_streamon+0x30/0x3c + __video_do_ioctl+0x184/0x3e0 + video_usercopy+0x37c/0x7b0 + video_ioctl2+0x24/0x40 + v4l2_ioctl+0x4c/0x70 + +The fix is to correct the error path in video_start_streaming() of camss. + +Fixes: 0ac2586c410f ("media: camss: Add files which handle the video device nodes") +Signed-off-by: Vladimir Zapolskiy +Reviewed-by: Robert Foss +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/camss/camss-video.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/camss/camss-video.c b/drivers/media/platform/qcom/camss/camss-video.c +index e81ebeb0506e..23701ec8d7de 100644 +--- a/drivers/media/platform/qcom/camss/camss-video.c ++++ b/drivers/media/platform/qcom/camss/camss-video.c +@@ -438,7 +438,7 @@ static int video_start_streaming(struct vb2_queue *q, unsigned int count) + + ret = media_pipeline_start(&vdev->entity, &video->pipe); + if (ret < 0) +- return ret; ++ goto flush_buffers; + + ret = video_check_format(video); + if (ret < 0) +@@ -467,6 +467,7 @@ static int video_start_streaming(struct vb2_queue *q, unsigned int count) + error: + media_pipeline_stop(&vdev->entity); + ++flush_buffers: + video->ops->flush_buffers(video, VB2_BUF_STATE_QUEUED); + + return ret; +-- +2.35.1 + diff --git a/queue-4.19/media-coda-add-check-for-dcoda_iram_alloc.patch b/queue-4.19/media-coda-add-check-for-dcoda_iram_alloc.patch new file mode 100644 index 00000000000..bde6690d483 --- /dev/null +++ b/queue-4.19/media-coda-add-check-for-dcoda_iram_alloc.patch @@ -0,0 +1,47 @@ +From 6e4d9d2878609e914b0c3ff873227c69068907c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 14:56:52 +0800 +Subject: media: coda: Add check for dcoda_iram_alloc + +From: Jiasheng Jiang + +[ Upstream commit 6b8082238fb8bb20f67e46388123e67a5bbc558d ] + +As the coda_iram_alloc may return NULL pointer, +it should be better to check the return value +in order to avoid NULL poineter dereference, +same as the others. + +Fixes: b313bcc9a467 ("[media] coda: simplify IRAM setup") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/coda-bit.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c +index c3eaddced721..57b62076b1ba 100644 +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -670,7 +670,7 @@ static void coda_setup_iram(struct coda_ctx *ctx) + /* Only H.264BP and H.263P3 are considered */ + iram_info->buf_dbk_y_use = coda_iram_alloc(iram_info, w64); + iram_info->buf_dbk_c_use = coda_iram_alloc(iram_info, w64); +- if (!iram_info->buf_dbk_c_use) ++ if (!iram_info->buf_dbk_y_use || !iram_info->buf_dbk_c_use) + goto out; + iram_info->axi_sram_use |= dbk_bits; + +@@ -694,7 +694,7 @@ static void coda_setup_iram(struct coda_ctx *ctx) + + iram_info->buf_dbk_y_use = coda_iram_alloc(iram_info, w128); + iram_info->buf_dbk_c_use = coda_iram_alloc(iram_info, w128); +- if (!iram_info->buf_dbk_c_use) ++ if (!iram_info->buf_dbk_y_use || !iram_info->buf_dbk_c_use) + goto out; + iram_info->axi_sram_use |= dbk_bits; + +-- +2.35.1 + diff --git a/queue-4.19/media-coda-add-check-for-kmalloc.patch b/queue-4.19/media-coda-add-check-for-kmalloc.patch new file mode 100644 index 00000000000..e62a901d693 --- /dev/null +++ b/queue-4.19/media-coda-add-check-for-kmalloc.patch @@ -0,0 +1,48 @@ +From 6b020ebb25feeb7c99f90e6988715b5fb2fd3fcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 15:02:36 +0800 +Subject: media: coda: Add check for kmalloc + +From: Jiasheng Jiang + +[ Upstream commit 6e5e5defdb8b0186312c2f855ace175aee6daf9b ] + +As the kmalloc may return NULL pointer, +it should be better to check the return value +in order to avoid NULL poineter dereference, +same as the others. + +Fixes: cb1d3a336371 ("[media] coda: add CODA7541 JPEG support") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/coda-bit.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c +index 57b62076b1ba..e73bf8e14f33 100644 +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -901,10 +901,16 @@ static int coda_start_encoding(struct coda_ctx *ctx) + } + + if (dst_fourcc == V4L2_PIX_FMT_JPEG) { +- if (!ctx->params.jpeg_qmat_tab[0]) ++ if (!ctx->params.jpeg_qmat_tab[0]) { + ctx->params.jpeg_qmat_tab[0] = kmalloc(64, GFP_KERNEL); +- if (!ctx->params.jpeg_qmat_tab[1]) ++ if (!ctx->params.jpeg_qmat_tab[0]) ++ return -ENOMEM; ++ } ++ if (!ctx->params.jpeg_qmat_tab[1]) { + ctx->params.jpeg_qmat_tab[1] = kmalloc(64, GFP_KERNEL); ++ if (!ctx->params.jpeg_qmat_tab[1]) ++ return -ENOMEM; ++ } + coda_set_jpeg_compression_quality(ctx, ctx->params.jpeg_quality); + } + +-- +2.35.1 + diff --git a/queue-4.19/media-dvb-core-fix-ignored-return-value-in-dvb_regis.patch b/queue-4.19/media-dvb-core-fix-ignored-return-value-in-dvb_regis.patch new file mode 100644 index 00000000000..50b19bc96be --- /dev/null +++ b/queue-4.19/media-dvb-core-fix-ignored-return-value-in-dvb_regis.patch @@ -0,0 +1,71 @@ +From 6f9625999b5d9dccc48b3e6932359f08fc72a8c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 03:30:05 +0000 +Subject: media: dvb-core: Fix ignored return value in dvb_register_frontend() + +From: Chen Zhongjin + +[ Upstream commit a574359e2e71ce16be212df3a082ed60a4bd2c5f ] + +In dvb_register_frontend(), dvb_register_device() is possible to fail +but its return value is ignored. + +It will cause use-after-free when module is removed, because in +dvb_unregister_frontend() it tries to unregister a not registered +device. + +BUG: KASAN: use-after-free in dvb_remove_device+0x18b/0x1f0 [dvb_core] +Read of size 4 at addr ffff88800dff4824 by task rmmod/428 +CPU: 3 PID: 428 Comm: rmmod +Call Trace: + + ... + dvb_remove_device+0x18b/0x1f0 [dvb_core] + dvb_unregister_frontend+0x7b/0x130 [dvb_core] + vidtv_bridge_remove+0x6e/0x160 [dvb_vidtv_bridge] + ... + +Fix this by catching return value of dvb_register_device(). +However the fe->refcount can't be put to zero immediately, because +there are still modules calling dvb_frontend_detach() when +dvb_register_frontend() fails. + +Link: https://lore.kernel.org/linux-media/20221108033005.169095-1-chenzhongjin@huawei.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Chen Zhongjin +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dvb_frontend.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c +index 8a61150ee249..1768c1b515b3 100644 +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -2956,6 +2956,7 @@ int dvb_register_frontend(struct dvb_adapter *dvb, + .name = fe->ops.info.name, + #endif + }; ++ int ret; + + dev_dbg(dvb->device, "%s:\n", __func__); + +@@ -2989,8 +2990,13 @@ int dvb_register_frontend(struct dvb_adapter *dvb, + "DVB: registering adapter %i frontend %i (%s)...\n", + fe->dvb->num, fe->id, fe->ops.info.name); + +- dvb_register_device(fe->dvb, &fepriv->dvbdev, &dvbdev_template, ++ ret = dvb_register_device(fe->dvb, &fepriv->dvbdev, &dvbdev_template, + fe, DVB_DEVICE_FRONTEND, 0); ++ if (ret) { ++ dvb_frontend_put(fe); ++ mutex_unlock(&frontend_mutex); ++ return ret; ++ } + + /* + * Initialize the cache to the proper values according with the +-- +2.35.1 + diff --git a/queue-4.19/media-dvb-frontends-fix-leak-of-memory-fw.patch b/queue-4.19/media-dvb-frontends-fix-leak-of-memory-fw.patch new file mode 100644 index 00000000000..ab67dc32558 --- /dev/null +++ b/queue-4.19/media-dvb-frontends-fix-leak-of-memory-fw.patch @@ -0,0 +1,32 @@ +From f88bb7b1ae6586c90dfc69cc64dedaee8fdd7359 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Apr 2022 07:19:25 +0100 +Subject: media: dvb-frontends: fix leak of memory fw + +From: Yan Lei + +[ Upstream commit a15fe8d9f1bf460a804bcf18a890bfd2cf0d5caa ] + +Link: https://lore.kernel.org/linux-media/20220410061925.4107-1-chinayanlei2002@163.com +Signed-off-by: Yan Lei +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/bcm3510.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c +index e92542b92d34..6457b0912d14 100644 +--- a/drivers/media/dvb-frontends/bcm3510.c ++++ b/drivers/media/dvb-frontends/bcm3510.c +@@ -649,6 +649,7 @@ static int bcm3510_download_firmware(struct dvb_frontend* fe) + deb_info("firmware chunk, addr: 0x%04x, len: 0x%04x, total length: 0x%04zx\n",addr,len,fw->size); + if ((ret = bcm3510_write_ram(st,addr,&b[i+4],len)) < 0) { + err("firmware download failed: %d\n",ret); ++ release_firmware(fw); + return ret; + } + i += 4 + len; +-- +2.35.1 + diff --git a/queue-4.19/media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch b/queue-4.19/media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch new file mode 100644 index 00000000000..2c93324549d --- /dev/null +++ b/queue-4.19/media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch @@ -0,0 +1,64 @@ +From 29c8ca475bea53a7b9a93a6df2cabd8ab5630db3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Nov 2022 06:59:18 +0000 +Subject: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() + +From: Baisong Zhong + +[ Upstream commit 0ed554fd769a19ea8464bb83e9ac201002ef74ad ] + +Wei Chen reports a kernel bug as blew: + +general protection fault, probably for non-canonical address +KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] +... +Call Trace: + +__i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 +i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 +i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 +i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 +vfs_ioctl fs/ioctl.c:51 [inline] +__do_sys_ioctl fs/ioctl.c:870 [inline] +__se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7fd834a8bded + +In az6027_i2c_xfer(), if msg[i].addr is 0x99, +a null-ptr-deref will caused when accessing msg[i].buf. +For msg[i].len is 0 and msg[i].buf is null. + +Fix this by checking msg[i].len in az6027_i2c_xfer(). + +Link: https://lore.kernel.org/lkml/CAO4mrfcPHB5aQJO=mpqV+p8mPLNg-Fok0gw8gZ=zemAfMGTzMg@mail.gmail.com/ + +Link: https://lore.kernel.org/linux-media/20221120065918.2160782-1-zhongbaisong@huawei.com +Fixes: 76f9a820c867 ("V4L/DVB: AZ6027: Initial import of the driver") +Reported-by: Wei Chen +Signed-off-by: Baisong Zhong +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/az6027.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c +index 990719727dc3..7d71ac7811eb 100644 +--- a/drivers/media/usb/dvb-usb/az6027.c ++++ b/drivers/media/usb/dvb-usb/az6027.c +@@ -978,6 +978,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n + if (msg[i].addr == 0x99) { + req = 0xBE; + index = 0; ++ if (msg[i].len < 1) { ++ i = -EOPNOTSUPP; ++ break; ++ } + value = msg[i].buf[0] & 0x00ff; + length = 1; + az6027_usb_out_op(d, req, value, index, data, length); +-- +2.35.1 + diff --git a/queue-4.19/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch b/queue-4.19/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch new file mode 100644 index 00000000000..06138ecbe55 --- /dev/null +++ b/queue-4.19/media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch @@ -0,0 +1,97 @@ +From e45baf60f528a9b68bf0608191779a86105c379a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 02:21:52 +0100 +Subject: media: dvb-usb: fix memory leak in dvb_usb_adapter_init() + +From: Mazin Al Haddad + +[ Upstream commit 94d90fb06b94a90c176270d38861bcba34ce377d ] + +Syzbot reports a memory leak in "dvb_usb_adapter_init()". +The leak is due to not accounting for and freeing current iteration's +adapter->priv in case of an error. Currently if an error occurs, +it will exit before incrementing "num_adapters_initalized", +which is used as a reference counter to free all adap->priv +in "dvb_usb_adapter_exit()". There are multiple error paths that +can exit from before incrementing the counter. Including the +error handling paths for "dvb_usb_adapter_stream_init()", +"dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" +within "dvb_usb_adapter_init()". + +This means that in case of an error in any of these functions the +current iteration is not accounted for and the current iteration's +adap->priv is not freed. + +Fix this by freeing the current iteration's adap->priv in the +"stream_init_err:" label in the error path. The rest of the +(accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() +as expected using the num_adapters_initalized variable. + +Syzbot report: + +BUG: memory leak +unreferenced object 0xffff8881172f1a00 (size 512): + comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ +backtrace: + [] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] + [] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] + [] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 + [] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 + [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 + [] call_driver_probe drivers/base/dd.c:542 [inline] + [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 + [] really_probe drivers/base/dd.c:583 [inline] + [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 + [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 + [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 + [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 + [] __device_attach+0x122/0x260 drivers/base/dd.c:970 + [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 + [] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 + [] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 + [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 + [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 + [] call_driver_probe drivers/base/dd.c:542 [inline] + [] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 + [] really_probe drivers/base/dd.c:583 [inline] + [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 + +Link: https://syzkaller.appspot.com/bug?extid=f66dd31987e6740657be +Reported-and-tested-by: syzbot+f66dd31987e6740657be@syzkaller.appspotmail.com + +Link: https://lore.kernel.org/linux-media/20220824012152.539788-1-mazinalhaddad05@gmail.com +Signed-off-by: Mazin Al Haddad +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dvb-usb-init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c +index 4b1445d806e5..16be32b19ca1 100644 +--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c ++++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c +@@ -84,7 +84,7 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + + ret = dvb_usb_adapter_stream_init(adap); + if (ret) +- return ret; ++ goto stream_init_err; + + ret = dvb_usb_adapter_dvb_init(adap, adapter_nrs); + if (ret) +@@ -117,6 +117,8 @@ static int dvb_usb_adapter_init(struct dvb_usb_device *d, short *adapter_nrs) + dvb_usb_adapter_dvb_exit(adap); + dvb_init_err: + dvb_usb_adapter_stream_exit(adap); ++stream_init_err: ++ kfree(adap->priv); + return ret; + } + +-- +2.35.1 + diff --git a/queue-4.19/media-dvbdev-adopts-refcnt-to-avoid-uaf.patch b/queue-4.19/media-dvbdev-adopts-refcnt-to-avoid-uaf.patch new file mode 100644 index 00000000000..e240d5d74ac --- /dev/null +++ b/queue-4.19/media-dvbdev-adopts-refcnt-to-avoid-uaf.patch @@ -0,0 +1,210 @@ +From 46a2c3c6f94607deab2adf3da91ae6a58ef595fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Aug 2022 15:59:52 +0100 +Subject: media: dvbdev: adopts refcnt to avoid UAF + +From: Lin Ma + +[ Upstream commit 0fc044b2b5e2d05a1fa1fb0d7f270367a7855d79 ] + +dvb_unregister_device() is known that prone to use-after-free. +That is, the cleanup from dvb_unregister_device() releases the dvb_device +even if there are pointers stored in file->private_data still refer to it. + +This patch adds a reference counter into struct dvb_device and delays its +deallocation until no pointer refers to the object. + +Link: https://lore.kernel.org/linux-media/20220807145952.10368-1-linma@zju.edu.cn +Signed-off-by: Lin Ma +Reported-by: kernel test robot +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dvb_ca_en50221.c | 2 +- + drivers/media/dvb-core/dvb_frontend.c | 2 +- + drivers/media/dvb-core/dvbdev.c | 32 +++++++++++++++++++------ + include/media/dvbdev.h | 31 +++++++++++++----------- + 4 files changed, 44 insertions(+), 23 deletions(-) + +diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c +index 4d371cea0d5d..36afcea709a7 100644 +--- a/drivers/media/dvb-core/dvb_ca_en50221.c ++++ b/drivers/media/dvb-core/dvb_ca_en50221.c +@@ -168,7 +168,7 @@ static void dvb_ca_private_free(struct dvb_ca_private *ca) + { + unsigned int i; + +- dvb_free_device(ca->dvbdev); ++ dvb_device_put(ca->dvbdev); + for (i = 0; i < ca->slot_count; i++) + vfree(ca->slot_info[i].rx_buffer.data); + +diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c +index 1768c1b515b3..e0650bc2df61 100644 +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -147,7 +147,7 @@ static void __dvb_frontend_free(struct dvb_frontend *fe) + struct dvb_frontend_private *fepriv = fe->frontend_priv; + + if (fepriv) +- dvb_free_device(fepriv->dvbdev); ++ dvb_device_put(fepriv->dvbdev); + + dvb_frontend_invoke_release(fe, fe->ops.release); + +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index d8f19a4d214a..bf527eda6f05 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -107,7 +107,7 @@ static int dvb_device_open(struct inode *inode, struct file *file) + new_fops = fops_get(dvbdev->fops); + if (!new_fops) + goto fail; +- file->private_data = dvbdev; ++ file->private_data = dvb_device_get(dvbdev); + replace_fops(file, new_fops); + if (file->f_op->open) + err = file->f_op->open(inode, file); +@@ -171,6 +171,9 @@ int dvb_generic_release(struct inode *inode, struct file *file) + } + + dvbdev->users++; ++ ++ dvb_device_put(dvbdev); ++ + return 0; + } + EXPORT_SYMBOL(dvb_generic_release); +@@ -487,6 +490,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + return -ENOMEM; + } + ++ kref_init(&dvbdev->ref); + memcpy(dvbdev, template, sizeof(struct dvb_device)); + dvbdev->type = type; + dvbdev->id = id; +@@ -518,7 +522,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + #endif + + dvbdev->minor = minor; +- dvb_minors[minor] = dvbdev; ++ dvb_minors[minor] = dvb_device_get(dvbdev); + up_write(&minor_rwsem); + + ret = dvb_register_media_device(dvbdev, type, minor, demux_sink_pads); +@@ -559,6 +563,7 @@ void dvb_remove_device(struct dvb_device *dvbdev) + + down_write(&minor_rwsem); + dvb_minors[dvbdev->minor] = NULL; ++ dvb_device_put(dvbdev); + up_write(&minor_rwsem); + + dvb_media_device_free(dvbdev); +@@ -570,21 +575,34 @@ void dvb_remove_device(struct dvb_device *dvbdev) + EXPORT_SYMBOL(dvb_remove_device); + + +-void dvb_free_device(struct dvb_device *dvbdev) ++static void dvb_free_device(struct kref *ref) + { +- if (!dvbdev) +- return; ++ struct dvb_device *dvbdev = container_of(ref, struct dvb_device, ref); + + kfree (dvbdev->fops); + kfree (dvbdev); + } +-EXPORT_SYMBOL(dvb_free_device); ++ ++ ++struct dvb_device *dvb_device_get(struct dvb_device *dvbdev) ++{ ++ kref_get(&dvbdev->ref); ++ return dvbdev; ++} ++EXPORT_SYMBOL(dvb_device_get); ++ ++ ++void dvb_device_put(struct dvb_device *dvbdev) ++{ ++ if (dvbdev) ++ kref_put(&dvbdev->ref, dvb_free_device); ++} + + + void dvb_unregister_device(struct dvb_device *dvbdev) + { + dvb_remove_device(dvbdev); +- dvb_free_device(dvbdev); ++ dvb_device_put(dvbdev); + } + EXPORT_SYMBOL(dvb_unregister_device); + +diff --git a/include/media/dvbdev.h b/include/media/dvbdev.h +index 881ca461b7bb..6a0d22c4c3d8 100644 +--- a/include/media/dvbdev.h ++++ b/include/media/dvbdev.h +@@ -156,6 +156,7 @@ struct dvb_adapter { + */ + struct dvb_device { + struct list_head list_head; ++ struct kref ref; + const struct file_operations *fops; + struct dvb_adapter *adapter; + enum dvb_device_type type; +@@ -187,6 +188,20 @@ struct dvb_device { + void *priv; + }; + ++/** ++ * dvb_device_get - Increase dvb_device reference ++ * ++ * @dvbdev: pointer to struct dvb_device ++ */ ++struct dvb_device *dvb_device_get(struct dvb_device *dvbdev); ++ ++/** ++ * dvb_device_get - Decrease dvb_device reference ++ * ++ * @dvbdev: pointer to struct dvb_device ++ */ ++void dvb_device_put(struct dvb_device *dvbdev); ++ + /** + * dvb_register_adapter - Registers a new DVB adapter + * +@@ -231,29 +246,17 @@ int dvb_register_device(struct dvb_adapter *adap, + /** + * dvb_remove_device - Remove a registered DVB device + * +- * This does not free memory. To do that, call dvb_free_device(). ++ * This does not free memory. dvb_free_device() will do that when ++ * reference counter is empty + * + * @dvbdev: pointer to struct dvb_device + */ + void dvb_remove_device(struct dvb_device *dvbdev); + +-/** +- * dvb_free_device - Free memory occupied by a DVB device. +- * +- * Call dvb_unregister_device() before calling this function. +- * +- * @dvbdev: pointer to struct dvb_device +- */ +-void dvb_free_device(struct dvb_device *dvbdev); + + /** + * dvb_unregister_device - Unregisters a DVB device + * +- * This is a combination of dvb_remove_device() and dvb_free_device(). +- * Using this function is usually a mistake, and is often an indicator +- * for a use-after-free bug (when a userspace process keeps a file +- * handle to a detached device). +- * + * @dvbdev: pointer to struct dvb_device + */ + void dvb_unregister_device(struct dvb_device *dvbdev); +-- +2.35.1 + diff --git a/queue-4.19/media-i2c-ad5820-fix-error-path.patch b/queue-4.19/media-i2c-ad5820-fix-error-path.patch new file mode 100644 index 00000000000..8428830330f --- /dev/null +++ b/queue-4.19/media-i2c-ad5820-fix-error-path.patch @@ -0,0 +1,51 @@ +From 3c2882e378f104f6fa27e9897f8fe334df3d1367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 13:38:00 +0200 +Subject: media: i2c: ad5820: Fix error path + +From: Ricardo Ribalda + +[ Upstream commit 9fce241660f37d9e95e93c0ae6fba8cfefa5797b ] + +Error path seems to be swaped. Fix the order and provide some meaningful +names. + +Fixes: bee3d5115611 ("[media] ad5820: Add driver for auto-focus coil") +Signed-off-by: Ricardo Ribalda +Signed-off-by: Sakari Ailus +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ad5820.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/i2c/ad5820.c b/drivers/media/i2c/ad5820.c +index 034ebf754007..c2a6d1d5217a 100644 +--- a/drivers/media/i2c/ad5820.c ++++ b/drivers/media/i2c/ad5820.c +@@ -321,18 +321,18 @@ static int ad5820_probe(struct i2c_client *client, + + ret = media_entity_pads_init(&coil->subdev.entity, 0, NULL); + if (ret < 0) +- goto cleanup2; ++ goto clean_mutex; + + ret = v4l2_async_register_subdev(&coil->subdev); + if (ret < 0) +- goto cleanup; ++ goto clean_entity; + + return ret; + +-cleanup2: +- mutex_destroy(&coil->power_lock); +-cleanup: ++clean_entity: + media_entity_cleanup(&coil->subdev.entity); ++clean_mutex: ++ mutex_destroy(&coil->power_lock); + return ret; + } + +-- +2.35.1 + diff --git a/queue-4.19/media-imon-fix-a-race-condition-in-send_packet.patch b/queue-4.19/media-imon-fix-a-race-condition-in-send_packet.patch new file mode 100644 index 00000000000..234dfa90be1 --- /dev/null +++ b/queue-4.19/media-imon-fix-a-race-condition-in-send_packet.patch @@ -0,0 +1,79 @@ +From b16ded380726289357eaeb4241d17e82a6da9ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 06:02:14 +0100 +Subject: media: imon: fix a race condition in send_packet() + +From: Gautam Menghani + +[ Upstream commit 813ceef062b53d68f296aa3cb944b21a091fabdb ] + +The function send_packet() has a race condition as follows: + +func send_packet() +{ + // do work + call usb_submit_urb() + mutex_unlock() + wait_for_event_interruptible() <-- lock gone + mutex_lock() +} + +func vfd_write() +{ + mutex_lock() + call send_packet() <- prev call is not completed + mutex_unlock() +} + +When the mutex is unlocked and the function send_packet() waits for the +call to complete, vfd_write() can start another call, which leads to the +"URB submitted while active" warning in usb_submit_urb(). +Fix this by removing the mutex_unlock() call in send_packet() and using +mutex_lock_interruptible(). + +Link: https://syzkaller.appspot.com/bug?id=e378e6a51fbe6c5cc43e34f131cc9a315ef0337e + +Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver") +Reported-by: syzbot+0c3cb6dc05fbbdc3ad66@syzkaller.appspotmail.com +Signed-off-by: Gautam Menghani +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/imon.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c +index 6b10363fb6f0..99bb7380ee0e 100644 +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -613,15 +613,14 @@ static int send_packet(struct imon_context *ictx) + pr_err_ratelimited("error submitting urb(%d)\n", retval); + } else { + /* Wait for transmission to complete (or abort) */ +- mutex_unlock(&ictx->lock); + retval = wait_for_completion_interruptible( + &ictx->tx.finished); + if (retval) { + usb_kill_urb(ictx->tx_urb); + pr_err_ratelimited("task interrupted\n"); + } +- mutex_lock(&ictx->lock); + ++ ictx->tx.busy = false; + retval = ictx->tx.status; + if (retval) + pr_err_ratelimited("packet tx failed (%d)\n", retval); +@@ -928,7 +927,8 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, + return -ENODEV; + } + +- mutex_lock(&ictx->lock); ++ if (mutex_lock_interruptible(&ictx->lock)) ++ return -ERESTARTSYS; + + if (!ictx->dev_present_intf0) { + pr_err_ratelimited("no iMON device present\n"); +-- +2.35.1 + diff --git a/queue-4.19/media-platform-exynos4-is-fix-error-handling-in-fimc.patch b/queue-4.19/media-platform-exynos4-is-fix-error-handling-in-fimc.patch new file mode 100644 index 00000000000..a6a7c564e21 --- /dev/null +++ b/queue-4.19/media-platform-exynos4-is-fix-error-handling-in-fimc.patch @@ -0,0 +1,75 @@ +From 380f5f6d423ee75cf3e51c63604282c546b75afd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 06:08:53 +0000 +Subject: media: platform: exynos4-is: Fix error handling in fimc_md_init() + +From: Yuan Can + +[ Upstream commit b434422c45282a0573d8123239abc41fa72665d4 ] + +A problem about modprobe s5p_fimc failed is triggered with the +following log given: + + [ 272.075275] Error: Driver 'exynos4-fimc' is already registered, aborting... + modprobe: ERROR: could not insert 's5p_fimc': Device or resource busy + +The reason is that fimc_md_init() returns platform_driver_register() +directly without checking its return value, if platform_driver_register() +failed, it returns without unregister fimc_driver, resulting the +s5p_fimc can never be installed later. +A simple call graph is shown as below: + + fimc_md_init() + fimc_register_driver() # register fimc_driver + platform_driver_register() + platform_driver_register() + driver_register() + bus_add_driver() + dev = kzalloc(...) # OOM happened + # return without unregister fimc_driver + +Fix by unregister fimc_driver when platform_driver_register() returns +error. + +Fixes: d3953223b090 ("[media] s5p-fimc: Add the media device driver") +Signed-off-by: Yuan Can +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/fimc-core.c | 2 +- + drivers/media/platform/exynos4-is/media-dev.c | 6 +++++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c +index d8d8c9902b19..cc8bc41b7db7 100644 +--- a/drivers/media/platform/exynos4-is/fimc-core.c ++++ b/drivers/media/platform/exynos4-is/fimc-core.c +@@ -1255,7 +1255,7 @@ int __init fimc_register_driver(void) + return platform_driver_register(&fimc_driver); + } + +-void __exit fimc_unregister_driver(void) ++void fimc_unregister_driver(void) + { + platform_driver_unregister(&fimc_driver); + } +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index 3261dc72cc61..03171f2cf296 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -1566,7 +1566,11 @@ static int __init fimc_md_init(void) + if (ret) + return ret; + +- return platform_driver_register(&fimc_md_driver); ++ ret = platform_driver_register(&fimc_md_driver); ++ if (ret) ++ fimc_unregister_driver(); ++ ++ return ret; + } + + static void __exit fimc_md_exit(void) +-- +2.35.1 + diff --git a/queue-4.19/media-s5p-mfc-add-variant-data-for-mfc-v7-hardware-f.patch b/queue-4.19/media-s5p-mfc-add-variant-data-for-mfc-v7-hardware-f.patch new file mode 100644 index 00000000000..401e0031c4f --- /dev/null +++ b/queue-4.19/media-s5p-mfc-add-variant-data-for-mfc-v7-hardware-f.patch @@ -0,0 +1,66 @@ +From 782560ba03174ef418cf99ba1b5992dba5831998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 11:50:23 +0000 +Subject: media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 + SoC + +From: Aakarsh Jain + +[ Upstream commit f50ebe10f5d8092c37e2bd430c78e03bf38b1e20 ] + +Commit 5441e9dafdfc6dc40 ("[media] s5p-mfc: Core support for MFC v7") +which adds mfc v7 support for Exynos3250 and use the same compatible +string as used by Exynos5240 but both the IPs are a bit different in +terms of IP clock. +Add variant driver data based on the new compatible string +"samsung,exynos3250-mfc" for Exynos3250 SoC. + +Suggested-by: Alim Akhtar +Fixes: 5441e9dafdfc ("[media] s5p-mfc: Core support for MFC v7") +Signed-off-by: Aakarsh Jain +Reviewed-by: Alim Akhtar +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-mfc/s5p_mfc.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c +index 0fc101bc58d6..684aa8491a38 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c +@@ -1574,8 +1574,18 @@ static struct s5p_mfc_variant mfc_drvdata_v7 = { + .port_num = MFC_NUM_PORTS_V7, + .buf_size = &buf_size_v7, + .fw_name[0] = "s5p-mfc-v7.fw", +- .clk_names = {"mfc", "sclk_mfc"}, +- .num_clocks = 2, ++ .clk_names = {"mfc"}, ++ .num_clocks = 1, ++}; ++ ++static struct s5p_mfc_variant mfc_drvdata_v7_3250 = { ++ .version = MFC_VERSION_V7, ++ .version_bit = MFC_V7_BIT, ++ .port_num = MFC_NUM_PORTS_V7, ++ .buf_size = &buf_size_v7, ++ .fw_name[0] = "s5p-mfc-v7.fw", ++ .clk_names = {"mfc", "sclk_mfc"}, ++ .num_clocks = 2, + }; + + static struct s5p_mfc_buf_size_v6 mfc_buf_size_v8 = { +@@ -1645,6 +1655,9 @@ static const struct of_device_id exynos_mfc_match[] = { + }, { + .compatible = "samsung,mfc-v7", + .data = &mfc_drvdata_v7, ++ }, { ++ .compatible = "samsung,exynos3250-mfc", ++ .data = &mfc_drvdata_v7_3250, + }, { + .compatible = "samsung,mfc-v8", + .data = &mfc_drvdata_v8, +-- +2.35.1 + diff --git a/queue-4.19/media-saa7164-fix-missing-pci_disable_device.patch b/queue-4.19/media-saa7164-fix-missing-pci_disable_device.patch new file mode 100644 index 00000000000..f8150fd7b42 --- /dev/null +++ b/queue-4.19/media-saa7164-fix-missing-pci_disable_device.patch @@ -0,0 +1,45 @@ +From c7418820c6ca2141200fec70230341fdf5decf9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Nov 2022 11:31:26 +0000 +Subject: media: saa7164: fix missing pci_disable_device() + +From: Liu Shixin + +[ Upstream commit 57fb35d7542384cac8f198cd1c927540ad38b61a ] + +Add missing pci_disable_device() in the error path in saa7164_initdev(). + +Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") +Signed-off-by: Liu Shixin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7164/saa7164-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c +index 5102519df108..dba9071e8507 100644 +--- a/drivers/media/pci/saa7164/saa7164-core.c ++++ b/drivers/media/pci/saa7164/saa7164-core.c +@@ -1237,7 +1237,7 @@ static int saa7164_initdev(struct pci_dev *pci_dev, + + if (saa7164_dev_setup(dev) < 0) { + err = -EINVAL; +- goto fail_free; ++ goto fail_dev; + } + + /* print pci info */ +@@ -1405,6 +1405,8 @@ static int saa7164_initdev(struct pci_dev *pci_dev, + + fail_irq: + saa7164_dev_unregister(dev); ++fail_dev: ++ pci_disable_device(pci_dev); + fail_free: + v4l2_device_unregister(&dev->v4l2_dev); + kfree(dev); +-- +2.35.1 + diff --git a/queue-4.19/media-si470x-fix-use-after-free-in-si470x_int_in_cal.patch b/queue-4.19/media-si470x-fix-use-after-free-in-si470x_int_in_cal.patch new file mode 100644 index 00000000000..651f09074c7 --- /dev/null +++ b/queue-4.19/media-si470x-fix-use-after-free-in-si470x_int_in_cal.patch @@ -0,0 +1,64 @@ +From 674f95ecc74334686c3d97c3635287530ac38aee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 03:51:59 +0900 +Subject: media: si470x: Fix use-after-free in si470x_int_in_callback() + +From: Shigeru Yoshida + +[ Upstream commit 7d21e0b1b41b21d628bf2afce777727bd4479aa5 ] + +syzbot reported use-after-free in si470x_int_in_callback() [1]. This +indicates that urb->context, which contains struct si470x_device +object, is freed when si470x_int_in_callback() is called. + +The cause of this issue is that si470x_int_in_callback() is called for +freed urb. + +si470x_usb_driver_probe() calls si470x_start_usb(), which then calls +usb_submit_urb() and si470x_start(). If si470x_start_usb() fails, +si470x_usb_driver_probe() doesn't kill urb, but it just frees struct +si470x_device object, as depicted below: + +si470x_usb_driver_probe() + ... + si470x_start_usb() + ... + usb_submit_urb() + retval = si470x_start() + return retval + if (retval < 0) + free struct si470x_device object, but don't kill urb + +This patch fixes this issue by killing urb when si470x_start_usb() +fails and urb is submitted. If si470x_start_usb() fails and urb is +not submitted, i.e. submitting usb fails, it just frees struct +si470x_device object. + +Reported-by: syzbot+9ca7a12fd736d93e0232@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=94ed6dddd5a55e90fd4bab942aa4bb297741d977 [1] +Signed-off-by: Shigeru Yoshida +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/radio/si470x/radio-si470x-usb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/radio/si470x/radio-si470x-usb.c b/drivers/media/radio/si470x/radio-si470x-usb.c +index ba43a727c0b9..51b961cfba7c 100644 +--- a/drivers/media/radio/si470x/radio-si470x-usb.c ++++ b/drivers/media/radio/si470x/radio-si470x-usb.c +@@ -742,8 +742,10 @@ static int si470x_usb_driver_probe(struct usb_interface *intf, + + /* start radio */ + retval = si470x_start_usb(radio); +- if (retval < 0) ++ if (retval < 0 && !radio->int_in_running) + goto err_buf; ++ else if (retval < 0) /* in case of radio->int_in_running == 1 */ ++ goto err_all; + + /* set initial frequency */ + si470x_set_freq(radio, 87.5 * FREQ_MUL); /* available in all regions */ +-- +2.35.1 + diff --git a/queue-4.19/media-solo6x10-fix-possible-memory-leak-in-solo_sysf.patch b/queue-4.19/media-solo6x10-fix-possible-memory-leak-in-solo_sysf.patch new file mode 100644 index 00000000000..30de69ea236 --- /dev/null +++ b/queue-4.19/media-solo6x10-fix-possible-memory-leak-in-solo_sysf.patch @@ -0,0 +1,38 @@ +From ec399a2ae7dcb1633c3e786bfd89ce6f94060676 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 16:24:23 +0800 +Subject: media: solo6x10: fix possible memory leak in solo_sysfs_init() + +From: Yang Yingliang + +[ Upstream commit 7f5866dd96d95b74e439f6ee17b8abd8195179fb ] + +If device_register() returns error in solo_sysfs_init(), the +name allocated by dev_set_name() need be freed. As comment of +device_register() says, it should use put_device() to give up +the reference in the error path. So fix this by calling +put_device(), then the name can be freed in kobject_cleanup(). + +Fixes: dcae5dacbce5 ("[media] solo6x10: sync to latest code from Bluecherry's git repo") +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-core.c b/drivers/media/pci/solo6x10/solo6x10-core.c +index 19ffd2ed3cc7..d3bca099b78b 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-core.c ++++ b/drivers/media/pci/solo6x10/solo6x10-core.c +@@ -429,6 +429,7 @@ static int solo_sysfs_init(struct solo_dev *solo_dev) + solo_dev->nr_chans); + + if (device_register(dev)) { ++ put_device(dev); + dev->parent = NULL; + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-4.19/media-vivid-fix-compose-size-exceed-boundary.patch b/queue-4.19/media-vivid-fix-compose-size-exceed-boundary.patch new file mode 100644 index 00000000000..89d479e59b9 --- /dev/null +++ b/queue-4.19/media-vivid-fix-compose-size-exceed-boundary.patch @@ -0,0 +1,57 @@ +From 94175e61f2de5e48eb31fb3614d461ea396b22d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 20:38:55 +0800 +Subject: media: vivid: fix compose size exceed boundary + +From: Liu Shixin + +[ Upstream commit 94a7ad9283464b75b12516c5512541d467cefcf8 ] + +syzkaller found a bug: + + BUG: unable to handle page fault for address: ffffc9000a3b1000 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 100000067 P4D 100000067 PUD 10015f067 PMD 1121ca067 PTE 0 + Oops: 0002 [#1] PREEMPT SMP + CPU: 0 PID: 23489 Comm: vivid-000-vid-c Not tainted 6.1.0-rc1+ #512 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 + RIP: 0010:memcpy_erms+0x6/0x10 +[...] + Call Trace: + + ? tpg_fill_plane_buffer+0x856/0x15b0 + vivid_fillbuff+0x8ac/0x1110 + vivid_thread_vid_cap_tick+0x361/0xc90 + vivid_thread_vid_cap+0x21a/0x3a0 + kthread+0x143/0x180 + ret_from_fork+0x1f/0x30 + + +This is because we forget to check boundary after adjust compose->height +int V4L2_SEL_TGT_CROP case. Add v4l2_rect_map_inside() to fix this problem +for this case. + +Fixes: ef834f7836ec ("[media] vivid: add the video capture and output parts") +Signed-off-by: Liu Shixin +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vivid/vivid-vid-cap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c +index 48f2c9c96fc9..ded48b7ad774 100644 +--- a/drivers/media/platform/vivid/vivid-vid-cap.c ++++ b/drivers/media/platform/vivid/vivid-vid-cap.c +@@ -923,6 +923,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection + if (dev->has_compose_cap) { + v4l2_rect_set_min_size(compose, &min_rect); + v4l2_rect_set_max_size(compose, &max_rect); ++ v4l2_rect_map_inside(compose, &fmt); + } + dev->fmt_cap_rect = fmt; + tpg_s_buf_height(&dev->tpg, fmt.height); +-- +2.35.1 + diff --git a/queue-4.19/mips-bcm63xx-add-check-for-null-for-clk-in-clk_enabl.patch b/queue-4.19/mips-bcm63xx-add-check-for-null-for-clk-in-clk_enabl.patch new file mode 100644 index 00000000000..ed5d4c84ab7 --- /dev/null +++ b/queue-4.19/mips-bcm63xx-add-check-for-null-for-clk-in-clk_enabl.patch @@ -0,0 +1,44 @@ +From 2f54c6d97fb55d1703abafdd4c943eaf2530ce79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 13:05:50 +0300 +Subject: MIPS: BCM63xx: Add check for NULL for clk in clk_enable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Anastasia Belova + +[ Upstream commit ee9ef11bd2a59c2fefaa0959e5efcdf040d7c654 ] + +Check clk for NULL before calling clk_enable_unlocked where clk +is dereferenced. There is such check in other implementations +of clk_enable. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.") +Signed-off-by: Anastasia Belova +Reviewed-by: Philippe Mathieu-Daudé +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bcm63xx/clk.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c +index dcfa0ea912fe..f183c45503ce 100644 +--- a/arch/mips/bcm63xx/clk.c ++++ b/arch/mips/bcm63xx/clk.c +@@ -361,6 +361,8 @@ static struct clk clk_periph = { + */ + int clk_enable(struct clk *clk) + { ++ if (!clk) ++ return 0; + mutex_lock(&clocks_mutex); + clk_enable_unlocked(clk); + mutex_unlock(&clocks_mutex); +-- +2.35.1 + diff --git a/queue-4.19/mips-vpe-cmp-fix-possible-memory-leak-while-module-e.patch b/queue-4.19/mips-vpe-cmp-fix-possible-memory-leak-while-module-e.patch new file mode 100644 index 00000000000..c97e1ffdfe3 --- /dev/null +++ b/queue-4.19/mips-vpe-cmp-fix-possible-memory-leak-while-module-e.patch @@ -0,0 +1,55 @@ +From 7eae071667e435eb31bbd680f869c05ae97d2e13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 11:39:45 +0800 +Subject: MIPS: vpe-cmp: fix possible memory leak while module exiting + +From: Yang Yingliang + +[ Upstream commit c5ed1fe0801f0c66b0fbce2785239a5664629057 ] + +dev_set_name() allocates memory for name, it need be freed +when module exiting, call put_device() to give up reference, +so that it can be freed in kobject_cleanup() when the refcount +hit to 0. The vpe_device is static, so remove kfree() from +vpe_device_release(). + +Fixes: 17a1d523aa58 ("MIPS: APRP: Add VPE loader support for CMP platforms.") +Signed-off-by: Yang Yingliang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/vpe-cmp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/vpe-cmp.c b/arch/mips/kernel/vpe-cmp.c +index 9268ebc0f61e..903c07bdc92d 100644 +--- a/arch/mips/kernel/vpe-cmp.c ++++ b/arch/mips/kernel/vpe-cmp.c +@@ -75,7 +75,6 @@ ATTRIBUTE_GROUPS(vpe); + + static void vpe_device_release(struct device *cd) + { +- kfree(cd); + } + + static struct class vpe_class = { +@@ -157,6 +156,7 @@ int __init vpe_module_init(void) + device_del(&vpe_device); + + out_class: ++ put_device(&vpe_device); + class_unregister(&vpe_class); + + out_chrdev: +@@ -169,7 +169,7 @@ void __exit vpe_module_exit(void) + { + struct vpe *v, *n; + +- device_del(&vpe_device); ++ device_unregister(&vpe_device); + class_unregister(&vpe_class); + unregister_chrdev(major, VPE_MODULE_NAME); + +-- +2.35.1 + diff --git a/queue-4.19/mips-vpe-mt-fix-possible-memory-leak-while-module-ex.patch b/queue-4.19/mips-vpe-mt-fix-possible-memory-leak-while-module-ex.patch new file mode 100644 index 00000000000..0adbfc30373 --- /dev/null +++ b/queue-4.19/mips-vpe-mt-fix-possible-memory-leak-while-module-ex.patch @@ -0,0 +1,56 @@ +From 567119b84cb4db5c89f61b2463d13782f0cf22df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 11:39:44 +0800 +Subject: MIPS: vpe-mt: fix possible memory leak while module exiting + +From: Yang Yingliang + +[ Upstream commit 5822e8cc84ee37338ab0bdc3124f6eec04dc232d ] + +Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's +bus_id string array"), the name of device is allocated dynamically, +it need be freed when module exiting, call put_device() to give up +reference, so that it can be freed in kobject_cleanup() when the +refcount hit to 0. The vpe_device is static, so remove kfree() from +vpe_device_release(). + +Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") +Signed-off-by: Yang Yingliang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/vpe-mt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/vpe-mt.c b/arch/mips/kernel/vpe-mt.c +index 2e003b11a098..9fd7cd48ea1d 100644 +--- a/arch/mips/kernel/vpe-mt.c ++++ b/arch/mips/kernel/vpe-mt.c +@@ -313,7 +313,6 @@ ATTRIBUTE_GROUPS(vpe); + + static void vpe_device_release(struct device *cd) + { +- kfree(cd); + } + + static struct class vpe_class = { +@@ -497,6 +496,7 @@ int __init vpe_module_init(void) + device_del(&vpe_device); + + out_class: ++ put_device(&vpe_device); + class_unregister(&vpe_class); + + out_chrdev: +@@ -509,7 +509,7 @@ void __exit vpe_module_exit(void) + { + struct vpe *v, *n; + +- device_del(&vpe_device); ++ device_unregister(&vpe_device); + class_unregister(&vpe_class); + unregister_chrdev(major, VPE_MODULE_NAME); + +-- +2.35.1 + diff --git a/queue-4.19/misc-sgi-gru-fix-use-after-free-error-in-gru_set_con.patch b/queue-4.19/misc-sgi-gru-fix-use-after-free-error-in-gru_set_con.patch new file mode 100644 index 00000000000..749aad03764 --- /dev/null +++ b/queue-4.19/misc-sgi-gru-fix-use-after-free-error-in-gru_set_con.patch @@ -0,0 +1,140 @@ +From ea8857b3680da7d634c6854b73771c71d5d3227f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 11:50:33 +0800 +Subject: misc: sgi-gru: fix use-after-free error in gru_set_context_option, + gru_fault and gru_handle_user_call_os + +From: Zheng Wang + +[ Upstream commit 643a16a0eb1d6ac23744bb6e90a00fc21148a9dc ] + +In some bad situation, the gts may be freed gru_check_chiplet_assignment. +The call chain can be gru_unload_context->gru_free_gru_context->gts_drop +and kfree finally. However, the caller didn't know if the gts is freed +or not and use it afterwards. This will trigger a Use after Free bug. + +Fix it by introducing a return value to see if it's in error path or not. +Free the gts in caller if gru_check_chiplet_assignment check failed. + +Fixes: 55484c45dbec ("gru: allow users to specify gru chiplet 2") +Signed-off-by: Zheng Wang +Acked-by: Dimitri Sivanich +Link: https://lore.kernel.org/r/20221110035033.19498-1-zyytlz.wz@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/sgi-gru/grufault.c | 13 +++++++++++-- + drivers/misc/sgi-gru/grumain.c | 22 ++++++++++++++++++---- + drivers/misc/sgi-gru/grutables.h | 2 +- + 3 files changed, 30 insertions(+), 7 deletions(-) + +diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c +index 93be82fc338a..16df731e63c5 100644 +--- a/drivers/misc/sgi-gru/grufault.c ++++ b/drivers/misc/sgi-gru/grufault.c +@@ -661,6 +661,7 @@ int gru_handle_user_call_os(unsigned long cb) + if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB) + return -EINVAL; + ++again: + gts = gru_find_lock_gts(cb); + if (!gts) + return -EINVAL; +@@ -669,7 +670,11 @@ int gru_handle_user_call_os(unsigned long cb) + if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE) + goto exit; + +- gru_check_context_placement(gts); ++ if (gru_check_context_placement(gts)) { ++ gru_unlock_gts(gts); ++ gru_unload_context(gts, 1); ++ goto again; ++ } + + /* + * CCH may contain stale data if ts_force_cch_reload is set. +@@ -887,7 +892,11 @@ int gru_set_context_option(unsigned long arg) + } else { + gts->ts_user_blade_id = req.val1; + gts->ts_user_chiplet_id = req.val0; +- gru_check_context_placement(gts); ++ if (gru_check_context_placement(gts)) { ++ gru_unlock_gts(gts); ++ gru_unload_context(gts, 1); ++ return ret; ++ } + } + break; + case sco_gseg_owner: +diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c +index ab174f28e3be..8c3e0317c115 100644 +--- a/drivers/misc/sgi-gru/grumain.c ++++ b/drivers/misc/sgi-gru/grumain.c +@@ -729,9 +729,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru, + * chiplet. Misassignment can occur if the process migrates to a different + * blade or if the user changes the selected blade/chiplet. + */ +-void gru_check_context_placement(struct gru_thread_state *gts) ++int gru_check_context_placement(struct gru_thread_state *gts) + { + struct gru_state *gru; ++ int ret = 0; + + /* + * If the current task is the context owner, verify that the +@@ -739,15 +740,23 @@ void gru_check_context_placement(struct gru_thread_state *gts) + * references. Pthread apps use non-owner references to the CBRs. + */ + gru = gts->ts_gru; ++ /* ++ * If gru or gts->ts_tgid_owner isn't initialized properly, return ++ * success to indicate that the caller does not need to unload the ++ * gru context.The caller is responsible for their inspection and ++ * reinitialization if needed. ++ */ + if (!gru || gts->ts_tgid_owner != current->tgid) +- return; ++ return ret; + + if (!gru_check_chiplet_assignment(gru, gts)) { + STAT(check_context_unload); +- gru_unload_context(gts, 1); ++ ret = -EINVAL; + } else if (gru_retarget_intr(gts)) { + STAT(check_context_retarget_intr); + } ++ ++ return ret; + } + + +@@ -947,7 +956,12 @@ vm_fault_t gru_fault(struct vm_fault *vmf) + mutex_lock(>s->ts_ctxlock); + preempt_disable(); + +- gru_check_context_placement(gts); ++ if (gru_check_context_placement(gts)) { ++ preempt_enable(); ++ mutex_unlock(>s->ts_ctxlock); ++ gru_unload_context(gts, 1); ++ return VM_FAULT_NOPAGE; ++ } + + if (!gts->ts_gru) { + STAT(load_user_context); +diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h +index 3e041b6f7a68..2becf4c3f7ca 100644 +--- a/drivers/misc/sgi-gru/grutables.h ++++ b/drivers/misc/sgi-gru/grutables.h +@@ -652,7 +652,7 @@ extern int gru_user_flush_tlb(unsigned long arg); + extern int gru_user_unload_context(unsigned long arg); + extern int gru_get_exception_detail(unsigned long arg); + extern int gru_set_context_option(unsigned long address); +-extern void gru_check_context_placement(struct gru_thread_state *gts); ++extern int gru_check_context_placement(struct gru_thread_state *gts); + extern int gru_cpu_fault_map_id(void); + extern struct vm_area_struct *gru_find_vma(unsigned long vaddr); + extern void gru_flush_all_tlb(struct gru_state *gru); +-- +2.35.1 + diff --git a/queue-4.19/misc-tifm-fix-possible-memory-leak-in-tifm_7xx1_swit.patch b/queue-4.19/misc-tifm-fix-possible-memory-leak-in-tifm_7xx1_swit.patch new file mode 100644 index 00000000000..10245f3a4f3 --- /dev/null +++ b/queue-4.19/misc-tifm-fix-possible-memory-leak-in-tifm_7xx1_swit.patch @@ -0,0 +1,42 @@ +From 8544e32339c83fa177c89482353b92e28959ddaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 14:47:25 +0800 +Subject: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() + +From: ruanjinjie + +[ Upstream commit fd2c930cf6a5b9176382c15f9acb1996e76e25ad ] + +If device_register() returns error in tifm_7xx1_switch_media(), +name of kobject which is allocated in dev_set_name() called in device_add() +is leaked. + +Never directly free @dev after calling device_register(), even +if it returned an error! Always use put_device() to give up the +reference initialized. + +Fixes: 2428a8fe2261 ("tifm: move common device management tasks from tifm_7xx1 to tifm_core") +Signed-off-by: ruanjinjie +Link: https://lore.kernel.org/r/20221117064725.3478402-1-ruanjinjie@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/tifm_7xx1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c +index 9ac95b48ef92..1d33c4facd44 100644 +--- a/drivers/misc/tifm_7xx1.c ++++ b/drivers/misc/tifm_7xx1.c +@@ -194,7 +194,7 @@ static void tifm_7xx1_switch_media(struct work_struct *work) + spin_unlock_irqrestore(&fm->lock, flags); + } + if (sock) +- tifm_free_device(&sock->dev); ++ put_device(&sock->dev); + } + spin_lock_irqsave(&fm->lock, flags); + } +-- +2.35.1 + diff --git a/queue-4.19/misdn-hfcmulti-don-t-call-dev_kfree_skb-kfree_skb-un.patch b/queue-4.19/misdn-hfcmulti-don-t-call-dev_kfree_skb-kfree_skb-un.patch new file mode 100644 index 00000000000..bd0d6965cb7 --- /dev/null +++ b/queue-4.19/misdn-hfcmulti-don-t-call-dev_kfree_skb-kfree_skb-un.patch @@ -0,0 +1,112 @@ +From e135ca1b14dfef3f70b8938f99a45ee60eb8ec3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 16:41:39 +0800 +Subject: mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 1232946cf522b8de9e398828bde325d7c41f29dd ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +skb_queue_purge() is called under spin_lock_irqsave() in handle_dmsg() +and hfcm_l1callback(), kfree_skb() is called in them, to fix this, use +skb_queue_splice_init() to move the dch->squeue to a free queue, also +enqueue the tx_skb and rx_skb, at last calling __skb_queue_purge() to +free the SKBs afer unlock. + +Fixes: af69fb3a8ffa ("Add mISDN HFC multiport driver") +Signed-off-by: Yang Yingliang +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcmulti.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c +index 0928fd1f0e0c..60b3a4aabe6b 100644 +--- a/drivers/isdn/hardware/mISDN/hfcmulti.c ++++ b/drivers/isdn/hardware/mISDN/hfcmulti.c +@@ -3233,6 +3233,7 @@ static int + hfcm_l1callback(struct dchannel *dch, u_int cmd) + { + struct hfc_multi *hc = dch->hw; ++ struct sk_buff_head free_queue; + u_long flags; + + switch (cmd) { +@@ -3261,6 +3262,7 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd) + l1_event(dch->l1, HW_POWERUP_IND); + break; + case HW_DEACT_REQ: ++ __skb_queue_head_init(&free_queue); + /* start deactivation */ + spin_lock_irqsave(&hc->lock, flags); + if (hc->ctype == HFC_TYPE_E1) { +@@ -3280,20 +3282,21 @@ hfcm_l1callback(struct dchannel *dch, u_int cmd) + plxsd_checksync(hc, 0); + } + } +- skb_queue_purge(&dch->squeue); ++ skb_queue_splice_init(&dch->squeue, &free_queue); + if (dch->tx_skb) { +- dev_kfree_skb(dch->tx_skb); ++ __skb_queue_tail(&free_queue, dch->tx_skb); + dch->tx_skb = NULL; + } + dch->tx_idx = 0; + if (dch->rx_skb) { +- dev_kfree_skb(dch->rx_skb); ++ __skb_queue_tail(&free_queue, dch->rx_skb); + dch->rx_skb = NULL; + } + test_and_clear_bit(FLG_TX_BUSY, &dch->Flags); + if (test_and_clear_bit(FLG_BUSY_TIMER, &dch->Flags)) + del_timer(&dch->timer); + spin_unlock_irqrestore(&hc->lock, flags); ++ __skb_queue_purge(&free_queue); + break; + case HW_POWERUP_REQ: + spin_lock_irqsave(&hc->lock, flags); +@@ -3400,6 +3403,9 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb) + case PH_DEACTIVATE_REQ: + test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags); + if (dch->dev.D.protocol != ISDN_P_TE_S0) { ++ struct sk_buff_head free_queue; ++ ++ __skb_queue_head_init(&free_queue); + spin_lock_irqsave(&hc->lock, flags); + if (debug & DEBUG_HFCMULTI_MSG) + printk(KERN_DEBUG +@@ -3421,14 +3427,14 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb) + /* deactivate */ + dch->state = 1; + } +- skb_queue_purge(&dch->squeue); ++ skb_queue_splice_init(&dch->squeue, &free_queue); + if (dch->tx_skb) { +- dev_kfree_skb(dch->tx_skb); ++ __skb_queue_tail(&free_queue, dch->tx_skb); + dch->tx_skb = NULL; + } + dch->tx_idx = 0; + if (dch->rx_skb) { +- dev_kfree_skb(dch->rx_skb); ++ __skb_queue_tail(&free_queue, dch->rx_skb); + dch->rx_skb = NULL; + } + test_and_clear_bit(FLG_TX_BUSY, &dch->Flags); +@@ -3440,6 +3446,7 @@ handle_dmsg(struct mISDNchannel *ch, struct sk_buff *skb) + #endif + ret = 0; + spin_unlock_irqrestore(&hc->lock, flags); ++ __skb_queue_purge(&free_queue); + } else + ret = l1_event(dch->l1, hh->prim); + break; +-- +2.35.1 + diff --git a/queue-4.19/misdn-hfcpci-don-t-call-dev_kfree_skb-kfree_skb-unde.patch b/queue-4.19/misdn-hfcpci-don-t-call-dev_kfree_skb-kfree_skb-unde.patch new file mode 100644 index 00000000000..5d05826038e --- /dev/null +++ b/queue-4.19/misdn-hfcpci-don-t-call-dev_kfree_skb-kfree_skb-unde.patch @@ -0,0 +1,71 @@ +From f0a5c4f529e34b815a45be8d48291f6151fbcc81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 16:41:38 +0800 +Subject: mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit f0f596bd75a9d573ca9b587abb39cee0b916bb82 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +skb_queue_purge() is called under spin_lock_irqsave() in hfcpci_l2l1D(), +kfree_skb() is called in it, to fix this, use skb_queue_splice_init() +to move the dch->squeue to a free queue, also enqueue the tx_skb and +rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock. + +Fixes: 1700fe1a10dc ("Add mISDN HFC PCI driver") +Signed-off-by: Yang Yingliang +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcpci.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcpci.c b/drivers/isdn/hardware/mISDN/hfcpci.c +index 53349850f866..de98e94711d2 100644 +--- a/drivers/isdn/hardware/mISDN/hfcpci.c ++++ b/drivers/isdn/hardware/mISDN/hfcpci.c +@@ -1633,16 +1633,19 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb) + test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags); + spin_lock_irqsave(&hc->lock, flags); + if (hc->hw.protocol == ISDN_P_NT_S0) { ++ struct sk_buff_head free_queue; ++ ++ __skb_queue_head_init(&free_queue); + /* prepare deactivation */ + Write_hfc(hc, HFCPCI_STATES, 0x40); +- skb_queue_purge(&dch->squeue); ++ skb_queue_splice_init(&dch->squeue, &free_queue); + if (dch->tx_skb) { +- dev_kfree_skb(dch->tx_skb); ++ __skb_queue_tail(&free_queue, dch->tx_skb); + dch->tx_skb = NULL; + } + dch->tx_idx = 0; + if (dch->rx_skb) { +- dev_kfree_skb(dch->rx_skb); ++ __skb_queue_tail(&free_queue, dch->rx_skb); + dch->rx_skb = NULL; + } + test_and_clear_bit(FLG_TX_BUSY, &dch->Flags); +@@ -1655,10 +1658,12 @@ hfcpci_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb) + hc->hw.mst_m &= ~HFCPCI_MASTER; + Write_hfc(hc, HFCPCI_MST_MODE, hc->hw.mst_m); + ret = 0; ++ spin_unlock_irqrestore(&hc->lock, flags); ++ __skb_queue_purge(&free_queue); + } else { + ret = l1_event(dch->l1, hh->prim); ++ spin_unlock_irqrestore(&hc->lock, flags); + } +- spin_unlock_irqrestore(&hc->lock, flags); + break; + } + if (!ret) +-- +2.35.1 + diff --git a/queue-4.19/misdn-hfcsusb-don-t-call-dev_kfree_skb-kfree_skb-und.patch b/queue-4.19/misdn-hfcsusb-don-t-call-dev_kfree_skb-kfree_skb-und.patch new file mode 100644 index 00000000000..1902a859e2b --- /dev/null +++ b/queue-4.19/misdn-hfcsusb-don-t-call-dev_kfree_skb-kfree_skb-und.patch @@ -0,0 +1,79 @@ +From 4d287bac29c22d9caf16a5697f4771310cf2f46b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 16:41:37 +0800 +Subject: mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit ddc9648db162eee556edd5222d2808fe33730203 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +skb_queue_purge() is called under spin_lock_irqsave() in hfcusb_l2l1D(), +kfree_skb() is called in it, to fix this, use skb_queue_splice_init() +to move the dch->squeue to a free queue, also enqueue the tx_skb and +rx_skb, at last calling __skb_queue_purge() to free the SKBs afer unlock. + +In tx_iso_complete(), dev_kfree_skb() is called to consume the transmitted +SKB, so replace it with dev_consume_skb_irq(). + +Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver") +Signed-off-by: Yang Yingliang +Reviewed-by: Alexander Duyck +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcsusb.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c +index c952002c6301..c49081ed5734 100644 +--- a/drivers/isdn/hardware/mISDN/hfcsusb.c ++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c +@@ -337,20 +337,24 @@ hfcusb_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb) + test_and_clear_bit(FLG_L2_ACTIVATED, &dch->Flags); + + if (hw->protocol == ISDN_P_NT_S0) { ++ struct sk_buff_head free_queue; ++ ++ __skb_queue_head_init(&free_queue); + hfcsusb_ph_command(hw, HFC_L1_DEACTIVATE_NT); + spin_lock_irqsave(&hw->lock, flags); +- skb_queue_purge(&dch->squeue); ++ skb_queue_splice_init(&dch->squeue, &free_queue); + if (dch->tx_skb) { +- dev_kfree_skb(dch->tx_skb); ++ __skb_queue_tail(&free_queue, dch->tx_skb); + dch->tx_skb = NULL; + } + dch->tx_idx = 0; + if (dch->rx_skb) { +- dev_kfree_skb(dch->rx_skb); ++ __skb_queue_tail(&free_queue, dch->rx_skb); + dch->rx_skb = NULL; + } + test_and_clear_bit(FLG_TX_BUSY, &dch->Flags); + spin_unlock_irqrestore(&hw->lock, flags); ++ __skb_queue_purge(&free_queue); + #ifdef FIXME + if (test_and_clear_bit(FLG_L1_BUSY, &dch->Flags)) + dchannel_sched_event(&hc->dch, D_CLEARBUSY); +@@ -1344,7 +1348,7 @@ tx_iso_complete(struct urb *urb) + printk("\n"); + } + +- dev_kfree_skb(tx_skb); ++ dev_consume_skb_irq(tx_skb); + tx_skb = NULL; + if (fifo->dch && get_next_dframe(fifo->dch)) + tx_skb = fifo->dch->tx_skb; +-- +2.35.1 + diff --git a/queue-4.19/mmc-atmel-mci-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-atmel-mci-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..2ff26da9424 --- /dev/null +++ b/queue-4.19/mmc-atmel-mci-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,60 @@ +From 775299f35fd5811e4a501056186c29b74eb3717d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 20:28:19 +0800 +Subject: mmc: atmel-mci: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit 9e6e8c43726673ca2abcaac87640b9215fd72f4c ] + +mmc_add_host() may return error, if we ignore its return value, +it will lead two issues: +1. The memory that allocated in mmc_alloc_host() is leaked. +2. In the remove() path, mmc_remove_host() will be called to + delete device, but it's not added yet, it will lead a kernel + crash because of null-ptr-deref in device_del(). + +So fix this by checking the return value and calling mmc_free_host() +in the error path. + +Fixes: 7d2be0749a59 ("atmel-mci: Driver for Atmel on-chip MMC controllers") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221108122819.429975-1-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/atmel-mci.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index fbc56ee99682..d40bab3d9f4a 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -2262,6 +2262,7 @@ static int atmci_init_slot(struct atmel_mci *host, + { + struct mmc_host *mmc; + struct atmel_mci_slot *slot; ++ int ret; + + mmc = mmc_alloc_host(sizeof(struct atmel_mci_slot), &host->pdev->dev); + if (!mmc) +@@ -2342,11 +2343,13 @@ static int atmci_init_slot(struct atmel_mci *host, + + host->slot[id] = slot; + mmc_regulator_get_supply(mmc); +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) { ++ mmc_free_host(mmc); ++ return ret; ++ } + + if (gpio_is_valid(slot->detect_pin)) { +- int ret; +- + timer_setup(&slot->detect_timer, atmci_detect_change, 0); + + ret = request_irq(gpio_to_irq(slot->detect_pin), +-- +2.35.1 + diff --git a/queue-4.19/mmc-f-sdh30-add-quirks-for-broken-timeout-clock-capa.patch b/queue-4.19/mmc-f-sdh30-add-quirks-for-broken-timeout-clock-capa.patch new file mode 100644 index 00000000000..5419aa8f990 --- /dev/null +++ b/queue-4.19/mmc-f-sdh30-add-quirks-for-broken-timeout-clock-capa.patch @@ -0,0 +1,38 @@ +From bb2346644ae4fa89d3b349b7162ec59b6a913806 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 17:10:33 +0900 +Subject: mmc: f-sdh30: Add quirks for broken timeout clock capability + +From: Kunihiko Hayashi + +[ Upstream commit aae9d3a440736691b3c1cb09ae2c32c4f1ee2e67 ] + +There is a case where the timeout clock is not supplied to the capability. +Add a quirk for that. + +Signed-off-by: Kunihiko Hayashi +Acked-by: Jassi Brar +Link: https://lore.kernel.org/r/20221111081033.3813-7-hayashi.kunihiko@socionext.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci_f_sdh30.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mmc/host/sdhci_f_sdh30.c b/drivers/mmc/host/sdhci_f_sdh30.c +index 485f7591fae4..ca9e05440da1 100644 +--- a/drivers/mmc/host/sdhci_f_sdh30.c ++++ b/drivers/mmc/host/sdhci_f_sdh30.c +@@ -199,6 +199,9 @@ static int sdhci_f_sdh30_probe(struct platform_device *pdev) + if (reg & SDHCI_CAN_DO_8BIT) + priv->vendor_hs200 = F_SDH30_EMMC_HS200; + ++ if (!(reg & SDHCI_TIMEOUT_CLK_MASK)) ++ host->quirks |= SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK; ++ + ret = sdhci_add_host(host); + if (ret) + goto err_add_host; +-- +2.35.1 + diff --git a/queue-4.19/mmc-meson-gx-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-meson-gx-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..4f1e56aac13 --- /dev/null +++ b/queue-4.19/mmc-meson-gx-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,47 @@ +From 0269fc7b1c27e849984e6b201914293a8d3c2acc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 20:34:17 +0800 +Subject: mmc: meson-gx: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit 90935f16f2650ab7416fa2ffbe5c28cb39cf3f1e ] + +mmc_add_host() may return error, if we ignore its return value, +it will lead two issues: +1. The memory that allocated in mmc_alloc_host() is leaked. +2. In the remove() path, mmc_remove_host() will be called to + delete device, but it's not added yet, it will lead a kernel + crash because of null-ptr-deref in device_del(). + +Fix this by checking the return value and goto error path which +will call mmc_free_host(). + +Fixes: 51c5d8447bd7 ("MMC: meson: initial support for GX platforms") +Signed-off-by: Yang Yingliang +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20221108123417.479045-1-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/meson-gx-mmc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c +index 72f34a58928c..dba98c2886f2 100644 +--- a/drivers/mmc/host/meson-gx-mmc.c ++++ b/drivers/mmc/host/meson-gx-mmc.c +@@ -1370,7 +1370,9 @@ static int meson_mmc_probe(struct platform_device *pdev) + } + + mmc->ops = &meson_mmc_ops; +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto err_free_irq; + + return 0; + +-- +2.35.1 + diff --git a/queue-4.19/mmc-mmci-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-mmci-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..db3e9051667 --- /dev/null +++ b/queue-4.19/mmc-mmci-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,46 @@ +From 341690ddf94b20f3075a106cd31ccc97f62d2d49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 21:35:39 +0800 +Subject: mmc: mmci: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit b38a20f29a49ae04d23750d104b25400b792b98c ] + +mmc_add_host() may return error, if we ignore its return value, +it will lead two issues: +1. The memory that allocated in mmc_alloc_host() is leaked. +2. In the remove() path, mmc_remove_host() will be called to + delete device, but it's not added yet, it will lead a kernel + crash because of null-ptr-deref in device_del(). + +So fix this by checking the return value and goto error path which +will call mmc_free_host(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221109133539.3275664-1-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mmci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c +index fa6268c0f123..434ba4a39ded 100644 +--- a/drivers/mmc/host/mmci.c ++++ b/drivers/mmc/host/mmci.c +@@ -1808,7 +1808,9 @@ static int mmci_probe(struct amba_device *dev, + pm_runtime_set_autosuspend_delay(&dev->dev, 50); + pm_runtime_use_autosuspend(&dev->dev); + +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto clk_disable; + + pm_runtime_put(&dev->dev); + return 0; +-- +2.35.1 + diff --git a/queue-4.19/mmc-moxart-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-moxart-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..517151e5cfd --- /dev/null +++ b/queue-4.19/mmc-moxart-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,43 @@ +From 9a824bb8d87d07dc34e69f3728d72ea6244d5cd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 14:30:16 +0800 +Subject: mmc: moxart: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit 0ca18d09c744fb030ae9bc5836c3e357e0237dea ] + +mmc_add_host() may return error, if we ignore its return value, the memory +that allocated in mmc_alloc_host() will be leaked and it will lead a kernel +crash because of deleting not added device in the remove path. + +So fix this by checking the return value and goto error path which will call +mmc_free_host(). + +Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221101063023.1664968-3-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/moxart-mmc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c +index 1552d1f09c5c..52307dce08ba 100644 +--- a/drivers/mmc/host/moxart-mmc.c ++++ b/drivers/mmc/host/moxart-mmc.c +@@ -660,7 +660,9 @@ static int moxart_probe(struct platform_device *pdev) + goto out; + + dev_set_drvdata(dev, mmc); +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto out; + + dev_dbg(dev, "IRQ=%d, FIFO is %d bytes\n", irq, host->fifo_width); + +-- +2.35.1 + diff --git a/queue-4.19/mmc-mxcmmc-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-mxcmmc-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..d5a78fba036 --- /dev/null +++ b/queue-4.19/mmc-mxcmmc-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,43 @@ +From 7e3ebe5ef0f89ef51d57534b78ffcd898499b80d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 14:30:17 +0800 +Subject: mmc: mxcmmc: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit cde600af7b413c9fe03e85c58c4279df90e91d13 ] + +mmc_add_host() may return error, if we ignore its return value, the memory +that allocated in mmc_alloc_host() will be leaked and it will lead a kernel +crash because of deleting not added device in the remove path. + +So fix this by checking the return value and goto error path which will call +mmc_free_host(). + +Fixes: d96be879ff46 ("mmc: Add a MX2/MX3 specific SDHC driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221101063023.1664968-4-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mxcmmc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c +index 2f604b312767..6215feb976e3 100644 +--- a/drivers/mmc/host/mxcmmc.c ++++ b/drivers/mmc/host/mxcmmc.c +@@ -1167,7 +1167,9 @@ static int mxcmci_probe(struct platform_device *pdev) + + timer_setup(&host->watchdog, mxcmci_watchdog, 0); + +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto out_free_dma; + + return 0; + +-- +2.35.1 + diff --git a/queue-4.19/mmc-pxamci-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-pxamci-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..6a5478fa751 --- /dev/null +++ b/queue-4.19/mmc-pxamci-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,46 @@ +From 52a95ad54ec9fa84d2681cd5837668aed94b3cdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 14:30:18 +0800 +Subject: mmc: pxamci: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit 80e1ef3afb8bfbe768380b70ffe1b6cab87d1a3b ] + +mmc_add_host() may return error, if we ignore its return value, the memory +that allocated in mmc_alloc_host() will be leaked and it will lead a kernel +crash because of deleting not added device in the remove path. + +So fix this by checking the return value and goto error path which will call +mmc_free_host(), besides, ->exit() need be called to uninit the pdata. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221101063023.1664968-5-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/pxamci.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c +index d0db1c37552f..e90a84e0cbda 100644 +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -779,7 +779,12 @@ static int pxamci_probe(struct platform_device *pdev) + dev_warn(dev, "gpio_ro and get_ro() both defined\n"); + } + +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) { ++ if (host->pdata && host->pdata->exit) ++ host->pdata->exit(dev, mmc); ++ goto out; ++ } + + return 0; + +-- +2.35.1 + diff --git a/queue-4.19/mmc-rtsx_usb_sdmmc-fix-return-value-check-of-mmc_add.patch b/queue-4.19/mmc-rtsx_usb_sdmmc-fix-return-value-check-of-mmc_add.patch new file mode 100644 index 00000000000..5f4a77c465d --- /dev/null +++ b/queue-4.19/mmc-rtsx_usb_sdmmc-fix-return-value-check-of-mmc_add.patch @@ -0,0 +1,58 @@ +From 1c3d0109cf07290d29bbb45f62d2f36108b5a7c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 14:30:20 +0800 +Subject: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit fc38a5a10e9e5a75eb9189854abeb8405b214cc9 ] + +mmc_add_host() may return error, if we ignore its return value, the memory +that allocated in mmc_alloc_host() will be leaked and it will lead a kernel +crash because of deleting not added device in the remove path. + +So fix this by checking the return value and calling mmc_free_host() in the +error path, besides, led_classdev_unregister() and pm_runtime_disable() also +need be called. + +Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221101063023.1664968-7-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/rtsx_usb_sdmmc.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c +index 9a3ff22dd0fe..1e5f54054a53 100644 +--- a/drivers/mmc/host/rtsx_usb_sdmmc.c ++++ b/drivers/mmc/host/rtsx_usb_sdmmc.c +@@ -1344,6 +1344,7 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev) + #ifdef RTSX_USB_USE_LEDS_CLASS + int err; + #endif ++ int ret; + + ucr = usb_get_intfdata(to_usb_interface(pdev->dev.parent)); + if (!ucr) +@@ -1382,7 +1383,15 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev) + INIT_WORK(&host->led_work, rtsx_usb_update_led); + + #endif +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) { ++#ifdef RTSX_USB_USE_LEDS_CLASS ++ led_classdev_unregister(&host->led); ++#endif ++ mmc_free_host(mmc); ++ pm_runtime_disable(&pdev->dev); ++ return ret; ++ } + + return 0; + } +-- +2.35.1 + diff --git a/queue-4.19/mmc-toshsd-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-toshsd-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..4735fc37946 --- /dev/null +++ b/queue-4.19/mmc-toshsd-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,52 @@ +From 86bd58515d95ddbc18e95327d5388c47dfc25322 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 14:30:21 +0800 +Subject: mmc: toshsd: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit f670744a316ea983113a65313dcd387b5a992444 ] + +mmc_add_host() may return error, if we ignore its return value, the memory +that allocated in mmc_alloc_host() will be leaked and it will lead a kernel +crash because of deleting not added device in the remove path. + +So fix this by checking the return value and goto error path which will call +mmc_free_host(), besides, free_irq() also needs be called. + +Fixes: a5eb8bbd66cc ("mmc: add Toshiba PCI SD controller driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221101063023.1664968-8-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/toshsd.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/toshsd.c b/drivers/mmc/host/toshsd.c +index dd961c54a6a9..9236965b00fd 100644 +--- a/drivers/mmc/host/toshsd.c ++++ b/drivers/mmc/host/toshsd.c +@@ -655,7 +655,9 @@ static int toshsd_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (ret) + goto unmap; + +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto free_irq; + + base = pci_resource_start(pdev, 0); + dev_dbg(&pdev->dev, "MMIO %pa, IRQ %d\n", &base, pdev->irq); +@@ -664,6 +666,8 @@ static int toshsd_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + return 0; + ++free_irq: ++ free_irq(pdev->irq, host); + unmap: + pci_iounmap(pdev, host->ioaddr); + release: +-- +2.35.1 + diff --git a/queue-4.19/mmc-via-sdmmc-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-via-sdmmc-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..fca4e3268b4 --- /dev/null +++ b/queue-4.19/mmc-via-sdmmc-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,46 @@ +From cb151bf15f1ce5877819545fee23b6a3b1fdd6b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 21:09:49 +0800 +Subject: mmc: via-sdmmc: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit e4e46fb61e3bb4628170810d3f2b996b709b90d9 ] + +mmc_add_host() may return error, if we ignore its return value, +it will lead two issues: +1. The memory that allocated in mmc_alloc_host() is leaked. +2. In the remove() path, mmc_remove_host() will be called to + delete device, but it's not added yet, it will lead a kernel + crash because of null-ptr-deref in device_del(). + +Fix this by checking the return value and goto error path which +will call mmc_free_host(). + +Fixes: f0bf7f61b840 ("mmc: Add new via-sdmmc host controller driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221108130949.1067699-1-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/via-sdmmc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c +index 1b66466d2ed4..b78e96b5289b 100644 +--- a/drivers/mmc/host/via-sdmmc.c ++++ b/drivers/mmc/host/via-sdmmc.c +@@ -1166,7 +1166,9 @@ static int via_sd_probe(struct pci_dev *pcidev, + pcidev->subsystem_device == 0x3891) + sdhost->quirks = VIA_CRDR_QUIRK_300MS_PWRDELAY; + +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto unmap; + + return 0; + +-- +2.35.1 + diff --git a/queue-4.19/mmc-vub300-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-vub300-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..a4480bdf36e --- /dev/null +++ b/queue-4.19/mmc-vub300-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,67 @@ +From 92b18aa0924a04ffde36cf249cfbd877faf85ad1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 14:30:22 +0800 +Subject: mmc: vub300: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit 0613ad2401f88bdeae5594c30afe318e93b14676 ] + +mmc_add_host() may return error, if we ignore its return value, the memory +that allocated in mmc_alloc_host() will be leaked and it will lead a kernel +crash because of deleting not added device in the remove path. + +So fix this by checking the return value and goto error path which will call +mmc_free_host(), besides, the timer added before mmc_add_host() needs be del. + +And this patch fixes another missing call mmc_free_host() if usb_control_msg() +fails. + +Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221101063023.1664968-9-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/vub300.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c +index aa8905753be3..59768cc18ac1 100644 +--- a/drivers/mmc/host/vub300.c ++++ b/drivers/mmc/host/vub300.c +@@ -2309,14 +2309,14 @@ static int vub300_probe(struct usb_interface *interface, + 0x0000, 0x0000, &vub300->system_port_status, + sizeof(vub300->system_port_status), 1000); + if (retval < 0) { +- goto error4; ++ goto error5; + } else if (sizeof(vub300->system_port_status) == retval) { + vub300->card_present = + (0x0001 & vub300->system_port_status.port_flags) ? 1 : 0; + vub300->read_only = + (0x0010 & vub300->system_port_status.port_flags) ? 1 : 0; + } else { +- goto error4; ++ goto error5; + } + usb_set_intfdata(interface, vub300); + INIT_DELAYED_WORK(&vub300->pollwork, vub300_pollwork_thread); +@@ -2339,8 +2339,13 @@ static int vub300_probe(struct usb_interface *interface, + "USB vub300 remote SDIO host controller[%d]" + "connected with no SD/SDIO card inserted\n", + interface_to_InterfaceNumber(interface)); +- mmc_add_host(mmc); ++ retval = mmc_add_host(mmc); ++ if (retval) ++ goto error6; ++ + return 0; ++error6: ++ del_timer_sync(&vub300->inactivity_timer); + error5: + mmc_free_host(mmc); + /* +-- +2.35.1 + diff --git a/queue-4.19/mmc-wbsd-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-wbsd-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..d1314990ff2 --- /dev/null +++ b/queue-4.19/mmc-wbsd-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,55 @@ +From 1397f4c284bdde14265ba8b4e44f0593d8eedc84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 21:32:37 +0800 +Subject: mmc: wbsd: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit dc5b9b50fc9d1334407e316e6e29a5097ef833bd ] + +mmc_add_host() may return error, if we ignore its return value, +it will lead two issues: +1. The memory that allocated in mmc_alloc_host() is leaked. +2. In the remove() path, mmc_remove_host() will be called to + delete device, but it's not added yet, it will lead a kernel + crash because of null-ptr-deref in device_del(). + +So fix this by checking the return value and goto error path which +will call mmc_free_host(), besides, other resources also need be +released. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221109133237.3273558-1-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/wbsd.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/wbsd.c b/drivers/mmc/host/wbsd.c +index 1e54bbf13d75..9b15431d961c 100644 +--- a/drivers/mmc/host/wbsd.c ++++ b/drivers/mmc/host/wbsd.c +@@ -1706,7 +1706,17 @@ static int wbsd_init(struct device *dev, int base, int irq, int dma, + */ + wbsd_init_device(host); + +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) { ++ if (!pnp) ++ wbsd_chip_poweroff(host); ++ ++ wbsd_release_resources(host); ++ wbsd_free_mmc(dev); ++ ++ mmc_free_host(mmc); ++ return ret; ++ } + + pr_info("%s: W83L51xD", mmc_hostname(mmc)); + if (host->chip_id != 0) +-- +2.35.1 + diff --git a/queue-4.19/mmc-wmt-sdmmc-fix-return-value-check-of-mmc_add_host.patch b/queue-4.19/mmc-wmt-sdmmc-fix-return-value-check-of-mmc_add_host.patch new file mode 100644 index 00000000000..768fbd57bfe --- /dev/null +++ b/queue-4.19/mmc-wmt-sdmmc-fix-return-value-check-of-mmc_add_host.patch @@ -0,0 +1,49 @@ +From a4c8522619d00fddaa611b9aedca427ac7a3d987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 14:30:23 +0800 +Subject: mmc: wmt-sdmmc: fix return value check of mmc_add_host() + +From: Yang Yingliang + +[ Upstream commit 29276d56f6ed138db0f38cd31aedc0b725c8c76c ] + +mmc_add_host() may return error, if we ignore its return value, the memory +that allocated in mmc_alloc_host() will be leaked and it will lead a kernel +crash because of deleting not added device in the remove path. + +So fix this by checking the return value and goto error path which will call +mmc_free_host(), besides, clk_disable_unprepare() also needs be called. + +Fixes: 3a96dff0f828 ("mmc: SD/MMC Host Controller for Wondermedia WM8505/WM8650") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221101063023.1664968-10-yangyingliang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/wmt-sdmmc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c +index f8b169684693..a132bc822b5c 100644 +--- a/drivers/mmc/host/wmt-sdmmc.c ++++ b/drivers/mmc/host/wmt-sdmmc.c +@@ -863,11 +863,15 @@ static int wmt_mci_probe(struct platform_device *pdev) + /* configure the controller to a known 'ready' state */ + wmt_reset_hardware(mmc); + +- mmc_add_host(mmc); ++ ret = mmc_add_host(mmc); ++ if (ret) ++ goto fail7; + + dev_info(&pdev->dev, "WMT SDHC Controller initialized\n"); + + return 0; ++fail7: ++ clk_disable_unprepare(priv->clk_sdmmc); + fail6: + clk_put(priv->clk_sdmmc); + fail5_and_a_half: +-- +2.35.1 + diff --git a/queue-4.19/mrp-introduce-active-flags-to-prevent-uaf-when-appli.patch b/queue-4.19/mrp-introduce-active-flags-to-prevent-uaf-when-appli.patch new file mode 100644 index 00000000000..0237d8e2182 --- /dev/null +++ b/queue-4.19/mrp-introduce-active-flags-to-prevent-uaf-when-appli.patch @@ -0,0 +1,126 @@ +From f7a8f1815b34d06240bed0fc7ba367798f974ace Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Nov 2022 19:45:11 +0800 +Subject: mrp: introduce active flags to prevent UAF when applicant uninit + +From: Schspa Shi + +[ Upstream commit ab0377803dafc58f1e22296708c1c28e309414d6 ] + +The caller of del_timer_sync must prevent restarting of the timer, If +we have no this synchronization, there is a small probability that the +cancellation will not be successful. + +And syzbot report the fellowing crash: +================================================================== +BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] +BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 +Write at addr f9ff000024df6058 by task syz-fuzzer/2256 +Pointer tag: [f9], memory tag: [fe] + +CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008- +ge01d50cbd6ee #0 +Hardware name: linux,dummy-virt (DT) +Call trace: + dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 + dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline] + show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163 + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:284 [inline] + print_report+0x1a8/0x4a0 mm/kasan/report.c:395 + kasan_report+0x94/0xb4 mm/kasan/report.c:495 + __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320 + do_bad_area arch/arm64/mm/fault.c:473 [inline] + do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749 + do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 + el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367 + el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 + el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576 + hlist_add_head include/linux/list.h:929 [inline] + enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 + mod_timer+0x14/0x20 kernel/time/timer.c:1161 + mrp_periodic_timer_arm net/802/mrp.c:614 [inline] + mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627 + call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 + expire_timers+0x98/0xc4 kernel/time/timer.c:1519 + +To fix it, we can introduce a new active flags to make sure the timer will +not restart. + +Reported-by: syzbot+6fd64001c20aa99e34a4@syzkaller.appspotmail.com + +Signed-off-by: Schspa Shi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/mrp.h | 1 + + net/802/mrp.c | 18 +++++++++++++----- + 2 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/include/net/mrp.h b/include/net/mrp.h +index ef58b4a07190..c6c53370e390 100644 +--- a/include/net/mrp.h ++++ b/include/net/mrp.h +@@ -120,6 +120,7 @@ struct mrp_applicant { + struct sk_buff *pdu; + struct rb_root mad; + struct rcu_head rcu; ++ bool active; + }; + + struct mrp_port { +diff --git a/net/802/mrp.c b/net/802/mrp.c +index 32f87d458f05..ce6e4774d333 100644 +--- a/net/802/mrp.c ++++ b/net/802/mrp.c +@@ -609,7 +609,10 @@ static void mrp_join_timer(struct timer_list *t) + spin_unlock(&app->lock); + + mrp_queue_xmit(app); +- mrp_join_timer_arm(app); ++ spin_lock(&app->lock); ++ if (likely(app->active)) ++ mrp_join_timer_arm(app); ++ spin_unlock(&app->lock); + } + + static void mrp_periodic_timer_arm(struct mrp_applicant *app) +@@ -623,11 +626,12 @@ static void mrp_periodic_timer(struct timer_list *t) + struct mrp_applicant *app = from_timer(app, t, periodic_timer); + + spin_lock(&app->lock); +- mrp_mad_event(app, MRP_EVENT_PERIODIC); +- mrp_pdu_queue(app); ++ if (likely(app->active)) { ++ mrp_mad_event(app, MRP_EVENT_PERIODIC); ++ mrp_pdu_queue(app); ++ mrp_periodic_timer_arm(app); ++ } + spin_unlock(&app->lock); +- +- mrp_periodic_timer_arm(app); + } + + static int mrp_pdu_parse_end_mark(struct sk_buff *skb, int *offset) +@@ -875,6 +879,7 @@ int mrp_init_applicant(struct net_device *dev, struct mrp_application *appl) + app->dev = dev; + app->app = appl; + app->mad = RB_ROOT; ++ app->active = true; + spin_lock_init(&app->lock); + skb_queue_head_init(&app->queue); + rcu_assign_pointer(dev->mrp_port->applicants[appl->type], app); +@@ -903,6 +908,9 @@ void mrp_uninit_applicant(struct net_device *dev, struct mrp_application *appl) + + RCU_INIT_POINTER(port->applicants[appl->type], NULL); + ++ spin_lock_bh(&app->lock); ++ app->active = false; ++ spin_unlock_bh(&app->lock); + /* Delete timer and generate a final TX event to flush out + * all pending messages before the applicant is gone. + */ +-- +2.35.1 + diff --git a/queue-4.19/mtd-fix-device-name-leak-when-register-device-failed.patch b/queue-4.19/mtd-fix-device-name-leak-when-register-device-failed.patch new file mode 100644 index 00000000000..b74b244e583 --- /dev/null +++ b/queue-4.19/mtd-fix-device-name-leak-when-register-device-failed.patch @@ -0,0 +1,62 @@ +From 4f073114849b31d68b0377c873612672badb76be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Oct 2022 20:13:52 +0800 +Subject: mtd: Fix device name leak when register device failed in + add_mtd_device() + +From: Zhang Xiaoxu + +[ Upstream commit 895d68a39481a75c680aa421546931fb11942fa6 ] + +There is a kmemleak when register device failed: + unreferenced object 0xffff888101aab550 (size 8): + comm "insmod", pid 3922, jiffies 4295277753 (age 925.408s) + hex dump (first 8 bytes): + 6d 74 64 30 00 88 ff ff mtd0.... + backtrace: + [<00000000bde26724>] __kmalloc_node_track_caller+0x4e/0x150 + [<000000003c32b416>] kvasprintf+0xb0/0x130 + [<000000001f7a8f15>] kobject_set_name_vargs+0x2f/0xb0 + [<000000006e781163>] dev_set_name+0xab/0xe0 + [<00000000e30d0c78>] add_mtd_device+0x4bb/0x700 + [<00000000f3d34de7>] mtd_device_parse_register+0x2ac/0x3f0 + [<00000000c0d88488>] 0xffffffffa0238457 + [<00000000b40d0922>] 0xffffffffa02a008f + [<0000000023d17b9d>] do_one_initcall+0x87/0x2a0 + [<00000000770f6ca6>] do_init_module+0xdf/0x320 + [<000000007b6768fe>] load_module+0x2f98/0x3330 + [<00000000346bed5a>] __do_sys_finit_module+0x113/0x1b0 + [<00000000674c2290>] do_syscall_64+0x35/0x80 + [<000000004c6a8d97>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +If register device failed, should call put_device() to give up the +reference. + +Fixes: 1f24b5a8ecbb ("[MTD] driver model updates") +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221022121352.2534682-1-zhangxiaoxu5@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c +index a0b1a7814e2e..90d9c0e93157 100644 +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -567,8 +567,10 @@ int add_mtd_device(struct mtd_info *mtd) + dev_set_drvdata(&mtd->dev, mtd); + of_node_get(mtd_get_of_node(mtd)); + error = device_register(&mtd->dev); +- if (error) ++ if (error) { ++ put_device(&mtd->dev); + goto fail_added; ++ } + + if (!IS_ERR_OR_NULL(dfs_dir_mtd)) { + mtd->dbg.dfs_dir = debugfs_create_dir(dev_name(&mtd->dev), dfs_dir_mtd); +-- +2.35.1 + diff --git a/queue-4.19/mtd-lpddr2_nvm-fix-possible-null-ptr-deref.patch b/queue-4.19/mtd-lpddr2_nvm-fix-possible-null-ptr-deref.patch new file mode 100644 index 00000000000..9c9bbd49149 --- /dev/null +++ b/queue-4.19/mtd-lpddr2_nvm-fix-possible-null-ptr-deref.patch @@ -0,0 +1,41 @@ +From c8553d927a979f3488f0cdad08390e45967bf369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 17:02:40 +0800 +Subject: mtd: lpddr2_nvm: Fix possible null-ptr-deref +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hui Tang + +[ Upstream commit 6bdd45d795adf9e73b38ced5e7f750cd199499ff ] + +It will cause null-ptr-deref when resource_size(add_range) invoked, +if platform_get_resource() returns NULL. + +Fixes: 96ba9dd65788 ("mtd: lpddr: add driver for LPDDR2-NVM PCM memories") +Signed-off-by: Hui Tang +Acked-by: Uwe Kleine-König +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221114090240.244172-1-tanghui20@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/lpddr/lpddr2_nvm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c +index 90e6cb64db69..b004d3213a66 100644 +--- a/drivers/mtd/lpddr/lpddr2_nvm.c ++++ b/drivers/mtd/lpddr/lpddr2_nvm.c +@@ -442,6 +442,8 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) + + /* lpddr2_nvm address range */ + add_range = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!add_range) ++ return -ENODEV; + + /* Populate map_info data structure */ + *map = (struct map_info) { +-- +2.35.1 + diff --git a/queue-4.19/mtd-maps-pxa2xx-flash-fix-memory-leak-in-probe.patch b/queue-4.19/mtd-maps-pxa2xx-flash-fix-memory-leak-in-probe.patch new file mode 100644 index 00000000000..e4c982deef5 --- /dev/null +++ b/queue-4.19/mtd-maps-pxa2xx-flash-fix-memory-leak-in-probe.patch @@ -0,0 +1,44 @@ +From f5057d81b72eccd008039c3a043b23a5fa67fa68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Nov 2022 07:33:07 +0000 +Subject: mtd: maps: pxa2xx-flash: fix memory leak in probe + +From: Zheng Yongjun + +[ Upstream commit 2399401feee27c639addc5b7e6ba519d3ca341bf ] + +Free 'info' upon remapping error to avoid a memory leak. + +Fixes: e644f7d62894 ("[MTD] MAPS: Merge Lubbock and Mainstone drivers into common PXA2xx driver") +Signed-off-by: Zheng Yongjun +[: Reword the commit log] +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20221119073307.22929-1-zhengyongjun3@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/maps/pxa2xx-flash.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c +index 2cde28ed95c9..59d2fe1f46e1 100644 +--- a/drivers/mtd/maps/pxa2xx-flash.c ++++ b/drivers/mtd/maps/pxa2xx-flash.c +@@ -69,6 +69,7 @@ static int pxa2xx_flash_probe(struct platform_device *pdev) + if (!info->map.virt) { + printk(KERN_WARNING "Failed to ioremap %s\n", + info->map.name); ++ kfree(info); + return -ENOMEM; + } + info->map.cached = +@@ -91,6 +92,7 @@ static int pxa2xx_flash_probe(struct platform_device *pdev) + iounmap((void *)info->map.virt); + if (info->map.cached) + iounmap(info->map.cached); ++ kfree(info); + return -EIO; + } + info->mtd->dev.parent = &pdev->dev; +-- +2.35.1 + diff --git a/queue-4.19/myri10ge-fix-an-error-handling-path-in-myri10ge_prob.patch b/queue-4.19/myri10ge-fix-an-error-handling-path-in-myri10ge_prob.patch new file mode 100644 index 00000000000..c35e26ae9b2 --- /dev/null +++ b/queue-4.19/myri10ge-fix-an-error-handling-path-in-myri10ge_prob.patch @@ -0,0 +1,37 @@ +From cdfed5217ea6467ec094d46bbd5b25686db82a5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Dec 2022 19:08:40 +0100 +Subject: myri10ge: Fix an error handling path in myri10ge_probe() + +From: Christophe JAILLET + +[ Upstream commit d83b950d44d2982c0e62e3d81b0f35ab09431008 ] + +Some memory allocated in myri10ge_probe_slices() is not released in the +error handling path of myri10ge_probe(). + +Add the corresponding kfree(), as already done in the remove function. + +Fixes: 0dcffac1a329 ("myri10ge: add multislices support") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index 3bc570c46f81..8296b0aa42a9 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -3960,6 +3960,7 @@ static int myri10ge_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + myri10ge_free_slices(mgp); + + abort_with_firmware: ++ kfree(mgp->msix_vectors); + myri10ge_dummy_rdma(mgp, 0); + + abort_with_ioremap: +-- +2.35.1 + diff --git a/queue-4.19/net-amd-lance-don-t-call-dev_kfree_skb-under-spin_lo.patch b/queue-4.19/net-amd-lance-don-t-call-dev_kfree_skb-under-spin_lo.patch new file mode 100644 index 00000000000..b16017956d1 --- /dev/null +++ b/queue-4.19/net-amd-lance-don-t-call-dev_kfree_skb-under-spin_lo.patch @@ -0,0 +1,58 @@ +From 99561bd5d25606d1afc174f17ca5e793c1444c93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 22:21:47 +0800 +Subject: net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 6151d105dfce8c23edf30eed35e97f3d9b96a35c ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In these two cases, dev_kfree_skb() is called consume the xmited SKB, +so replace it with dev_consume_skb_irq(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/atarilance.c | 2 +- + drivers/net/ethernet/amd/lance.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/amd/atarilance.c b/drivers/net/ethernet/amd/atarilance.c +index d3d44e07afbc..414b990827e8 100644 +--- a/drivers/net/ethernet/amd/atarilance.c ++++ b/drivers/net/ethernet/amd/atarilance.c +@@ -825,7 +825,7 @@ lance_start_xmit(struct sk_buff *skb, struct net_device *dev) + lp->memcpy_f( PKTBUF_ADDR(head), (void *)skb->data, skb->len ); + head->flag = TMD1_OWN_CHIP | TMD1_ENP | TMD1_STP; + dev->stats.tx_bytes += skb->len; +- dev_kfree_skb( skb ); ++ dev_consume_skb_irq(skb); + lp->cur_tx++; + while( lp->cur_tx >= TX_RING_SIZE && lp->dirty_tx >= TX_RING_SIZE ) { + lp->cur_tx -= TX_RING_SIZE; +diff --git a/drivers/net/ethernet/amd/lance.c b/drivers/net/ethernet/amd/lance.c +index b56d84c7df46..a21f4f82a9c2 100644 +--- a/drivers/net/ethernet/amd/lance.c ++++ b/drivers/net/ethernet/amd/lance.c +@@ -997,7 +997,7 @@ static netdev_tx_t lance_start_xmit(struct sk_buff *skb, + skb_copy_from_linear_data(skb, &lp->tx_bounce_buffs[entry], skb->len); + lp->tx_ring[entry].base = + ((u32)isa_virt_to_bus((lp->tx_bounce_buffs + entry)) & 0xffffff) | 0x83000000; +- dev_kfree_skb(skb); ++ dev_consume_skb_irq(skb); + } else { + lp->tx_skbuff[entry] = skb; + lp->tx_ring[entry].base = ((u32)isa_virt_to_bus(skb->data) & 0xffffff) | 0x83000000; +-- +2.35.1 + diff --git a/queue-4.19/net-amd-xgbe-check-only-the-minimum-speed-for-active.patch b/queue-4.19/net-amd-xgbe-check-only-the-minimum-speed-for-active.patch new file mode 100644 index 00000000000..cdf855a1ec7 --- /dev/null +++ b/queue-4.19/net-amd-xgbe-check-only-the-minimum-speed-for-active.patch @@ -0,0 +1,75 @@ +From fdf444af30a691c06036d8a839610124b0373dbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 10:22:25 -0600 +Subject: net: amd-xgbe: Check only the minimum speed for active/passive cables + +From: Tom Lendacky + +[ Upstream commit f8ab263d4d48e6dab752029bf562f20a2ee630ed ] + +There are cables that exist that can support speeds in excess of 10GbE. +The driver, however, restricts the EEPROM advertised nominal bitrate to +a specific range, which can prevent usage of cables that can support, +for example, up to 25GbE. + +Rather than checking that an active or passive cable supports a specific +range, only check for a minimum supported speed. + +Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules") +Signed-off-by: Tom Lendacky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 098792eb279c..e32649c254cd 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -236,10 +236,7 @@ enum xgbe_sfp_speed { + + #define XGBE_SFP_BASE_BR 12 + #define XGBE_SFP_BASE_BR_1GBE_MIN 0x0a +-#define XGBE_SFP_BASE_BR_1GBE_MAX 0x0d + #define XGBE_SFP_BASE_BR_10GBE_MIN 0x64 +-#define XGBE_SFP_BASE_BR_10GBE_MAX 0x68 +-#define XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX 0x78 + + #define XGBE_SFP_BASE_CU_CABLE_LEN 18 + +@@ -826,29 +823,22 @@ static void xgbe_phy_sfp_phy_settings(struct xgbe_prv_data *pdata) + static bool xgbe_phy_sfp_bit_rate(struct xgbe_sfp_eeprom *sfp_eeprom, + enum xgbe_sfp_speed sfp_speed) + { +- u8 *sfp_base, min, max; ++ u8 *sfp_base, min; + + sfp_base = sfp_eeprom->base; + + switch (sfp_speed) { + case XGBE_SFP_SPEED_1000: + min = XGBE_SFP_BASE_BR_1GBE_MIN; +- max = XGBE_SFP_BASE_BR_1GBE_MAX; + break; + case XGBE_SFP_SPEED_10000: + min = XGBE_SFP_BASE_BR_10GBE_MIN; +- if (memcmp(&sfp_eeprom->base[XGBE_SFP_BASE_VENDOR_NAME], +- XGBE_MOLEX_VENDOR, XGBE_SFP_BASE_VENDOR_NAME_LEN) == 0) +- max = XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX; +- else +- max = XGBE_SFP_BASE_BR_10GBE_MAX; + break; + default: + return false; + } + +- return ((sfp_base[XGBE_SFP_BASE_BR] >= min) && +- (sfp_base[XGBE_SFP_BASE_BR] <= max)); ++ return sfp_base[XGBE_SFP_BASE_BR] >= min; + } + + static void xgbe_phy_free_phy_device(struct xgbe_prv_data *pdata) +-- +2.35.1 + diff --git a/queue-4.19/net-amd-xgbe-fix-logic-around-active-and-passive-cab.patch b/queue-4.19/net-amd-xgbe-fix-logic-around-active-and-passive-cab.patch new file mode 100644 index 00000000000..4babd1d6a18 --- /dev/null +++ b/queue-4.19/net-amd-xgbe-fix-logic-around-active-and-passive-cab.patch @@ -0,0 +1,63 @@ +From 9d2457df7a25ab4358e2c9d1951f199dd1eba2fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 10:22:24 -0600 +Subject: net: amd-xgbe: Fix logic around active and passive cables + +From: Tom Lendacky + +[ Upstream commit 4998006c73afe44e2f639d55bd331c6c26eb039f ] + +SFP+ active and passive cables are copper cables with fixed SFP+ end +connectors. Due to a misinterpretation of this, SFP+ active cables could +end up not being recognized, causing the driver to fail to establish a +connection. + +Introduce a new enum in SFP+ cable types, XGBE_SFP_CABLE_FIBER, that is +the default cable type, and handle active and passive cables when they are +specifically detected. + +Fixes: abf0a1c2b26a ("amd-xgbe: Add support for SFP+ modules") +Signed-off-by: Tom Lendacky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index d54e6e138aaf..098792eb279c 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -188,6 +188,7 @@ enum xgbe_sfp_cable { + XGBE_SFP_CABLE_UNKNOWN = 0, + XGBE_SFP_CABLE_ACTIVE, + XGBE_SFP_CABLE_PASSIVE, ++ XGBE_SFP_CABLE_FIBER, + }; + + enum xgbe_sfp_base { +@@ -1136,16 +1137,18 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata) + phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data); + phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data); + +- /* Assume ACTIVE cable unless told it is PASSIVE */ ++ /* Assume FIBER cable unless told otherwise */ + if (sfp_base[XGBE_SFP_BASE_CABLE] & XGBE_SFP_BASE_CABLE_PASSIVE) { + phy_data->sfp_cable = XGBE_SFP_CABLE_PASSIVE; + phy_data->sfp_cable_len = sfp_base[XGBE_SFP_BASE_CU_CABLE_LEN]; +- } else { ++ } else if (sfp_base[XGBE_SFP_BASE_CABLE] & XGBE_SFP_BASE_CABLE_ACTIVE) { + phy_data->sfp_cable = XGBE_SFP_CABLE_ACTIVE; ++ } else { ++ phy_data->sfp_cable = XGBE_SFP_CABLE_FIBER; + } + + /* Determine the type of SFP */ +- if (phy_data->sfp_cable == XGBE_SFP_CABLE_PASSIVE && ++ if (phy_data->sfp_cable != XGBE_SFP_CABLE_FIBER && + xgbe_phy_sfp_bit_rate(sfp_eeprom, XGBE_SFP_SPEED_10000)) + phy_data->sfp_base = XGBE_SFP_BASE_10000_CR; + else if (sfp_base[XGBE_SFP_BASE_10GBE_CC] & XGBE_SFP_BASE_10GBE_CC_SR) +-- +2.35.1 + diff --git a/queue-4.19/net-apple-bmac-don-t-call-dev_kfree_skb-under-spin_l.patch b/queue-4.19/net-apple-bmac-don-t-call-dev_kfree_skb-under-spin_l.patch new file mode 100644 index 00000000000..93f73759d9f --- /dev/null +++ b/queue-4.19/net-apple-bmac-don-t-call-dev_kfree_skb-under-spin_l.patch @@ -0,0 +1,45 @@ +From edc5f1b0828cac0816cdc418ac5190c4d7d560e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 21:37:35 +0800 +Subject: net: apple: bmac: don't call dev_kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 5fe02e046e6422c4adfdbc50206ec7186077da24 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called in bmac_tx_timeout() to drop +the SKB, when tx timeout, so replace it with dev_kfree_skb_irq(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/apple/bmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c +index ab6ce85540b8..a0ce699903cf 100644 +--- a/drivers/net/ethernet/apple/bmac.c ++++ b/drivers/net/ethernet/apple/bmac.c +@@ -1510,7 +1510,7 @@ static void bmac_tx_timeout(struct timer_list *t) + i = bp->tx_empty; + ++dev->stats.tx_errors; + if (i != bp->tx_fill) { +- dev_kfree_skb(bp->tx_bufs[i]); ++ dev_kfree_skb_irq(bp->tx_bufs[i]); + bp->tx_bufs[i] = NULL; + if (++i >= N_TX_RING) i = 0; + bp->tx_empty = i; +-- +2.35.1 + diff --git a/queue-4.19/net-apple-mace-don-t-call-dev_kfree_skb-under-spin_l.patch b/queue-4.19/net-apple-mace-don-t-call-dev_kfree_skb-under-spin_l.patch new file mode 100644 index 00000000000..882cfff4783 --- /dev/null +++ b/queue-4.19/net-apple-mace-don-t-call-dev_kfree_skb-under-spin_l.patch @@ -0,0 +1,45 @@ +From 060cf1cc02a712c9ca712cc911ef8e6a97f4b731 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 21:37:34 +0800 +Subject: net: apple: mace: don't call dev_kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit 3dfe3486c1cd4f82b466b7d307f23777137b8acc ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called in mace_tx_timeout() to drop +the SKB, when tx timeout, so replace it with dev_kfree_skb_irq(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/apple/mace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/apple/mace.c b/drivers/net/ethernet/apple/mace.c +index 68b9ee489489..8f5e0cc00ddd 100644 +--- a/drivers/net/ethernet/apple/mace.c ++++ b/drivers/net/ethernet/apple/mace.c +@@ -840,7 +840,7 @@ static void mace_tx_timeout(struct timer_list *t) + if (mp->tx_bad_runt) { + mp->tx_bad_runt = 0; + } else if (i != mp->tx_fill) { +- dev_kfree_skb(mp->tx_bufs[i]); ++ dev_kfree_skb_irq(mp->tx_bufs[i]); + if (++i >= N_TX_RING) + i = 0; + mp->tx_empty = i; +-- +2.35.1 + diff --git a/queue-4.19/net-defxx-fix-missing-err-handling-in-dfx_init.patch b/queue-4.19/net-defxx-fix-missing-err-handling-in-dfx_init.patch new file mode 100644 index 00000000000..d106680cd58 --- /dev/null +++ b/queue-4.19/net-defxx-fix-missing-err-handling-in-dfx_init.patch @@ -0,0 +1,61 @@ +From 53227c579560513b8e96b3ef11f0071de95c4668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 07:20:45 +0000 +Subject: net: defxx: Fix missing err handling in dfx_init() + +From: Yongqiang Liu + +[ Upstream commit ae18dcdff0f8d7e84cd3fd9f496518b5e72d185d ] + +When eisa_driver_register() or tc_register_driver() failed, +the modprobe defxx would fail with some err log as follows: + + Error: Driver 'defxx' is already registered, aborting... + +Fix this issue by adding err hanling in dfx_init(). + +Fixes: e89a2cfb7d7b5 ("[TC] defxx: TURBOchannel support") +Signed-off-by: Yongqiang Liu +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/fddi/defxx.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/fddi/defxx.c b/drivers/net/fddi/defxx.c +index 3b48c890540a..7f14aad1c240 100644 +--- a/drivers/net/fddi/defxx.c ++++ b/drivers/net/fddi/defxx.c +@@ -3844,10 +3844,24 @@ static int dfx_init(void) + int status; + + status = pci_register_driver(&dfx_pci_driver); +- if (!status) +- status = eisa_driver_register(&dfx_eisa_driver); +- if (!status) +- status = tc_register_driver(&dfx_tc_driver); ++ if (status) ++ goto err_pci_register; ++ ++ status = eisa_driver_register(&dfx_eisa_driver); ++ if (status) ++ goto err_eisa_register; ++ ++ status = tc_register_driver(&dfx_tc_driver); ++ if (status) ++ goto err_tc_register; ++ ++ return 0; ++ ++err_tc_register: ++ eisa_driver_unregister(&dfx_eisa_driver); ++err_eisa_register: ++ pci_unregister_driver(&dfx_pci_driver); ++err_pci_register: + return status; + } + +-- +2.35.1 + diff --git a/queue-4.19/net-emaclite-don-t-call-dev_kfree_skb-under-spin_loc.patch b/queue-4.19/net-emaclite-don-t-call-dev_kfree_skb-under-spin_loc.patch new file mode 100644 index 00000000000..0c73257012c --- /dev/null +++ b/queue-4.19/net-emaclite-don-t-call-dev_kfree_skb-under-spin_loc.patch @@ -0,0 +1,44 @@ +From 157460d4b4973d828c5061425c97b516a0656ad3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 22:21:44 +0800 +Subject: net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit d1678bf45f21fa5ae4a456f821858679556ea5f8 ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. +The difference between them is free reason, dev_kfree_skb_irq() means +the SKB is dropped in error and dev_consume_skb_irq() means the SKB +is consumed in normal. + +In this case, dev_kfree_skb() is called in xemaclite_tx_timeout() to +drop the SKB, when tx timeout, so replace it with dev_kfree_skb_irq(). + +Fixes: bb81b2ddfa19 ("net: add Xilinx emac lite device driver") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +index 4e1504587895..e3f0beaa7d55 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c ++++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c +@@ -543,7 +543,7 @@ static void xemaclite_tx_timeout(struct net_device *dev) + xemaclite_enable_interrupts(lp); + + if (lp->deferred_skb) { +- dev_kfree_skb(lp->deferred_skb); ++ dev_kfree_skb_irq(lp->deferred_skb); + lp->deferred_skb = NULL; + dev->stats.tx_errors++; + } +-- +2.35.1 + diff --git a/queue-4.19/net-ethernet-dnet-don-t-call-dev_kfree_skb-under-spi.patch b/queue-4.19/net-ethernet-dnet-don-t-call-dev_kfree_skb-under-spi.patch new file mode 100644 index 00000000000..41fb6391aff --- /dev/null +++ b/queue-4.19/net-ethernet-dnet-don-t-call-dev_kfree_skb-under-spi.patch @@ -0,0 +1,45 @@ +From 9e9894e14dec8e0088d5d0fe4222ddfaa16cc8ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 22:21:45 +0800 +Subject: net: ethernet: dnet: don't call dev_kfree_skb() under + spin_lock_irqsave() + +From: Yang Yingliang + +[ Upstream commit f07fadcbee2a5e84caa67c7c445424200bffb60b ] + +It is not allowed to call kfree_skb() or consume_skb() from hardware +interrupt context or with hardware interrupts being disabled. + +In this case, the lock is used to protected 'bp', so we can move +dev_kfree_skb() after the spin_unlock_irqrestore(). + +Fixes: 4796417417a6 ("dnet: Dave DNET ethernet controller driver (updated)") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dnet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/dnet.c b/drivers/net/ethernet/dnet.c +index 5a847941c46b..f7d126a2617e 100644 +--- a/drivers/net/ethernet/dnet.c ++++ b/drivers/net/ethernet/dnet.c +@@ -558,11 +558,11 @@ static netdev_tx_t dnet_start_xmit(struct sk_buff *skb, struct net_device *dev) + + skb_tx_timestamp(skb); + ++ spin_unlock_irqrestore(&bp->lock, flags); ++ + /* free the buffer */ + dev_kfree_skb(skb); + +- spin_unlock_irqrestore(&bp->lock, flags); +- + return NETDEV_TX_OK; + } + +-- +2.35.1 + diff --git a/queue-4.19/net-ethernet-ti-fix-return-type-of-netcp_ndo_start_x.patch b/queue-4.19/net-ethernet-ti-fix-return-type-of-netcp_ndo_start_x.patch new file mode 100644 index 00000000000..d942d0711f9 --- /dev/null +++ b/queue-4.19/net-ethernet-ti-fix-return-type-of-netcp_ndo_start_x.patch @@ -0,0 +1,53 @@ +From 7c8ba066d548d6188e8b19bdc4c7c53fa26ebcfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Nov 2022 09:09:33 -0700 +Subject: net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() + +From: Nathan Chancellor + +[ Upstream commit 63fe6ff674a96cfcfc0fa8df1051a27aa31c70b4 ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/net/ethernet/ti/netcp_core.c:1944:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .ndo_start_xmit = netcp_ndo_start_xmit, + ^~~~~~~~~~~~~~~~~~~~ + 1 error generated. + +->ndo_start_xmit() in 'struct net_device_ops' expects a return type of +'netdev_tx_t', not 'int'. Adjust the return type of +netcp_ndo_start_xmit() to match the prototype's to resolve the warning +and CFI failure. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Signed-off-by: Nathan Chancellor +Reviewed-by: Kees Cook +Link: https://lore.kernel.org/r/20221102160933.1601260-1-nathan@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/netcp_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c +index 6099865217f2..7fdbd2ff5573 100644 +--- a/drivers/net/ethernet/ti/netcp_core.c ++++ b/drivers/net/ethernet/ti/netcp_core.c +@@ -1276,7 +1276,7 @@ static int netcp_tx_submit_skb(struct netcp_intf *netcp, + } + + /* Submit the packet */ +-static int netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t netcp_ndo_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct netcp_intf *netcp = netdev_priv(ndev); + struct netcp_stats *tx_stats = &netcp->stats; +-- +2.35.1 + diff --git a/queue-4.19/net-farsync-fix-kmemleak-when-rmmods-farsync.patch b/queue-4.19/net-farsync-fix-kmemleak-when-rmmods-farsync.patch new file mode 100644 index 00000000000..665acf456de --- /dev/null +++ b/queue-4.19/net-farsync-fix-kmemleak-when-rmmods-farsync.patch @@ -0,0 +1,75 @@ +From efa4aada1f602e150243581ba23e1e5254cd37b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 20:05:40 +0800 +Subject: net: farsync: Fix kmemleak when rmmods farsync + +From: Li Zetao + +[ Upstream commit 2f623aaf9f31de968dea6169849706a2f9be444c ] + +There are two memory leaks reported by kmemleak: + + unreferenced object 0xffff888114b20200 (size 128): + comm "modprobe", pid 4846, jiffies 4295146524 (age 401.345s) + hex dump (first 32 bytes): + e0 62 57 09 81 88 ff ff e0 62 57 09 81 88 ff ff .bW......bW..... + 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] kmalloc_trace+0x22/0x60 + [] __hw_addr_add_ex+0x198/0x6c0 + [] dev_addr_init+0x13d/0x230 + [] alloc_netdev_mqs+0x10d/0xe50 + [] alloc_hdlcdev+0x2e/0x80 + [] fst_add_one+0x601/0x10e0 [farsync] + ... + + unreferenced object 0xffff88810b85b000 (size 1024): + comm "modprobe", pid 4846, jiffies 4295146523 (age 401.346s) + hex dump (first 32 bytes): + 00 00 b0 02 00 c9 ff ff 00 70 0a 00 00 c9 ff ff .........p...... + 00 00 00 f2 00 00 00 f3 0a 00 00 00 02 00 00 00 ................ + backtrace: + [] kmalloc_trace+0x22/0x60 + [] fst_add_one+0x154/0x10e0 [farsync] + [] local_pci_probe+0xd3/0x170 + ... + +The root cause is traced to the netdev and fst_card_info are not freed +when removes one fst in fst_remove_one(), which may trigger oom if +repeated insmod and rmmod module. + +Fix it by adding free_netdev() and kfree() in fst_remove_one(), just as +the operations on the error handling path in fst_add_one(). + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Li Zetao +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/farsync.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c +index 2a3f0f1a2b0a..bc249f81c80d 100644 +--- a/drivers/net/wan/farsync.c ++++ b/drivers/net/wan/farsync.c +@@ -2617,6 +2617,7 @@ fst_remove_one(struct pci_dev *pdev) + for (i = 0; i < card->nports; i++) { + struct net_device *dev = port_to_dev(&card->ports[i]); + unregister_hdlc_device(dev); ++ free_netdev(dev); + } + + fst_disable_intr(card); +@@ -2637,6 +2638,7 @@ fst_remove_one(struct pci_dev *pdev) + card->tx_dma_handle_card); + } + fst_card_array[card->card_no] = NULL; ++ kfree(card); + } + + static struct pci_driver fst_driver = { +-- +2.35.1 + diff --git a/queue-4.19/net-lan9303-fix-read-error-execution-path.patch b/queue-4.19/net-lan9303-fix-read-error-execution-path.patch new file mode 100644 index 00000000000..df223d5d67e --- /dev/null +++ b/queue-4.19/net-lan9303-fix-read-error-execution-path.patch @@ -0,0 +1,44 @@ +From 80d6b8774b1b3d48e7d1f21380f4b6983f160e62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Dec 2022 09:35:02 -0600 +Subject: net: lan9303: Fix read error execution path + +From: Jerry Ray + +[ Upstream commit 8964916d206071b058c6351f88b1966bd58cbde0 ] + +This patch fixes an issue where a read failure of a port statistic counter +will return unknown results. While it is highly unlikely the read will +ever fail, it is much cleaner to return a zero for the stat count. + +Fixes: a1292595e006 ("net: dsa: add new DSA switch driver for the SMSC-LAN9303") +Signed-off-by: Jerry Ray +Reviewed-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20221209153502.7429-1-jerry.ray@microchip.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/lan9303-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/lan9303-core.c b/drivers/net/dsa/lan9303-core.c +index 03dc075ff4e8..f976b3d64593 100644 +--- a/drivers/net/dsa/lan9303-core.c ++++ b/drivers/net/dsa/lan9303-core.c +@@ -1010,9 +1010,11 @@ static void lan9303_get_ethtool_stats(struct dsa_switch *ds, int port, + ret = lan9303_read_switch_port( + chip, port, lan9303_mib[u].offset, ®); + +- if (ret) ++ if (ret) { + dev_warn(chip->dev, "Reading status port %d reg %u failed\n", + port, lan9303_mib[u].offset); ++ reg = 0; ++ } + data[u] = reg; + } + } +-- +2.35.1 + diff --git a/queue-4.19/net-proc-provide-proc_fs-n-fallback-for-proc_create_.patch b/queue-4.19/net-proc-provide-proc_fs-n-fallback-for-proc_create_.patch new file mode 100644 index 00000000000..d6c7726557d --- /dev/null +++ b/queue-4.19/net-proc-provide-proc_fs-n-fallback-for-proc_create_.patch @@ -0,0 +1,43 @@ +From 9b6ce1de0efdd7faa908a5daf1540991ffbaa8e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Oct 2022 07:34:21 +0100 +Subject: net, proc: Provide PROC_FS=n fallback for + proc_create_net_single_write() + +From: David Howells + +[ Upstream commit c3d96f690a790074b508fe183a41e36a00cd7ddd ] + +Provide a CONFIG_PROC_FS=n fallback for proc_create_net_single_write(). + +Also provide a fallback for proc_create_net_data_write(). + +Fixes: 564def71765c ("proc: Add a way to make network proc files writable") +Reported-by: kernel test robot +Signed-off-by: David Howells +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +cc: netdev@vger.kernel.org +Signed-off-by: Sasha Levin +--- + include/linux/proc_fs.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h +index 5141657a0f7f..c16352fbbe1f 100644 +--- a/include/linux/proc_fs.h ++++ b/include/linux/proc_fs.h +@@ -117,8 +117,10 @@ static inline void proc_remove(struct proc_dir_entry *de) {} + static inline int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) { return 0; } + + #define proc_create_net_data(name, mode, parent, ops, state_size, data) ({NULL;}) ++#define proc_create_net_data_write(name, mode, parent, ops, write, state_size, data) ({NULL;}) + #define proc_create_net(name, mode, parent, state_size, ops) ({NULL;}) + #define proc_create_net_single(name, mode, parent, show, data) ({NULL;}) ++#define proc_create_net_single_write(name, mode, parent, show, write, data) ({NULL;}) + + #endif /* CONFIG_PROC_FS */ + +-- +2.35.1 + diff --git a/queue-4.19/net-stream-purge-sk_error_queue-in-sk_stream_kill_qu.patch b/queue-4.19/net-stream-purge-sk_error_queue-in-sk_stream_kill_qu.patch new file mode 100644 index 00000000000..e2c01ea667c --- /dev/null +++ b/queue-4.19/net-stream-purge-sk_error_queue-in-sk_stream_kill_qu.patch @@ -0,0 +1,69 @@ +From 185ac2467346dcaaa8e27856147dee444c37c69c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Dec 2022 16:29:17 +0000 +Subject: net: stream: purge sk_error_queue in sk_stream_kill_queues() + +From: Eric Dumazet + +[ Upstream commit e0c8bccd40fc1c19e1d246c39bcf79e357e1ada3 ] + +Changheon Lee reported TCP socket leaks, with a nice repro. + +It seems we leak TCP sockets with the following sequence: + +1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket. + + Each ACK will cook an skb put in error queue, from __skb_tstamp_tx(). + __skb_tstamp_tx() is using skb_clone(), unless + SOF_TIMESTAMPING_OPT_TSONLY was also requested. + +2) If the application is also using MSG_ZEROCOPY, then we put in the + error queue cloned skbs that had a struct ubuf_info attached to them. + + Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc() + does a sock_hold(). + + As long as the cloned skbs are still in sk_error_queue, + socket refcount is kept elevated. + +3) Application closes the socket, while error queue is not empty. + +Since tcp_close() no longer purges the socket error queue, +we might end up with a TCP socket with at least one skb in +error queue keeping the socket alive forever. + +This bug can be (ab)used to consume all kernel memory +and freeze the host. + +We need to purge the error queue, with proper synchronization +against concurrent writers. + +Fixes: 24bcbe1cc69f ("net: stream: don't purge sk_error_queue in sk_stream_kill_queues()") +Reported-by: Changheon Lee +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/stream.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/core/stream.c b/net/core/stream.c +index 7b411a91a81c..58755528d39e 100644 +--- a/net/core/stream.c ++++ b/net/core/stream.c +@@ -196,6 +196,12 @@ void sk_stream_kill_queues(struct sock *sk) + /* First the read buffer. */ + __skb_queue_purge(&sk->sk_receive_queue); + ++ /* Next, the error queue. ++ * We need to use queue lock, because other threads might ++ * add packets to the queue without socket lock being held. ++ */ ++ skb_queue_purge(&sk->sk_error_queue); ++ + /* Next, the write queue. */ + WARN_ON(!skb_queue_empty(&sk->sk_write_queue)); + +-- +2.35.1 + diff --git a/queue-4.19/net-tunnel-wait-until-all-sk_user_data-reader-finish.patch b/queue-4.19/net-tunnel-wait-until-all-sk_user_data-reader-finish.patch new file mode 100644 index 00000000000..79b7191b034 --- /dev/null +++ b/queue-4.19/net-tunnel-wait-until-all-sk_user_data-reader-finish.patch @@ -0,0 +1,75 @@ +From ae55aaee9615aba322ac10e3510e98b1d5af44bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 20:04:52 +0800 +Subject: net/tunnel: wait until all sk_user_data reader finish before + releasing the sock + +From: Hangbin Liu + +[ Upstream commit 3cf7203ca620682165706f70a1b12b5194607dce ] + +There is a race condition in vxlan that when deleting a vxlan device +during receiving packets, there is a possibility that the sock is +released after getting vxlan_sock vs from sk_user_data. Then in +later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got +NULL pointer dereference. e.g. + + #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 + #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d + #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 + #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b + #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb + #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542 + #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62 + [exception RIP: vxlan_ecn_decapsulate+0x3b] + RIP: ffffffffc1014e7b RSP: ffffa25ec6978cb0 RFLAGS: 00010246 + RAX: 0000000000000008 RBX: ffff8aa000888000 RCX: 0000000000000000 + RDX: 000000000000000e RSI: ffff8a9fc7ab803e RDI: ffff8a9fd1168700 + RBP: ffff8a9fc7ab803e R8: 0000000000700000 R9: 00000000000010ae + R10: ffff8a9fcb748980 R11: 0000000000000000 R12: ffff8a9fd1168700 + R13: ffff8aa000888000 R14: 00000000002a0000 R15: 00000000000010ae + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan] + #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507 + #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45 + #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807 + #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951 + #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde + #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b + #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139 + #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a + #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3 + #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca + #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3 + +Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh + +Fix this by waiting for all sk_user_data reader to finish before +releasing the sock. + +Reported-by: Jianlin Shi +Suggested-by: Jakub Sitnicki +Fixes: 6a93cc905274 ("udp-tunnel: Add a few more UDP tunnel APIs") +Signed-off-by: Hangbin Liu +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/udp_tunnel.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv4/udp_tunnel.c b/net/ipv4/udp_tunnel.c +index 6539ff15e9a3..d03d74388870 100644 +--- a/net/ipv4/udp_tunnel.c ++++ b/net/ipv4/udp_tunnel.c +@@ -186,6 +186,7 @@ EXPORT_SYMBOL_GPL(udp_tunnel_xmit_skb); + void udp_tunnel_sock_release(struct socket *sock) + { + rcu_assign_sk_user_data(sock->sk, NULL); ++ synchronize_rcu(); + kernel_sock_shutdown(sock, SHUT_RDWR); + sock_release(sock); + } +-- +2.35.1 + diff --git a/queue-4.19/net-vmw_vsock-vmci-check-memcpy_from_msg.patch b/queue-4.19/net-vmw_vsock-vmci-check-memcpy_from_msg.patch new file mode 100644 index 00000000000..df5a2630ae3 --- /dev/null +++ b/queue-4.19/net-vmw_vsock-vmci-check-memcpy_from_msg.patch @@ -0,0 +1,47 @@ +From 602d43087d59fbf50cfee21c5968bd23eb4902d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 09:58:34 +0300 +Subject: net: vmw_vsock: vmci: Check memcpy_from_msg() + +From: Artem Chernyshev + +[ Upstream commit 44aa5a6dba8283bfda28b1517af4de711c5652a4 ] + +vmci_transport_dgram_enqueue() does not check the return value +of memcpy_from_msg(). If memcpy_from_msg() fails, it is possible that +uninitialized memory contents are sent unintentionally instead of user's +message in the datagram to the destination. Return with an error if +memcpy_from_msg() fails. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0f7db23a07af ("vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr") +Signed-off-by: Artem Chernyshev +Reviewed-by: Stefano Garzarella +Reviewed-by: Vishnu Dasa +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 42ab3e2ac060..2a8127f245e8 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -1733,7 +1733,11 @@ static int vmci_transport_dgram_enqueue( + if (!dg) + return -ENOMEM; + +- memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len); ++ err = memcpy_from_msg(VMCI_DG_PAYLOAD(dg), msg, len); ++ if (err) { ++ kfree(dg); ++ return err; ++ } + + dg->dst = vmci_make_handle(remote_addr->svm_cid, + remote_addr->svm_port); +-- +2.35.1 + diff --git a/queue-4.19/net_sched-reject-tcf_em_simple-case-for-complex-emat.patch b/queue-4.19/net_sched-reject-tcf_em_simple-case-for-complex-emat.patch new file mode 100644 index 00000000000..20238bfdc4c --- /dev/null +++ b/queue-4.19/net_sched-reject-tcf_em_simple-case-for-complex-emat.patch @@ -0,0 +1,52 @@ +From d9c3bf9d394021702ed0a171e60b0b889c431759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 14:17:07 -0800 +Subject: net_sched: reject TCF_EM_SIMPLE case for complex ematch module + +From: Cong Wang + +[ Upstream commit 9cd3fd2054c3b3055163accbf2f31a4426f10317 ] + +When TCF_EM_SIMPLE was introduced, it is supposed to be convenient +for ematch implementation: + +https://lore.kernel.org/all/20050105110048.GO26856@postel.suug.ch/ + +"You don't have to, providing a 32bit data chunk without TCF_EM_SIMPLE +set will simply result in allocating & copy. It's an optimization, +nothing more." + +So if an ematch module provides ops->datalen that means it wants a +complex data structure (saved in its em->data) instead of a simple u32 +value. We should simply reject such a combination, otherwise this u32 +could be misinterpreted as a pointer. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-and-tested-by: syzbot+4caeae4c7103813598ae@syzkaller.appspotmail.com +Reported-by: Jun Nie +Cc: Jamal Hadi Salim +Cc: Paolo Abeni +Signed-off-by: Cong Wang +Acked-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/ematch.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/sched/ematch.c b/net/sched/ematch.c +index 113a133ee544..5ba3548d2eb7 100644 +--- a/net/sched/ematch.c ++++ b/net/sched/ematch.c +@@ -259,6 +259,8 @@ static int tcf_em_validate(struct tcf_proto *tp, + * the value carried. + */ + if (em_hdr->flags & TCF_EM_SIMPLE) { ++ if (em->ops->datalen > 0) ++ goto errout; + if (data_len < sizeof(u32)) + goto errout; + em->data = *(u32 *) data; +-- +2.35.1 + diff --git a/queue-4.19/nfc-pn533-clear-nfc_target-before-being-used.patch b/queue-4.19/nfc-pn533-clear-nfc_target-before-being-used.patch new file mode 100644 index 00000000000..0e8b1cc4e97 --- /dev/null +++ b/queue-4.19/nfc-pn533-clear-nfc_target-before-being-used.patch @@ -0,0 +1,73 @@ +From d0fff281b43d8016d973bd56778691d5a0c8ecbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 10:51:39 +0900 +Subject: nfc: pn533: Clear nfc_target before being used + +From: Minsuk Kang + +[ Upstream commit 9f28157778ede0d4f183f7ab3b46995bb400abbe ] + +Fix a slab-out-of-bounds read that occurs in nla_put() called from +nfc_genl_send_target() when target->sensb_res_len, which is duplicated +from an nfc_target in pn533, is too large as the nfc_target is not +properly initialized and retains garbage values. Clear nfc_targets with +memset() before they are used. + +Found by a modified version of syzkaller. + +BUG: KASAN: slab-out-of-bounds in nla_put +Call Trace: + memcpy + nla_put + nfc_genl_dump_targets + genl_lock_dumpit + netlink_dump + __netlink_dump_start + genl_family_rcv_msg_dumpit + genl_rcv_msg + netlink_rcv_skb + genl_rcv + netlink_unicast + netlink_sendmsg + sock_sendmsg + ____sys_sendmsg + ___sys_sendmsg + __sys_sendmsg + do_syscall_64 + +Fixes: 673088fb42d0 ("NFC: pn533: Send ATR_REQ directly for active device detection") +Fixes: 361f3cb7f9cf ("NFC: DEP link hook implementation for pn533") +Signed-off-by: Minsuk Kang +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20221214015139.119673-1-linuxlovemin@yonsei.ac.kr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/pn533/pn533.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c +index 79bf8e1bd39c..b7f5db3a6aa0 100644 +--- a/drivers/nfc/pn533/pn533.c ++++ b/drivers/nfc/pn533/pn533.c +@@ -1305,6 +1305,8 @@ static int pn533_poll_dep_complete(struct pn533 *dev, void *arg, + if (IS_ERR(resp)) + return PTR_ERR(resp); + ++ memset(&nfc_target, 0, sizeof(struct nfc_target)); ++ + rsp = (struct pn533_cmd_jump_dep_response *)resp->data; + + rc = rsp->status & PN533_CMD_RET_MASK; +@@ -1786,6 +1788,8 @@ static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg, + + dev_dbg(dev->dev, "Creating new target\n"); + ++ memset(&nfc_target, 0, sizeof(struct nfc_target)); ++ + nfc_target.supported_protocols = NFC_PROTO_NFC_DEP_MASK; + nfc_target.nfcid1_len = 10; + memcpy(nfc_target.nfcid1, rsp->nfcid3t, nfc_target.nfcid1_len); +-- +2.35.1 + diff --git a/queue-4.19/nfsd-under-nfsv4.1-fix-double-svc_xprt_put-on-rpc_cr.patch b/queue-4.19/nfsd-under-nfsv4.1-fix-double-svc_xprt_put-on-rpc_cr.patch new file mode 100644 index 00000000000..4ee95e2976b --- /dev/null +++ b/queue-4.19/nfsd-under-nfsv4.1-fix-double-svc_xprt_put-on-rpc_cr.patch @@ -0,0 +1,87 @@ +From 76e02235a7b3498f2d39830b5027e8146ea200ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Dec 2022 13:11:06 +0200 +Subject: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure + +From: Dan Aloni + +[ Upstream commit 3bc8edc98bd43540dbe648e4ef91f443d6d20a24 ] + +On error situation `clp->cl_cb_conn.cb_xprt` should not be given +a reference to the xprt otherwise both client cleanup and the +error handling path of the caller call to put it. Better to +delay handing over the reference to a later branch. + +[ 72.530665] refcount_t: underflow; use-after-free. +[ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 +[ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] +[ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 +[ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 +[ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] +[ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 +[ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 +[ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 +[ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 +[ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 +[ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff +[ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 +[ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 +[ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 +[ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 +[ 72.554874] Call Trace: +[ 72.555278] +[ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] +[ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] +[ 72.557087] ? update_load_avg+0x82/0x610 +[ 72.557652] ? cpuacct_charge+0x60/0x70 +[ 72.558212] ? dequeue_entity+0xdb/0x3e0 +[ 72.558765] ? queued_spin_unlock+0x9/0x20 +[ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] +[ 72.560031] process_one_work+0x1df/0x390 +[ 72.560600] worker_thread+0x37/0x3b0 +[ 72.561644] ? process_one_work+0x390/0x390 +[ 72.562247] kthread+0x12f/0x150 +[ 72.562710] ? set_kthread_struct+0x50/0x50 +[ 72.563309] ret_from_fork+0x22/0x30 +[ 72.563818] +[ 72.564189] ---[ end trace 031117b1c72ec616 ]--- +[ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). +[ 72.567647] ------------[ cut here ]------------ + +Fixes: a4abc6b12eb1 ("nfsd: Fix svc_xprt refcnt leak when setup callback client failed") +Cc: Xiyu Yang +Cc: J. Bruce Fields +Signed-off-by: Dan Aloni +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4callback.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c +index 7ee417b685e9..519d994c0c4c 100644 +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -800,7 +800,6 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c + } else { + if (!conn->cb_xprt) + return -EINVAL; +- clp->cl_cb_conn.cb_xprt = conn->cb_xprt; + clp->cl_cb_session = ses; + args.bc_xprt = conn->cb_xprt; + args.prognumber = clp->cl_cb_session->se_cb_prog; +@@ -820,6 +819,9 @@ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *c + rpc_shutdown_client(client); + return PTR_ERR(cred); + } ++ ++ if (clp->cl_minorversion != 0) ++ clp->cl_cb_conn.cb_xprt = conn->cb_xprt; + clp->cl_cb_client = client; + clp->cl_cb_cred = cred; + return 0; +-- +2.35.1 + diff --git a/queue-4.19/nfsv4-fix-a-deadlock-between-nfs4_open_recover_helpe.patch b/queue-4.19/nfsv4-fix-a-deadlock-between-nfs4_open_recover_helpe.patch new file mode 100644 index 00000000000..7c239232ca0 --- /dev/null +++ b/queue-4.19/nfsv4-fix-a-deadlock-between-nfs4_open_recover_helpe.patch @@ -0,0 +1,73 @@ +From 8484e47e60d80915730147e617c3df00b77b4252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 13:20:01 -0400 +Subject: NFSv4: Fix a deadlock between nfs4_open_recover_helper() and + delegreturn + +From: Trond Myklebust + +[ Upstream commit 51069e4aef6257b0454057359faed0ab0c9af083 ] + +If we're asked to recover open state while a delegation return is +outstanding, then the state manager thread cannot use a cached open, so +if the server returns a delegation, we can end up deadlocked behind the +pending delegreturn. +To avoid this problem, let's just ask the server not to give us a +delegation unless we're explicitly reclaiming one. + +Fixes: be36e185bd26 ("NFSv4: nfs4_open_recover_helper() must set share access") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 9a0f48f7f2b8..250fa88303fa 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1980,18 +1980,18 @@ static struct nfs4_opendata *nfs4_open_recoverdata_alloc(struct nfs_open_context + } + + static int nfs4_open_recover_helper(struct nfs4_opendata *opendata, +- fmode_t fmode) ++ fmode_t fmode) + { + struct nfs4_state *newstate; ++ struct nfs_server *server = NFS_SB(opendata->dentry->d_sb); ++ int openflags = opendata->o_arg.open_flags; + int ret; + + if (!nfs4_mode_match_open_stateid(opendata->state, fmode)) + return 0; +- opendata->o_arg.open_flags = 0; + opendata->o_arg.fmode = fmode; +- opendata->o_arg.share_access = nfs4_map_atomic_open_share( +- NFS_SB(opendata->dentry->d_sb), +- fmode, 0); ++ opendata->o_arg.share_access = ++ nfs4_map_atomic_open_share(server, fmode, openflags); + memset(&opendata->o_res, 0, sizeof(opendata->o_res)); + memset(&opendata->c_res, 0, sizeof(opendata->c_res)); + nfs4_init_opendata_res(opendata); +@@ -2569,10 +2569,15 @@ static int _nfs4_open_expired(struct nfs_open_context *ctx, struct nfs4_state *s + struct nfs4_opendata *opendata; + int ret; + +- opendata = nfs4_open_recoverdata_alloc(ctx, state, +- NFS4_OPEN_CLAIM_FH); ++ opendata = nfs4_open_recoverdata_alloc(ctx, state, NFS4_OPEN_CLAIM_FH); + if (IS_ERR(opendata)) + return PTR_ERR(opendata); ++ /* ++ * We're not recovering a delegation, so ask for no delegation. ++ * Otherwise the recovery thread could deadlock with an outstanding ++ * delegation return. ++ */ ++ opendata->o_arg.open_flags = O_DIRECT; + ret = nfs4_open_recover(opendata, state); + if (ret == -ESTALE) + d_drop(ctx->dentry); +-- +2.35.1 + diff --git a/queue-4.19/nfsv4.2-fix-a-memory-stomp-in-decode_attr_security_l.patch b/queue-4.19/nfsv4.2-fix-a-memory-stomp-in-decode_attr_security_l.patch new file mode 100644 index 00000000000..3f1bda25b2d --- /dev/null +++ b/queue-4.19/nfsv4.2-fix-a-memory-stomp-in-decode_attr_security_l.patch @@ -0,0 +1,43 @@ +From 0b80c79acdcc8e394fc10fd417d0c94b77fd0444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 18:21:14 -0400 +Subject: NFSv4.2: Fix a memory stomp in decode_attr_security_label + +From: Trond Myklebust + +[ Upstream commit 43c1031f7110967c240cb6e922adcfc4b8899183 ] + +We must not change the value of label->len if it is zero, since that +indicates we stored a label. + +Fixes: b4487b935452 ("nfs: Fix getxattr kernel panic and memory overflow") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4xdr.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index 56e48642c43e..f0021e3b8efd 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -4277,12 +4277,10 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, + if (unlikely(!p)) + goto out_overflow; + if (len < NFS4_MAXLABELLEN) { +- if (label) { +- if (label->len) { +- if (label->len < len) +- return -ERANGE; +- memcpy(label->label, p, len); +- } ++ if (label && label->len) { ++ if (label->len < len) ++ return -ERANGE; ++ memcpy(label->label, p, len); + label->len = len; + label->pi = pi; + label->lfs = lfs; +-- +2.35.1 + diff --git a/queue-4.19/nfsv4.x-fail-client-initialisation-if-state-manager-.patch b/queue-4.19/nfsv4.x-fail-client-initialisation-if-state-manager-.patch new file mode 100644 index 00000000000..05ae4ae17e2 --- /dev/null +++ b/queue-4.19/nfsv4.x-fail-client-initialisation-if-state-manager-.patch @@ -0,0 +1,37 @@ +From c7dbfa6a6bc4e46c7eaeabc53f51173570b26a6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Dec 2022 12:42:59 -0500 +Subject: NFSv4.x: Fail client initialisation if state manager thread can't run + +From: Trond Myklebust + +[ Upstream commit b4e4f66901658fae0614dea5bf91062a5387eda7 ] + +If the state manager thread fails to start, then we should just mark the +client initialisation as failed so that other processes or threads don't +get stuck in nfs_wait_client_init_complete(). + +Reported-by: ChenXiaoSong +Fixes: 4697bd5e9419 ("NFSv4: Fix a race in the net namespace mount notification") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 5ab021f87ecf..b9fbd01ef4cf 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1247,6 +1247,8 @@ void nfs4_schedule_state_manager(struct nfs_client *clp) + if (IS_ERR(task)) { + printk(KERN_ERR "%s: kthread_run: %ld\n", + __func__, PTR_ERR(task)); ++ if (!nfs_client_init_is_complete(clp)) ++ nfs_mark_client_ready(clp, PTR_ERR(task)); + nfs4_clear_state_manager_bit(clp); + nfs_put_client(clp); + module_put(THIS_MODULE); +-- +2.35.1 + diff --git a/queue-4.19/nilfs2-fix-shift-out-of-bounds-overflow-in-nilfs_sb2.patch b/queue-4.19/nilfs2-fix-shift-out-of-bounds-overflow-in-nilfs_sb2.patch new file mode 100644 index 00000000000..6f29869063f --- /dev/null +++ b/queue-4.19/nilfs2-fix-shift-out-of-bounds-overflow-in-nilfs_sb2.patch @@ -0,0 +1,114 @@ +From 00ee98b77e29b500a75314509d6c837136edf02a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Oct 2022 13:43:05 +0900 +Subject: nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset() + +From: Ryusuke Konishi + +[ Upstream commit 610a2a3d7d8be3537458a378ec69396a76c385b6 ] + +Patch series "nilfs2: fix UBSAN shift-out-of-bounds warnings on mount +time". + +The first patch fixes a bug reported by syzbot, and the second one fixes +the remaining bug of the same kind. Although they are triggered by the +same super block data anomaly, I divided it into the above two because the +details of the issues and how to fix it are different. + +Both are required to eliminate the shift-out-of-bounds issues at mount +time. + +This patch (of 2): + +If the block size exponent information written in an on-disk superblock is +corrupted, nilfs_sb2_bad_offset helper function can trigger +shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn +is set): + + shift exponent 38983 is too large for 64-bit type 'unsigned long long' + Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 + ubsan_epilogue lib/ubsan.c:151 [inline] + __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322 + nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline] + nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523 + init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577 + nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047 + nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317 + ... + +In addition, since nilfs_sb2_bad_offset() performs multiplication without +considering the upper bound, the computation may overflow if the disk +layout parameters are not normal. + +This fixes these issues by inserting preliminary sanity checks for those +parameters and by converting the comparison from one involving +multiplication and left bit-shifting to one using division and right +bit-shifting. + +Link: https://lkml.kernel.org/r/20221027044306.42774-1-konishi.ryusuke@gmail.com +Link: https://lkml.kernel.org/r/20221027044306.42774-2-konishi.ryusuke@gmail.com +Signed-off-by: Ryusuke Konishi +Reported-by: syzbot+e91619dd4c11c4960706@syzkaller.appspotmail.com +Tested-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/nilfs2/the_nilfs.c | 31 +++++++++++++++++++++++++++---- + 1 file changed, 27 insertions(+), 4 deletions(-) + +diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c +index fb61c33c6004..74ef3d313686 100644 +--- a/fs/nilfs2/the_nilfs.c ++++ b/fs/nilfs2/the_nilfs.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include "nilfs.h" + #include "segment.h" +@@ -448,11 +449,33 @@ static int nilfs_valid_sb(struct nilfs_super_block *sbp) + return crc == le32_to_cpu(sbp->s_sum); + } + +-static int nilfs_sb2_bad_offset(struct nilfs_super_block *sbp, u64 offset) ++/** ++ * nilfs_sb2_bad_offset - check the location of the second superblock ++ * @sbp: superblock raw data buffer ++ * @offset: byte offset of second superblock calculated from device size ++ * ++ * nilfs_sb2_bad_offset() checks if the position on the second ++ * superblock is valid or not based on the filesystem parameters ++ * stored in @sbp. If @offset points to a location within the segment ++ * area, or if the parameters themselves are not normal, it is ++ * determined to be invalid. ++ * ++ * Return Value: true if invalid, false if valid. ++ */ ++static bool nilfs_sb2_bad_offset(struct nilfs_super_block *sbp, u64 offset) + { +- return offset < ((le64_to_cpu(sbp->s_nsegments) * +- le32_to_cpu(sbp->s_blocks_per_segment)) << +- (le32_to_cpu(sbp->s_log_block_size) + 10)); ++ unsigned int shift_bits = le32_to_cpu(sbp->s_log_block_size); ++ u32 blocks_per_segment = le32_to_cpu(sbp->s_blocks_per_segment); ++ u64 nsegments = le64_to_cpu(sbp->s_nsegments); ++ u64 index; ++ ++ if (blocks_per_segment < NILFS_SEG_MIN_BLOCKS || ++ shift_bits > ilog2(NILFS_MAX_BLOCK_SIZE) - BLOCK_SIZE_BITS) ++ return true; ++ ++ index = offset >> (shift_bits + BLOCK_SIZE_BITS); ++ do_div(index, blocks_per_segment); ++ return index < nsegments; + } + + static void nilfs_release_super_block(struct the_nilfs *nilfs) +-- +2.35.1 + diff --git a/queue-4.19/ntb_netdev-use-dev_kfree_skb_any-in-interrupt-contex.patch b/queue-4.19/ntb_netdev-use-dev_kfree_skb_any-in-interrupt-contex.patch new file mode 100644 index 00000000000..76aac156e2f --- /dev/null +++ b/queue-4.19/ntb_netdev-use-dev_kfree_skb_any-in-interrupt-contex.patch @@ -0,0 +1,73 @@ +From b7f2cf242ca2d6d670a60127153725e473962512 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 16:06:59 -0800 +Subject: ntb_netdev: Use dev_kfree_skb_any() in interrupt context + +From: Eric Pilmore + +[ Upstream commit 5f7d78b2b12a9d561f48fa00bab29b40f4616dad ] + +TX/RX callback handlers (ntb_netdev_tx_handler(), +ntb_netdev_rx_handler()) can be called in interrupt +context via the DMA framework when the respective +DMA operations have completed. As such, any calls +by these routines to free skb's, should use the +interrupt context safe dev_kfree_skb_any() function. + +Previously, these callback handlers would call the +interrupt unsafe version of dev_kfree_skb(). This has +not presented an issue on Intel IOAT DMA engines as +that driver utilizes tasklets rather than a hard +interrupt handler, like the AMD PTDMA DMA driver. +On AMD systems, a kernel WARNING message is +encountered, which is being issued from +skb_release_head_state() due to in_hardirq() +being true. + +Besides the user visible WARNING from the kernel, +the other symptom of this bug was that TCP/IP performance +across the ntb_netdev interface was very poor, i.e. +approximately an order of magnitude below what was +expected. With the repair to use dev_kfree_skb_any(), +kernel WARNINGs from skb_release_head_state() ceased +and TCP/IP performance, as measured by iperf, was on +par with expected results, approximately 20 Gb/s on +AMD Milan based server. Note that this performance +is comparable with Intel based servers. + +Fixes: 765ccc7bc3d91 ("ntb_netdev: correct skb leak") +Fixes: 548c237c0a997 ("net: Add support for NTB virtual ethernet device") +Signed-off-by: Eric Pilmore +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20221209000659.8318-1-epilmore@gigaio.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ntb_netdev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c +index 33974e7519ce..ca0053775d3f 100644 +--- a/drivers/net/ntb_netdev.c ++++ b/drivers/net/ntb_netdev.c +@@ -140,7 +140,7 @@ static void ntb_netdev_rx_handler(struct ntb_transport_qp *qp, void *qp_data, + enqueue_again: + rc = ntb_transport_rx_enqueue(qp, skb, skb->data, ndev->mtu + ETH_HLEN); + if (rc) { +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + ndev->stats.rx_errors++; + ndev->stats.rx_fifo_errors++; + } +@@ -195,7 +195,7 @@ static void ntb_netdev_tx_handler(struct ntb_transport_qp *qp, void *qp_data, + ndev->stats.tx_aborted_errors++; + } + +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + + if (ntb_transport_tx_free_entry(dev->qp) >= tx_start) { + /* Make sure anybody stopping the queue after this sees the new +-- +2.35.1 + diff --git a/queue-4.19/ocfs2-fix-memory-leak-in-ocfs2_stack_glue_init.patch b/queue-4.19/ocfs2-fix-memory-leak-in-ocfs2_stack_glue_init.patch new file mode 100644 index 00000000000..73bfdddae01 --- /dev/null +++ b/queue-4.19/ocfs2-fix-memory-leak-in-ocfs2_stack_glue_init.patch @@ -0,0 +1,73 @@ +From 890278ecc6a71c0166457acd6e6435b2f1f4ced3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 19:15:33 +0800 +Subject: ocfs2: fix memory leak in ocfs2_stack_glue_init() + +From: Shang XiaoJing + +[ Upstream commit 13b6269dd022aaa69ca8d1df374ab327504121cf ] + +ocfs2_table_header should be free in ocfs2_stack_glue_init() if +ocfs2_sysfs_init() failed, otherwise kmemleak will report memleak. + +BUG: memory leak +unreferenced object 0xffff88810eeb5800 (size 128): + comm "modprobe", pid 4507, jiffies 4296182506 (age 55.888s) + hex dump (first 32 bytes): + c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00 .@.............. + 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<000000001e59e1cd>] __register_sysctl_table+0xca/0xef0 + [<00000000c04f70f7>] 0xffffffffa0050037 + [<000000001bd12912>] do_one_initcall+0xdb/0x480 + [<0000000064f766c9>] do_init_module+0x1cf/0x680 + [<000000002ba52db0>] load_module+0x6441/0x6f20 + [<000000009772580d>] __do_sys_finit_module+0x12f/0x1c0 + [<00000000380c1f22>] do_syscall_64+0x3f/0x90 + [<000000004cf473bc>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Link: https://lkml.kernel.org/r/41651ca1-432a-db34-eb97-d35744559de1@linux.alibaba.com +Fixes: 3878f110f71a ("ocfs2: Move the hb_ctl_path sysctl into the stack glue.") +Signed-off-by: Shang XiaoJing +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + fs/ocfs2/stackglue.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c +index e7eb08ac4215..10d691530d83 100644 +--- a/fs/ocfs2/stackglue.c ++++ b/fs/ocfs2/stackglue.c +@@ -715,6 +715,8 @@ static struct ctl_table_header *ocfs2_table_header; + + static int __init ocfs2_stack_glue_init(void) + { ++ int ret; ++ + strcpy(cluster_stack_name, OCFS2_STACK_PLUGIN_O2CB); + + ocfs2_table_header = register_sysctl_table(ocfs2_root_table); +@@ -724,7 +726,11 @@ static int __init ocfs2_stack_glue_init(void) + return -ENOMEM; /* or something. */ + } + +- return ocfs2_sysfs_init(); ++ ret = ocfs2_sysfs_init(); ++ if (ret) ++ unregister_sysctl_table(ocfs2_table_header); ++ ++ return ret; + } + + static void __exit ocfs2_stack_glue_exit(void) +-- +2.35.1 + diff --git a/queue-4.19/openvswitch-fix-flow-lookup-to-use-unmasked-key.patch b/queue-4.19/openvswitch-fix-flow-lookup-to-use-unmasked-key.patch new file mode 100644 index 00000000000..742495da585 --- /dev/null +++ b/queue-4.19/openvswitch-fix-flow-lookup-to-use-unmasked-key.patch @@ -0,0 +1,121 @@ +From 2d1b287101684a1013f84072490f0170d9b615bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 15:46:33 +0100 +Subject: openvswitch: Fix flow lookup to use unmasked key + +From: Eelco Chaudron + +[ Upstream commit 68bb10101e6b0a6bb44e9c908ef795fc4af99eae ] + +The commit mentioned below causes the ovs_flow_tbl_lookup() function +to be called with the masked key. However, it's supposed to be called +with the unmasked key. This due to the fact that the datapath supports +installing wider flows, and OVS relies on this behavior. For example +if ipv4(src=1.1.1.1/192.0.0.0, dst=1.1.1.2/192.0.0.0) exists, a wider +flow (smaller mask) of ipv4(src=192.1.1.1/128.0.0.0,dst=192.1.1.2/ +128.0.0.0) is allowed to be added. + +However, if we try to add a wildcard rule, the installation fails: + +$ ovs-appctl dpctl/add-flow system@myDP "in_port(1),eth_type(0x0800), \ + ipv4(src=1.1.1.1/192.0.0.0,dst=1.1.1.2/192.0.0.0,frag=no)" 2 +$ ovs-appctl dpctl/add-flow system@myDP "in_port(1),eth_type(0x0800), \ + ipv4(src=192.1.1.1/0.0.0.0,dst=49.1.1.2/0.0.0.0,frag=no)" 2 +ovs-vswitchd: updating flow table (File exists) + +The reason is that the key used to determine if the flow is already +present in the system uses the original key ANDed with the mask. +This results in the IP address not being part of the (miniflow) key, +i.e., being substituted with an all-zero value. When doing the actual +lookup, this results in the key wrongfully matching the first flow, +and therefore the flow does not get installed. + +This change reverses the commit below, but rather than having the key +on the stack, it's allocated. + +Fixes: 190aa3e77880 ("openvswitch: Fix Frame-size larger than 1024 bytes warning.") + +Signed-off-by: Eelco Chaudron +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/openvswitch/datapath.c | 25 ++++++++++++++++--------- + 1 file changed, 16 insertions(+), 9 deletions(-) + +diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c +index e9a10a66b4ca..fbc575247268 100644 +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -903,6 +903,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + struct sw_flow_mask mask; + struct sk_buff *reply; + struct datapath *dp; ++ struct sw_flow_key *key; + struct sw_flow_actions *acts; + struct sw_flow_match match; + u32 ufid_flags = ovs_nla_get_ufid_flags(a[OVS_FLOW_ATTR_UFID_FLAGS]); +@@ -930,24 +931,26 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + } + + /* Extract key. */ +- ovs_match_init(&match, &new_flow->key, false, &mask); ++ key = kzalloc(sizeof(*key), GFP_KERNEL); ++ if (!key) { ++ error = -ENOMEM; ++ goto err_kfree_key; ++ } ++ ++ ovs_match_init(&match, key, false, &mask); + error = ovs_nla_get_match(net, &match, a[OVS_FLOW_ATTR_KEY], + a[OVS_FLOW_ATTR_MASK], log); + if (error) + goto err_kfree_flow; + ++ ovs_flow_mask_key(&new_flow->key, key, true, &mask); ++ + /* Extract flow identifier. */ + error = ovs_nla_get_identifier(&new_flow->id, a[OVS_FLOW_ATTR_UFID], +- &new_flow->key, log); ++ key, log); + if (error) + goto err_kfree_flow; + +- /* unmasked key is needed to match when ufid is not used. */ +- if (ovs_identifier_is_key(&new_flow->id)) +- match.key = new_flow->id.unmasked_key; +- +- ovs_flow_mask_key(&new_flow->key, &new_flow->key, true, &mask); +- + /* Validate actions. */ + error = ovs_nla_copy_actions(net, a[OVS_FLOW_ATTR_ACTIONS], + &new_flow->key, &acts, log); +@@ -974,7 +977,7 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + if (ovs_identifier_is_ufid(&new_flow->id)) + flow = ovs_flow_tbl_lookup_ufid(&dp->table, &new_flow->id); + if (!flow) +- flow = ovs_flow_tbl_lookup(&dp->table, &new_flow->key); ++ flow = ovs_flow_tbl_lookup(&dp->table, key); + if (likely(!flow)) { + rcu_assign_pointer(new_flow->sf_acts, acts); + +@@ -1044,6 +1047,8 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + + if (reply) + ovs_notify(&dp_flow_genl_family, reply, info); ++ ++ kfree(key); + return 0; + + err_unlock_ovs: +@@ -1053,6 +1058,8 @@ static int ovs_flow_cmd_new(struct sk_buff *skb, struct genl_info *info) + ovs_nla_free_flow_actions(acts); + err_kfree_flow: + ovs_flow_free(new_flow, false); ++err_kfree_key: ++ kfree(key); + error: + return error; + } +-- +2.35.1 + diff --git a/queue-4.19/orangefs-fix-kmemleak-in-orangefs_prepare_debugfs_he.patch b/queue-4.19/orangefs-fix-kmemleak-in-orangefs_prepare_debugfs_he.patch new file mode 100644 index 00000000000..bd444051337 --- /dev/null +++ b/queue-4.19/orangefs-fix-kmemleak-in-orangefs_prepare_debugfs_he.patch @@ -0,0 +1,62 @@ +From a782903916bc8ad013c96ae41ac10becb561771f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 12:40:05 +0800 +Subject: orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() + +From: Zhang Xiaoxu + +[ Upstream commit d23417a5bf3a3afc55de5442eb46e1e60458b0a1 ] + +When insert and remove the orangefs module, then debug_help_string will +be leaked: + + unreferenced object 0xffff8881652ba000 (size 4096): + comm "insmod", pid 1701, jiffies 4294893639 (age 13218.530s) + hex dump (first 32 bytes): + 43 6c 69 65 6e 74 20 44 65 62 75 67 20 4b 65 79 Client Debug Key + 77 6f 72 64 73 20 61 72 65 20 75 6e 6b 6e 6f 77 words are unknow + backtrace: + [<0000000004e6f8e3>] kmalloc_trace+0x27/0xa0 + [<0000000006f75d85>] orangefs_prepare_debugfs_help_string+0x5e/0x480 [orangefs] + [<0000000091270a2a>] _sub_I_65535_1+0x57/0xf70 [crc_itu_t] + [<000000004b1ee1a3>] do_one_initcall+0x87/0x2a0 + [<000000001d0614ae>] do_init_module+0xdf/0x320 + [<00000000efef068c>] load_module+0x2f98/0x3330 + [<000000006533b44d>] __do_sys_finit_module+0x113/0x1b0 + [<00000000a0da6f99>] do_syscall_64+0x35/0x80 + [<000000007790b19b>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +When remove the module, should always free debug_help_string. Should +always free the allocated buffer when change the free_debug_help_string. + +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Mike Marshall +Signed-off-by: Sasha Levin +--- + fs/orangefs/orangefs-debugfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c +index e24738c691f6..f79c015fa7cb 100644 +--- a/fs/orangefs/orangefs-debugfs.c ++++ b/fs/orangefs/orangefs-debugfs.c +@@ -254,6 +254,8 @@ static int orangefs_kernel_debug_init(void) + void orangefs_debugfs_cleanup(void) + { + debugfs_remove_recursive(debug_dir); ++ kfree(debug_help_string); ++ debug_help_string = NULL; + } + + /* open ORANGEFS_KMOD_DEBUG_HELP_FILE */ +@@ -709,6 +711,7 @@ int orangefs_prepare_debugfs_help_string(int at_boot) + memset(debug_help_string, 0, DEBUG_HELP_STRING_SIZE); + strlcat(debug_help_string, new, string_size); + mutex_unlock(&orangefs_help_file_lock); ++ kfree(new); + } + + rc = 0; +-- +2.35.1 + diff --git a/queue-4.19/orangefs-fix-sysfs-not-cleanup-when-dev-init-failed.patch b/queue-4.19/orangefs-fix-sysfs-not-cleanup-when-dev-init-failed.patch new file mode 100644 index 00000000000..f89198661df --- /dev/null +++ b/queue-4.19/orangefs-fix-sysfs-not-cleanup-when-dev-init-failed.patch @@ -0,0 +1,74 @@ +From 9d98c56e89647c492cce346cd8ad9158eaf197d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 12:40:04 +0800 +Subject: orangefs: Fix sysfs not cleanup when dev init failed + +From: Zhang Xiaoxu + +[ Upstream commit ea60a4ad0cf88b411cde6888b8c890935686ecd7 ] + +When the dev init failed, should cleanup the sysfs, otherwise, the +module will never be loaded since can not create duplicate sysfs +directory: + + sysfs: cannot create duplicate filename '/fs/orangefs' + + CPU: 1 PID: 6549 Comm: insmod Tainted: G W 6.0.0+ #44 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 + Call Trace: + + dump_stack_lvl+0x34/0x44 + sysfs_warn_dup.cold+0x17/0x24 + sysfs_create_dir_ns+0x16d/0x180 + kobject_add_internal+0x156/0x3a0 + kobject_init_and_add+0xcf/0x120 + orangefs_sysfs_init+0x7e/0x3a0 [orangefs] + orangefs_init+0xfe/0x1000 [orangefs] + do_one_initcall+0x87/0x2a0 + do_init_module+0xdf/0x320 + load_module+0x2f98/0x3330 + __do_sys_finit_module+0x113/0x1b0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + + kobject_add_internal failed for orangefs with -EEXIST, don't try to register things with the same name in the same directory. + +Fixes: 2f83ace37181 ("orangefs: put register_chrdev immediately before register_filesystem") +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Mike Marshall +Signed-off-by: Sasha Levin +--- + fs/orangefs/orangefs-mod.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/orangefs/orangefs-mod.c b/fs/orangefs/orangefs-mod.c +index 85ef87245a87..c8818163e392 100644 +--- a/fs/orangefs/orangefs-mod.c ++++ b/fs/orangefs/orangefs-mod.c +@@ -141,7 +141,7 @@ static int __init orangefs_init(void) + gossip_err("%s: could not initialize device subsystem %d!\n", + __func__, + ret); +- goto cleanup_device; ++ goto cleanup_sysfs; + } + + ret = register_filesystem(&orangefs_fs_type); +@@ -153,11 +153,11 @@ static int __init orangefs_init(void) + goto out; + } + +- orangefs_sysfs_exit(); +- +-cleanup_device: + orangefs_dev_cleanup(); + ++cleanup_sysfs: ++ orangefs_sysfs_exit(); ++ + sysfs_init_failed: + + debugfs_init_failed: +-- +2.35.1 + diff --git a/queue-4.19/pata_ipx4xx_cf-fix-unsigned-comparison-with-less-tha.patch b/queue-4.19/pata_ipx4xx_cf-fix-unsigned-comparison-with-less-tha.patch new file mode 100644 index 00000000000..817e27c57ad --- /dev/null +++ b/queue-4.19/pata_ipx4xx_cf-fix-unsigned-comparison-with-less-tha.patch @@ -0,0 +1,46 @@ +From 58a54a58fcd3e1dec535d6330d191ccef8219ea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 21:54:26 +0800 +Subject: pata_ipx4xx_cf: Fix unsigned comparison with less than zero + +From: Junlin Yang + +[ Upstream commit c38ae56ee034623c59e39c0130ca0dec086c1a39 ] + +The return from the call to platform_get_irq() is int, it can be +a negative error code, however this is being assigned to an unsigned +int variable 'irq', so making 'irq' an int, and change the position to +keep the code format. + +./drivers/ata/pata_ixp4xx_cf.c:168:5-8: +WARNING: Unsigned expression compared with zero: irq > 0 + +Signed-off-by: Junlin Yang +Link: https://lore.kernel.org/r/20210409135426.1773-1-angkery@163.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_ixp4xx_cf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_ixp4xx_cf.c b/drivers/ata/pata_ixp4xx_cf.c +index 867621f8c387..8c34c64e4d51 100644 +--- a/drivers/ata/pata_ixp4xx_cf.c ++++ b/drivers/ata/pata_ixp4xx_cf.c +@@ -139,12 +139,12 @@ static void ixp4xx_setup_port(struct ata_port *ap, + + static int ixp4xx_pata_probe(struct platform_device *pdev) + { +- unsigned int irq; + struct resource *cs0, *cs1; + struct ata_host *host; + struct ata_port *ap; + struct ixp4xx_pata_data *data = dev_get_platdata(&pdev->dev); + int ret; ++ int irq; + + cs0 = platform_get_resource(pdev, IORESOURCE_MEM, 0); + cs1 = platform_get_resource(pdev, IORESOURCE_MEM, 1); +-- +2.35.1 + diff --git a/queue-4.19/pci-check-for-alloc-failure-in-pci_request_irq.patch b/queue-4.19/pci-check-for-alloc-failure-in-pci_request_irq.patch new file mode 100644 index 00000000000..e1a39a3cac6 --- /dev/null +++ b/queue-4.19/pci-check-for-alloc-failure-in-pci_request_irq.patch @@ -0,0 +1,39 @@ +From 60b24c5e813b5f57ca38e27ebc10f9a437f92f91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 10:00:29 +0800 +Subject: PCI: Check for alloc failure in pci_request_irq() + +From: Zeng Heng + +[ Upstream commit 2d9cd957d40c3ac491b358e7cff0515bb07a3a9c ] + +When kvasprintf() fails to allocate memory, it returns a NULL pointer. +Return error from pci_request_irq() so we don't dereference it. + +[bhelgaas: commit log] +Fixes: 704e8953d3e9 ("PCI/irq: Add pci_request_irq() and pci_free_irq() helpers") +Link: https://lore.kernel.org/r/20221121020029.3759444-1-zengheng4@huawei.com +Signed-off-by: Zeng Heng +Signed-off-by: Bjorn Helgaas +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/pci/irq.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pci/irq.c b/drivers/pci/irq.c +index a1de501a2729..3f6a5d520259 100644 +--- a/drivers/pci/irq.c ++++ b/drivers/pci/irq.c +@@ -94,6 +94,8 @@ int pci_request_irq(struct pci_dev *dev, unsigned int nr, irq_handler_t handler, + va_start(ap, fmt); + devname = kvasprintf(GFP_KERNEL, fmt, ap); + va_end(ap); ++ if (!devname) ++ return -ENOMEM; + + ret = request_threaded_irq(pci_irq_vector(dev, nr), handler, thread_fn, + irqflags, devname, dev_id); +-- +2.35.1 + diff --git a/queue-4.19/perf-arm_dsu-fix-hotplug-callback-leak-in-dsu_pmu_in.patch b/queue-4.19/perf-arm_dsu-fix-hotplug-callback-leak-in-dsu_pmu_in.patch new file mode 100644 index 00000000000..bf372a336fd --- /dev/null +++ b/queue-4.19/perf-arm_dsu-fix-hotplug-callback-leak-in-dsu_pmu_in.patch @@ -0,0 +1,46 @@ +From 96c5ae450247e34810dd717d77cd49ee40e6309d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 07:02:06 +0000 +Subject: perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init() + +From: Yuan Can + +[ Upstream commit facafab7611f7b872c6b9eeaff53461ef11f482e ] + +dsu_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() +when platform_driver_register() failed. Remove the callback by +cpuhp_remove_multi_state() in fail path. + +Similar to the handling of arm_ccn_init() in commit 26242b330093 ("bus: +arm-ccn: Prevent hotplug callback leak") + +Fixes: 7520fa99246d ("perf: ARM DynamIQ Shared Unit PMU support") +Signed-off-by: Yuan Can +Acked-by: Suzuki K Poulose +Link: https://lore.kernel.org/r/20221115070207.32634-2-yuancan@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_dsu_pmu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/perf/arm_dsu_pmu.c b/drivers/perf/arm_dsu_pmu.c +index 660cb8ac886a..961533ba33e7 100644 +--- a/drivers/perf/arm_dsu_pmu.c ++++ b/drivers/perf/arm_dsu_pmu.c +@@ -823,7 +823,11 @@ static int __init dsu_pmu_init(void) + if (ret < 0) + return ret; + dsu_pmu_cpuhp_state = ret; +- return platform_driver_register(&dsu_pmu_driver); ++ ret = platform_driver_register(&dsu_pmu_driver); ++ if (ret) ++ cpuhp_remove_multi_state(dsu_pmu_cpuhp_state); ++ ++ return ret; + } + + static void __exit dsu_pmu_exit(void) +-- +2.35.1 + diff --git a/queue-4.19/perf-fix-possible-memleak-in-pmu_dev_alloc.patch b/queue-4.19/perf-fix-possible-memleak-in-pmu_dev_alloc.patch new file mode 100644 index 00000000000..726bc08ed84 --- /dev/null +++ b/queue-4.19/perf-fix-possible-memleak-in-pmu_dev_alloc.patch @@ -0,0 +1,71 @@ +From a8680f08e17ebff5fe802e5789460d54748900ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 18:36:53 +0800 +Subject: perf: Fix possible memleak in pmu_dev_alloc() + +From: Chen Zhongjin + +[ Upstream commit e8d7a90c08ce963c592fb49845f2ccc606a2ac21 ] + +In pmu_dev_alloc(), when dev_set_name() failed, it will goto free_dev +and call put_device(pmu->dev) to release it. +However pmu->dev->release is assigned after this, which makes warning +and memleak. +Call dev_set_name() after pmu->dev->release = pmu_dev_release to fix it. + + Device '(null)' does not have a release() function... + WARNING: CPU: 2 PID: 441 at drivers/base/core.c:2332 device_release+0x1b9/0x240 + ... + Call Trace: + + kobject_put+0x17f/0x460 + put_device+0x20/0x30 + pmu_dev_alloc+0x152/0x400 + perf_pmu_register+0x96b/0xee0 + ... + kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) + unreferenced object 0xffff888014759000 (size 2048): + comm "modprobe", pid 441, jiffies 4294931444 (age 38.332s) + backtrace: + [<0000000005aed3b4>] kmalloc_trace+0x27/0x110 + [<000000006b38f9b8>] pmu_dev_alloc+0x50/0x400 + [<00000000735f17be>] perf_pmu_register+0x96b/0xee0 + [<00000000e38477f1>] 0xffffffffc0ad8603 + [<000000004e162216>] do_one_initcall+0xd0/0x4e0 + ... + +Fixes: abe43400579d ("perf: Sysfs enumeration") +Signed-off-by: Chen Zhongjin +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20221111103653.91058-1-chenzhongjin@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index ba66ea3ca705..668e5492e4c4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9682,13 +9682,15 @@ static int pmu_dev_alloc(struct pmu *pmu) + + pmu->dev->groups = pmu->attr_groups; + device_initialize(pmu->dev); +- ret = dev_set_name(pmu->dev, "%s", pmu->name); +- if (ret) +- goto free_dev; + + dev_set_drvdata(pmu->dev, pmu); + pmu->dev->bus = &pmu_bus; + pmu->dev->release = pmu_dev_release; ++ ++ ret = dev_set_name(pmu->dev, "%s", pmu->name); ++ if (ret) ++ goto free_dev; ++ + ret = device_add(pmu->dev); + if (ret) + goto free_dev; +-- +2.35.1 + diff --git a/queue-4.19/perf-symbol-correction-while-adjusting-symbol.patch b/queue-4.19/perf-symbol-correction-while-adjusting-symbol.patch new file mode 100644 index 00000000000..ac39b96aca3 --- /dev/null +++ b/queue-4.19/perf-symbol-correction-while-adjusting-symbol.patch @@ -0,0 +1,76 @@ +From 87281ccb98bf977951dc2afe20e3449f6626907a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 15:48:16 +0530 +Subject: perf symbol: correction while adjusting symbol + +From: Ajay Kaher + +[ Upstream commit 6f520ce17920b3cdfbd2479b3ccf27f9706219d0 ] + +perf doesn't provide proper symbol information for specially crafted +.debug files. + +Sometimes .debug file may not have similar program header as runtime +ELF file. For example if we generate .debug file using objcopy +--only-keep-debug resulting file will not contain .text, .data and +other runtime sections. That means corresponding program headers will +have zero FileSiz and modified Offset. + +Example: program header of text section of libxxx.so: + +Type Offset VirtAddr PhysAddr + FileSiz MemSiz Flags Align +LOAD 0x00000000003d3000 0x00000000003d3000 0x00000000003d3000 + 0x000000000055ae80 0x000000000055ae80 R E 0x1000 + +Same program header after executing: +objcopy --only-keep-debug libxxx.so libxxx.so.debug + +LOAD 0x0000000000001000 0x00000000003d3000 0x00000000003d3000 + 0x0000000000000000 0x000000000055ae80 R E 0x1000 + +Offset and FileSiz have been changed. + +Following formula will not provide correct value, if program header +taken from .debug file (syms_ss): + + sym.st_value -= phdr.p_vaddr - phdr.p_offset; + +Correct program header information is located inside runtime ELF +file (runtime_ss). + +Fixes: 2d86612aacb7805f ("perf symbol: Correct address for bss symbols") +Signed-off-by: Ajay Kaher +Cc: Alexander Shishkin +Cc: Alexey Makhalov +Cc: Jiri Olsa +Cc: Leo Yan +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Srivatsa S. Bhat +Cc: Steven Rostedt (VMware) +Cc: Vasavi Sirnapalli +Link: http://lore.kernel.org/lkml/1669198696-50547-1-git-send-email-akaher@vmware.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 5fba57c10edd..8dde4369fbcd 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1129,7 +1129,7 @@ int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss, + (!used_opd && syms_ss->adjust_symbols)) { + GElf_Phdr phdr; + +- if (elf_read_program_header(syms_ss->elf, ++ if (elf_read_program_header(runtime_ss->elf, + (u64)sym.st_value, &phdr)) { + pr_warning("%s: failed to find program header for " + "symbol: %s st_value: %#" PRIx64 "\n", +-- +2.35.1 + diff --git a/queue-4.19/perf-x86-intel-uncore-fix-reference-count-leak-in-hs.patch b/queue-4.19/perf-x86-intel-uncore-fix-reference-count-leak-in-hs.patch new file mode 100644 index 00000000000..2b8a5fb9291 --- /dev/null +++ b/queue-4.19/perf-x86-intel-uncore-fix-reference-count-leak-in-hs.patch @@ -0,0 +1,40 @@ +From aa3b40c370c9cf4c1356acfe475cb3c345ed9a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 14:31:35 +0800 +Subject: perf/x86/intel/uncore: Fix reference count leak in + hswep_has_limit_sbox() + +From: Xiongfeng Wang + +[ Upstream commit 1ff9dd6e7071a561f803135c1d684b13c7a7d01d ] + +pci_get_device() will increase the reference count for the returned +'dev'. We need to call pci_dev_put() to decrease the reference count. +Since 'dev' is only used in pci_read_config_dword(), let's add +pci_dev_put() right after it. + +Fixes: 9d480158ee86 ("perf/x86/intel/uncore: Remove uncore extra PCI dev HSWEP_PCI_PCU_3") +Signed-off-by: Xiongfeng Wang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Kan Liang +Link: https://lore.kernel.org/r/20221118063137.121512-3-wangxiongfeng2@huawei.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore_snbep.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 2bf1170f7afd..34da6d27d839 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -2699,6 +2699,7 @@ static bool hswep_has_limit_sbox(unsigned int device) + return false; + + pci_read_config_dword(dev, HSWEP_PCU_CAPID4_OFFET, &capid4); ++ pci_dev_put(dev); + if (!hswep_get_chop(capid4)) + return true; + +-- +2.35.1 + diff --git a/queue-4.19/pinctrl-pinconf-generic-add-missing-of_node_put.patch b/queue-4.19/pinctrl-pinconf-generic-add-missing-of_node_put.patch new file mode 100644 index 00000000000..e5bcde9f608 --- /dev/null +++ b/queue-4.19/pinctrl-pinconf-generic-add-missing-of_node_put.patch @@ -0,0 +1,40 @@ +From 7f6fa5dec43b6a4364439e543258f3df413aec5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 07:01:56 +0000 +Subject: pinctrl: pinconf-generic: add missing of_node_put() + +From: ZhangPeng + +[ Upstream commit 5ead93289815a075d43c415e35c8beafafb801c9 ] + +of_node_put() needs to be called when jumping out of the loop, since +for_each_available_child_of_node() will increase the refcount of node. + +Fixes: c7289500e29d ("pinctrl: pinconf-generic: scan also referenced phandle node") +Signed-off-by: ZhangPeng +Link: https://lore.kernel.org/r/20221125070156.3535855-1-zhangpeng362@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinconf-generic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c +index 55b56440a5a8..7e946c54681a 100644 +--- a/drivers/pinctrl/pinconf-generic.c ++++ b/drivers/pinctrl/pinconf-generic.c +@@ -390,8 +390,10 @@ int pinconf_generic_dt_node_to_map(struct pinctrl_dev *pctldev, + for_each_available_child_of_node(np_config, np) { + ret = pinconf_generic_dt_subnode_to_map(pctldev, np, map, + &reserved_maps, num_maps, type); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(np); + goto exit; ++ } + } + return 0; + +-- +2.35.1 + diff --git a/queue-4.19/platform-x86-mxm-wmi-fix-memleak-in-mxm_wmi_call_mx-.patch b/queue-4.19/platform-x86-mxm-wmi-fix-memleak-in-mxm_wmi_call_mx-.patch new file mode 100644 index 00000000000..5e54ac9918d --- /dev/null +++ b/queue-4.19/platform-x86-mxm-wmi-fix-memleak-in-mxm_wmi_call_mx-.patch @@ -0,0 +1,62 @@ +From bfd8b1be6b4a68bc7b927481ab3358e0c5555a9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 09:11:01 +0800 +Subject: platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() + +From: Yu Liao + +[ Upstream commit 727cc0147f5066e359aca65cc6cc5e6d64cc15d8 ] + +The ACPI buffer memory (out.pointer) returned by wmi_evaluate_method() +is not freed after the call, so it leads to memory leak. + +The method results in ACPI buffer is not used, so just pass NULL to +wmi_evaluate_method() which fixes the memory leak. + +Fixes: 99b38b4acc0d ("platform/x86: add MXM WMI driver.") +Signed-off-by: Yu Liao +Link: https://lore.kernel.org/r/20221129011101.2042315-1-liaoyu15@huawei.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mxm-wmi.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/platform/x86/mxm-wmi.c b/drivers/platform/x86/mxm-wmi.c +index 35d8b9a939f9..9c1893a703e6 100644 +--- a/drivers/platform/x86/mxm-wmi.c ++++ b/drivers/platform/x86/mxm-wmi.c +@@ -48,13 +48,11 @@ int mxm_wmi_call_mxds(int adapter) + .xarg = 1, + }; + struct acpi_buffer input = { (acpi_size)sizeof(args), &args }; +- struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; + acpi_status status; + + printk("calling mux switch %d\n", adapter); + +- status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, +- &output); ++ status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL); + + if (ACPI_FAILURE(status)) + return status; +@@ -73,13 +71,11 @@ int mxm_wmi_call_mxmx(int adapter) + .xarg = 1, + }; + struct acpi_buffer input = { (acpi_size)sizeof(args), &args }; +- struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; + acpi_status status; + + printk("calling mux switch %d\n", adapter); + +- status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, +- &output); ++ status = wmi_evaluate_method(MXM_WMMX_GUID, 0x0, adapter, &input, NULL); + + if (ACPI_FAILURE(status)) + return status; +-- +2.35.1 + diff --git a/queue-4.19/pm-runtime-do-not-call-__rpm_callback-from-rpm_idle.patch b/queue-4.19/pm-runtime-do-not-call-__rpm_callback-from-rpm_idle.patch new file mode 100644 index 00000000000..ffcce50ff39 --- /dev/null +++ b/queue-4.19/pm-runtime-do-not-call-__rpm_callback-from-rpm_idle.patch @@ -0,0 +1,54 @@ +From f5366ceef564bf51dc591adb38d3cdf44c88bb45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 15:30:28 +0100 +Subject: PM: runtime: Do not call __rpm_callback() from rpm_idle() + +From: Rafael J. Wysocki + +[ Upstream commit bc80c2e438dcbfcf748452ec0f7ad5b79ff3ad88 ] + +Calling __rpm_callback() from rpm_idle() after adding device links +support to the former is a clear mistake. + +Not only it causes rpm_idle() to carry out unnecessary actions, but it +is also against the assumption regarding the stability of PM-runtime +status across __rpm_callback() invocations, because rpm_suspend() and +rpm_resume() may run in parallel with __rpm_callback() when it is called +by rpm_idle() and the device's PM-runtime status can be updated by any +of them. + +Fixes: 21d5c57b3726 ("PM / runtime: Use device links") +Link: https://lore.kernel.org/linux-pm/36aed941-a73e-d937-2721-4f0decd61ce0@quicinc.com +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Adrian Hunter +Signed-off-by: Sasha Levin +--- + drivers/base/power/runtime.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index 8a018e6d7976..911bb8a4bf6d 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -422,7 +422,17 @@ static int rpm_idle(struct device *dev, int rpmflags) + + dev->power.idle_notification = true; + +- retval = __rpm_callback(callback, dev); ++ if (dev->power.irq_safe) ++ spin_unlock(&dev->power.lock); ++ else ++ spin_unlock_irq(&dev->power.lock); ++ ++ retval = callback(dev); ++ ++ if (dev->power.irq_safe) ++ spin_lock(&dev->power.lock); ++ else ++ spin_lock_irq(&dev->power.lock); + + dev->power.idle_notification = false; + wake_up_all(&dev->power.wait_queue); +-- +2.35.1 + diff --git a/queue-4.19/pm-runtime-improve-path-in-rpm_idle-when-no-callback.patch b/queue-4.19/pm-runtime-improve-path-in-rpm_idle-when-no-callback.patch new file mode 100644 index 00000000000..82e6043a527 --- /dev/null +++ b/queue-4.19/pm-runtime-improve-path-in-rpm_idle-when-no-callback.patch @@ -0,0 +1,59 @@ +From 0a14dedf051b026f09f089c896af9881ec166363 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 11:02:48 +0200 +Subject: PM: runtime: Improve path in rpm_idle() when no callback + +From: Ulf Hansson + +[ Upstream commit 5a2bd1b1c64e1ac5627db3767ac465f18606315c ] + +When pm_runtime_no_callbacks() has been called for a struct device to set +the dev->power.no_callbacks flag for it, it enables rpm_idle() to take a +slightly quicker path by assuming that a ->runtime_idle() callback would +have returned 0 to indicate success. + +A device that does not have the dev->power.no_callbacks flag set for it, +may still be missing a corresponding ->runtime_idle() callback, in which +case the slower path in rpm_idle() is taken. Let's improve the behaviour +for this case, by aligning code to the quicker path. + +Signed-off-by: Ulf Hansson +Acked-by: Alan Stern +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: bc80c2e438dc ("PM: runtime: Do not call __rpm_callback() from rpm_idle()") +Signed-off-by: Sasha Levin +--- + drivers/base/power/runtime.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c +index eaae4adf9ce4..8a018e6d7976 100644 +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -403,7 +403,10 @@ static int rpm_idle(struct device *dev, int rpmflags) + /* Pending requests need to be canceled. */ + dev->power.request = RPM_REQ_NONE; + +- if (dev->power.no_callbacks) ++ callback = RPM_GET_CALLBACK(dev, runtime_idle); ++ ++ /* If no callback assume success. */ ++ if (!callback || dev->power.no_callbacks) + goto out; + + /* Carry out an asynchronous or a synchronous idle notification. */ +@@ -419,10 +422,7 @@ static int rpm_idle(struct device *dev, int rpmflags) + + dev->power.idle_notification = true; + +- callback = RPM_GET_CALLBACK(dev, runtime_idle); +- +- if (callback) +- retval = __rpm_callback(callback, dev); ++ retval = __rpm_callback(callback, dev); + + dev->power.idle_notification = false; + wake_up_all(&dev->power.wait_queue); +-- +2.35.1 + diff --git a/queue-4.19/pnp-fix-name-memory-leak-in-pnp_alloc_dev.patch b/queue-4.19/pnp-fix-name-memory-leak-in-pnp_alloc_dev.patch new file mode 100644 index 00000000000..a59141db6a8 --- /dev/null +++ b/queue-4.19/pnp-fix-name-memory-leak-in-pnp_alloc_dev.patch @@ -0,0 +1,46 @@ +From 14596868b8967363d8479025768d9b60bc330920 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 09:23:58 +0800 +Subject: PNP: fix name memory leak in pnp_alloc_dev() + +From: Yang Yingliang + +[ Upstream commit 110d7b0325c55ff3620073ba4201845f59e22ebf ] + +After commit 1fa5ae857bb1 ("driver core: get rid of struct device's +bus_id string array"), the name of device is allocated dynamically, +move dev_set_name() after pnp_add_id() to avoid memory leak. + +Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") +Signed-off-by: Yang Yingliang +Reviewed-by: Hanjun Guo +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/pnp/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pnp/core.c b/drivers/pnp/core.c +index 3bf18d718975..131b925b820d 100644 +--- a/drivers/pnp/core.c ++++ b/drivers/pnp/core.c +@@ -160,14 +160,14 @@ struct pnp_dev *pnp_alloc_dev(struct pnp_protocol *protocol, int id, + dev->dev.coherent_dma_mask = dev->dma_mask; + dev->dev.release = &pnp_release_device; + +- dev_set_name(&dev->dev, "%02x:%02x", dev->protocol->number, dev->number); +- + dev_id = pnp_add_id(dev, pnpid); + if (!dev_id) { + kfree(dev); + return NULL; + } + ++ dev_set_name(&dev->dev, "%02x:%02x", dev->protocol->number, dev->number); ++ + return dev; + } + +-- +2.35.1 + diff --git a/queue-4.19/power-supply-fix-residue-sysfs-file-in-error-handle-.patch b/queue-4.19/power-supply-fix-residue-sysfs-file-in-error-handle-.patch new file mode 100644 index 00000000000..3baf030378d --- /dev/null +++ b/queue-4.19/power-supply-fix-residue-sysfs-file-in-error-handle-.patch @@ -0,0 +1,50 @@ +From fdef0139b339cc7e3b317cda345460487b3d389c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 16:32:19 +0800 +Subject: power: supply: fix residue sysfs file in error handle route of + __power_supply_register() + +From: Zeng Heng + +[ Upstream commit 5b79480ce1978864ac3f06f2134dfa3b6691fe74 ] + +If device_add() succeeds, we should call device_del() when want to +get rid of it, so move it into proper jump symbol. + +Otherwise, when __power_supply_register() returns fail and goto +wakeup_init_failed to exit, there is still residue device file in sysfs. +When attempt to probe device again, sysfs would complain as below: + +sysfs: cannot create duplicate filename '/devices/platform/i2c/i2c-0/0-001c/power_supply/adp5061' +Call Trace: + dump_stack_lvl+0x68/0x85 + sysfs_warn_dup.cold+0x1c/0x29 + sysfs_create_dir_ns+0x1b1/0x1d0 + kobject_add_internal+0x143/0x390 + kobject_add+0x108/0x170 + +Fixes: 80c6463e2fa3 ("power_supply: Fix Oops from NULL pointer dereference from wakeup_source_activate") +Signed-off-by: Zeng Heng +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/power_supply_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index e43a7b3b570c..9b98921a3b16 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -945,8 +945,8 @@ __power_supply_register(struct device *parent, + register_cooler_failed: + psy_unregister_thermal(psy); + register_thermal_failed: +- device_del(dev); + wakeup_init_failed: ++ device_del(dev); + device_add_failed: + check_supplies_failed: + dev_set_name_failed: +-- +2.35.1 + diff --git a/queue-4.19/powerpc-52xx-fix-a-resource-leak-in-an-error-handlin.patch b/queue-4.19/powerpc-52xx-fix-a-resource-leak-in-an-error-handlin.patch new file mode 100644 index 00000000000..47a20b30784 --- /dev/null +++ b/queue-4.19/powerpc-52xx-fix-a-resource-leak-in-an-error-handlin.patch @@ -0,0 +1,38 @@ +From 794b9486d13ef8d65c543be626eca95850da6089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jan 2022 08:16:04 +0100 +Subject: powerpc/52xx: Fix a resource leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 5836947613ef33d311b4eff6a32d019580a214f5 ] + +The error handling path of mpc52xx_lpbfifo_probe() has a request_irq() +that is not balanced by a corresponding free_irq(). + +Add the missing call, as already done in the remove function. + +Fixes: 3c9059d79f5e ("powerpc/5200: add LocalPlus bus FIFO device driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/dec1496d46ccd5311d0f6e9f9ca4238be11bf6a6.1643440531.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c b/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c +index 7bb42a0100de..caaaaf2bea52 100644 +--- a/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c ++++ b/arch/powerpc/platforms/52xx/mpc52xx_lpbfifo.c +@@ -531,6 +531,7 @@ static int mpc52xx_lpbfifo_probe(struct platform_device *op) + err_bcom_rx_irq: + bcom_gen_bd_rx_release(lpbfifo.bcom_rx_task); + err_bcom_rx: ++ free_irq(lpbfifo.irq, &lpbfifo); + err_irq: + iounmap(lpbfifo.regs); + lpbfifo.regs = NULL; +-- +2.35.1 + diff --git a/queue-4.19/powerpc-83xx-mpc832x_rdb-call-platform_device_put-in.patch b/queue-4.19/powerpc-83xx-mpc832x_rdb-call-platform_device_put-in.patch new file mode 100644 index 00000000000..75395fffe2e --- /dev/null +++ b/queue-4.19/powerpc-83xx-mpc832x_rdb-call-platform_device_put-in.patch @@ -0,0 +1,39 @@ +From aed8ab78c359eee04931364a964836ddab2514a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Oct 2022 19:16:26 +0800 +Subject: powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in + of_fsl_spi_probe() + +From: Yang Yingliang + +[ Upstream commit 4d0eea415216fe3791da2f65eb41399e70c7bedf ] + +If platform_device_add() is not called or failed, it can not call +platform_device_del() to clean up memory, it should call +platform_device_put() in error case. + +Fixes: 26f6cb999366 ("[POWERPC] fsl_soc: add support for fsl_spi") +Signed-off-by: Yang Yingliang +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221029111626.429971-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/83xx/mpc832x_rdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/83xx/mpc832x_rdb.c b/arch/powerpc/platforms/83xx/mpc832x_rdb.c +index 438986593873..bfebfc67b23f 100644 +--- a/arch/powerpc/platforms/83xx/mpc832x_rdb.c ++++ b/arch/powerpc/platforms/83xx/mpc832x_rdb.c +@@ -111,7 +111,7 @@ static int __init of_fsl_spi_probe(char *type, char *compatible, u32 sysclk, + + goto next; + unreg: +- platform_device_del(pdev); ++ platform_device_put(pdev); + err: + pr_err("%pOF: registration failed\n", np); + next: +-- +2.35.1 + diff --git a/queue-4.19/powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch b/queue-4.19/powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch new file mode 100644 index 00000000000..9eea07902ad --- /dev/null +++ b/queue-4.19/powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch @@ -0,0 +1,142 @@ +From 156389fc09d204f632cbc6af4d896839246e6d1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 16:22:39 -0400 +Subject: powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G + +From: Sean Anderson + +[ Upstream commit 36926a7d70c2d462fca1ed85bfee000d17fd8662 ] + +On the T208X SoCs, MAC1 and MAC2 support XGMII. Add some new MAC dtsi +fragments, and mark the QMAN ports as 10G. + +Fixes: da414bb923d9 ("powerpc/mpc85xx: Add FSL QorIQ DPAA FMan support to the SoC device tree(s)") +Signed-off-by: Sean Anderson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi | 44 +++++++++++++++++++ + .../boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi | 44 +++++++++++++++++++ + arch/powerpc/boot/dts/fsl/t2081si-post.dtsi | 4 +- + 3 files changed, 90 insertions(+), 2 deletions(-) + create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi + create mode 100644 arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi + +diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi +new file mode 100644 +index 000000000000..437dab3fc017 +--- /dev/null ++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-2.dtsi +@@ -0,0 +1,44 @@ ++// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later ++/* ++ * QorIQ FMan v3 10g port #2 device tree stub [ controller @ offset 0x400000 ] ++ * ++ * Copyright 2022 Sean Anderson ++ * Copyright 2012 - 2015 Freescale Semiconductor Inc. ++ */ ++ ++fman@400000 { ++ fman0_rx_0x08: port@88000 { ++ cell-index = <0x8>; ++ compatible = "fsl,fman-v3-port-rx"; ++ reg = <0x88000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ fman0_tx_0x28: port@a8000 { ++ cell-index = <0x28>; ++ compatible = "fsl,fman-v3-port-tx"; ++ reg = <0xa8000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ ethernet@e0000 { ++ cell-index = <0>; ++ compatible = "fsl,fman-memac"; ++ reg = <0xe0000 0x1000>; ++ fsl,fman-ports = <&fman0_rx_0x08 &fman0_tx_0x28>; ++ ptp-timer = <&ptp_timer0>; ++ pcsphy-handle = <&pcsphy0>; ++ }; ++ ++ mdio@e1000 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; ++ reg = <0xe1000 0x1000>; ++ fsl,erratum-a011043; /* must ignore read errors */ ++ ++ pcsphy0: ethernet-phy@0 { ++ reg = <0x0>; ++ }; ++ }; ++}; +diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi +new file mode 100644 +index 000000000000..ad116b17850a +--- /dev/null ++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-3.dtsi +@@ -0,0 +1,44 @@ ++// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0-or-later ++/* ++ * QorIQ FMan v3 10g port #3 device tree stub [ controller @ offset 0x400000 ] ++ * ++ * Copyright 2022 Sean Anderson ++ * Copyright 2012 - 2015 Freescale Semiconductor Inc. ++ */ ++ ++fman@400000 { ++ fman0_rx_0x09: port@89000 { ++ cell-index = <0x9>; ++ compatible = "fsl,fman-v3-port-rx"; ++ reg = <0x89000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ fman0_tx_0x29: port@a9000 { ++ cell-index = <0x29>; ++ compatible = "fsl,fman-v3-port-tx"; ++ reg = <0xa9000 0x1000>; ++ fsl,fman-10g-port; ++ }; ++ ++ ethernet@e2000 { ++ cell-index = <1>; ++ compatible = "fsl,fman-memac"; ++ reg = <0xe2000 0x1000>; ++ fsl,fman-ports = <&fman0_rx_0x09 &fman0_tx_0x29>; ++ ptp-timer = <&ptp_timer0>; ++ pcsphy-handle = <&pcsphy1>; ++ }; ++ ++ mdio@e3000 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; ++ reg = <0xe3000 0x1000>; ++ fsl,erratum-a011043; /* must ignore read errors */ ++ ++ pcsphy1: ethernet-phy@0 { ++ reg = <0x0>; ++ }; ++ }; ++}; +diff --git a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +index a97296c64eb2..a3cee1acd7ab 100644 +--- a/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t2081si-post.dtsi +@@ -631,8 +631,8 @@ usb1: usb@211000 { + /include/ "qoriq-bman1.dtsi" + + /include/ "qoriq-fman3-0.dtsi" +-/include/ "qoriq-fman3-0-1g-0.dtsi" +-/include/ "qoriq-fman3-0-1g-1.dtsi" ++/include/ "qoriq-fman3-0-10g-2.dtsi" ++/include/ "qoriq-fman3-0-10g-3.dtsi" + /include/ "qoriq-fman3-0-1g-2.dtsi" + /include/ "qoriq-fman3-0-1g-3.dtsi" + /include/ "qoriq-fman3-0-1g-4.dtsi" +-- +2.35.1 + diff --git a/queue-4.19/powerpc-eeh-drop-redundant-spinlock-initialization.patch b/queue-4.19/powerpc-eeh-drop-redundant-spinlock-initialization.patch new file mode 100644 index 00000000000..69c1fddb839 --- /dev/null +++ b/queue-4.19/powerpc-eeh-drop-redundant-spinlock-initialization.patch @@ -0,0 +1,38 @@ +From 7a9788c654c6bc697212df29bce0cea2cae1e4f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 May 2022 09:27:56 +0800 +Subject: powerpc/eeh: Drop redundant spinlock initialization + +From: Haowen Bai + +[ Upstream commit 3def164a5cedad9117859dd4610cae2cc59cb6d2 ] + +slot_errbuf_lock has declared and initialized by DEFINE_SPINLOCK, +so we don't need to spin_lock_init again, drop it. + +Signed-off-by: Haowen Bai +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1652232476-9696-1-git-send-email-baihaowen@meizu.com +Stable-dep-of: 9aafbfa5f57a ("powerpc/pseries/eeh: use correct API for error log size") +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/eeh_pseries.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index 7a0b9aa09d10..f56248f19ef3 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -945,8 +945,7 @@ static int __init eeh_pseries_init(void) + return -EINVAL; + } + +- /* Initialize error log lock and size */ +- spin_lock_init(&slot_errbuf_lock); ++ /* Initialize error log size */ + eeh_error_buf_size = rtas_token("rtas-error-log-max"); + if (eeh_error_buf_size == RTAS_UNKNOWN_SERVICE) { + pr_info("%s: unknown EEH error log size\n", +-- +2.35.1 + diff --git a/queue-4.19/powerpc-eeh-eeh-for-pseries-hot-plug.patch b/queue-4.19/powerpc-eeh-eeh-for-pseries-hot-plug.patch new file mode 100644 index 00000000000..d0969b09262 --- /dev/null +++ b/queue-4.19/powerpc-eeh-eeh-for-pseries-hot-plug.patch @@ -0,0 +1,223 @@ +From 7364ac257fcea41fcce6deec87df6b6756ac5375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 14:48:09 +1000 +Subject: powerpc/eeh: EEH for pSeries hot plug + +From: Sam Bobroff + +[ Upstream commit b905f8cdca7725e750a84f7188ea6821750124c3 ] + +On PowerNV and pSeries, devices currently acquire EEH support from +several different places: Boot-time devices from eeh_probe_devices() +and eeh_addr_cache_build(), Virtual Function devices from the pcibios +bus add device hooks and hot plugged devices from pci_hp_add_devices() +(with other platforms using other methods as well). Unfortunately, +pSeries machines currently discover hot plugged devices using +pci_rescan_bus(), not pci_hp_add_devices(), and so those devices do +not receive EEH support. + +Rather than adding another case for pci_rescan_bus(), this change +widens the scope of the pcibios bus add device hooks so that they can +handle all devices. As a side effect this also supports devices +discovered after manually rescanning via /sys/bus/pci/rescan. + +Note that on PowerNV, this change allows the EEH subsystem to become +enabled after boot as long as it has not been forced off, which was +not previously possible (it was already possible on pSeries). + +Signed-off-by: Sam Bobroff +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/72ae8ae9c54097158894a52de23690448de38ea9.1565930772.git.sbobroff@linux.ibm.com +Stable-dep-of: 9aafbfa5f57a ("powerpc/pseries/eeh: use correct API for error log size") +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/eeh.c | 4 +- + arch/powerpc/platforms/powernv/eeh-powernv.c | 39 +++++++++----- + arch/powerpc/platforms/pseries/eeh_pseries.c | 54 ++++++++++---------- + 3 files changed, 56 insertions(+), 41 deletions(-) + +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 2b81e9a056b5..be475e946306 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -1170,7 +1170,7 @@ void eeh_add_device_late(struct pci_dev *dev) + struct pci_dn *pdn; + struct eeh_dev *edev; + +- if (!dev || !eeh_enabled()) ++ if (!dev) + return; + + pr_debug("EEH: Adding device %s\n", pci_name(dev)); +@@ -1226,6 +1226,8 @@ void eeh_add_device_tree_late(struct pci_bus *bus) + { + struct pci_dev *dev; + ++ if (eeh_has_flag(EEH_FORCE_DISABLED)) ++ return; + list_for_each_entry(dev, &bus->devices, bus_list) { + eeh_add_device_late(dev); + if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) { +diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c +index 4fa601feb860..4dab6ffa3f69 100644 +--- a/arch/powerpc/platforms/powernv/eeh-powernv.c ++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c +@@ -47,7 +47,7 @@ void pnv_pcibios_bus_add_device(struct pci_dev *pdev) + { + struct pci_dn *pdn = pci_get_pdn(pdev); + +- if (!pdev->is_virtfn) ++ if (eeh_has_flag(EEH_FORCE_DISABLED)) + return; + + pr_debug("%s: EEH: Setting up device %s.\n", __func__, pci_name(pdev)); +@@ -202,6 +202,25 @@ PNV_EEH_DBGFS_ENTRY(inbB, 0xE10); + + #endif /* CONFIG_DEBUG_FS */ + ++void pnv_eeh_enable_phbs(void) ++{ ++ struct pci_controller *hose; ++ struct pnv_phb *phb; ++ ++ list_for_each_entry(hose, &hose_list, list_node) { ++ phb = hose->private_data; ++ /* ++ * If EEH is enabled, we're going to rely on that. ++ * Otherwise, we restore to conventional mechanism ++ * to clear frozen PE during PCI config access. ++ */ ++ if (eeh_enabled()) ++ phb->flags |= PNV_PHB_FLAG_EEH; ++ else ++ phb->flags &= ~PNV_PHB_FLAG_EEH; ++ } ++} ++ + /** + * pnv_eeh_post_init - EEH platform dependent post initialization + * +@@ -248,19 +267,11 @@ int pnv_eeh_post_init(void) + if (!eeh_enabled()) + disable_irq(eeh_event_irq); + ++ pnv_eeh_enable_phbs(); ++ + list_for_each_entry(hose, &hose_list, list_node) { + phb = hose->private_data; + +- /* +- * If EEH is enabled, we're going to rely on that. +- * Otherwise, we restore to conventional mechanism +- * to clear frozen PE during PCI config access. +- */ +- if (eeh_enabled()) +- phb->flags |= PNV_PHB_FLAG_EEH; +- else +- phb->flags &= ~PNV_PHB_FLAG_EEH; +- + /* Create debugfs entries */ + #ifdef CONFIG_DEBUG_FS + if (phb->has_dbgfs || !phb->dbgfs) +@@ -474,7 +485,11 @@ static void *pnv_eeh_probe(struct pci_dn *pdn, void *data) + * Enable EEH explicitly so that we will do EEH check + * while accessing I/O stuff + */ +- eeh_add_flag(EEH_ENABLED); ++ if (!eeh_has_flag(EEH_ENABLED)) { ++ enable_irq(eeh_event_irq); ++ pnv_eeh_enable_phbs(); ++ eeh_add_flag(EEH_ENABLED); ++ } + + /* Save memory bars */ + eeh_save_bars(edev); +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index b4f77bc5f8bf..2713d2aa963c 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -55,44 +55,44 @@ static int ibm_get_config_addr_info; + static int ibm_get_config_addr_info2; + static int ibm_configure_pe; + +-#ifdef CONFIG_PCI_IOV + void pseries_pcibios_bus_add_device(struct pci_dev *pdev) + { + struct pci_dn *pdn = pci_get_pdn(pdev); +- struct pci_dn *physfn_pdn; +- struct eeh_dev *edev; + +- if (!pdev->is_virtfn) ++ if (eeh_has_flag(EEH_FORCE_DISABLED)) + return; + + pr_debug("%s: EEH: Setting up device %s.\n", __func__, pci_name(pdev)); ++#ifdef CONFIG_PCI_IOV ++ if (pdev->is_virtfn) { ++ struct pci_dn *physfn_pdn; + +- pdn->device_id = pdev->device; +- pdn->vendor_id = pdev->vendor; +- pdn->class_code = pdev->class; +- /* +- * Last allow unfreeze return code used for retrieval +- * by user space in eeh-sysfs to show the last command +- * completion from platform. +- */ +- pdn->last_allow_rc = 0; +- physfn_pdn = pci_get_pdn(pdev->physfn); +- pdn->pe_number = physfn_pdn->pe_num_map[pdn->vf_index]; +- edev = pdn_to_eeh_dev(pdn); +- +- /* +- * The following operations will fail if VF's sysfs files +- * aren't created or its resources aren't finalized. +- */ ++ pdn->device_id = pdev->device; ++ pdn->vendor_id = pdev->vendor; ++ pdn->class_code = pdev->class; ++ /* ++ * Last allow unfreeze return code used for retrieval ++ * by user space in eeh-sysfs to show the last command ++ * completion from platform. ++ */ ++ pdn->last_allow_rc = 0; ++ physfn_pdn = pci_get_pdn(pdev->physfn); ++ pdn->pe_number = physfn_pdn->pe_num_map[pdn->vf_index]; ++ } ++#endif + eeh_add_device_early(pdn); + eeh_add_device_late(pdev); +- edev->pe_config_addr = (pdn->busno << 16) | (pdn->devfn << 8); +- eeh_rmv_from_parent_pe(edev); /* Remove as it is adding to bus pe */ +- eeh_add_to_parent_pe(edev); /* Add as VF PE type */ +- eeh_sysfs_add_device(pdev); ++#ifdef CONFIG_PCI_IOV ++ if (pdev->is_virtfn) { ++ struct eeh_dev *edev = pdn_to_eeh_dev(pdn); + +-} ++ edev->pe_config_addr = (pdn->busno << 16) | (pdn->devfn << 8); ++ eeh_rmv_from_parent_pe(edev); /* Remove as it is adding to bus pe */ ++ eeh_add_to_parent_pe(edev); /* Add as VF PE type */ ++ } + #endif ++ eeh_sysfs_add_device(pdev); ++} + + /* + * Buffer for reporting slot-error-detail rtas calls. Its here +@@ -159,10 +159,8 @@ static int pseries_eeh_init(void) + /* Set EEH probe mode */ + eeh_add_flag(EEH_PROBE_MODE_DEVTREE | EEH_ENABLE_IO_FOR_LOG); + +-#ifdef CONFIG_PCI_IOV + /* Set EEH machine dependent code */ + ppc_md.pcibios_bus_add_device = pseries_pcibios_bus_add_device; +-#endif + + return 0; + } +-- +2.35.1 + diff --git a/queue-4.19/powerpc-eeh-fix-pseries_eeh_configure_bridge.patch b/queue-4.19/powerpc-eeh-fix-pseries_eeh_configure_bridge.patch new file mode 100644 index 00000000000..4916e7680b5 --- /dev/null +++ b/queue-4.19/powerpc-eeh-fix-pseries_eeh_configure_bridge.patch @@ -0,0 +1,55 @@ +From 03c8a9c0fa59b5b5bbb8a2e0bdede1e851845d2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Apr 2020 13:45:05 +1000 +Subject: powerpc/eeh: Fix pseries_eeh_configure_bridge() + +From: Sam Bobroff + +[ Upstream commit 6fa13640aea7bb0760846981aa2da4245307bd26 ] + +If a device is hot unplgged during EEH recovery, it's possible for the +RTAS call to ibm,configure-pe in pseries_eeh_configure() to return +parameter error (-3), however negative return values are not checked +for and this leads to an infinite loop. + +Fix this by correctly bailing out on negative values. + +Signed-off-by: Sam Bobroff +Signed-off-by: Michael Ellerman +Reviewed-by: Nathan Lynch +Link: https://lore.kernel.org/r/1b0a6010a647dc915816e44845b64d72066676a7.1588045502.git.sbobroff@linux.ibm.com +Stable-dep-of: 9aafbfa5f57a ("powerpc/pseries/eeh: use correct API for error log size") +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/eeh_pseries.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index 2713d2aa963c..0fc93f7e167d 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -684,6 +684,8 @@ static int pseries_eeh_configure_bridge(struct eeh_pe *pe) + + if (!ret) + return ret; ++ if (ret < 0) ++ break; + + /* + * If RTAS returns a delay value that's above 100ms, cut it +@@ -704,7 +706,11 @@ static int pseries_eeh_configure_bridge(struct eeh_pe *pe) + + pr_warn("%s: Unable to configure bridge PHB#%x-PE#%x (%d)\n", + __func__, pe->phb->global_number, pe->addr, ret); +- return ret; ++ /* PAPR defines -3 as "Parameter Error" for this function: */ ++ if (ret == -3) ++ return -EINVAL; ++ else ++ return -EIO; + } + + /** +-- +2.35.1 + diff --git a/queue-4.19/powerpc-eeh-improve-debug-messages-around-device-add.patch b/queue-4.19/powerpc-eeh-improve-debug-messages-around-device-add.patch new file mode 100644 index 00000000000..85a2ccb061b --- /dev/null +++ b/queue-4.19/powerpc-eeh-improve-debug-messages-around-device-add.patch @@ -0,0 +1,140 @@ +From 8b8010a7292e03ac4ad0b2f8eae13cb845a01200 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 14:48:07 +1000 +Subject: powerpc/eeh: Improve debug messages around device addition + +From: Sam Bobroff + +[ Upstream commit 617082a4817a4354fa3de05c80b5f6088e2083b7 ] + +Also remove useless comment. + +Signed-off-by: Sam Bobroff +Reviewed-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/59db84f4bf94718a12f206bc923ac797d47e4cc1.1565930772.git.sbobroff@linux.ibm.com +Stable-dep-of: 9aafbfa5f57a ("powerpc/pseries/eeh: use correct API for error log size") +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/eeh.c | 2 +- + arch/powerpc/platforms/powernv/eeh-powernv.c | 14 ++++++++---- + arch/powerpc/platforms/pseries/eeh_pseries.c | 23 +++++++++++++++----- + 3 files changed, 28 insertions(+), 11 deletions(-) + +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 44bb522fb4a2..2b81e9a056b5 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -1178,7 +1178,7 @@ void eeh_add_device_late(struct pci_dev *dev) + pdn = pci_get_pdn_by_devfn(dev->bus, dev->devfn); + edev = pdn_to_eeh_dev(pdn); + if (edev->pdev == dev) { +- pr_debug("EEH: Already referenced !\n"); ++ pr_debug("EEH: Device %s already referenced!\n", pci_name(dev)); + return; + } + +diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c +index 9dd5b8909178..4fa601feb860 100644 +--- a/arch/powerpc/platforms/powernv/eeh-powernv.c ++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c +@@ -50,10 +50,7 @@ void pnv_pcibios_bus_add_device(struct pci_dev *pdev) + if (!pdev->is_virtfn) + return; + +- /* +- * The following operations will fail if VF's sysfs files +- * aren't created or its resources aren't finalized. +- */ ++ pr_debug("%s: EEH: Setting up device %s.\n", __func__, pci_name(pdev)); + eeh_add_device_early(pdn); + eeh_add_device_late(pdev); + eeh_sysfs_add_device(pdev); +@@ -378,6 +375,10 @@ static void *pnv_eeh_probe(struct pci_dn *pdn, void *data) + int ret; + int config_addr = (pdn->busno << 8) | (pdn->devfn); + ++ pr_debug("%s: probing %04x:%02x:%02x.%01x\n", ++ __func__, hose->global_number, pdn->busno, ++ PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn)); ++ + /* + * When probing the root bridge, which doesn't have any + * subordinate PCI devices. We don't have OF node for +@@ -478,6 +479,11 @@ static void *pnv_eeh_probe(struct pci_dn *pdn, void *data) + /* Save memory bars */ + eeh_save_bars(edev); + ++ pr_debug("%s: EEH enabled on %02x:%02x.%01x PHB#%x-PE#%x\n", ++ __func__, pdn->busno, PCI_SLOT(pdn->devfn), ++ PCI_FUNC(pdn->devfn), edev->pe->phb->global_number, ++ edev->pe->addr); ++ + return NULL; + } + +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index 823cb27efa8b..b4f77bc5f8bf 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -65,6 +65,8 @@ void pseries_pcibios_bus_add_device(struct pci_dev *pdev) + if (!pdev->is_virtfn) + return; + ++ pr_debug("%s: EEH: Setting up device %s.\n", __func__, pci_name(pdev)); ++ + pdn->device_id = pdev->device; + pdn->vendor_id = pdev->vendor; + pdn->class_code = pdev->class; +@@ -251,6 +253,10 @@ static void *pseries_eeh_probe(struct pci_dn *pdn, void *data) + int enable = 0; + int ret; + ++ pr_debug("%s: probing %04x:%02x:%02x.%01x\n", ++ __func__, pdn->phb->global_number, pdn->busno, ++ PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn)); ++ + /* Retrieve OF node and eeh device */ + edev = pdn_to_eeh_dev(pdn); + if (!edev || edev->pe) +@@ -294,7 +300,12 @@ static void *pseries_eeh_probe(struct pci_dn *pdn, void *data) + + /* Enable EEH on the device */ + ret = eeh_ops->set_option(&pe, EEH_OPT_ENABLE); +- if (!ret) { ++ if (ret) { ++ pr_debug("%s: EEH failed to enable on %02x:%02x.%01x PHB#%x-PE#%x (code %d)\n", ++ __func__, pdn->busno, PCI_SLOT(pdn->devfn), ++ PCI_FUNC(pdn->devfn), pe.phb->global_number, ++ pe.addr, ret); ++ } else { + /* Retrieve PE address */ + edev->pe_config_addr = eeh_ops->get_pe_addr(&pe); + pe.addr = edev->pe_config_addr; +@@ -310,11 +321,6 @@ static void *pseries_eeh_probe(struct pci_dn *pdn, void *data) + if (enable) { + eeh_add_flag(EEH_ENABLED); + eeh_add_to_parent_pe(edev); +- +- pr_debug("%s: EEH enabled on %02x:%02x.%01x PHB#%x-PE#%x\n", +- __func__, pdn->busno, PCI_SLOT(pdn->devfn), +- PCI_FUNC(pdn->devfn), pe.phb->global_number, +- pe.addr); + } else if (pdn->parent && pdn_to_eeh_dev(pdn->parent) && + (pdn_to_eeh_dev(pdn->parent))->pe) { + /* This device doesn't support EEH, but it may have an +@@ -323,6 +329,11 @@ static void *pseries_eeh_probe(struct pci_dn *pdn, void *data) + edev->pe_config_addr = pdn_to_eeh_dev(pdn->parent)->pe_config_addr; + eeh_add_to_parent_pe(edev); + } ++ pr_debug("%s: EEH %s on %02x:%02x.%01x PHB#%x-PE#%x (code %d)\n", ++ __func__, (enable ? "enabled" : "unsupported"), ++ pdn->busno, PCI_SLOT(pdn->devfn), ++ PCI_FUNC(pdn->devfn), pe.phb->global_number, ++ pe.addr, ret); + } + + /* Save memory bars */ +-- +2.35.1 + diff --git a/queue-4.19/powerpc-hv-gpci-fix-hv_gpci-event-list.patch b/queue-4.19/powerpc-hv-gpci-fix-hv_gpci-event-list.patch new file mode 100644 index 00000000000..020568abaa6 --- /dev/null +++ b/queue-4.19/powerpc-hv-gpci-fix-hv_gpci-event-list.patch @@ -0,0 +1,174 @@ +From fb6a890c1e3124abb5cf10701c4b7e8405ab08d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Nov 2022 23:15:13 +0530 +Subject: powerpc/hv-gpci: Fix hv_gpci event list + +From: Kajol Jain + +[ Upstream commit 03f7c1d2a49acd30e38789cd809d3300721e9b0e ] + +Based on getPerfCountInfo v1.018 documentation, some of the +hv_gpci events were deprecated for platform firmware that +supports counter_info_version 0x8 or above. + +Fix the hv_gpci event list by adding a new attribute group +called "hv_gpci_event_attrs_v6" and a "ENABLE_EVENTS_COUNTERINFO_V6" +macro to enable these events for platform firmware +that supports counter_info_version 0x6 or below. And assigning +the hv_gpci event list based on output counter info version +of underlying plaform. + +Fixes: 97bf2640184f ("powerpc/perf/hv-gpci: add the remaining gpci requests") +Signed-off-by: Kajol Jain +Reviewed-by: Madhavan Srinivasan +Reviewed-by: Athira Rajeev +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221130174513.87501-1-kjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/hv-gpci-requests.h | 4 ++++ + arch/powerpc/perf/hv-gpci.c | 33 +++++++++++++++++++++++++++- + arch/powerpc/perf/hv-gpci.h | 1 + + arch/powerpc/perf/req-gen/perf.h | 20 +++++++++++++++++ + 4 files changed, 57 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h +index 8965b4463d43..5e86371a20c7 100644 +--- a/arch/powerpc/perf/hv-gpci-requests.h ++++ b/arch/powerpc/perf/hv-gpci-requests.h +@@ -79,6 +79,7 @@ REQUEST(__field(0, 8, partition_id) + ) + #include I(REQUEST_END) + ++#ifdef ENABLE_EVENTS_COUNTERINFO_V6 + /* + * Not available for counter_info_version >= 0x8, use + * run_instruction_cycles_by_partition(0x100) instead. +@@ -92,6 +93,7 @@ REQUEST(__field(0, 8, partition_id) + __count(0x10, 8, cycles) + ) + #include I(REQUEST_END) ++#endif + + #define REQUEST_NAME system_performance_capabilities + #define REQUEST_NUM 0x40 +@@ -103,6 +105,7 @@ REQUEST(__field(0, 1, perf_collect_privileged) + ) + #include I(REQUEST_END) + ++#ifdef ENABLE_EVENTS_COUNTERINFO_V6 + #define REQUEST_NAME processor_bus_utilization_abc_links + #define REQUEST_NUM 0x50 + #define REQUEST_IDX_KIND "hw_chip_id=?" +@@ -194,6 +197,7 @@ REQUEST(__field(0, 4, phys_processor_idx) + __count(0x28, 8, instructions_completed) + ) + #include I(REQUEST_END) ++#endif + + /* Processor_core_power_mode (0x95) skipped, no counters */ + /* Affinity_domain_information_by_virtual_processor (0xA0) skipped, +diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c +index 160b86d9d819..126409bb5626 100644 +--- a/arch/powerpc/perf/hv-gpci.c ++++ b/arch/powerpc/perf/hv-gpci.c +@@ -74,7 +74,7 @@ static struct attribute_group format_group = { + + static struct attribute_group event_group = { + .name = "events", +- .attrs = hv_gpci_event_attrs, ++ /* .attrs is set in init */ + }; + + #define HV_CAPS_ATTR(_name, _format) \ +@@ -292,6 +292,7 @@ static int hv_gpci_init(void) + int r; + unsigned long hret; + struct hv_perf_caps caps; ++ struct hv_gpci_request_buffer *arg; + + hv_gpci_assert_offsets_correct(); + +@@ -310,6 +311,36 @@ static int hv_gpci_init(void) + /* sampling not supported */ + h_gpci_pmu.capabilities |= PERF_PMU_CAP_NO_INTERRUPT; + ++ arg = (void *)get_cpu_var(hv_gpci_reqb); ++ memset(arg, 0, HGPCI_REQ_BUFFER_SIZE); ++ ++ /* ++ * hcall H_GET_PERF_COUNTER_INFO populates the output ++ * counter_info_version value based on the system hypervisor. ++ * Pass the counter request 0x10 corresponds to request type ++ * 'Dispatch_timebase_by_processor', to get the supported ++ * counter_info_version. ++ */ ++ arg->params.counter_request = cpu_to_be32(0x10); ++ ++ r = plpar_hcall_norets(H_GET_PERF_COUNTER_INFO, ++ virt_to_phys(arg), HGPCI_REQ_BUFFER_SIZE); ++ if (r) { ++ pr_devel("hcall failed, can't get supported counter_info_version: 0x%x\n", r); ++ arg->params.counter_info_version_out = 0x8; ++ } ++ ++ /* ++ * Use counter_info_version_out value to assign ++ * required hv-gpci event list. ++ */ ++ if (arg->params.counter_info_version_out >= 0x8) ++ event_group.attrs = hv_gpci_event_attrs; ++ else ++ event_group.attrs = hv_gpci_event_attrs_v6; ++ ++ put_cpu_var(hv_gpci_reqb); ++ + r = perf_pmu_register(&h_gpci_pmu, h_gpci_pmu.name, -1); + if (r) + return r; +diff --git a/arch/powerpc/perf/hv-gpci.h b/arch/powerpc/perf/hv-gpci.h +index a3053eda5dcc..060e464d35c6 100644 +--- a/arch/powerpc/perf/hv-gpci.h ++++ b/arch/powerpc/perf/hv-gpci.h +@@ -53,6 +53,7 @@ enum { + #define REQUEST_FILE "../hv-gpci-requests.h" + #define NAME_LOWER hv_gpci + #define NAME_UPPER HV_GPCI ++#define ENABLE_EVENTS_COUNTERINFO_V6 + #include "req-gen/perf.h" + #undef REQUEST_FILE + #undef NAME_LOWER +diff --git a/arch/powerpc/perf/req-gen/perf.h b/arch/powerpc/perf/req-gen/perf.h +index fa9bc804e67a..6b2a59fefffa 100644 +--- a/arch/powerpc/perf/req-gen/perf.h ++++ b/arch/powerpc/perf/req-gen/perf.h +@@ -139,6 +139,26 @@ PMU_EVENT_ATTR_STRING( \ + #define REQUEST_(r_name, r_value, r_idx_1, r_fields) \ + r_fields + ++/* Generate event list for platforms with counter_info_version 0x6 or below */ ++static __maybe_unused struct attribute *hv_gpci_event_attrs_v6[] = { ++#include REQUEST_FILE ++ NULL ++}; ++ ++/* ++ * Based on getPerfCountInfo v1.018 documentation, some of the hv-gpci ++ * events were deprecated for platform firmware that supports ++ * counter_info_version 0x8 or above. ++ * Those deprecated events are still part of platform firmware that ++ * support counter_info_version 0x6 and below. As per the getPerfCountInfo ++ * v1.018 documentation there is no counter_info_version 0x7. ++ * Undefining macro ENABLE_EVENTS_COUNTERINFO_V6, to disable the addition of ++ * deprecated events in "hv_gpci_event_attrs" attribute group, for platforms ++ * that supports counter_info_version 0x8 or above. ++ */ ++#undef ENABLE_EVENTS_COUNTERINFO_V6 ++ ++/* Generate event list for platforms with counter_info_version 0x8 or above*/ + static __maybe_unused struct attribute *hv_gpci_event_attrs[] = { + #include REQUEST_FILE + NULL +-- +2.35.1 + diff --git a/queue-4.19/powerpc-perf-callchain-validate-kernel-stack-pointer.patch b/queue-4.19/powerpc-perf-callchain-validate-kernel-stack-pointer.patch new file mode 100644 index 00000000000..b2d27699876 --- /dev/null +++ b/queue-4.19/powerpc-perf-callchain-validate-kernel-stack-pointer.patch @@ -0,0 +1,46 @@ +From 7eb74e95540f6577ac00f14ebfbdf69abff013fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Nov 2022 22:49:28 +1000 +Subject: powerpc/perf: callchain validate kernel stack pointer bounds + +From: Nicholas Piggin + +[ Upstream commit 32c5209214bd8d4f8c4e9d9b630ef4c671f58e79 ] + +The interrupt frame detection and loads from the hypothetical pt_regs +are not bounds-checked. The next-frame validation only bounds-checks +STACK_FRAME_OVERHEAD, which does not include the pt_regs. Add another +test for this. + +The user could set r1 to be equal to the address matching the first +interrupt frame - STACK_INT_FRAME_SIZE, which is in the previous page +due to the kernel redzone, and induce the kernel to load the marker from +there. Possibly this could cause a crash at least. If the user could +induce the previous page to contain a valid marker, then it might be +able to direct perf to read specific memory addresses in a way that +could be transmitted back to the user in the perf data. + +Fixes: 20002ded4d93 ("perf_counter: powerpc: Add callchain support") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221127124942.1665522-4-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/callchain.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c +index 0af051a1974e..26a31a3b661e 100644 +--- a/arch/powerpc/perf/callchain.c ++++ b/arch/powerpc/perf/callchain.c +@@ -68,6 +68,7 @@ perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *re + next_sp = fp[0]; + + if (next_sp == sp + STACK_INT_FRAME_SIZE && ++ validate_sp(sp, current, STACK_INT_FRAME_SIZE) && + fp[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) { + /* + * This looks like an interrupt frame for an +-- +2.35.1 + diff --git a/queue-4.19/powerpc-pseries-eeh-use-correct-api-for-error-log-si.patch b/queue-4.19/powerpc-pseries-eeh-use-correct-api-for-error-log-si.patch new file mode 100644 index 00000000000..08c6536c1c5 --- /dev/null +++ b/queue-4.19/powerpc-pseries-eeh-use-correct-api-for-error-log-si.patch @@ -0,0 +1,49 @@ +From 9b93c0e853b02c24c8a300ca45ac2e5cf01e58ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Nov 2022 09:07:43 -0600 +Subject: powerpc/pseries/eeh: use correct API for error log size + +From: Nathan Lynch + +[ Upstream commit 9aafbfa5f57a4b75bafd3bed0191e8429c5fa618 ] + +rtas-error-log-max is not the name of an RTAS function, so rtas_token() +is not the appropriate API for retrieving its value. We already have +rtas_get_error_log_max() which returns a sensible value if the property +is absent for any reason, so use that instead. + +Fixes: 8d633291b4fc ("powerpc/eeh: pseries platform EEH error log retrieval") +Signed-off-by: Nathan Lynch +[mpe: Drop no-longer possible error handling as noticed by ajd] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221118150751.469393-6-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/eeh_pseries.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index f56248f19ef3..b7160120c0bb 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -946,16 +946,7 @@ static int __init eeh_pseries_init(void) + } + + /* Initialize error log size */ +- eeh_error_buf_size = rtas_token("rtas-error-log-max"); +- if (eeh_error_buf_size == RTAS_UNKNOWN_SERVICE) { +- pr_info("%s: unknown EEH error log size\n", +- __func__); +- eeh_error_buf_size = 1024; +- } else if (eeh_error_buf_size > RTAS_ERROR_LOG_MAX) { +- pr_info("%s: EEH error log size %d exceeds the maximal %d\n", +- __func__, eeh_error_buf_size, RTAS_ERROR_LOG_MAX); +- eeh_error_buf_size = RTAS_ERROR_LOG_MAX; +- } ++ eeh_error_buf_size = rtas_get_error_log_max(); + + /* Set EEH probe mode */ + eeh_add_flag(EEH_PROBE_MODE_DEVTREE | EEH_ENABLE_IO_FOR_LOG); +-- +2.35.1 + diff --git a/queue-4.19/powerpc-pseries-pcie-phb-reset.patch b/queue-4.19/powerpc-pseries-pcie-phb-reset.patch new file mode 100644 index 00000000000..261f6e942ab --- /dev/null +++ b/queue-4.19/powerpc-pseries-pcie-phb-reset.patch @@ -0,0 +1,326 @@ +From 61659a948f6a31e0e0ca4aacd1861ac75a5aebde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2020 09:39:33 -0500 +Subject: powerpc/pseries: PCIE PHB reset + +From: Wen Xiong + +[ Upstream commit 5a090f7c363fdc09b99222eae679506a58e7cc68 ] + +Several device drivers hit EEH(Extended Error handling) when +triggering kdump on Pseries PowerVM. This patch implemented a reset of +the PHBs in pci general code when triggering kdump. PHB reset stop all +PCI transactions from normal kernel. We have tested the patch in +several enviroments: + - direct slot adapters + - adapters under the switch + - a VF adapter in PowerVM + - a VF adapter/adapter in KVM guest. + +Signed-off-by: Wen Xiong +[mpe: Fix broken whitespace, subject & SOB formatting] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1594651173-32166-1-git-send-email-wenxiong@linux.vnet.ibm.com +Stable-dep-of: 9aafbfa5f57a ("powerpc/pseries/eeh: use correct API for error log size") +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/eeh_pseries.c | 232 ++++++++++++++----- + 1 file changed, 169 insertions(+), 63 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index 0fc93f7e167d..560d7401496c 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -94,6 +95,152 @@ void pseries_pcibios_bus_add_device(struct pci_dev *pdev) + eeh_sysfs_add_device(pdev); + } + ++ ++/** ++ * pseries_eeh_get_config_addr - Retrieve config address ++ * ++ * Retrieve the assocated config address. Actually, there're 2 RTAS ++ * function calls dedicated for the purpose. We need implement ++ * it through the new function and then the old one. Besides, ++ * you should make sure the config address is figured out from ++ * FDT node before calling the function. ++ * ++ * It's notable that zero'ed return value means invalid PE config ++ * address. ++ */ ++static int pseries_eeh_get_config_addr(struct pci_controller *phb, int config_addr) ++{ ++ int ret = 0; ++ int rets[3]; ++ ++ if (ibm_get_config_addr_info2 != RTAS_UNKNOWN_SERVICE) { ++ /* ++ * First of all, we need to make sure there has one PE ++ * associated with the device. Otherwise, PE address is ++ * meaningless. ++ */ ++ ret = rtas_call(ibm_get_config_addr_info2, 4, 2, rets, ++ config_addr, BUID_HI(phb->buid), ++ BUID_LO(phb->buid), 1); ++ if (ret || (rets[0] == 0)) ++ return 0; ++ ++ /* Retrieve the associated PE config address */ ++ ret = rtas_call(ibm_get_config_addr_info2, 4, 2, rets, ++ config_addr, BUID_HI(phb->buid), ++ BUID_LO(phb->buid), 0); ++ if (ret) { ++ pr_warn("%s: Failed to get address for PHB#%x-PE#%x\n", ++ __func__, phb->global_number, config_addr); ++ return 0; ++ } ++ ++ return rets[0]; ++ } ++ ++ if (ibm_get_config_addr_info != RTAS_UNKNOWN_SERVICE) { ++ ret = rtas_call(ibm_get_config_addr_info, 4, 2, rets, ++ config_addr, BUID_HI(phb->buid), ++ BUID_LO(phb->buid), 0); ++ if (ret) { ++ pr_warn("%s: Failed to get address for PHB#%x-PE#%x\n", ++ __func__, phb->global_number, config_addr); ++ return 0; ++ } ++ ++ return rets[0]; ++ } ++ ++ return ret; ++} ++ ++/** ++ * pseries_eeh_phb_reset - Reset the specified PHB ++ * @phb: PCI controller ++ * @config_adddr: the associated config address ++ * @option: reset option ++ * ++ * Reset the specified PHB/PE ++ */ ++static int pseries_eeh_phb_reset(struct pci_controller *phb, int config_addr, int option) ++{ ++ int ret; ++ ++ /* Reset PE through RTAS call */ ++ ret = rtas_call(ibm_set_slot_reset, 4, 1, NULL, ++ config_addr, BUID_HI(phb->buid), ++ BUID_LO(phb->buid), option); ++ ++ /* If fundamental-reset not supported, try hot-reset */ ++ if (option == EEH_RESET_FUNDAMENTAL && ++ ret == -8) { ++ option = EEH_RESET_HOT; ++ ret = rtas_call(ibm_set_slot_reset, 4, 1, NULL, ++ config_addr, BUID_HI(phb->buid), ++ BUID_LO(phb->buid), option); ++ } ++ ++ /* We need reset hold or settlement delay */ ++ if (option == EEH_RESET_FUNDAMENTAL || ++ option == EEH_RESET_HOT) ++ msleep(EEH_PE_RST_HOLD_TIME); ++ else ++ msleep(EEH_PE_RST_SETTLE_TIME); ++ ++ return ret; ++} ++ ++/** ++ * pseries_eeh_phb_configure_bridge - Configure PCI bridges in the indicated PE ++ * @phb: PCI controller ++ * @config_adddr: the associated config address ++ * ++ * The function will be called to reconfigure the bridges included ++ * in the specified PE so that the mulfunctional PE would be recovered ++ * again. ++ */ ++static int pseries_eeh_phb_configure_bridge(struct pci_controller *phb, int config_addr) ++{ ++ int ret; ++ /* Waiting 0.2s maximum before skipping configuration */ ++ int max_wait = 200; ++ ++ while (max_wait > 0) { ++ ret = rtas_call(ibm_configure_pe, 3, 1, NULL, ++ config_addr, BUID_HI(phb->buid), ++ BUID_LO(phb->buid)); ++ ++ if (!ret) ++ return ret; ++ if (ret < 0) ++ break; ++ ++ /* ++ * If RTAS returns a delay value that's above 100ms, cut it ++ * down to 100ms in case firmware made a mistake. For more ++ * on how these delay values work see rtas_busy_delay_time ++ */ ++ if (ret > RTAS_EXTENDED_DELAY_MIN+2 && ++ ret <= RTAS_EXTENDED_DELAY_MAX) ++ ret = RTAS_EXTENDED_DELAY_MIN+2; ++ ++ max_wait -= rtas_busy_delay_time(ret); ++ ++ if (max_wait < 0) ++ break; ++ ++ rtas_busy_delay(ret); ++ } ++ ++ pr_warn("%s: Unable to configure bridge PHB#%x-PE#%x (%d)\n", ++ __func__, phb->global_number, config_addr, ret); ++ /* PAPR defines -3 as "Parameter Error" for this function: */ ++ if (ret == -3) ++ return -EINVAL; ++ else ++ return -EIO; ++} ++ + /* + * Buffer for reporting slot-error-detail rtas calls. Its here + * in BSS, and not dynamically alloced, so that it ends up in +@@ -110,6 +257,10 @@ static int eeh_error_buf_size; + */ + static int pseries_eeh_init(void) + { ++ struct pci_controller *phb; ++ struct pci_dn *pdn; ++ int addr, config_addr; ++ + /* figure out EEH RTAS function call tokens */ + ibm_set_eeh_option = rtas_token("ibm,set-eeh-option"); + ibm_set_slot_reset = rtas_token("ibm,set-slot-reset"); +@@ -162,6 +313,22 @@ static int pseries_eeh_init(void) + /* Set EEH machine dependent code */ + ppc_md.pcibios_bus_add_device = pseries_pcibios_bus_add_device; + ++ if (is_kdump_kernel() || reset_devices) { ++ pr_info("Issue PHB reset ...\n"); ++ list_for_each_entry(phb, &hose_list, list_node) { ++ pdn = list_first_entry(&PCI_DN(phb->dn)->child_list, struct pci_dn, list); ++ addr = (pdn->busno << 16) | (pdn->devfn << 8); ++ config_addr = pseries_eeh_get_config_addr(phb, addr); ++ /* invalid PE config addr */ ++ if (config_addr == 0) ++ continue; ++ ++ pseries_eeh_phb_reset(phb, config_addr, EEH_RESET_FUNDAMENTAL); ++ pseries_eeh_phb_reset(phb, config_addr, EEH_RESET_DEACTIVATE); ++ pseries_eeh_phb_configure_bridge(phb, config_addr); ++ } ++ } ++ + return 0; + } + +@@ -531,35 +698,13 @@ static int pseries_eeh_get_state(struct eeh_pe *pe, int *state) + static int pseries_eeh_reset(struct eeh_pe *pe, int option) + { + int config_addr; +- int ret; + + /* Figure out PE address */ + config_addr = pe->config_addr; + if (pe->addr) + config_addr = pe->addr; + +- /* Reset PE through RTAS call */ +- ret = rtas_call(ibm_set_slot_reset, 4, 1, NULL, +- config_addr, BUID_HI(pe->phb->buid), +- BUID_LO(pe->phb->buid), option); +- +- /* If fundamental-reset not supported, try hot-reset */ +- if (option == EEH_RESET_FUNDAMENTAL && +- ret == -8) { +- option = EEH_RESET_HOT; +- ret = rtas_call(ibm_set_slot_reset, 4, 1, NULL, +- config_addr, BUID_HI(pe->phb->buid), +- BUID_LO(pe->phb->buid), option); +- } +- +- /* We need reset hold or settlement delay */ +- if (option == EEH_RESET_FUNDAMENTAL || +- option == EEH_RESET_HOT) +- msleep(EEH_PE_RST_HOLD_TIME); +- else +- msleep(EEH_PE_RST_SETTLE_TIME); +- +- return ret; ++ return pseries_eeh_phb_reset(pe->phb, config_addr, option); + } + + /** +@@ -661,56 +806,17 @@ static int pseries_eeh_get_log(struct eeh_pe *pe, int severity, char *drv_log, u + * pseries_eeh_configure_bridge - Configure PCI bridges in the indicated PE + * @pe: EEH PE + * +- * The function will be called to reconfigure the bridges included +- * in the specified PE so that the mulfunctional PE would be recovered +- * again. + */ + static int pseries_eeh_configure_bridge(struct eeh_pe *pe) + { + int config_addr; +- int ret; +- /* Waiting 0.2s maximum before skipping configuration */ +- int max_wait = 200; + + /* Figure out the PE address */ + config_addr = pe->config_addr; + if (pe->addr) + config_addr = pe->addr; + +- while (max_wait > 0) { +- ret = rtas_call(ibm_configure_pe, 3, 1, NULL, +- config_addr, BUID_HI(pe->phb->buid), +- BUID_LO(pe->phb->buid)); +- +- if (!ret) +- return ret; +- if (ret < 0) +- break; +- +- /* +- * If RTAS returns a delay value that's above 100ms, cut it +- * down to 100ms in case firmware made a mistake. For more +- * on how these delay values work see rtas_busy_delay_time +- */ +- if (ret > RTAS_EXTENDED_DELAY_MIN+2 && +- ret <= RTAS_EXTENDED_DELAY_MAX) +- ret = RTAS_EXTENDED_DELAY_MIN+2; +- +- max_wait -= rtas_busy_delay_time(ret); +- +- if (max_wait < 0) +- break; +- +- rtas_busy_delay(ret); +- } +- +- pr_warn("%s: Unable to configure bridge PHB#%x-PE#%x (%d)\n", +- __func__, pe->phb->global_number, pe->addr, ret); +- /* PAPR defines -3 as "Parameter Error" for this function: */ +- if (ret == -3) +- return -EINVAL; +- else +- return -EIO; ++ return pseries_eeh_phb_configure_bridge(pe->phb, config_addr); + } + + /** +-- +2.35.1 + diff --git a/queue-4.19/powerpc-pseries-stop-using-eeh_ops-init.patch b/queue-4.19/powerpc-pseries-stop-using-eeh_ops-init.patch new file mode 100644 index 00000000000..8f71a4dbe9c --- /dev/null +++ b/queue-4.19/powerpc-pseries-stop-using-eeh_ops-init.patch @@ -0,0 +1,205 @@ +From dca24723685a88aa098119be7fec7df6cdb82e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 19:30:44 +1000 +Subject: powerpc/pseries: Stop using eeh_ops->init() + +From: Oliver O'Halloran + +[ Upstream commit 1f8fa0cd6a848ff072bffe0ee776554387128f60 ] + +Fold pseries_eeh_init() into eeh_pseries_init() rather than having +eeh_init() call it via eeh_ops->init(). It's simpler and it'll let us +delete eeh_ops.init. + +Signed-off-by: Oliver O'Halloran +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200918093050.37344-3-oohall@gmail.com +Stable-dep-of: 9aafbfa5f57a ("powerpc/pseries/eeh: use correct API for error log size") +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/eeh_pseries.c | 155 +++++++++---------- + 1 file changed, 71 insertions(+), 84 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index 560d7401496c..7a0b9aa09d10 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -250,88 +250,6 @@ static unsigned char slot_errbuf[RTAS_ERROR_LOG_MAX]; + static DEFINE_SPINLOCK(slot_errbuf_lock); + static int eeh_error_buf_size; + +-/** +- * pseries_eeh_init - EEH platform dependent initialization +- * +- * EEH platform dependent initialization on pseries. +- */ +-static int pseries_eeh_init(void) +-{ +- struct pci_controller *phb; +- struct pci_dn *pdn; +- int addr, config_addr; +- +- /* figure out EEH RTAS function call tokens */ +- ibm_set_eeh_option = rtas_token("ibm,set-eeh-option"); +- ibm_set_slot_reset = rtas_token("ibm,set-slot-reset"); +- ibm_read_slot_reset_state2 = rtas_token("ibm,read-slot-reset-state2"); +- ibm_read_slot_reset_state = rtas_token("ibm,read-slot-reset-state"); +- ibm_slot_error_detail = rtas_token("ibm,slot-error-detail"); +- ibm_get_config_addr_info2 = rtas_token("ibm,get-config-addr-info2"); +- ibm_get_config_addr_info = rtas_token("ibm,get-config-addr-info"); +- ibm_configure_pe = rtas_token("ibm,configure-pe"); +- +- /* +- * ibm,configure-pe and ibm,configure-bridge have the same semantics, +- * however ibm,configure-pe can be faster. If we can't find +- * ibm,configure-pe then fall back to using ibm,configure-bridge. +- */ +- if (ibm_configure_pe == RTAS_UNKNOWN_SERVICE) +- ibm_configure_pe = rtas_token("ibm,configure-bridge"); +- +- /* +- * Necessary sanity check. We needn't check "get-config-addr-info" +- * and its variant since the old firmware probably support address +- * of domain/bus/slot/function for EEH RTAS operations. +- */ +- if (ibm_set_eeh_option == RTAS_UNKNOWN_SERVICE || +- ibm_set_slot_reset == RTAS_UNKNOWN_SERVICE || +- (ibm_read_slot_reset_state2 == RTAS_UNKNOWN_SERVICE && +- ibm_read_slot_reset_state == RTAS_UNKNOWN_SERVICE) || +- ibm_slot_error_detail == RTAS_UNKNOWN_SERVICE || +- ibm_configure_pe == RTAS_UNKNOWN_SERVICE) { +- pr_info("EEH functionality not supported\n"); +- return -EINVAL; +- } +- +- /* Initialize error log lock and size */ +- spin_lock_init(&slot_errbuf_lock); +- eeh_error_buf_size = rtas_token("rtas-error-log-max"); +- if (eeh_error_buf_size == RTAS_UNKNOWN_SERVICE) { +- pr_info("%s: unknown EEH error log size\n", +- __func__); +- eeh_error_buf_size = 1024; +- } else if (eeh_error_buf_size > RTAS_ERROR_LOG_MAX) { +- pr_info("%s: EEH error log size %d exceeds the maximal %d\n", +- __func__, eeh_error_buf_size, RTAS_ERROR_LOG_MAX); +- eeh_error_buf_size = RTAS_ERROR_LOG_MAX; +- } +- +- /* Set EEH probe mode */ +- eeh_add_flag(EEH_PROBE_MODE_DEVTREE | EEH_ENABLE_IO_FOR_LOG); +- +- /* Set EEH machine dependent code */ +- ppc_md.pcibios_bus_add_device = pseries_pcibios_bus_add_device; +- +- if (is_kdump_kernel() || reset_devices) { +- pr_info("Issue PHB reset ...\n"); +- list_for_each_entry(phb, &hose_list, list_node) { +- pdn = list_first_entry(&PCI_DN(phb->dn)->child_list, struct pci_dn, list); +- addr = (pdn->busno << 16) | (pdn->devfn << 8); +- config_addr = pseries_eeh_get_config_addr(phb, addr); +- /* invalid PE config addr */ +- if (config_addr == 0) +- continue; +- +- pseries_eeh_phb_reset(phb, config_addr, EEH_RESET_FUNDAMENTAL); +- pseries_eeh_phb_reset(phb, config_addr, EEH_RESET_DEACTIVATE); +- pseries_eeh_phb_configure_bridge(phb, config_addr); +- } +- } +- +- return 0; +-} +- + static int pseries_eeh_cap_start(struct pci_dn *pdn) + { + u32 status; +@@ -964,7 +882,6 @@ static int pseries_notify_resume(struct pci_dn *pdn) + + static struct eeh_ops pseries_eeh_ops = { + .name = "pseries", +- .init = pseries_eeh_init, + .probe = pseries_eeh_probe, + .set_option = pseries_eeh_set_option, + .get_pe_addr = pseries_eeh_get_pe_addr, +@@ -991,7 +908,77 @@ static struct eeh_ops pseries_eeh_ops = { + */ + static int __init eeh_pseries_init(void) + { +- int ret; ++ struct pci_controller *phb; ++ struct pci_dn *pdn; ++ int ret, addr, config_addr; ++ ++ /* figure out EEH RTAS function call tokens */ ++ ibm_set_eeh_option = rtas_token("ibm,set-eeh-option"); ++ ibm_set_slot_reset = rtas_token("ibm,set-slot-reset"); ++ ibm_read_slot_reset_state2 = rtas_token("ibm,read-slot-reset-state2"); ++ ibm_read_slot_reset_state = rtas_token("ibm,read-slot-reset-state"); ++ ibm_slot_error_detail = rtas_token("ibm,slot-error-detail"); ++ ibm_get_config_addr_info2 = rtas_token("ibm,get-config-addr-info2"); ++ ibm_get_config_addr_info = rtas_token("ibm,get-config-addr-info"); ++ ibm_configure_pe = rtas_token("ibm,configure-pe"); ++ ++ /* ++ * ibm,configure-pe and ibm,configure-bridge have the same semantics, ++ * however ibm,configure-pe can be faster. If we can't find ++ * ibm,configure-pe then fall back to using ibm,configure-bridge. ++ */ ++ if (ibm_configure_pe == RTAS_UNKNOWN_SERVICE) ++ ibm_configure_pe = rtas_token("ibm,configure-bridge"); ++ ++ /* ++ * Necessary sanity check. We needn't check "get-config-addr-info" ++ * and its variant since the old firmware probably support address ++ * of domain/bus/slot/function for EEH RTAS operations. ++ */ ++ if (ibm_set_eeh_option == RTAS_UNKNOWN_SERVICE || ++ ibm_set_slot_reset == RTAS_UNKNOWN_SERVICE || ++ (ibm_read_slot_reset_state2 == RTAS_UNKNOWN_SERVICE && ++ ibm_read_slot_reset_state == RTAS_UNKNOWN_SERVICE) || ++ ibm_slot_error_detail == RTAS_UNKNOWN_SERVICE || ++ ibm_configure_pe == RTAS_UNKNOWN_SERVICE) { ++ pr_info("EEH functionality not supported\n"); ++ return -EINVAL; ++ } ++ ++ /* Initialize error log lock and size */ ++ spin_lock_init(&slot_errbuf_lock); ++ eeh_error_buf_size = rtas_token("rtas-error-log-max"); ++ if (eeh_error_buf_size == RTAS_UNKNOWN_SERVICE) { ++ pr_info("%s: unknown EEH error log size\n", ++ __func__); ++ eeh_error_buf_size = 1024; ++ } else if (eeh_error_buf_size > RTAS_ERROR_LOG_MAX) { ++ pr_info("%s: EEH error log size %d exceeds the maximal %d\n", ++ __func__, eeh_error_buf_size, RTAS_ERROR_LOG_MAX); ++ eeh_error_buf_size = RTAS_ERROR_LOG_MAX; ++ } ++ ++ /* Set EEH probe mode */ ++ eeh_add_flag(EEH_PROBE_MODE_DEVTREE | EEH_ENABLE_IO_FOR_LOG); ++ ++ /* Set EEH machine dependent code */ ++ ppc_md.pcibios_bus_add_device = pseries_pcibios_bus_add_device; ++ ++ if (is_kdump_kernel() || reset_devices) { ++ pr_info("Issue PHB reset ...\n"); ++ list_for_each_entry(phb, &hose_list, list_node) { ++ pdn = list_first_entry(&PCI_DN(phb->dn)->child_list, struct pci_dn, list); ++ addr = (pdn->busno << 16) | (pdn->devfn << 8); ++ config_addr = pseries_eeh_get_config_addr(phb, addr); ++ /* invalid PE config addr */ ++ if (config_addr == 0) ++ continue; ++ ++ pseries_eeh_phb_reset(phb, config_addr, EEH_RESET_FUNDAMENTAL); ++ pseries_eeh_phb_reset(phb, config_addr, EEH_RESET_DEACTIVATE); ++ pseries_eeh_phb_configure_bridge(phb, config_addr); ++ } ++ } + + ret = eeh_ops_register(&pseries_eeh_ops); + if (!ret) +-- +2.35.1 + diff --git a/queue-4.19/powerpc-xive-add-missing-iounmap-in-error-path-in-xi.patch b/queue-4.19/powerpc-xive-add-missing-iounmap-in-error-path-in-xi.patch new file mode 100644 index 00000000000..0f33fdb3af0 --- /dev/null +++ b/queue-4.19/powerpc-xive-add-missing-iounmap-in-error-path-in-xi.patch @@ -0,0 +1,41 @@ +From 4f1db21be8241b6c527a605f0fa37862c66053d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 11:23:33 +0800 +Subject: powerpc/xive: add missing iounmap() in error path in + xive_spapr_populate_irq_data() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yang Yingliang + +[ Upstream commit 8b49670f3bb3f10cd4d5a6dca17f5a31b173ecdc ] + +If remapping 'data->trig_page' fails, the 'data->eoi_mmio' need be unmapped +before returning from xive_spapr_populate_irq_data(). + +Fixes: eac1e731b59e ("powerpc/xive: guest exploitation of the XIVE interrupt controller") +Signed-off-by: Yang Yingliang +Reviewed-by: Cédric Le Goater +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221017032333.1852406-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/xive/spapr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c +index aa705732150c..ac1eb674f9d6 100644 +--- a/arch/powerpc/sysdev/xive/spapr.c ++++ b/arch/powerpc/sysdev/xive/spapr.c +@@ -389,6 +389,7 @@ static int xive_spapr_populate_irq_data(u32 hw_irq, struct xive_irq_data *data) + + data->trig_mmio = ioremap(data->trig_page, 1u << data->esb_shift); + if (!data->trig_mmio) { ++ iounmap(data->eoi_mmio); + pr_err("Failed to map trigger page for irq 0x%x\n", hw_irq); + return -ENOMEM; + } +-- +2.35.1 + diff --git a/queue-4.19/ppp-associate-skb-with-a-device-at-tx.patch b/queue-4.19/ppp-associate-skb-with-a-device-at-tx.patch new file mode 100644 index 00000000000..567085e7fdf --- /dev/null +++ b/queue-4.19/ppp-associate-skb-with-a-device-at-tx.patch @@ -0,0 +1,62 @@ +From b68a2d57ef9434f2901776d852ffa1ac7619f8c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 10:29:13 -0800 +Subject: ppp: associate skb with a device at tx + +From: Stanislav Fomichev + +[ Upstream commit 9f225444467b98579cf28d94f4ad053460dfdb84 ] + +Syzkaller triggered flow dissector warning with the following: + +r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) +ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) +ioctl$PPPIOCSACTIVE(r0, 0x40107446, &(0x7f0000000240)={0x2, &(0x7f0000000180)=[{0x20, 0x0, 0x0, 0xfffff034}, {0x6}]}) +pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000140)='\x00!', 0x2}], 0x1, 0x0, 0x0) + +[ 9.485814] WARNING: CPU: 3 PID: 329 at net/core/flow_dissector.c:1016 __skb_flow_dissect+0x1ee0/0x1fa0 +[ 9.485929] skb_get_poff+0x53/0xa0 +[ 9.485937] bpf_skb_get_pay_offset+0xe/0x20 +[ 9.485944] ? ppp_send_frame+0xc2/0x5b0 +[ 9.485949] ? _raw_spin_unlock_irqrestore+0x40/0x60 +[ 9.485958] ? __ppp_xmit_process+0x7a/0xe0 +[ 9.485968] ? ppp_xmit_process+0x5b/0xb0 +[ 9.485974] ? ppp_write+0x12a/0x190 +[ 9.485981] ? do_iter_write+0x18e/0x2d0 +[ 9.485987] ? __import_iovec+0x30/0x130 +[ 9.485997] ? do_pwritev+0x1b6/0x240 +[ 9.486016] ? trace_hardirqs_on+0x47/0x50 +[ 9.486023] ? __x64_sys_pwritev+0x24/0x30 +[ 9.486026] ? do_syscall_64+0x3d/0x80 +[ 9.486031] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Flow dissector tries to find skb net namespace either via device +or via socket. Neigher is set in ppp_send_frame, so let's manually +use ppp->dev. + +Cc: Paul Mackerras +Cc: linux-ppp@vger.kernel.org +Reported-by: syzbot+41cab52ab62ee99ed24a@syzkaller.appspotmail.com +Signed-off-by: Stanislav Fomichev +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/ppp_generic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index 3f335b57d5cd..220b28711f98 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -1528,6 +1528,8 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) + int len; + unsigned char *cp; + ++ skb->dev = ppp->dev; ++ + if (proto < 0x8000) { + #ifdef CONFIG_PPP_FILTER + /* check if we should pass this packet */ +-- +2.35.1 + diff --git a/queue-4.19/proc-fixup-uptime-selftest.patch b/queue-4.19/proc-fixup-uptime-selftest.patch new file mode 100644 index 00000000000..802460f79ca --- /dev/null +++ b/queue-4.19/proc-fixup-uptime-selftest.patch @@ -0,0 +1,48 @@ +From 847ba8e6d6bb5c8f900ed4d549aac52e63a01c11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 21:08:09 +0300 +Subject: proc: fixup uptime selftest + +From: Alexey Dobriyan + +[ Upstream commit 5cc81d5c81af0dee54da9a67a3ebe4be076a13db ] + +syscall(3) returns -1 and sets errno on error, unlike "syscall" +instruction. + +Systems which have <= 32/64 CPUs are unaffected. Test won't bounce +to all CPUs before completing if there are more of them. + +Link: https://lkml.kernel.org/r/Y1bUiT7VRXlXPQa1@p183 +Fixes: 1f5bd0547654 ("proc: selftests: test /proc/uptime") +Signed-off-by: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/proc/proc-uptime-002.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c +index e7ceabed7f51..7d0aa22bdc12 100644 +--- a/tools/testing/selftests/proc/proc-uptime-002.c ++++ b/tools/testing/selftests/proc/proc-uptime-002.c +@@ -17,6 +17,7 @@ + // while shifting across CPUs. + #undef NDEBUG + #include ++#include + #include + #include + #include +@@ -54,7 +55,7 @@ int main(void) + len += sizeof(unsigned long); + free(m); + m = malloc(len); +- } while (sys_sched_getaffinity(0, len, m) == -EINVAL); ++ } while (sys_sched_getaffinity(0, len, m) == -1 && errno == EINVAL); + + fd = open("/proc/uptime", O_RDONLY); + assert(fd >= 0); +-- +2.35.1 + diff --git a/queue-4.19/pstore-avoid-kcore-oops-by-vmap-ing-with-vm_ioremap.patch b/queue-4.19/pstore-avoid-kcore-oops-by-vmap-ing-with-vm_ioremap.patch new file mode 100644 index 00000000000..1ad63cfde2c --- /dev/null +++ b/queue-4.19/pstore-avoid-kcore-oops-by-vmap-ing-with-vm_ioremap.patch @@ -0,0 +1,103 @@ +From 434a472455432948f2875878ca764886c14cef40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 15:31:36 -0800 +Subject: pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP + +From: Stephen Boyd + +[ Upstream commit e6b842741b4f39007215fd7e545cb55aa3d358a2 ] + +An oops can be induced by running 'cat /proc/kcore > /dev/null' on +devices using pstore with the ram backend because kmap_atomic() assumes +lowmem pages are accessible with __va(). + + Unable to handle kernel paging request at virtual address ffffff807ff2b000 + Mem abort info: + ESR = 0x96000006 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x06: level 2 translation fault + Data abort info: + ISV = 0, ISS = 0x00000006 + CM = 0, WnR = 0 + swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081d87000 + [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003, pmd=0000000000000000 + Internal error: Oops: 96000006 [#1] PREEMPT SMP + Modules linked in: dm_integrity + CPU: 7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1 baa443fb8e8477896a370b31a821eb2009f9bfba + Hardware name: Google Lazor (rev3 - 8) (DT) + pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : __memcpy+0x110/0x260 + lr : vread+0x194/0x294 + sp : ffffffc013ee39d0 + x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000 + x26: 0000000000001000 x25: ffffffc0085a2000 x24: ffffff802d4b3000 + x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21: ffffffc0085a2000 + x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000 + x17: 0000000000000000 x16: 0000000000000000 x15: ffffffd3073f2e60 + x14: ffffffffad588000 x13: 0000000000000000 x12: 0000000000000001 + x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b + x8 : 0000000000000001 x7 : 0000000000000000 x6 : 0000000000000000 + x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 : ffffffc013ee3a78 + x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000 + Call trace: + __memcpy+0x110/0x260 + read_kcore+0x584/0x778 + proc_reg_read+0xb4/0xe4 + +During early boot, memblock reserves the pages for the ramoops reserved +memory node in DT that would otherwise be part of the direct lowmem +mapping. Pstore's ram backend reuses those reserved pages to change the +memory type (writeback or non-cached) by passing the pages to vmap() +(see pfn_to_page() usage in persistent_ram_vmap() for more details) with +specific flags. When read_kcore() starts iterating over the vmalloc +region, it runs over the virtual address that vmap() returned for +ramoops. In aligned_vread() the virtual address is passed to +vmalloc_to_page() which returns the page struct for the reserved lowmem +area. That lowmem page is passed to kmap_atomic(), which effectively +calls page_to_virt() that assumes a lowmem page struct must be directly +accessible with __va() and friends. These pages are mapped via vmap() +though, and the lowmem mapping was never made, so accessing them via the +lowmem virtual address oopses like above. + +Let's side-step this problem by passing VM_IOREMAP to vmap(). This will +tell vread() to not include the ramoops region in the kcore. Instead the +area will look like a bunch of zeros. The alternative is to teach kmap() +about vmalloc areas that intersect with lowmem. Presumably such a change +isn't a one-liner, and there isn't much interest in inspecting the +ramoops region in kcore files anyway, so the most expedient route is +taken for now. + +Cc: Brian Geffon +Cc: Mike Rapoport +Cc: Andrew Morton +Fixes: 404a6043385d ("staging: android: persistent_ram: handle reserving and mapping memory") +Signed-off-by: Stephen Boyd +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20221205233136.3420802-1-swboyd@chromium.org +Signed-off-by: Sasha Levin +--- + fs/pstore/ram_core.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index 3c777ec80d47..60dff7180412 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -426,7 +426,11 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + phys_addr_t addr = page_start + i * PAGE_SIZE; + pages[i] = pfn_to_page(addr >> PAGE_SHIFT); + } +- vaddr = vmap(pages, page_count, VM_MAP, prot); ++ /* ++ * VM_IOREMAP used here to bypass this region during vread() ++ * and kmap_atomic() (i.e. kcore) to avoid __va() failures. ++ */ ++ vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); + kfree(pages); + + /* +-- +2.35.1 + diff --git a/queue-4.19/pstore-ram-fix-error-return-code-in-ramoops_probe.patch b/queue-4.19/pstore-ram-fix-error-return-code-in-ramoops_probe.patch new file mode 100644 index 00000000000..00e551e418a --- /dev/null +++ b/queue-4.19/pstore-ram-fix-error-return-code-in-ramoops_probe.patch @@ -0,0 +1,45 @@ +From f1eddf0db34eb1e251eff8614c36ef7d2830bc4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 16:22:54 +0800 +Subject: pstore/ram: Fix error return code in ramoops_probe() + +From: Wang Yufen + +[ Upstream commit e1fce564900f8734edf15b87f028c57e14f6e28d ] + +In the if (dev_of_node(dev) && !pdata) path, the "err" may be assigned a +value of 0, so the error return code -EINVAL may be incorrectly set +to 0. To fix set valid return code before calling to goto. + +Fixes: 35da60941e44 ("pstore/ram: add Device Tree bindings") +Signed-off-by: Wang Yufen +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/1669969374-46582-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Sasha Levin +--- + fs/pstore/ram.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index bafbab2dd039..33294dee7d7f 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -753,6 +753,7 @@ static int ramoops_probe(struct platform_device *pdev) + /* Make sure we didn't get bogus platform data pointer. */ + if (!pdata) { + pr_err("NULL platform data\n"); ++ err = -EINVAL; + goto fail_out; + } + +@@ -760,6 +761,7 @@ static int ramoops_probe(struct platform_device *pdev) + !pdata->ftrace_size && !pdata->pmsg_size)) { + pr_err("The memory size and the record/console size must be " + "non-zero\n"); ++ err = -EINVAL; + goto fail_out; + } + +-- +2.35.1 + diff --git a/queue-4.19/r6040-fix-kmemleak-in-probe-and-remove.patch b/queue-4.19/r6040-fix-kmemleak-in-probe-and-remove.patch new file mode 100644 index 00000000000..8ed3857436e --- /dev/null +++ b/queue-4.19/r6040-fix-kmemleak-in-probe-and-remove.patch @@ -0,0 +1,96 @@ +From eb7c4b634559d65c662ed5b52a1a546b7e2af450 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Dec 2022 20:56:14 +0800 +Subject: r6040: Fix kmemleak in probe and remove + +From: Li Zetao + +[ Upstream commit 7e43039a49c2da45edc1d9d7c9ede4003ab45a5f ] + +There is a memory leaks reported by kmemleak: + + unreferenced object 0xffff888116111000 (size 2048): + comm "modprobe", pid 817, jiffies 4294759745 (age 76.502s) + hex dump (first 32 bytes): + 00 c4 0a 04 81 88 ff ff 08 10 11 16 81 88 ff ff ................ + 08 10 11 16 81 88 ff ff 00 00 00 00 00 00 00 00 ................ + backtrace: + [] kmalloc_trace+0x22/0x60 + [] phy_device_create+0x4e/0x90 + [] get_phy_device+0xd2/0x220 + [] mdiobus_scan+0xa4/0x2e0 + [] __mdiobus_register+0x482/0x8b0 + [] r6040_init_one+0x714/0xd2c [r6040] + ... + +The problem occurs in probe process as follows: + r6040_init_one: + mdiobus_register + mdiobus_scan <- alloc and register phy_device, + the reference count of phy_device is 3 + r6040_mii_probe + phy_connect <- connect to the first phy_device, + so the reference count of the first + phy_device is 4, others are 3 + register_netdev <- fault inject succeeded, goto error handling path + + // error handling path + err_out_mdio_unregister: + mdiobus_unregister(lp->mii_bus); + err_out_mdio: + mdiobus_free(lp->mii_bus); <- the reference count of the first + phy_device is 1, it is not released + and other phy_devices are released + // similarly, the remove process also has the same problem + +The root cause is traced to the phy_device is not disconnected when +removes one r6040 device in r6040_remove_one() or on error handling path +after r6040_mii probed successfully. In r6040_mii_probe(), a net ethernet +device is connected to the first PHY device of mii_bus, in order to +notify the connected driver when the link status changes, which is the +default behavior of the PHY infrastructure to handle everything. +Therefore the phy_device should be disconnected when removes one r6040 +device or on error handling path. + +Fix it by adding phy_disconnect() when removes one r6040 device or on +error handling path after r6040_mii probed successfully. + +Fixes: 3831861b4ad8 ("r6040: implement phylib") +Signed-off-by: Li Zetao +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20221213125614.927754-1-lizetao1@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/rdc/r6040.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/rdc/r6040.c b/drivers/net/ethernet/rdc/r6040.c +index 2199bd08f4d6..e377c1f68777 100644 +--- a/drivers/net/ethernet/rdc/r6040.c ++++ b/drivers/net/ethernet/rdc/r6040.c +@@ -1184,10 +1184,12 @@ static int r6040_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + err = register_netdev(dev); + if (err) { + dev_err(&pdev->dev, "Failed to register net device\n"); +- goto err_out_mdio_unregister; ++ goto err_out_phy_disconnect; + } + return 0; + ++err_out_phy_disconnect: ++ phy_disconnect(dev->phydev); + err_out_mdio_unregister: + mdiobus_unregister(lp->mii_bus); + err_out_mdio: +@@ -1211,6 +1213,7 @@ static void r6040_remove_one(struct pci_dev *pdev) + struct r6040_private *lp = netdev_priv(dev); + + unregister_netdev(dev); ++ phy_disconnect(dev->phydev); + mdiobus_unregister(lp->mii_bus); + mdiobus_free(lp->mii_bus); + netif_napi_del(&lp->napi); +-- +2.35.1 + diff --git a/queue-4.19/rapidio-devices-fix-missing-put_device-in-mport_cdev.patch b/queue-4.19/rapidio-devices-fix-missing-put_device-in-mport_cdev.patch new file mode 100644 index 00000000000..fe80ac0b2da --- /dev/null +++ b/queue-4.19/rapidio-devices-fix-missing-put_device-in-mport_cdev.patch @@ -0,0 +1,44 @@ +From 738e280680cb58e75690ad06cfcb47f56cd2c217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Dec 2022 08:57:21 +0000 +Subject: rapidio: devices: fix missing put_device in mport_cdev_open + +From: Cai Xinchen + +[ Upstream commit d5b6e6eba3af11cb2a2791fa36a2524990fcde1a ] + +When kfifo_alloc fails, the refcount of chdev->dev is left incremental. +We should use put_device(&chdev->dev) to decrease the ref count of +chdev->dev to avoid refcount leak. + +Link: https://lkml.kernel.org/r/20221203085721.13146-1-caixinchen1@huawei.com +Fixes: e8de370188d0 ("rapidio: add mport char device driver") +Signed-off-by: Cai Xinchen +Cc: Alexandre Bounine +Cc: Dan Carpenter +Cc: Jakob Koschel +Cc: John Hubbard +Cc: Matt Porter +Cc: Wang Weiyang +Cc: Yang Yingliang +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/rapidio/devices/rio_mport_cdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c +index 1f4114b23f5a..ee19c511adce 100644 +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -1917,6 +1917,7 @@ static int mport_cdev_open(struct inode *inode, struct file *filp) + sizeof(struct rio_event) * MPORT_EVENT_DEPTH, + GFP_KERNEL); + if (ret < 0) { ++ put_device(&chdev->dev); + dev_err(&chdev->dev, DRV_NAME ": kfifo_alloc failed\n"); + ret = -ENOMEM; + goto err_fifo; +-- +2.35.1 + diff --git a/queue-4.19/rapidio-fix-possible-name-leaks-when-rio_add_device-.patch b/queue-4.19/rapidio-fix-possible-name-leaks-when-rio_add_device-.patch new file mode 100644 index 00000000000..4c929dce06a --- /dev/null +++ b/queue-4.19/rapidio-fix-possible-name-leaks-when-rio_add_device-.patch @@ -0,0 +1,76 @@ +From 700ce2e1e88540acd5a96299358d5e69c6b889ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 23:26:35 +0800 +Subject: rapidio: fix possible name leaks when rio_add_device() fails + +From: Yang Yingliang + +[ Upstream commit f9574cd48679926e2a569e1957a5a1bcc8a719ac ] + +Patch series "rapidio: fix three possible memory leaks". + +This patchset fixes three name leaks in error handling. + - patch #1 fixes two name leaks while rio_add_device() fails. + - patch #2 fixes a name leak while rio_register_mport() fails. + +This patch (of 2): + +If rio_add_device() returns error, the name allocated by dev_set_name() +need be freed. It should use put_device() to give up the reference in the +error path, so that the name can be freed in kobject_cleanup(), and the +'rdev' can be freed in rio_release_dev(). + +Link: https://lkml.kernel.org/r/20221114152636.2939035-1-yangyingliang@huawei.com +Link: https://lkml.kernel.org/r/20221114152636.2939035-2-yangyingliang@huawei.com +Fixes: e8de370188d0 ("rapidio: add mport char device driver") +Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") +Signed-off-by: Yang Yingliang +Cc: Alexandre Bounine +Cc: Matt Porter +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/rapidio/devices/rio_mport_cdev.c | 7 +++++-- + drivers/rapidio/rio-scan.c | 8 ++++++-- + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c +index a136a7ae7714..01eb1a594ce6 100644 +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -1809,8 +1809,11 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, + rio_init_dbell_res(&rdev->riores[RIO_DOORBELL_RESOURCE], + 0, 0xffff); + err = rio_add_device(rdev); +- if (err) +- goto cleanup; ++ if (err) { ++ put_device(&rdev->dev); ++ return err; ++ } ++ + rio_dev_get(rdev); + + return 0; +diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c +index fd7b517132ac..d2ddc173c5bd 100644 +--- a/drivers/rapidio/rio-scan.c ++++ b/drivers/rapidio/rio-scan.c +@@ -460,8 +460,12 @@ static struct rio_dev *rio_setup_device(struct rio_net *net, + 0, 0xffff); + + ret = rio_add_device(rdev); +- if (ret) +- goto cleanup; ++ if (ret) { ++ if (rswitch) ++ kfree(rswitch->route_table); ++ put_device(&rdev->dev); ++ return NULL; ++ } + + rio_dev_get(rdev); + +-- +2.35.1 + diff --git a/queue-4.19/rapidio-fix-possible-uaf-when-kfifo_alloc-fails.patch b/queue-4.19/rapidio-fix-possible-uaf-when-kfifo_alloc-fails.patch new file mode 100644 index 00000000000..03551e46ff3 --- /dev/null +++ b/queue-4.19/rapidio-fix-possible-uaf-when-kfifo_alloc-fails.patch @@ -0,0 +1,58 @@ +From e96f314af91d1a088a67edba79dd216510cbd366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 17:51:47 +0800 +Subject: rapidio: fix possible UAF when kfifo_alloc() fails + +From: Wang Weiyang + +[ Upstream commit 02d7d89f816951e0862147d751b1150d67aaebdd ] + +If kfifo_alloc() fails in mport_cdev_open(), goto err_fifo and just free +priv. But priv is still in the chdev->file_list, then list traversal +may cause UAF. This fixes the following smatch warning: + +drivers/rapidio/devices/rio_mport_cdev.c:1930 mport_cdev_open() warn: '&priv->list' not removed from list + +Link: https://lkml.kernel.org/r/20221123095147.52408-1-wangweiyang2@huawei.com +Fixes: e8de370188d0 ("rapidio: add mport char device driver") +Signed-off-by: Wang Weiyang +Cc: Alexandre Bounine +Cc: Dan Carpenter +Cc: Jakob Koschel +Cc: John Hubbard +Cc: Matt Porter +Cc: Yang Yingliang +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/rapidio/devices/rio_mport_cdev.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c +index 01eb1a594ce6..1f4114b23f5a 100644 +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -1909,10 +1909,6 @@ static int mport_cdev_open(struct inode *inode, struct file *filp) + + priv->md = chdev; + +- mutex_lock(&chdev->file_mutex); +- list_add_tail(&priv->list, &chdev->file_list); +- mutex_unlock(&chdev->file_mutex); +- + INIT_LIST_HEAD(&priv->db_filters); + INIT_LIST_HEAD(&priv->pw_filters); + spin_lock_init(&priv->fifo_lock); +@@ -1931,6 +1927,9 @@ static int mport_cdev_open(struct inode *inode, struct file *filp) + spin_lock_init(&priv->req_lock); + mutex_init(&priv->dma_lock); + #endif ++ mutex_lock(&chdev->file_mutex); ++ list_add_tail(&priv->list, &chdev->file_list); ++ mutex_unlock(&chdev->file_mutex); + + filp->private_data = priv; + goto out; +-- +2.35.1 + diff --git a/queue-4.19/rapidio-rio-fix-possible-name-leak-in-rio_register_m.patch b/queue-4.19/rapidio-rio-fix-possible-name-leak-in-rio_register_m.patch new file mode 100644 index 00000000000..c81c7516a7c --- /dev/null +++ b/queue-4.19/rapidio-rio-fix-possible-name-leak-in-rio_register_m.patch @@ -0,0 +1,51 @@ +From 11769689c270478168b5d9c12c8d47042364a23a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 23:26:36 +0800 +Subject: rapidio: rio: fix possible name leak in rio_register_mport() + +From: Yang Yingliang + +[ Upstream commit e92a216d16bde65d21a3227e0fb2aa0794576525 ] + +If device_register() returns error, the name allocated by dev_set_name() +need be freed. It should use put_device() to give up the reference in the +error path, so that the name can be freed in kobject_cleanup(), and +list_del() is called to delete the port from rio_mports. + +Link: https://lkml.kernel.org/r/20221114152636.2939035-3-yangyingliang@huawei.com +Fixes: 2aaf308b95b2 ("rapidio: rework device hierarchy and introduce mport class of devices") +Signed-off-by: Yang Yingliang +Cc: Alexandre Bounine +Cc: Matt Porter +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + drivers/rapidio/rio.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c +index 83406696c7aa..4304142d8700 100644 +--- a/drivers/rapidio/rio.c ++++ b/drivers/rapidio/rio.c +@@ -2271,11 +2271,16 @@ int rio_register_mport(struct rio_mport *port) + atomic_set(&port->state, RIO_DEVICE_RUNNING); + + res = device_register(&port->dev); +- if (res) ++ if (res) { + dev_err(&port->dev, "RIO: mport%d registration failed ERR=%d\n", + port->id, res); +- else ++ mutex_lock(&rio_mport_list_lock); ++ list_del(&port->node); ++ mutex_unlock(&rio_mport_list_lock); ++ put_device(&port->dev); ++ } else { + dev_dbg(&port->dev, "RIO: registered mport%d\n", port->id); ++ } + + return res; + } +-- +2.35.1 + diff --git a/queue-4.19/rdma-hfi-decrease-pci-device-reference-count-in-erro.patch b/queue-4.19/rdma-hfi-decrease-pci-device-reference-count-in-erro.patch new file mode 100644 index 00000000000..2b8b4bf014e --- /dev/null +++ b/queue-4.19/rdma-hfi-decrease-pci-device-reference-count-in-erro.patch @@ -0,0 +1,42 @@ +From 93713394afeb409824ccaaa5c4490a8bca194f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 21:15:46 +0800 +Subject: RDMA/hfi: Decrease PCI device reference count in error path + +From: Xiongfeng Wang + +[ Upstream commit 9b51d072da1d27e1193e84708201c48e385ad912 ] + +pci_get_device() will increase the reference count for the returned +pci_dev, and also decrease the reference count for the input parameter +*from* if it is not NULL. + +If we break out the loop in node_affinity_init() with 'dev' not NULL, we +need to call pci_dev_put() to decrease the reference count. Add missing +pci_dev_put() in error path. + +Fixes: c513de490f80 ("IB/hfi1: Invalid NUMA node information can cause a divide by zero") +Signed-off-by: Xiongfeng Wang +Link: https://lore.kernel.org/r/20221117131546.113280-1-wangxiongfeng2@huawei.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/affinity.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c +index 01ed0a667928..bb670249bebf 100644 +--- a/drivers/infiniband/hw/hfi1/affinity.c ++++ b/drivers/infiniband/hw/hfi1/affinity.c +@@ -217,6 +217,8 @@ int node_affinity_init(void) + for (node = 0; node < node_affinity.num_possible_nodes; node++) + hfi1_per_node_cntr[node] = 1; + ++ pci_dev_put(dev); ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-4.19/rdma-hfi1-fix-error-return-code-in-parse_platform_co.patch b/queue-4.19/rdma-hfi1-fix-error-return-code-in-parse_platform_co.patch new file mode 100644 index 00000000000..2287752880a --- /dev/null +++ b/queue-4.19/rdma-hfi1-fix-error-return-code-in-parse_platform_co.patch @@ -0,0 +1,78 @@ +From e7308b93db625f4cd8e48b7a92b841354bb1c34e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 12:00:37 +0800 +Subject: RDMA/hfi1: Fix error return code in parse_platform_config() + +From: Wang Yufen + +[ Upstream commit 725349f8ba1e78a146c6ff8f3ee5e2712e517106 ] + +In the previous iteration of the while loop, the "ret" may have been +assigned a value of 0, so the error return code -EINVAL may have been +incorrectly set to 0. To fix set valid return code before calling to +goto. + +Fixes: 97167e813415 ("staging/rdma/hfi1: Tune for unknown channel if configuration file is absent") +Signed-off-by: Wang Yufen +Link: https://lore.kernel.org/r/1669953638-11747-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/firmware.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/infiniband/hw/hfi1/firmware.c b/drivers/infiniband/hw/hfi1/firmware.c +index c09080712485..747ec08dec0d 100644 +--- a/drivers/infiniband/hw/hfi1/firmware.c ++++ b/drivers/infiniband/hw/hfi1/firmware.c +@@ -1786,6 +1786,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + + if (!dd->platform_config.data) { + dd_dev_err(dd, "%s: Missing config file\n", __func__); ++ ret = -EINVAL; + goto bail; + } + ptr = (u32 *)dd->platform_config.data; +@@ -1794,6 +1795,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + ptr++; + if (magic_num != PLATFORM_CONFIG_MAGIC_NUM) { + dd_dev_err(dd, "%s: Bad config file\n", __func__); ++ ret = -EINVAL; + goto bail; + } + +@@ -1817,6 +1819,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + if (file_length > dd->platform_config.size) { + dd_dev_info(dd, "%s:File claims to be larger than read size\n", + __func__); ++ ret = -EINVAL; + goto bail; + } else if (file_length < dd->platform_config.size) { + dd_dev_info(dd, +@@ -1837,6 +1840,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + dd_dev_err(dd, "%s: Failed validation at offset %ld\n", + __func__, (ptr - (u32 *) + dd->platform_config.data)); ++ ret = -EINVAL; + goto bail; + } + +@@ -1883,6 +1887,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + __func__, table_type, + (ptr - (u32 *) + dd->platform_config.data)); ++ ret = -EINVAL; + goto bail; /* We don't trust this file now */ + } + pcfgcache->config_tables[table_type].table = ptr; +@@ -1907,6 +1912,7 @@ int parse_platform_config(struct hfi1_devdata *dd) + __func__, table_type, + (ptr - + (u32 *)dd->platform_config.data)); ++ ret = -EINVAL; + goto bail; /* We don't trust this file now */ + } + pcfgcache->config_tables[table_type].table_metadata = +-- +2.35.1 + diff --git a/queue-4.19/rdma-nldev-return-eagain-if-the-cm_id-isn-t-from-exp.patch b/queue-4.19/rdma-nldev-return-eagain-if-the-cm_id-isn-t-from-exp.patch new file mode 100644 index 00000000000..1a92c6f9e5c --- /dev/null +++ b/queue-4.19/rdma-nldev-return-eagain-if-the-cm_id-isn-t-from-exp.patch @@ -0,0 +1,51 @@ +From d1c5923764998db9cdf3e8ba28c73af6da7b6f70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Nov 2022 10:51:36 +0200 +Subject: RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port + +From: Mark Zhang + +[ Upstream commit ecacb3751f254572af0009b9501e2cdc83a30b6a ] + +When filling a cm_id entry, return "-EAGAIN" instead of 0 if the cm_id +doesn'the have the same port as requested, otherwise an incomplete entry +may be returned, which causes "rdam res show cm_id" to return an error. + +For example on a machine with two rdma devices with "rping -C 1 -v -s" +running background, the "rdma" command fails: + $ rdma -V + rdma utility, iproute2-5.19.0 + $ rdma res show cm_id + link mlx5_0/- cm-idn 0 state LISTEN ps TCP pid 28056 comm rping src-addr 0.0.0.0:7174 + error: Protocol not available + +While with this fix it succeeds: + $ rdma res show cm_id + link mlx5_0/- cm-idn 0 state LISTEN ps TCP pid 26395 comm rping src-addr 0.0.0.0:7174 + link mlx5_1/- cm-idn 0 state LISTEN ps TCP pid 26395 comm rping src-addr 0.0.0.0:7174 + +Fixes: 00313983cda6 ("RDMA/nldev: provide detailed CM_ID information") +Signed-off-by: Mark Zhang +Link: https://lore.kernel.org/r/a08e898cdac5e28428eb749a99d9d981571b8ea7.1667810736.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/nldev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c +index f6fa9b115fda..798bc810b234 100644 +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -433,7 +433,7 @@ static int fill_res_cm_id_entry(struct sk_buff *msg, + struct nlattr *entry_attr; + + if (port && port != cm_id->port_num) +- return 0; ++ return -EAGAIN; + + entry_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_RES_CM_ID_ENTRY); + if (!entry_attr) +-- +2.35.1 + diff --git a/queue-4.19/rdma-rxe-fix-null-ptr-deref-in-rxe_qp_do_cleanup-whe.patch b/queue-4.19/rdma-rxe-fix-null-ptr-deref-in-rxe_qp_do_cleanup-whe.patch new file mode 100644 index 00000000000..0ea61ddb832 --- /dev/null +++ b/queue-4.19/rdma-rxe-fix-null-ptr-deref-in-rxe_qp_do_cleanup-whe.patch @@ -0,0 +1,78 @@ +From b551a61e39c53a02dd8f25f40a952befa42dba50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 23:14:37 +0800 +Subject: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket + create failed + +From: Zhang Xiaoxu + +[ Upstream commit f67376d801499f4fa0838c18c1efcad8840e550d ] + +There is a null-ptr-deref when mount.cifs over rdma: + + BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] + Read of size 8 at addr 0000000000000018 by task mount.cifs/3046 + + CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3 + Call Trace: + + dump_stack_lvl+0x34/0x44 + kasan_report+0xad/0x130 + rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] + execute_in_process_context+0x25/0x90 + __rxe_cleanup+0x101/0x1d0 [rdma_rxe] + rxe_create_qp+0x16a/0x180 [rdma_rxe] + create_qp.part.0+0x27d/0x340 + ib_create_qp_kernel+0x73/0x160 + rdma_create_qp+0x100/0x230 + _smbd_get_connection+0x752/0x20f0 + smbd_get_connection+0x21/0x40 + cifs_get_tcp_session+0x8ef/0xda0 + mount_get_conns+0x60/0x750 + cifs_mount+0x103/0xd00 + cifs_smb3_do_mount+0x1dd/0xcb0 + smb3_get_tree+0x1d5/0x300 + vfs_get_tree+0x41/0xf0 + path_mount+0x9b3/0xdd0 + __x64_sys_mount+0x190/0x1d0 + do_syscall_64+0x35/0x80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +The root cause of the issue is the socket create failed in +rxe_qp_init_req(). + +So move the reset rxe_qp_do_cleanup() after the NULL ptr check. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20221122151437.1057671-1-zhangxiaoxu5@huawei.com +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index 6320390f531c..2cae62ae6c64 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -836,12 +836,12 @@ static void rxe_qp_do_cleanup(struct work_struct *work) + qp->resp.mr = NULL; + } + +- if (qp_type(qp) == IB_QPT_RC) +- sk_dst_reset(qp->sk->sk); +- + free_rd_atomic_resources(qp); + + if (qp->sk) { ++ if (qp_type(qp) == IB_QPT_RC) ++ sk_dst_reset(qp->sk->sk); ++ + kernel_sock_shutdown(qp->sk, SHUT_RDWR); + sock_release(qp->sk); + } +-- +2.35.1 + diff --git a/queue-4.19/regulator-core-fix-module-refcount-leak-in-set_suppl.patch b/queue-4.19/regulator-core-fix-module-refcount-leak-in-set_suppl.patch new file mode 100644 index 00000000000..b80fa7ebb13 --- /dev/null +++ b/queue-4.19/regulator-core-fix-module-refcount-leak-in-set_suppl.patch @@ -0,0 +1,36 @@ +From 46996dd5767243e083d2d63db3d4588fcdc7ecac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 20:27:05 +0800 +Subject: regulator: core: fix module refcount leak in set_supply() + +From: Yang Yingliang + +[ Upstream commit da46ee19cbd8344d6860816b4827a7ce95764867 ] + +If create_regulator() fails in set_supply(), the module refcount +needs be put to keep refcount balanced. + +Fixes: e2c09ae7a74d ("regulator: core: Increase refcount for regulator supply's module") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221201122706.4055992-2-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 07982143ec18..9cf438a37eeb 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1241,6 +1241,7 @@ static int set_supply(struct regulator_dev *rdev, + + rdev->supply = create_regulator(supply_rdev, &rdev->dev, "SUPPLY"); + if (rdev->supply == NULL) { ++ module_put(supply_rdev->owner); + err = -ENOMEM; + return err; + } +-- +2.35.1 + diff --git a/queue-4.19/regulator-core-fix-unbalanced-of-node-refcount-in-re.patch b/queue-4.19/regulator-core-fix-unbalanced-of-node-refcount-in-re.patch new file mode 100644 index 00000000000..798788b1988 --- /dev/null +++ b/queue-4.19/regulator-core-fix-unbalanced-of-node-refcount-in-re.patch @@ -0,0 +1,43 @@ +From 99839c6b741c7357dd28324bb108ad137deb8ac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 17:15:08 +0800 +Subject: regulator: core: fix unbalanced of node refcount in + regulator_dev_lookup() + +From: Yang Yingliang + +[ Upstream commit f2b41b748c19962b82709d9f23c6b2b0ce9d2f91 ] + +I got the the following report: + + OF: ERROR: memory leak, expected refcount 1 instead of 2, + of_node_get()/of_node_put() unbalanced - destroy cset entry: + attach overlay node /i2c/pmic@62/regulators/exten + +In of_get_regulator(), the node is returned from of_parse_phandle() +with refcount incremented, after using it, of_node_put() need be called. + +Fixes: 69511a452e6d ("regulator: map consumer regulator based on device tree") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221115091508.900752-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 045075cd256c..07982143ec18 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1541,6 +1541,7 @@ static struct regulator_dev *regulator_dev_lookup(struct device *dev, + node = of_get_regulator(dev, supply); + if (node) { + r = of_find_regulator_by_node(node); ++ of_node_put(node); + if (r) + return r; + +-- +2.35.1 + diff --git a/queue-4.19/regulator-core-fix-use_count-leakage-when-handling-b.patch b/queue-4.19/regulator-core-fix-use_count-leakage-when-handling-b.patch new file mode 100644 index 00000000000..dc56df6822b --- /dev/null +++ b/queue-4.19/regulator-core-fix-use_count-leakage-when-handling-b.patch @@ -0,0 +1,62 @@ +From 3d33e14fd3cc61b1d0b1156eea423b548678c700 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 11:38:06 +0800 +Subject: regulator: core: fix use_count leakage when handling boot-on +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rui Zhang + +[ Upstream commit 0591b14ce0398125439c759f889647369aa616a0 ] + +I found a use_count leakage towards supply regulator of rdev with +boot-on option. + +┌───────────────────┐ ┌───────────────────┐ +│ regulator_dev A │ │ regulator_dev B │ +│ (boot-on) │ │ (boot-on) │ +│ use_count=0 │◀──supply──│ use_count=1 │ +│ │ │ │ +└───────────────────┘ └───────────────────┘ + +In case of rdev(A) configured with `regulator-boot-on', the use_count +of supplying regulator(B) will increment inside +regulator_enable(rdev->supply). + +Thus, B will acts like always-on, and further balanced +regulator_enable/disable cannot actually disable it anymore. + +However, B was also configured with `regulator-boot-on', we wish it +could be disabled afterwards. + +Signed-off-by: Rui Zhang +Link: https://lore.kernel.org/r/20221201033806.2567812-1-zr.zhang@vivo.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 9cf438a37eeb..11656b383674 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -1197,7 +1197,13 @@ static int set_machine_constraints(struct regulator_dev *rdev) + if (rdev->supply_name && !rdev->supply) + return -EPROBE_DEFER; + +- if (rdev->supply) { ++ /* If supplying regulator has already been enabled, ++ * it's not intended to have use_count increment ++ * when rdev is only boot-on. ++ */ ++ if (rdev->supply && ++ (rdev->constraints->always_on || ++ !regulator_is_enabled(rdev->supply))) { + ret = regulator_enable(rdev->supply); + if (ret < 0) { + _regulator_put(rdev->supply); +-- +2.35.1 + diff --git a/queue-4.19/relay-fix-type-mismatch-when-allocating-memory-in-re.patch b/queue-4.19/relay-fix-type-mismatch-when-allocating-memory-in-re.patch new file mode 100644 index 00000000000..1c996a32966 --- /dev/null +++ b/queue-4.19/relay-fix-type-mismatch-when-allocating-memory-in-re.patch @@ -0,0 +1,49 @@ +From da282125ac5280c219ef274f42a2c0905f721304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 09:23:38 +0000 +Subject: relay: fix type mismatch when allocating memory in relay_create_buf() + +From: Gavrilov Ilia + +[ Upstream commit 4d8586e04602fe42f0a782d2005956f8b6302678 ] + +The 'padding' field of the 'rchan_buf' structure is an array of 'size_t' +elements, but the memory is allocated for an array of 'size_t *' elements. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Link: https://lkml.kernel.org/r/20221129092002.3538384-1-Ilia.Gavrilov@infotecs.ru +Fixes: b86ff981a825 ("[PATCH] relay: migrate from relayfs to a generic relay API") +Signed-off-by: Ilia.Gavrilov +Cc: Colin Ian King +Cc: Jens Axboe +Cc: wuchi +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + kernel/relay.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/relay.c b/kernel/relay.c +index 735cb208f023..b7aa7df43955 100644 +--- a/kernel/relay.c ++++ b/kernel/relay.c +@@ -163,13 +163,13 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan) + { + struct rchan_buf *buf; + +- if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *)) ++ if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t)) + return NULL; + + buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL); + if (!buf) + return NULL; +- buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t *), ++ buf->padding = kmalloc_array(chan->n_subbufs, sizeof(size_t), + GFP_KERNEL); + if (!buf->padding) + goto free_buf; +-- +2.35.1 + diff --git a/queue-4.19/remoteproc-qcom-rename-hexagon-v5-pas-driver.patch b/queue-4.19/remoteproc-qcom-rename-hexagon-v5-pas-driver.patch new file mode 100644 index 00000000000..7a1ba500a78 --- /dev/null +++ b/queue-4.19/remoteproc-qcom-rename-hexagon-v5-pas-driver.patch @@ -0,0 +1,116 @@ +From dbbbd171e7a6f4e4353983be393c2b05d6c3bb59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Sep 2018 16:45:25 -0700 +Subject: remoteproc: qcom: Rename Hexagon v5 PAS driver + +From: Bjorn Andersson + +[ Upstream commit 9e004f97161d637d2dc82299be494bcfd07043bb ] + +The Hexagon v5 ADSP driver is used for more than only the ADSP and +there's an upcoming non-PAS ADSP PIL for SDM845, so rename the driver to +qcom_q6v5_pas in order to better suite this. + +Cc: Rohit kumar +Reviewed-by: Niklas Cassel +Signed-off-by: Bjorn Andersson +Stable-dep-of: 38e7d9c19276 ("remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()") +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/Kconfig | 27 ++++++++++--------- + drivers/remoteproc/Makefile | 2 +- + .../{qcom_adsp_pil.c => qcom_q6v5_pas.c} | 4 +-- + 3 files changed, 17 insertions(+), 16 deletions(-) + rename drivers/remoteproc/{qcom_adsp_pil.c => qcom_q6v5_pas.c} (98%) + +diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig +index 052d4dd347f9..425e502c6471 100644 +--- a/drivers/remoteproc/Kconfig ++++ b/drivers/remoteproc/Kconfig +@@ -84,8 +84,16 @@ config KEYSTONE_REMOTEPROC + It's safe to say N here if you're not interested in the Keystone + DSPs or just want to use a bare minimum kernel. + +-config QCOM_ADSP_PIL +- tristate "Qualcomm ADSP Peripheral Image Loader" ++config QCOM_RPROC_COMMON ++ tristate ++ ++config QCOM_Q6V5_COMMON ++ tristate ++ depends on ARCH_QCOM ++ depends on QCOM_SMEM ++ ++config QCOM_Q6V5_PAS ++ tristate "Qualcomm Hexagon v5 Peripheral Authentication Service support" + depends on OF && ARCH_QCOM + depends on QCOM_SMEM + depends on RPMSG_QCOM_SMD || (COMPILE_TEST && RPMSG_QCOM_SMD=n) +@@ -98,15 +106,7 @@ config QCOM_ADSP_PIL + select QCOM_SCM + help + Say y here to support the TrustZone based Peripherial Image Loader +- for the Qualcomm ADSP remote processors. +- +-config QCOM_RPROC_COMMON +- tristate +- +-config QCOM_Q6V5_COMMON +- tristate +- depends on ARCH_QCOM +- depends on QCOM_SMEM ++ for the Qualcomm Hexagon v5 based remote processors. + + config QCOM_Q6V5_PIL + tristate "Qualcomm Hexagon V5 Peripherial Image Loader" +@@ -120,8 +120,9 @@ config QCOM_Q6V5_PIL + select QCOM_RPROC_COMMON + select QCOM_SCM + help +- Say y here to support the Qualcomm Peripherial Image Loader for the +- Hexagon V5 based remote processors. ++ Say y here to support the TrustZone based Peripherial Image Loader ++ for the Qualcomm Hexagon v5 based remote processors. This is commonly ++ used to control subsystems such as ADSP, Compute and Sensor. + + config QCOM_Q6V5_WCSS + tristate "Qualcomm Hexagon based WCSS Peripheral Image Loader" +diff --git a/drivers/remoteproc/Makefile b/drivers/remoteproc/Makefile +index 03332fa7e2ee..eb86c8ba5a87 100644 +--- a/drivers/remoteproc/Makefile ++++ b/drivers/remoteproc/Makefile +@@ -14,9 +14,9 @@ obj-$(CONFIG_OMAP_REMOTEPROC) += omap_remoteproc.o + obj-$(CONFIG_WKUP_M3_RPROC) += wkup_m3_rproc.o + obj-$(CONFIG_DA8XX_REMOTEPROC) += da8xx_remoteproc.o + obj-$(CONFIG_KEYSTONE_REMOTEPROC) += keystone_remoteproc.o +-obj-$(CONFIG_QCOM_ADSP_PIL) += qcom_adsp_pil.o + obj-$(CONFIG_QCOM_RPROC_COMMON) += qcom_common.o + obj-$(CONFIG_QCOM_Q6V5_COMMON) += qcom_q6v5.o ++obj-$(CONFIG_QCOM_Q6V5_PAS) += qcom_q6v5_pas.o + obj-$(CONFIG_QCOM_Q6V5_PIL) += qcom_q6v5_pil.o + obj-$(CONFIG_QCOM_Q6V5_WCSS) += qcom_q6v5_wcss.o + obj-$(CONFIG_QCOM_SYSMON) += qcom_sysmon.o +diff --git a/drivers/remoteproc/qcom_adsp_pil.c b/drivers/remoteproc/qcom_q6v5_pas.c +similarity index 98% +rename from drivers/remoteproc/qcom_adsp_pil.c +rename to drivers/remoteproc/qcom_q6v5_pas.c +index d4339a6da616..2478ef3cd519 100644 +--- a/drivers/remoteproc/qcom_adsp_pil.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -364,11 +364,11 @@ static struct platform_driver adsp_driver = { + .probe = adsp_probe, + .remove = adsp_remove, + .driver = { +- .name = "qcom_adsp_pil", ++ .name = "qcom_q6v5_pas", + .of_match_table = adsp_of_match, + }, + }; + + module_platform_driver(adsp_driver); +-MODULE_DESCRIPTION("Qualcomm MSM8974/MSM8996 ADSP Peripherial Image Loader"); ++MODULE_DESCRIPTION("Qualcomm Hexagon v5 Peripheral Authentication Service driver"); + MODULE_LICENSE("GPL v2"); +-- +2.35.1 + diff --git a/queue-4.19/remoteproc-qcom_q6v5_pas-fix-missing-of_node_put-in-.patch b/queue-4.19/remoteproc-qcom_q6v5_pas-fix-missing-of_node_put-in-.patch new file mode 100644 index 00000000000..656baa92c6e --- /dev/null +++ b/queue-4.19/remoteproc-qcom_q6v5_pas-fix-missing-of_node_put-in-.patch @@ -0,0 +1,37 @@ +From 0d5826df2fe9e51390dd4e9a3a3ecdd8eddb6156 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Dec 2022 07:06:39 +0000 +Subject: remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in + adsp_alloc_memory_region() + +From: Yuan Can + +[ Upstream commit 38e7d9c19276832ebb0277f415b9214bf7baeb37 ] + +The pointer node is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: b9e718e950c3 ("remoteproc: Introduce Qualcomm ADSP PIL") +Signed-off-by: Yuan Can +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20221203070639.15128-1-yuancan@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_pas.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c +index 2478ef3cd519..d9b0e51ca91f 100644 +--- a/drivers/remoteproc/qcom_q6v5_pas.c ++++ b/drivers/remoteproc/qcom_q6v5_pas.c +@@ -238,6 +238,7 @@ static int adsp_alloc_memory_region(struct qcom_adsp *adsp) + } + + ret = of_address_to_resource(node, 0, &r); ++ of_node_put(node); + if (ret) + return ret; + +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-call-cmos_wake_setup-from-cmos_do_probe.patch b/queue-4.19/rtc-cmos-call-cmos_wake_setup-from-cmos_do_probe.patch new file mode 100644 index 00000000000..1e13c058e94 --- /dev/null +++ b/queue-4.19/rtc-cmos-call-cmos_wake_setup-from-cmos_do_probe.patch @@ -0,0 +1,147 @@ +From 114464e7777f95d483ca293ad4ad8290a994df62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 13:07:08 +0100 +Subject: rtc: cmos: Call cmos_wake_setup() from cmos_do_probe() + +From: Rafael J. Wysocki + +[ Upstream commit 508ccdfb86b21da37ad091003a4d4567709d5dfb ] + +Notice that cmos_wake_setup() is the only user of acpi_rtc_info and it +can operate on the cmos_rtc variable directly, so it need not set the +platform_data pointer before cmos_do_probe() is called. Instead, it +can be called by cmos_do_probe() in the case when the platform_data +pointer is not set to implement the default behavior (which is to use +the FADT information as long as ACPI support is enabled). + +Modify the code accordingly. + +While at it, drop a comment that doesn't really match the code it is +supposed to be describing. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Zhang Rui +Tested-by: Zhang Rui +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/4803444.31r3eYUQgx@kreacher +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 47 ++++++++++++++++++++---------------------- + 1 file changed, 22 insertions(+), 25 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index e83b976b9abe..c51f6450daf2 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -702,6 +702,8 @@ static irqreturn_t cmos_interrupt(int irq, void *p) + return IRQ_NONE; + } + ++static void cmos_wake_setup(struct device *dev); ++ + #ifdef CONFIG_PNP + #define INITSECTION + +@@ -785,19 +787,27 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq) + if (info->address_space) + address_space = info->address_space; + +- if (info->rtc_day_alarm && info->rtc_day_alarm < 128) +- cmos_rtc.day_alrm = info->rtc_day_alarm; +- if (info->rtc_mon_alarm && info->rtc_mon_alarm < 128) +- cmos_rtc.mon_alrm = info->rtc_mon_alarm; +- if (info->rtc_century && info->rtc_century < 128) +- cmos_rtc.century = info->rtc_century; ++ cmos_rtc.day_alrm = info->rtc_day_alarm; ++ cmos_rtc.mon_alrm = info->rtc_mon_alarm; ++ cmos_rtc.century = info->rtc_century; + + if (info->wake_on && info->wake_off) { + cmos_rtc.wake_on = info->wake_on; + cmos_rtc.wake_off = info->wake_off; + } ++ } else { ++ cmos_wake_setup(dev); + } + ++ if (cmos_rtc.day_alrm >= 128) ++ cmos_rtc.day_alrm = 0; ++ ++ if (cmos_rtc.mon_alrm >= 128) ++ cmos_rtc.mon_alrm = 0; ++ ++ if (cmos_rtc.century >= 128) ++ cmos_rtc.century = 0; ++ + cmos_rtc.dev = dev; + dev_set_drvdata(dev, &cmos_rtc); + +@@ -1222,13 +1232,6 @@ static void use_acpi_alarm_quirks(void) + static inline void use_acpi_alarm_quirks(void) { } + #endif + +-/* Every ACPI platform has a mc146818 compatible "cmos rtc". Here we find +- * its device node and pass extra config data. This helps its driver use +- * capabilities that the now-obsolete mc146818 didn't have, and informs it +- * that this board's RTC is wakeup-capable (per ACPI spec). +- */ +-static struct cmos_rtc_board_info acpi_rtc_info; +- + static void cmos_wake_setup(struct device *dev) + { + if (acpi_disabled) +@@ -1236,26 +1239,23 @@ static void cmos_wake_setup(struct device *dev) + + use_acpi_alarm_quirks(); + +- acpi_rtc_info.wake_on = rtc_wake_on; +- acpi_rtc_info.wake_off = rtc_wake_off; ++ cmos_rtc.wake_on = rtc_wake_on; ++ cmos_rtc.wake_off = rtc_wake_off; + +- /* workaround bug in some ACPI tables */ ++ /* ACPI tables bug workaround. */ + if (acpi_gbl_FADT.month_alarm && !acpi_gbl_FADT.day_alarm) { + dev_dbg(dev, "bogus FADT month_alarm (%d)\n", + acpi_gbl_FADT.month_alarm); + acpi_gbl_FADT.month_alarm = 0; + } + +- acpi_rtc_info.rtc_day_alarm = acpi_gbl_FADT.day_alarm; +- acpi_rtc_info.rtc_mon_alarm = acpi_gbl_FADT.month_alarm; +- acpi_rtc_info.rtc_century = acpi_gbl_FADT.century; ++ cmos_rtc.day_alrm = acpi_gbl_FADT.day_alarm; ++ cmos_rtc.mon_alrm = acpi_gbl_FADT.month_alarm; ++ cmos_rtc.century = acpi_gbl_FADT.century; + +- /* NOTE: S4_RTC_WAKE is NOT currently useful to Linux */ + if (acpi_gbl_FADT.flags & ACPI_FADT_S4_RTC_WAKE) + dev_info(dev, "RTC can wake from S4\n"); + +- dev->platform_data = &acpi_rtc_info; +- + /* RTC always wakes from S1/S2/S3, and often S4/STD */ + device_init_wakeup(dev, 1); + } +@@ -1306,8 +1306,6 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + { + int irq, ret; + +- cmos_wake_setup(&pnp->dev); +- + if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) { + irq = 0; + #ifdef CONFIG_X86 +@@ -1415,7 +1413,6 @@ static int __init cmos_platform_probe(struct platform_device *pdev) + int irq, ret; + + cmos_of_init(pdev); +- cmos_wake_setup(&pdev->dev); + + if (RTC_IOMAPPED) + resource = platform_get_resource(pdev, IORESOURCE_IO, 0); +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-call-rtc_wake_setup-from-cmos_do_probe.patch b/queue-4.19/rtc-cmos-call-rtc_wake_setup-from-cmos_do_probe.patch new file mode 100644 index 00000000000..014bec9bb1e --- /dev/null +++ b/queue-4.19/rtc-cmos-call-rtc_wake_setup-from-cmos_do_probe.patch @@ -0,0 +1,103 @@ +From 7e8f14aa7fce24432349d67100dcc9fee176fb31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 13:09:07 +0100 +Subject: rtc: cmos: Call rtc_wake_setup() from cmos_do_probe() + +From: Rafael J. Wysocki + +[ Upstream commit 375bbba09692fe4c5218eddee8e312dd733fa846 ] + +To reduce code duplication, move the invocation of rtc_wake_setup() +into cmos_do_probe() and simplify the callers of the latter. + +No intentional functional impact. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Zhang Rui +Tested-by: Zhang Rui +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/2143522.irdbgypaU6@kreacher +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 28 ++++++++++++---------------- + 1 file changed, 12 insertions(+), 16 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index c51f6450daf2..91205797bd0f 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -702,6 +702,7 @@ static irqreturn_t cmos_interrupt(int irq, void *p) + return IRQ_NONE; + } + ++static inline void rtc_wake_setup(struct device *dev); + static void cmos_wake_setup(struct device *dev); + + #ifdef CONFIG_PNP +@@ -889,6 +890,13 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq) + if (rtc_nvmem_register(cmos_rtc.rtc, &nvmem_cfg)) + dev_err(dev, "nvmem registration failed\n"); + ++ /* ++ * Everything has gone well so far, so by default register a handler for ++ * the ACPI RTC fixed event. ++ */ ++ if (!info) ++ rtc_wake_setup(dev); ++ + dev_info(dev, "%s%s, %d bytes nvram%s\n", + !is_valid_irq(rtc_irq) ? "no alarms" : + cmos_rtc.mon_alrm ? "alarms up to one year" : +@@ -1304,7 +1312,7 @@ static void rtc_wake_setup(struct device *dev) + + static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + { +- int irq, ret; ++ int irq; + + if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) { + irq = 0; +@@ -1320,13 +1328,7 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + irq = pnp_irq(pnp, 0); + } + +- ret = cmos_do_probe(&pnp->dev, pnp_get_resource(pnp, IORESOURCE_IO, 0), irq); +- if (ret) +- return ret; +- +- rtc_wake_setup(&pnp->dev); +- +- return 0; ++ return cmos_do_probe(&pnp->dev, pnp_get_resource(pnp, IORESOURCE_IO, 0), irq); + } + + static void cmos_pnp_remove(struct pnp_dev *pnp) +@@ -1410,7 +1412,7 @@ static inline void cmos_of_init(struct platform_device *pdev) {} + static int __init cmos_platform_probe(struct platform_device *pdev) + { + struct resource *resource; +- int irq, ret; ++ int irq; + + cmos_of_init(pdev); + +@@ -1422,13 +1424,7 @@ static int __init cmos_platform_probe(struct platform_device *pdev) + if (irq < 0) + irq = -1; + +- ret = cmos_do_probe(&pdev->dev, resource, irq); +- if (ret) +- return ret; +- +- rtc_wake_setup(&pdev->dev); +- +- return 0; ++ return cmos_do_probe(&pdev->dev, resource, irq); + } + + static int cmos_platform_remove(struct platform_device *pdev) +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-disable-acpi-rtc-event-on-removal.patch b/queue-4.19/rtc-cmos-disable-acpi-rtc-event-on-removal.patch new file mode 100644 index 00000000000..36aceabbf74 --- /dev/null +++ b/queue-4.19/rtc-cmos-disable-acpi-rtc-event-on-removal.patch @@ -0,0 +1,68 @@ +From bd12c3f117596bd694dff8d889680e03d8fc9ddc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 13:15:36 +0100 +Subject: rtc: cmos: Disable ACPI RTC event on removal + +From: Rafael J. Wysocki + +[ Upstream commit 83ebb7b3036d151ee39a4a752018665648fc3bd4 ] + +Make cmos_do_remove() drop the ACPI RTC fixed event handler so as to +prevent it from operating on stale data in case the event triggers +after driver removal. + +Fixes: 311ee9c151ad ("rtc: cmos: allow using ACPI for RTC alarm instead of HPET") +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Zhang Rui +Tested-by: Zhang Rui +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/2224609.iZASKD2KPV@kreacher +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 0c035c5a5ae6..5354c12f6b2a 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -756,6 +756,14 @@ static void acpi_rtc_event_setup(struct device *dev) + acpi_disable_event(ACPI_EVENT_RTC, 0); + } + ++static void acpi_rtc_event_cleanup(void) ++{ ++ if (acpi_disabled) ++ return; ++ ++ acpi_remove_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler); ++} ++ + static void rtc_wake_on(struct device *dev) + { + acpi_clear_event(ACPI_EVENT_RTC); +@@ -842,6 +850,10 @@ static inline void acpi_rtc_event_setup(struct device *dev) + { + } + ++static inline void acpi_rtc_event_cleanup(void) ++{ ++} ++ + static inline void acpi_cmos_wake_setup(struct device *dev) + { + } +@@ -1089,6 +1101,9 @@ static void cmos_do_remove(struct device *dev) + hpet_unregister_irq_handler(cmos_interrupt); + } + ++ if (!dev_get_platdata(dev)) ++ acpi_rtc_event_cleanup(); ++ + cmos->rtc = NULL; + + ports = cmos->iomem; +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-eliminate-forward-declarations-of-some-func.patch b/queue-4.19/rtc-cmos-eliminate-forward-declarations-of-some-func.patch new file mode 100644 index 00000000000..9bbed9568d0 --- /dev/null +++ b/queue-4.19/rtc-cmos-eliminate-forward-declarations-of-some-func.patch @@ -0,0 +1,362 @@ +From 91d73e815bba4a40d9048c3c75f6fcf01ded4fd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 13:09:32 +0100 +Subject: rtc: cmos: Eliminate forward declarations of some functions + +From: Rafael J. Wysocki + +[ Upstream commit dca4d3b71c8a09a16951add656711fbd6f5bfbb0 ] + +Reorder the ACPI-related code before cmos_do_probe() so as to eliminate +excessive forward declarations of some functions. + +While at it, for consistency, add the inline modifier to the +definitions of empty stub static funtions and remove it from the +corresponding definitions of functions with non-empty bodies. + +No intentional functional impact. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Zhang Rui +Tested-by: Zhang Rui +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/13157911.uLZWGnKmhe@kreacher +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 304 ++++++++++++++++++++--------------------- + 1 file changed, 149 insertions(+), 155 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 91205797bd0f..909cb1d4a4d5 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -702,8 +702,155 @@ static irqreturn_t cmos_interrupt(int irq, void *p) + return IRQ_NONE; + } + +-static inline void rtc_wake_setup(struct device *dev); +-static void cmos_wake_setup(struct device *dev); ++#ifdef CONFIG_ACPI ++ ++#include ++ ++static u32 rtc_handler(void *context) ++{ ++ struct device *dev = context; ++ struct cmos_rtc *cmos = dev_get_drvdata(dev); ++ unsigned char rtc_control = 0; ++ unsigned char rtc_intr; ++ unsigned long flags; ++ ++ ++ /* ++ * Always update rtc irq when ACPI is used as RTC Alarm. ++ * Or else, ACPI SCI is enabled during suspend/resume only, ++ * update rtc irq in that case. ++ */ ++ if (cmos_use_acpi_alarm()) ++ cmos_interrupt(0, (void *)cmos->rtc); ++ else { ++ /* Fix me: can we use cmos_interrupt() here as well? */ ++ spin_lock_irqsave(&rtc_lock, flags); ++ if (cmos_rtc.suspend_ctrl) ++ rtc_control = CMOS_READ(RTC_CONTROL); ++ if (rtc_control & RTC_AIE) { ++ cmos_rtc.suspend_ctrl &= ~RTC_AIE; ++ CMOS_WRITE(rtc_control, RTC_CONTROL); ++ rtc_intr = CMOS_READ(RTC_INTR_FLAGS); ++ rtc_update_irq(cmos->rtc, 1, rtc_intr); ++ } ++ spin_unlock_irqrestore(&rtc_lock, flags); ++ } ++ ++ pm_wakeup_hard_event(dev); ++ acpi_clear_event(ACPI_EVENT_RTC); ++ acpi_disable_event(ACPI_EVENT_RTC, 0); ++ return ACPI_INTERRUPT_HANDLED; ++} ++ ++static void rtc_wake_setup(struct device *dev) ++{ ++ if (acpi_disabled) ++ return; ++ ++ acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, dev); ++ /* ++ * After the RTC handler is installed, the Fixed_RTC event should ++ * be disabled. Only when the RTC alarm is set will it be enabled. ++ */ ++ acpi_clear_event(ACPI_EVENT_RTC); ++ acpi_disable_event(ACPI_EVENT_RTC, 0); ++} ++ ++static void rtc_wake_on(struct device *dev) ++{ ++ acpi_clear_event(ACPI_EVENT_RTC); ++ acpi_enable_event(ACPI_EVENT_RTC, 0); ++} ++ ++static void rtc_wake_off(struct device *dev) ++{ ++ acpi_disable_event(ACPI_EVENT_RTC, 0); ++} ++ ++#ifdef CONFIG_X86 ++/* Enable use_acpi_alarm mode for Intel platforms no earlier than 2015 */ ++static void use_acpi_alarm_quirks(void) ++{ ++ if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) ++ return; ++ ++ if (!is_hpet_enabled()) ++ return; ++ ++ if (dmi_get_bios_year() < 2015) ++ return; ++ ++ use_acpi_alarm = true; ++} ++#else ++static inline void use_acpi_alarm_quirks(void) { } ++#endif ++ ++static void cmos_wake_setup(struct device *dev) ++{ ++ if (acpi_disabled) ++ return; ++ ++ use_acpi_alarm_quirks(); ++ ++ cmos_rtc.wake_on = rtc_wake_on; ++ cmos_rtc.wake_off = rtc_wake_off; ++ ++ /* ACPI tables bug workaround. */ ++ if (acpi_gbl_FADT.month_alarm && !acpi_gbl_FADT.day_alarm) { ++ dev_dbg(dev, "bogus FADT month_alarm (%d)\n", ++ acpi_gbl_FADT.month_alarm); ++ acpi_gbl_FADT.month_alarm = 0; ++ } ++ ++ cmos_rtc.day_alrm = acpi_gbl_FADT.day_alarm; ++ cmos_rtc.mon_alrm = acpi_gbl_FADT.month_alarm; ++ cmos_rtc.century = acpi_gbl_FADT.century; ++ ++ if (acpi_gbl_FADT.flags & ACPI_FADT_S4_RTC_WAKE) ++ dev_info(dev, "RTC can wake from S4\n"); ++ ++ /* RTC always wakes from S1/S2/S3, and often S4/STD */ ++ device_init_wakeup(dev, 1); ++} ++ ++static void cmos_check_acpi_rtc_status(struct device *dev, ++ unsigned char *rtc_control) ++{ ++ struct cmos_rtc *cmos = dev_get_drvdata(dev); ++ acpi_event_status rtc_status; ++ acpi_status status; ++ ++ if (acpi_gbl_FADT.flags & ACPI_FADT_FIXED_RTC) ++ return; ++ ++ status = acpi_get_event_status(ACPI_EVENT_RTC, &rtc_status); ++ if (ACPI_FAILURE(status)) { ++ dev_err(dev, "Could not get RTC status\n"); ++ } else if (rtc_status & ACPI_EVENT_FLAG_SET) { ++ unsigned char mask; ++ *rtc_control &= ~RTC_AIE; ++ CMOS_WRITE(*rtc_control, RTC_CONTROL); ++ mask = CMOS_READ(RTC_INTR_FLAGS); ++ rtc_update_irq(cmos->rtc, 1, mask); ++ } ++} ++ ++#else /* !CONFIG_ACPI */ ++ ++static inline void rtc_wake_setup(struct device *dev) ++{ ++} ++ ++static inline void cmos_wake_setup(struct device *dev) ++{ ++} ++ ++static inline void cmos_check_acpi_rtc_status(struct device *dev, ++ unsigned char *rtc_control) ++{ ++} ++#endif /* CONFIG_ACPI */ + + #ifdef CONFIG_PNP + #define INITSECTION +@@ -1087,9 +1234,6 @@ static void cmos_check_wkalrm(struct device *dev) + } + } + +-static void cmos_check_acpi_rtc_status(struct device *dev, +- unsigned char *rtc_control); +- + static int __maybe_unused cmos_resume(struct device *dev) + { + struct cmos_rtc *cmos = dev_get_drvdata(dev); +@@ -1156,156 +1300,6 @@ static SIMPLE_DEV_PM_OPS(cmos_pm_ops, cmos_suspend, cmos_resume); + * predate even PNPBIOS should set up platform_bus devices. + */ + +-#ifdef CONFIG_ACPI +- +-#include +- +-static u32 rtc_handler(void *context) +-{ +- struct device *dev = context; +- struct cmos_rtc *cmos = dev_get_drvdata(dev); +- unsigned char rtc_control = 0; +- unsigned char rtc_intr; +- unsigned long flags; +- +- +- /* +- * Always update rtc irq when ACPI is used as RTC Alarm. +- * Or else, ACPI SCI is enabled during suspend/resume only, +- * update rtc irq in that case. +- */ +- if (cmos_use_acpi_alarm()) +- cmos_interrupt(0, (void *)cmos->rtc); +- else { +- /* Fix me: can we use cmos_interrupt() here as well? */ +- spin_lock_irqsave(&rtc_lock, flags); +- if (cmos_rtc.suspend_ctrl) +- rtc_control = CMOS_READ(RTC_CONTROL); +- if (rtc_control & RTC_AIE) { +- cmos_rtc.suspend_ctrl &= ~RTC_AIE; +- CMOS_WRITE(rtc_control, RTC_CONTROL); +- rtc_intr = CMOS_READ(RTC_INTR_FLAGS); +- rtc_update_irq(cmos->rtc, 1, rtc_intr); +- } +- spin_unlock_irqrestore(&rtc_lock, flags); +- } +- +- pm_wakeup_hard_event(dev); +- acpi_clear_event(ACPI_EVENT_RTC); +- acpi_disable_event(ACPI_EVENT_RTC, 0); +- return ACPI_INTERRUPT_HANDLED; +-} +- +-static inline void rtc_wake_setup(struct device *dev) +-{ +- if (acpi_disabled) +- return; +- +- acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, dev); +- /* +- * After the RTC handler is installed, the Fixed_RTC event should +- * be disabled. Only when the RTC alarm is set will it be enabled. +- */ +- acpi_clear_event(ACPI_EVENT_RTC); +- acpi_disable_event(ACPI_EVENT_RTC, 0); +-} +- +-static void rtc_wake_on(struct device *dev) +-{ +- acpi_clear_event(ACPI_EVENT_RTC); +- acpi_enable_event(ACPI_EVENT_RTC, 0); +-} +- +-static void rtc_wake_off(struct device *dev) +-{ +- acpi_disable_event(ACPI_EVENT_RTC, 0); +-} +- +-#ifdef CONFIG_X86 +-/* Enable use_acpi_alarm mode for Intel platforms no earlier than 2015 */ +-static void use_acpi_alarm_quirks(void) +-{ +- if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) +- return; +- +- if (!is_hpet_enabled()) +- return; +- +- if (dmi_get_bios_year() < 2015) +- return; +- +- use_acpi_alarm = true; +-} +-#else +-static inline void use_acpi_alarm_quirks(void) { } +-#endif +- +-static void cmos_wake_setup(struct device *dev) +-{ +- if (acpi_disabled) +- return; +- +- use_acpi_alarm_quirks(); +- +- cmos_rtc.wake_on = rtc_wake_on; +- cmos_rtc.wake_off = rtc_wake_off; +- +- /* ACPI tables bug workaround. */ +- if (acpi_gbl_FADT.month_alarm && !acpi_gbl_FADT.day_alarm) { +- dev_dbg(dev, "bogus FADT month_alarm (%d)\n", +- acpi_gbl_FADT.month_alarm); +- acpi_gbl_FADT.month_alarm = 0; +- } +- +- cmos_rtc.day_alrm = acpi_gbl_FADT.day_alarm; +- cmos_rtc.mon_alrm = acpi_gbl_FADT.month_alarm; +- cmos_rtc.century = acpi_gbl_FADT.century; +- +- if (acpi_gbl_FADT.flags & ACPI_FADT_S4_RTC_WAKE) +- dev_info(dev, "RTC can wake from S4\n"); +- +- /* RTC always wakes from S1/S2/S3, and often S4/STD */ +- device_init_wakeup(dev, 1); +-} +- +-static void cmos_check_acpi_rtc_status(struct device *dev, +- unsigned char *rtc_control) +-{ +- struct cmos_rtc *cmos = dev_get_drvdata(dev); +- acpi_event_status rtc_status; +- acpi_status status; +- +- if (acpi_gbl_FADT.flags & ACPI_FADT_FIXED_RTC) +- return; +- +- status = acpi_get_event_status(ACPI_EVENT_RTC, &rtc_status); +- if (ACPI_FAILURE(status)) { +- dev_err(dev, "Could not get RTC status\n"); +- } else if (rtc_status & ACPI_EVENT_FLAG_SET) { +- unsigned char mask; +- *rtc_control &= ~RTC_AIE; +- CMOS_WRITE(*rtc_control, RTC_CONTROL); +- mask = CMOS_READ(RTC_INTR_FLAGS); +- rtc_update_irq(cmos->rtc, 1, mask); +- } +-} +- +-#else +- +-static void cmos_wake_setup(struct device *dev) +-{ +-} +- +-static void cmos_check_acpi_rtc_status(struct device *dev, +- unsigned char *rtc_control) +-{ +-} +- +-static void rtc_wake_setup(struct device *dev) +-{ +-} +-#endif +- + #ifdef CONFIG_PNP + + #include +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-fix-build-on-non-acpi-platforms.patch b/queue-4.19/rtc-cmos-fix-build-on-non-acpi-platforms.patch new file mode 100644 index 00000000000..8e209016e89 --- /dev/null +++ b/queue-4.19/rtc-cmos-fix-build-on-non-acpi-platforms.patch @@ -0,0 +1,38 @@ +From 85df9d346c5c333acc8c779f466016369a7f9a32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 22:35:11 +0200 +Subject: rtc: cmos: fix build on non-ACPI platforms + +From: Alexandre Belloni + +[ Upstream commit db4e955ae333567dea02822624106c0b96a2f84f ] + +Now that rtc_wake_setup is called outside of cmos_wake_setup, it also need +to be defined on non-ACPI platforms. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/r/20221018203512.2532407-1-alexandre.belloni@bootlin.com +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index d8384f7a7381..e83b976b9abe 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -1293,6 +1293,9 @@ static void cmos_check_acpi_rtc_status(struct device *dev, + { + } + ++static void rtc_wake_setup(struct device *dev) ++{ ++} + #endif + + #ifdef CONFIG_PNP +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-fix-event-handler-registration-ordering-iss.patch b/queue-4.19/rtc-cmos-fix-event-handler-registration-ordering-iss.patch new file mode 100644 index 00000000000..454a7bc74f1 --- /dev/null +++ b/queue-4.19/rtc-cmos-fix-event-handler-registration-ordering-iss.patch @@ -0,0 +1,124 @@ +From 20c7d95c69551b43f7de3894d5bdb33ddcd37e91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 20:07:01 +0200 +Subject: rtc: cmos: Fix event handler registration ordering issue + +From: Rafael J. Wysocki + +[ Upstream commit 4919d3eb2ec0ee364f7e3cf2d99646c1b224fae8 ] + +Because acpi_install_fixed_event_handler() enables the event +automatically on success, it is incorrect to call it before the +handler routine passed to it is ready to handle events. + +Unfortunately, the rtc-cmos driver does exactly the incorrect thing +by calling cmos_wake_setup(), which passes rtc_handler() to +acpi_install_fixed_event_handler(), before cmos_do_probe(), because +rtc_handler() uses dev_get_drvdata() to get to the cmos object +pointer and the driver data pointer is only populated in +cmos_do_probe(). + +This leads to a NULL pointer dereference in rtc_handler() on boot +if the RTC fixed event happens to be active at the init time. + +To address this issue, change the initialization ordering of the +driver so that cmos_wake_setup() is always called after a successful +cmos_do_probe() call. + +While at it, change cmos_pnp_probe() to call cmos_do_probe() after +the initial if () statement used for computing the IRQ argument to +be passed to cmos_do_probe() which is cleaner than calling it in +each branch of that if () (local variable "irq" can be of type int, +because it is passed to that function as an argument of type int). + +Note that commit 6492fed7d8c9 ("rtc: rtc-cmos: Do not check +ACPI_FADT_LOW_POWER_S0") caused this issue to affect a larger number +of systems, because previously it only affected systems with +ACPI_FADT_LOW_POWER_S0 set, but it is present regardless of that +commit. + +Fixes: 6492fed7d8c9 ("rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0") +Fixes: a474aaedac99 ("rtc-cmos: move wake setup from ACPI glue into RTC driver") +Link: https://lore.kernel.org/linux-acpi/20221010141630.zfzi7mk7zvnmclzy@techsingularity.net/ +Reported-by: Mel Gorman +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Bjorn Helgaas +Tested-by: Mel Gorman +Link: https://lore.kernel.org/r/5629262.DvuYhMxLoT@kreacher +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 29 +++++++++++++++++++---------- + 1 file changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index c7f6088ef91f..7962cdd933f9 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -1299,10 +1299,10 @@ static void cmos_check_acpi_rtc_status(struct device *dev, + + static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + { +- cmos_wake_setup(&pnp->dev); ++ int irq, ret; + + if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) { +- unsigned int irq = 0; ++ irq = 0; + #ifdef CONFIG_X86 + /* Some machines contain a PNP entry for the RTC, but + * don't define the IRQ. It should always be safe to +@@ -1311,13 +1311,17 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + if (nr_legacy_irqs()) + irq = 8; + #endif +- return cmos_do_probe(&pnp->dev, +- pnp_get_resource(pnp, IORESOURCE_IO, 0), irq); + } else { +- return cmos_do_probe(&pnp->dev, +- pnp_get_resource(pnp, IORESOURCE_IO, 0), +- pnp_irq(pnp, 0)); ++ irq = pnp_irq(pnp, 0); + } ++ ++ ret = cmos_do_probe(&pnp->dev, pnp_get_resource(pnp, IORESOURCE_IO, 0), irq); ++ if (ret) ++ return ret; ++ ++ cmos_wake_setup(&pnp->dev); ++ ++ return 0; + } + + static void cmos_pnp_remove(struct pnp_dev *pnp) +@@ -1401,10 +1405,9 @@ static inline void cmos_of_init(struct platform_device *pdev) {} + static int __init cmos_platform_probe(struct platform_device *pdev) + { + struct resource *resource; +- int irq; ++ int irq, ret; + + cmos_of_init(pdev); +- cmos_wake_setup(&pdev->dev); + + if (RTC_IOMAPPED) + resource = platform_get_resource(pdev, IORESOURCE_IO, 0); +@@ -1414,7 +1417,13 @@ static int __init cmos_platform_probe(struct platform_device *pdev) + if (irq < 0) + irq = -1; + +- return cmos_do_probe(&pdev->dev, resource, irq); ++ ret = cmos_do_probe(&pdev->dev, resource, irq); ++ if (ret) ++ return ret; ++ ++ cmos_wake_setup(&pdev->dev); ++ ++ return 0; + } + + static int cmos_platform_remove(struct platform_device *pdev) +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-fix-wake-alarm-breakage.patch b/queue-4.19/rtc-cmos-fix-wake-alarm-breakage.patch new file mode 100644 index 00000000000..3713eef3490 --- /dev/null +++ b/queue-4.19/rtc-cmos-fix-wake-alarm-breakage.patch @@ -0,0 +1,92 @@ +From e1774c490ea79fe1d2fdeae8bef8d8828d7c7935 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 18:09:31 +0200 +Subject: rtc: cmos: Fix wake alarm breakage + +From: Rafael J. Wysocki + +[ Upstream commit 0782b66ed2fbb035dda76111df0954515e417b24 ] + +Commit 4919d3eb2ec0 ("rtc: cmos: Fix event handler registration +ordering issue") overlooked the fact that cmos_do_probe() depended +on the preparations carried out by cmos_wake_setup() and the wake +alarm stopped working after the ordering of them had been changed. + +Address this by partially reverting commit 4919d3eb2ec0 so that +cmos_wake_setup() is called before cmos_do_probe() again and moving +the rtc_wake_setup() invocation from cmos_wake_setup() directly to the +callers of cmos_do_probe() where it will happen after a successful +completion of the latter. + +Fixes: 4919d3eb2ec0 ("rtc: cmos: Fix event handler registration ordering issue") +Reported-by: Zhang Rui +Reported-by: Todd Brandt +Signed-off-by: Rafael J. Wysocki +Link: https://lore.kernel.org/r/5887691.lOV4Wx5bFT@kreacher +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 7962cdd933f9..d8384f7a7381 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -1180,6 +1180,9 @@ static u32 rtc_handler(void *context) + + static inline void rtc_wake_setup(struct device *dev) + { ++ if (acpi_disabled) ++ return; ++ + acpi_install_fixed_event_handler(ACPI_EVENT_RTC, rtc_handler, dev); + /* + * After the RTC handler is installed, the Fixed_RTC event should +@@ -1233,7 +1236,6 @@ static void cmos_wake_setup(struct device *dev) + + use_acpi_alarm_quirks(); + +- rtc_wake_setup(dev); + acpi_rtc_info.wake_on = rtc_wake_on; + acpi_rtc_info.wake_off = rtc_wake_off; + +@@ -1301,6 +1303,8 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + { + int irq, ret; + ++ cmos_wake_setup(&pnp->dev); ++ + if (pnp_port_start(pnp, 0) == 0x70 && !pnp_irq_valid(pnp, 0)) { + irq = 0; + #ifdef CONFIG_X86 +@@ -1319,7 +1323,7 @@ static int cmos_pnp_probe(struct pnp_dev *pnp, const struct pnp_device_id *id) + if (ret) + return ret; + +- cmos_wake_setup(&pnp->dev); ++ rtc_wake_setup(&pnp->dev); + + return 0; + } +@@ -1408,6 +1412,7 @@ static int __init cmos_platform_probe(struct platform_device *pdev) + int irq, ret; + + cmos_of_init(pdev); ++ cmos_wake_setup(&pdev->dev); + + if (RTC_IOMAPPED) + resource = platform_get_resource(pdev, IORESOURCE_IO, 0); +@@ -1421,7 +1426,7 @@ static int __init cmos_platform_probe(struct platform_device *pdev) + if (ret) + return ret; + +- cmos_wake_setup(&pdev->dev); ++ rtc_wake_setup(&pdev->dev); + + return 0; + } +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-refactor-code-by-using-the-new-dmi_get_bios.patch b/queue-4.19/rtc-cmos-refactor-code-by-using-the-new-dmi_get_bios.patch new file mode 100644 index 00000000000..2644c10f67f --- /dev/null +++ b/queue-4.19/rtc-cmos-refactor-code-by-using-the-new-dmi_get_bios.patch @@ -0,0 +1,55 @@ +From c4809f41861d8540acdb8e36603c124fccf65773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jan 2020 15:14:37 +0200 +Subject: rtc: cmos: Refactor code by using the new dmi_get_bios_year() helper + +From: Andy Shevchenko + +[ Upstream commit 604c521259c8051b7607c000eda7938f7a705d92 ] + +Refactor code by using the new dmi_get_bios_year() helper instead of +open coding its functionality. This also makes logic slightly clearer. + +No changes intended. + +Cc: Hans de Goede +Signed-off-by: Andy Shevchenko +Tested-by: Guilherme G. Piccoli +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20200123131437.28157-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 8545f0da57fe..58a3104b8a1c 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -1204,8 +1204,6 @@ static void rtc_wake_off(struct device *dev) + /* Enable use_acpi_alarm mode for Intel platforms no earlier than 2015 */ + static void use_acpi_alarm_quirks(void) + { +- int year; +- + if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) + return; + +@@ -1215,8 +1213,10 @@ static void use_acpi_alarm_quirks(void) + if (!is_hpet_enabled()) + return; + +- if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year >= 2015) +- use_acpi_alarm = true; ++ if (dmi_get_bios_year() < 2015) ++ return; ++ ++ use_acpi_alarm = true; + } + #else + static inline void use_acpi_alarm_quirks(void) { } +-- +2.35.1 + diff --git a/queue-4.19/rtc-cmos-rename-acpi-related-functions.patch b/queue-4.19/rtc-cmos-rename-acpi-related-functions.patch new file mode 100644 index 00000000000..07f94db719f --- /dev/null +++ b/queue-4.19/rtc-cmos-rename-acpi-related-functions.patch @@ -0,0 +1,87 @@ +From 2849c6a9334fa7f7f8d79aac762f1ffbd8487611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 13:12:00 +0100 +Subject: rtc: cmos: Rename ACPI-related functions + +From: Rafael J. Wysocki + +[ Upstream commit d13e9ad9f5146f066a5c5a1cc993d09e4fb21ead ] + +The names of rtc_wake_setup() and cmos_wake_setup() don't indicate +that these functions are ACPI-related, which is the case, and the +former doesn't really reflect the role of the function. + +Rename them to acpi_rtc_event_setup() and acpi_cmos_wake_setup(), +respectively, to address this shortcoming. + +No intentional functional impact. + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Zhang Rui +Tested-by: Zhang Rui +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/3225614.44csPzL39Z@kreacher +Signed-off-by: Alexandre Belloni +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 909cb1d4a4d5..0c035c5a5ae6 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -742,7 +742,7 @@ static u32 rtc_handler(void *context) + return ACPI_INTERRUPT_HANDLED; + } + +-static void rtc_wake_setup(struct device *dev) ++static void acpi_rtc_event_setup(struct device *dev) + { + if (acpi_disabled) + return; +@@ -786,7 +786,7 @@ static void use_acpi_alarm_quirks(void) + static inline void use_acpi_alarm_quirks(void) { } + #endif + +-static void cmos_wake_setup(struct device *dev) ++static void acpi_cmos_wake_setup(struct device *dev) + { + if (acpi_disabled) + return; +@@ -838,11 +838,11 @@ static void cmos_check_acpi_rtc_status(struct device *dev, + + #else /* !CONFIG_ACPI */ + +-static inline void rtc_wake_setup(struct device *dev) ++static inline void acpi_rtc_event_setup(struct device *dev) + { + } + +-static inline void cmos_wake_setup(struct device *dev) ++static inline void acpi_cmos_wake_setup(struct device *dev) + { + } + +@@ -944,7 +944,7 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq) + cmos_rtc.wake_off = info->wake_off; + } + } else { +- cmos_wake_setup(dev); ++ acpi_cmos_wake_setup(dev); + } + + if (cmos_rtc.day_alrm >= 128) +@@ -1042,7 +1042,7 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq) + * the ACPI RTC fixed event. + */ + if (!info) +- rtc_wake_setup(dev); ++ acpi_rtc_event_setup(dev); + + dev_info(dev, "%s%s, %d bytes nvram%s\n", + !is_valid_irq(rtc_irq) ? "no alarms" : +-- +2.35.1 + diff --git a/queue-4.19/rtc-mxc_v2-add-missing-clk_disable_unprepare.patch b/queue-4.19/rtc-mxc_v2-add-missing-clk_disable_unprepare.patch new file mode 100644 index 00000000000..2a10eed424e --- /dev/null +++ b/queue-4.19/rtc-mxc_v2-add-missing-clk_disable_unprepare.patch @@ -0,0 +1,40 @@ +From 79b368b03fdc169856508e12738e2b54d8884698 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 16:50:46 +0800 +Subject: rtc: mxc_v2: Add missing clk_disable_unprepare() + +From: GUO Zihua + +[ Upstream commit 55d5a86618d3b1a768bce01882b74cbbd2651975 ] + +The call to clk_disable_unprepare() is left out in the error handling of +devm_rtc_allocate_device. Add it back. + +Fixes: 5490a1e018a4 ("rtc: mxc_v2: fix possible race condition") +Signed-off-by: GUO Zihua +Link: https://lore.kernel.org/r/20221122085046.21689-1-guozihua@huawei.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-mxc_v2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-mxc_v2.c b/drivers/rtc/rtc-mxc_v2.c +index 45c7366b7286..c16aa4a389e9 100644 +--- a/drivers/rtc/rtc-mxc_v2.c ++++ b/drivers/rtc/rtc-mxc_v2.c +@@ -335,8 +335,10 @@ static int mxc_rtc_probe(struct platform_device *pdev) + } + + pdata->rtc = devm_rtc_allocate_device(&pdev->dev); +- if (IS_ERR(pdata->rtc)) ++ if (IS_ERR(pdata->rtc)) { ++ clk_disable_unprepare(pdata->clk); + return PTR_ERR(pdata->rtc); ++ } + + pdata->rtc->ops = &mxc_rtc_ops; + pdata->rtc->range_max = U32_MAX; +-- +2.35.1 + diff --git a/queue-4.19/rtc-rtc-cmos-do-not-check-acpi_fadt_low_power_s0.patch b/queue-4.19/rtc-rtc-cmos-do-not-check-acpi_fadt_low_power_s0.patch new file mode 100644 index 00000000000..12731bf85d3 --- /dev/null +++ b/queue-4.19/rtc-rtc-cmos-do-not-check-acpi_fadt_low_power_s0.patch @@ -0,0 +1,58 @@ +From b2d06a97b1870a3e0e049d6081bdf4e154194794 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Aug 2022 20:23:59 +0200 +Subject: rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0 + +From: Rafael J. Wysocki + +[ Upstream commit 6492fed7d8c95f53b0b804ef541324d924d95d41 ] + +The ACPI_FADT_LOW_POWER_S0 flag merely means that it is better to +use low-power S0 idle on the given platform than S3 (provided that +the latter is supported) and it doesn't preclude using either of +them (which of them will be used depends on the choices made by user +space). + +For this reason, there is no benefit from checking that flag in +use_acpi_alarm_quirks(). + +First off, it cannot be a bug to do S3 with use_acpi_alarm set, +because S3 can be used on systems with ACPI_FADT_LOW_POWER_S0 and it +must work if really supported, so the ACPI_FADT_LOW_POWER_S0 check is +not needed to protect the S3-capable systems from failing. + +Second, suspend-to-idle can be carried out on a system with +ACPI_FADT_LOW_POWER_S0 unset and it is expected to work, so if setting +use_acpi_alarm is needed to handle that case correctly, it should be +set regardless of the ACPI_FADT_LOW_POWER_S0 value. + +Accordingly, drop the ACPI_FADT_LOW_POWER_S0 check from +use_acpi_alarm_quirks(). + +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Mario Limonciello +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/12054246.O9o76ZdvQC@kreacher +Stable-dep-of: 83ebb7b3036d ("rtc: cmos: Disable ACPI RTC event on removal") +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index 58a3104b8a1c..c7f6088ef91f 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -1207,9 +1207,6 @@ static void use_acpi_alarm_quirks(void) + if (boot_cpu_data.x86_vendor != X86_VENDOR_INTEL) + return; + +- if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0)) +- return; +- + if (!is_hpet_enabled()) + return; + +-- +2.35.1 + diff --git a/queue-4.19/rtc-snvs-allow-a-time-difference-on-clock-register-r.patch b/queue-4.19/rtc-snvs-allow-a-time-difference-on-clock-register-r.patch new file mode 100644 index 00000000000..794bd7af4c2 --- /dev/null +++ b/queue-4.19/rtc-snvs-allow-a-time-difference-on-clock-register-r.patch @@ -0,0 +1,92 @@ +From 31861835c4cc762ed00c4906c253f1a086a85a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Nov 2022 12:59:15 +0100 +Subject: rtc: snvs: Allow a time difference on clock register read + +From: Stefan Eichenberger + +[ Upstream commit 0462681e207ccc44778a77b3297af728b1cf5b9f ] + +On an iMX6ULL the following message appears when a wakealarm is set: + +echo 0 > /sys/class/rtc/rtc1/wakealarm +rtc rtc1: Timeout trying to get valid LPSRT Counter read + +This does not always happen but is reproducible quite often (7 out of 10 +times). The problem appears because the iMX6ULL is not able to read the +registers within one 32kHz clock cycle which is the base clock of the +RTC. Therefore, this patch allows a difference of up to 320 cycles +(10ms). 10ms was chosen to be big enough even on systems with less cpu +power (e.g. iMX6ULL). According to the reference manual a difference is +fine: +- If the two consecutive reads are similar, the value is correct. +The values have to be similar, not equal. + +Fixes: cd7f3a249dbe ("rtc: snvs: Add timeouts to avoid kernel lockups") +Reviewed-by: Francesco Dolcini +Signed-off-by: Stefan Eichenberger +Signed-off-by: Francesco Dolcini +Link: https://lore.kernel.org/r/20221106115915.7930-1-francesco@dolcini.it +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-snvs.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c +index 3cf011e12053..b1e13f2877ad 100644 +--- a/drivers/rtc/rtc-snvs.c ++++ b/drivers/rtc/rtc-snvs.c +@@ -32,6 +32,14 @@ + #define SNVS_LPPGDR_INIT 0x41736166 + #define CNTR_TO_SECS_SH 15 + ++/* The maximum RTC clock cycles that are allowed to pass between two ++ * consecutive clock counter register reads. If the values are corrupted a ++ * bigger difference is expected. The RTC frequency is 32kHz. With 320 cycles ++ * we end at 10ms which should be enough for most cases. If it once takes ++ * longer than expected we do a retry. ++ */ ++#define MAX_RTC_READ_DIFF_CYCLES 320 ++ + struct snvs_rtc_data { + struct rtc_device *rtc; + struct regmap *regmap; +@@ -56,6 +64,7 @@ static u64 rtc_read_lpsrt(struct snvs_rtc_data *data) + static u32 rtc_read_lp_counter(struct snvs_rtc_data *data) + { + u64 read1, read2; ++ s64 diff; + unsigned int timeout = 100; + + /* As expected, the registers might update between the read of the LSB +@@ -66,7 +75,8 @@ static u32 rtc_read_lp_counter(struct snvs_rtc_data *data) + do { + read2 = read1; + read1 = rtc_read_lpsrt(data); +- } while (read1 != read2 && --timeout); ++ diff = read1 - read2; ++ } while (((diff < 0) || (diff > MAX_RTC_READ_DIFF_CYCLES)) && --timeout); + if (!timeout) + dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n"); + +@@ -78,13 +88,15 @@ static u32 rtc_read_lp_counter(struct snvs_rtc_data *data) + static int rtc_read_lp_counter_lsb(struct snvs_rtc_data *data, u32 *lsb) + { + u32 count1, count2; ++ s32 diff; + unsigned int timeout = 100; + + regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1); + do { + count2 = count1; + regmap_read(data->regmap, data->offset + SNVS_LPSRTCLR, &count1); +- } while (count1 != count2 && --timeout); ++ diff = count1 - count2; ++ } while (((diff < 0) || (diff > MAX_RTC_READ_DIFF_CYCLES)) && --timeout); + if (!timeout) { + dev_err(&data->rtc->dev, "Timeout trying to get valid LPSRT Counter read\n"); + return -ETIMEDOUT; +-- +2.35.1 + diff --git a/queue-4.19/rtc-st-lpc-add-missing-clk_disable_unprepare-in-st_r.patch b/queue-4.19/rtc-st-lpc-add-missing-clk_disable_unprepare-in-st_r.patch new file mode 100644 index 00000000000..b0b5823e802 --- /dev/null +++ b/queue-4.19/rtc-st-lpc-add-missing-clk_disable_unprepare-in-st_r.patch @@ -0,0 +1,36 @@ +From bd6cd5a668d782799f21bdf8f294e6124bab7695 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 09:48:05 +0800 +Subject: rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe() + +From: Gaosheng Cui + +[ Upstream commit 5fb733d7bd6949e90028efdce8bd528c6ab7cf1e ] + +The clk_disable_unprepare() should be called in the error handling +of clk_get_rate(), fix it. + +Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221123014805.1993052-1-cuigaosheng1@huawei.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-st-lpc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c +index bee75ca7ff79..e66439b6247a 100644 +--- a/drivers/rtc/rtc-st-lpc.c ++++ b/drivers/rtc/rtc-st-lpc.c +@@ -249,6 +249,7 @@ static int st_rtc_probe(struct platform_device *pdev) + + rtc->clkrate = clk_get_rate(rtc->clk); + if (!rtc->clkrate) { ++ clk_disable_unprepare(rtc->clk); + dev_err(&pdev->dev, "Unable to fetch clock rate\n"); + return -EINVAL; + } +-- +2.35.1 + diff --git a/queue-4.19/rtl8xxxu-add-enumeration-for-channel-bandwidth.patch b/queue-4.19/rtl8xxxu-add-enumeration-for-channel-bandwidth.patch new file mode 100644 index 00000000000..d032283b6ea --- /dev/null +++ b/queue-4.19/rtl8xxxu-add-enumeration-for-channel-bandwidth.patch @@ -0,0 +1,58 @@ +From b474d930a85ece6c0752fc98586f89e49517853d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Mar 2020 14:38:32 +0800 +Subject: rtl8xxxu: add enumeration for channel bandwidth + +From: Chris Chiu + +[ Upstream commit a66b8b4108f178f34394681232c7df07e9b0f6be ] + +There's a data field in H2C and C2H commands which is used to +carry channel bandwidth information. Add enumeration to make it +more descriptive in code. + +Signed-off-by: Chris Chiu +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200320063833.1058-2-chiu@endlessm.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 9 +++++++++ + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- + 2 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index 7eef3f7c36ad..921a226b18f8 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1136,6 +1136,15 @@ enum bt_mp_oper_opcode_8723b { + BT_MP_OP_ENABLE_CFO_TRACKING = 0x24, + }; + ++enum rtl8xxxu_bw_mode { ++ RTL8XXXU_CHANNEL_WIDTH_20 = 0, ++ RTL8XXXU_CHANNEL_WIDTH_40 = 1, ++ RTL8XXXU_CHANNEL_WIDTH_80 = 2, ++ RTL8XXXU_CHANNEL_WIDTH_160 = 3, ++ RTL8XXXU_CHANNEL_WIDTH_80_80 = 4, ++ RTL8XXXU_CHANNEL_WIDTH_MAX = 5, ++}; ++ + struct rtl8723bu_c2h { + u8 id; + u8 seq; +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index fb8545f79fa6..c3c8382dd0ba 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -4333,7 +4333,7 @@ void rtl8xxxu_gen2_update_rate_mask(struct rtl8xxxu_priv *priv, + u32 ramask, int sgi) + { + struct h2c_cmd h2c; +- u8 bw = 0; ++ u8 bw = RTL8XXXU_CHANNEL_WIDTH_20; + + memset(&h2c, 0, sizeof(struct h2c_cmd)); + +-- +2.35.1 + diff --git a/queue-4.19/rxrpc-fix-missing-unlock-in-rxrpc_do_sendmsg.patch b/queue-4.19/rxrpc-fix-missing-unlock-in-rxrpc_do_sendmsg.patch new file mode 100644 index 00000000000..61acb24d5e6 --- /dev/null +++ b/queue-4.19/rxrpc-fix-missing-unlock-in-rxrpc_do_sendmsg.patch @@ -0,0 +1,47 @@ +From d39208c77c39ca75077d67a711662ed369bbbf63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Dec 2022 16:19:47 +0000 +Subject: rxrpc: Fix missing unlock in rxrpc_do_sendmsg() + +From: David Howells + +[ Upstream commit 4feb2c44629e6f9b459b41a5a60491069d346a95 ] + +One of the error paths in rxrpc_do_sendmsg() doesn't unlock the call mutex +before returning. Fix it to do this. + +Note that this still doesn't get rid of the checker warning: + + ../net/rxrpc/sendmsg.c:617:5: warning: context imbalance in 'rxrpc_do_sendmsg' - wrong count at exit + +I think the interplay between the socket lock and the call's user_mutex may +be too complicated for checker to analyse, especially as +rxrpc_new_client_call_for_sendmsg(), which it calls, returns with the +call's user_mutex if successful but unconditionally drops the socket lock. + +Fixes: e754eba685aa ("rxrpc: Provide a cmsg to specify the amount of Tx data for a call") +Signed-off-by: David Howells +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/sendmsg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index 0220a2935002..a7a09eb04d93 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -689,7 +689,7 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len) + if (call->tx_total_len != -1 || + call->tx_pending || + call->tx_top != 0) +- goto error_put; ++ goto out_put_unlock; + call->tx_total_len = p.call.tx_total_len; + } + } +-- +2.35.1 + diff --git a/queue-4.19/s390-ctcm-fix-return-type-of-ctc-mp-m_tx.patch b/queue-4.19/s390-ctcm-fix-return-type-of-ctc-mp-m_tx.patch new file mode 100644 index 00000000000..9a6b29469db --- /dev/null +++ b/queue-4.19/s390-ctcm-fix-return-type-of-ctc-mp-m_tx.patch @@ -0,0 +1,76 @@ +From 30014331c0e771d42ec6b3766b5f3b2f91751350 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 10:01:28 -0700 +Subject: s390/ctcm: Fix return type of ctc{mp,}m_tx() + +From: Nathan Chancellor + +[ Upstream commit aa5bf80c3c067b82b4362cd6e8e2194623bcaca6 ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/s390/net/ctcm_main.c:1064:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .ndo_start_xmit = ctcm_tx, + ^~~~~~~ + drivers/s390/net/ctcm_main.c:1072:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .ndo_start_xmit = ctcmpc_tx, + ^~~~~~~~~ + +->ndo_start_xmit() in 'struct net_device_ops' expects a return type of +'netdev_tx_t', not 'int'. Adjust the return type of ctc{mp,}m_tx() to +match the prototype's to resolve the warning and potential CFI failure, +should s390 select ARCH_SUPPORTS_CFI_CLANG in the future. + +Additionally, while in the area, remove a comment block that is no +longer relevant. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Reviewed-by: Alexandra Winter +Reviewed-by: Kees Cook +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/ctcm_main.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c +index f63c5c871d3d..d9fdcdd6760b 100644 +--- a/drivers/s390/net/ctcm_main.c ++++ b/drivers/s390/net/ctcm_main.c +@@ -867,16 +867,9 @@ static int ctcmpc_transmit_skb(struct channel *ch, struct sk_buff *skb) + /** + * Start transmission of a packet. + * Called from generic network device layer. +- * +- * skb Pointer to buffer containing the packet. +- * dev Pointer to interface struct. +- * +- * returns 0 if packet consumed, !0 if packet rejected. +- * Note: If we return !0, then the packet is free'd by +- * the generic network layer. + */ + /* first merge version - leaving both functions separated */ +-static int ctcm_tx(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ctcm_tx(struct sk_buff *skb, struct net_device *dev) + { + struct ctcm_priv *priv = dev->ml_priv; + +@@ -919,7 +912,7 @@ static int ctcm_tx(struct sk_buff *skb, struct net_device *dev) + } + + /* unmerged MPC variant of ctcm_tx */ +-static int ctcmpc_tx(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ctcmpc_tx(struct sk_buff *skb, struct net_device *dev) + { + int len = 0; + struct ctcm_priv *priv = dev->ml_priv; +-- +2.35.1 + diff --git a/queue-4.19/s390-lcs-fix-return-type-of-lcs_start_xmit.patch b/queue-4.19/s390-lcs-fix-return-type-of-lcs_start_xmit.patch new file mode 100644 index 00000000000..07ebb634455 --- /dev/null +++ b/queue-4.19/s390-lcs-fix-return-type-of-lcs_start_xmit.patch @@ -0,0 +1,68 @@ +From 0380a3420b71e63dfa3cfbfd527503b43baf57c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 10:01:30 -0700 +Subject: s390/lcs: Fix return type of lcs_start_xmit() + +From: Nathan Chancellor + +[ Upstream commit bb16db8393658e0978c3f0d30ae069e878264fa3 ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/s390/net/lcs.c:2090:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .ndo_start_xmit = lcs_start_xmit, + ^~~~~~~~~~~~~~ + drivers/s390/net/lcs.c:2097:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .ndo_start_xmit = lcs_start_xmit, + ^~~~~~~~~~~~~~ + +->ndo_start_xmit() in 'struct net_device_ops' expects a return type of +'netdev_tx_t', not 'int'. Adjust the return type of lcs_start_xmit() to +match the prototype's to resolve the warning and potential CFI failure, +should s390 select ARCH_SUPPORTS_CFI_CLANG in the future. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Reviewed-by: Alexandra Winter +Reviewed-by: Kees Cook +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/lcs.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c +index d8f99ff53a94..09e019d76bdd 100644 +--- a/drivers/s390/net/lcs.c ++++ b/drivers/s390/net/lcs.c +@@ -1518,9 +1518,8 @@ lcs_txbuffer_cb(struct lcs_channel *channel, struct lcs_buffer *buffer) + /** + * Packet transmit function called by network stack + */ +-static int +-__lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb, +- struct net_device *dev) ++static netdev_tx_t __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb, ++ struct net_device *dev) + { + struct lcs_header *header; + int rc = NETDEV_TX_OK; +@@ -1581,8 +1580,7 @@ __lcs_start_xmit(struct lcs_card *card, struct sk_buff *skb, + return rc; + } + +-static int +-lcs_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t lcs_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct lcs_card *card; + int rc; +-- +2.35.1 + diff --git a/queue-4.19/s390-netiucv-fix-return-type-of-netiucv_tx.patch b/queue-4.19/s390-netiucv-fix-return-type-of-netiucv_tx.patch new file mode 100644 index 00000000000..b1ec27eb8ae --- /dev/null +++ b/queue-4.19/s390-netiucv-fix-return-type-of-netiucv_tx.patch @@ -0,0 +1,63 @@ +From d9bd66ca6c8c517f671e46648b5aea5507451f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Nov 2022 10:01:29 -0700 +Subject: s390/netiucv: Fix return type of netiucv_tx() + +From: Nathan Chancellor + +[ Upstream commit 88d86d18d7cf7e9137c95f9d212bb9fff8a1b4be ] + +With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), +indirect call targets are validated against the expected function +pointer prototype to make sure the call target is valid to help mitigate +ROP attacks. If they are not identical, there is a failure at run time, +which manifests as either a kernel panic or thread getting killed. A +proposed warning in clang aims to catch these at compile time, which +reveals: + + drivers/s390/net/netiucv.c:1854:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] + .ndo_start_xmit = netiucv_tx, + ^~~~~~~~~~ + +->ndo_start_xmit() in 'struct net_device_ops' expects a return type of +'netdev_tx_t', not 'int'. Adjust the return type of netiucv_tx() to +match the prototype's to resolve the warning and potential CFI failure, +should s390 select ARCH_SUPPORTS_CFI_CLANG in the future. + +Additionally, while in the area, remove a comment block that is no +longer relevant. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1750 +Reviewed-by: Alexandra Winter +Reviewed-by: Kees Cook +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/netiucv.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c +index 5ce2424ca729..e2984b54447b 100644 +--- a/drivers/s390/net/netiucv.c ++++ b/drivers/s390/net/netiucv.c +@@ -1344,15 +1344,8 @@ static int netiucv_pm_restore_thaw(struct device *dev) + /** + * Start transmission of a packet. + * Called from generic network device layer. +- * +- * @param skb Pointer to buffer containing the packet. +- * @param dev Pointer to interface struct. +- * +- * @return 0 if packet consumed, !0 if packet rejected. +- * Note: If we return !0, then the packet is free'd by +- * the generic network layer. + */ +-static int netiucv_tx(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t netiucv_tx(struct sk_buff *skb, struct net_device *dev) + { + struct netiucv_priv *privptr = netdev_priv(dev); + int rc; +-- +2.35.1 + diff --git a/queue-4.19/samples-vfio-mdev-fix-missing-pci_disable_device-in-.patch b/queue-4.19/samples-vfio-mdev-fix-missing-pci_disable_device-in-.patch new file mode 100644 index 00000000000..94ec7e1dd2f --- /dev/null +++ b/queue-4.19/samples-vfio-mdev-fix-missing-pci_disable_device-in-.patch @@ -0,0 +1,59 @@ +From 19669449c0a64a15326ee754246ee654dce05b06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 09:33:41 +0800 +Subject: samples: vfio-mdev: Fix missing pci_disable_device() in + mdpy_fb_probe() + +From: Shang XiaoJing + +[ Upstream commit d1f0f50fbbbbca1e3e8157e51934613bf88f6d44 ] + +Add missing pci_disable_device() in fail path of mdpy_fb_probe(). +Besides, fix missing release functions in mdpy_fb_remove(). + +Fixes: cacade1946a4 ("sample: vfio mdev display - guest driver") +Signed-off-by: Shang XiaoJing +Link: https://lore.kernel.org/r/20221208013341.3999-1-shangxiaojing@huawei.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + samples/vfio-mdev/mdpy-fb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/samples/vfio-mdev/mdpy-fb.c b/samples/vfio-mdev/mdpy-fb.c +index a760e130bd0d..8ad1aa13ddd9 100644 +--- a/samples/vfio-mdev/mdpy-fb.c ++++ b/samples/vfio-mdev/mdpy-fb.c +@@ -109,7 +109,7 @@ static int mdpy_fb_probe(struct pci_dev *pdev, + + ret = pci_request_regions(pdev, "mdpy-fb"); + if (ret < 0) +- return ret; ++ goto err_disable_dev; + + pci_read_config_dword(pdev, MDPY_FORMAT_OFFSET, &format); + pci_read_config_dword(pdev, MDPY_WIDTH_OFFSET, &width); +@@ -191,6 +191,9 @@ static int mdpy_fb_probe(struct pci_dev *pdev, + err_release_regions: + pci_release_regions(pdev); + ++err_disable_dev: ++ pci_disable_device(pdev); ++ + return ret; + } + +@@ -199,7 +202,10 @@ static void mdpy_fb_remove(struct pci_dev *pdev) + struct fb_info *info = pci_get_drvdata(pdev); + + unregister_framebuffer(info); ++ iounmap(info->screen_base); + framebuffer_release(info); ++ pci_release_regions(pdev); ++ pci_disable_device(pdev); + } + + static struct pci_device_id mdpy_fb_pci_table[] = { +-- +2.35.1 + diff --git a/queue-4.19/scsi-fcoe-fix-possible-name-leak-when-device_registe.patch b/queue-4.19/scsi-fcoe-fix-possible-name-leak-when-device_registe.patch new file mode 100644 index 00000000000..eb372ccc407 --- /dev/null +++ b/queue-4.19/scsi-fcoe-fix-possible-name-leak-when-device_registe.patch @@ -0,0 +1,78 @@ +From 3ce48cfe926f504394204865cd0147b333f729a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Nov 2022 17:43:10 +0800 +Subject: scsi: fcoe: Fix possible name leak when device_register() fails + +From: Yang Yingliang + +[ Upstream commit 47b6a122c7b69a876c7ee2fc064a26b09627de9d ] + +If device_register() returns an error, the name allocated by dev_set_name() +needs to be freed. As the comment of device_register() says, one should use +put_device() to give up the reference in the error path. Fix this by +calling put_device(), then the name can be freed in kobject_cleanup(). + +The 'fcf' is freed in fcoe_fcf_device_release(), so the kfree() in the +error path can be removed. + +The 'ctlr' is freed in fcoe_ctlr_device_release(), so don't use the error +label, just return NULL after calling put_device(). + +Fixes: 9a74e884ee71 ("[SCSI] libfcoe: Add fcoe_sysfs") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221112094310.3633291-1-yangyingliang@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fcoe/fcoe_sysfs.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/fcoe/fcoe_sysfs.c b/drivers/scsi/fcoe/fcoe_sysfs.c +index 5c8310bade61..dab025e3ed27 100644 +--- a/drivers/scsi/fcoe/fcoe_sysfs.c ++++ b/drivers/scsi/fcoe/fcoe_sysfs.c +@@ -831,14 +831,15 @@ struct fcoe_ctlr_device *fcoe_ctlr_device_add(struct device *parent, + + dev_set_name(&ctlr->dev, "ctlr_%d", ctlr->id); + error = device_register(&ctlr->dev); +- if (error) +- goto out_del_q2; ++ if (error) { ++ destroy_workqueue(ctlr->devloss_work_q); ++ destroy_workqueue(ctlr->work_q); ++ put_device(&ctlr->dev); ++ return NULL; ++ } + + return ctlr; + +-out_del_q2: +- destroy_workqueue(ctlr->devloss_work_q); +- ctlr->devloss_work_q = NULL; + out_del_q: + destroy_workqueue(ctlr->work_q); + ctlr->work_q = NULL; +@@ -1037,16 +1038,16 @@ struct fcoe_fcf_device *fcoe_fcf_device_add(struct fcoe_ctlr_device *ctlr, + fcf->selected = new_fcf->selected; + + error = device_register(&fcf->dev); +- if (error) +- goto out_del; ++ if (error) { ++ put_device(&fcf->dev); ++ goto out; ++ } + + fcf->state = FCOE_FCF_STATE_CONNECTED; + list_add_tail(&fcf->peers, &ctlr->fcfs); + + return fcf; + +-out_del: +- kfree(fcf); + out: + return NULL; + } +-- +2.35.1 + diff --git a/queue-4.19/scsi-fcoe-fix-transport-not-deattached-when-fcoe_if_.patch b/queue-4.19/scsi-fcoe-fix-transport-not-deattached-when-fcoe_if_.patch new file mode 100644 index 00000000000..ec194cba86e --- /dev/null +++ b/queue-4.19/scsi-fcoe-fix-transport-not-deattached-when-fcoe_if_.patch @@ -0,0 +1,46 @@ +From 8151ecadd477ecfc40250c72bf29dad337bf8a04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Nov 2022 17:24:42 +0800 +Subject: scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails + +From: Chen Zhongjin + +[ Upstream commit 4155658cee394b22b24c6d64e49247bf26d95b92 ] + +fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport), but when +fcoe_if_init() fails, &fcoe_sw_transport is not detached and leaves freed +&fcoe_sw_transport on fcoe_transports list. This causes panic when +reinserting module. + + BUG: unable to handle page fault for address: fffffbfff82e2213 + RIP: 0010:fcoe_transport_attach+0xe1/0x230 [libfcoe] + Call Trace: + + do_one_initcall+0xd0/0x4e0 + load_module+0x5eee/0x7210 + ... + +Fixes: 78a582463c1e ("[SCSI] fcoe: convert fcoe.ko to become an fcoe transport provider driver") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221115092442.133088-1-chenzhongjin@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fcoe/fcoe.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c +index 6768b2e8148a..c5c4805435f6 100644 +--- a/drivers/scsi/fcoe/fcoe.c ++++ b/drivers/scsi/fcoe/fcoe.c +@@ -2519,6 +2519,7 @@ static int __init fcoe_init(void) + + out_free: + mutex_unlock(&fcoe_config_mutex); ++ fcoe_transport_detach(&fcoe_sw_transport); + out_destroy: + destroy_workqueue(fcoe_wq); + return rc; +-- +2.35.1 + diff --git a/queue-4.19/scsi-hpsa-fix-error-handling-in-hpsa_add_sas_host.patch b/queue-4.19/scsi-hpsa-fix-error-handling-in-hpsa_add_sas_host.patch new file mode 100644 index 00000000000..49a0fca6391 --- /dev/null +++ b/queue-4.19/scsi-hpsa-fix-error-handling-in-hpsa_add_sas_host.patch @@ -0,0 +1,54 @@ +From db60064ca92d5c82e1ff6e10f5f7b1e11c6fb748 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 23:11:29 +0800 +Subject: scsi: hpsa: Fix error handling in hpsa_add_sas_host() + +From: Yang Yingliang + +[ Upstream commit 4ef174a3ad9b5d73c1b6573e244ebba2b0d86eac ] + +hpsa_sas_port_add_phy() does: + ... + sas_phy_add() -> may return error here + sas_port_add_phy() + ... + +Whereas hpsa_free_sas_phy() does: + ... + sas_port_delete_phy() + sas_phy_delete() + ... + +If hpsa_sas_port_add_phy() returns an error, hpsa_free_sas_phy() can not be +called to free the memory because the port and the phy have not been added +yet. + +Replace hpsa_free_sas_phy() with sas_phy_free() and kfree() to avoid kernel +crash in this case. + +Fixes: d04e62b9d63a ("hpsa: add in sas transport class") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221110151129.394389-1-yangyingliang@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 1a4fc8b8a9cd..392dfc8f3cbb 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -9700,7 +9700,8 @@ static int hpsa_add_sas_host(struct ctlr_info *h) + return 0; + + free_sas_phy: +- hpsa_free_sas_phy(hpsa_sas_phy); ++ sas_phy_free(hpsa_sas_phy->phy); ++ kfree(hpsa_sas_phy); + free_sas_port: + hpsa_free_sas_port(hpsa_sas_port); + free_sas_node: +-- +2.35.1 + diff --git a/queue-4.19/scsi-hpsa-fix-possible-memory-leak-in-hpsa_add_sas_d.patch b/queue-4.19/scsi-hpsa-fix-possible-memory-leak-in-hpsa_add_sas_d.patch new file mode 100644 index 00000000000..e50c77aa2dc --- /dev/null +++ b/queue-4.19/scsi-hpsa-fix-possible-memory-leak-in-hpsa_add_sas_d.patch @@ -0,0 +1,43 @@ +From bcde0119c52b90c8c4fbab25d3220c0b98cc6164 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 12:30:12 +0800 +Subject: scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device() + +From: Yang Yingliang + +[ Upstream commit fda34a5d304d0b98cc967e8763b52221b66dc202 ] + +If hpsa_sas_port_add_rphy() returns an error, the 'rphy' allocated in +sas_end_device_alloc() needs to be freed. Address this by calling +sas_rphy_free() in the error path. + +Fixes: d04e62b9d63a ("hpsa: add in sas transport class") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221111043012.1074466-1-yangyingliang@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 392dfc8f3cbb..13931c5c0eff 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -9737,10 +9737,12 @@ static int hpsa_add_sas_device(struct hpsa_sas_node *hpsa_sas_node, + + rc = hpsa_sas_port_add_rphy(hpsa_sas_port, rphy); + if (rc) +- goto free_sas_port; ++ goto free_sas_rphy; + + return 0; + ++free_sas_rphy: ++ sas_rphy_free(rphy); + free_sas_port: + hpsa_free_sas_port(hpsa_sas_port); + device->sas_port = NULL; +-- +2.35.1 + diff --git a/queue-4.19/scsi-hpsa-fix-possible-memory-leak-in-hpsa_init_one.patch b/queue-4.19/scsi-hpsa-fix-possible-memory-leak-in-hpsa_init_one.patch new file mode 100644 index 00000000000..72e5c3b531f --- /dev/null +++ b/queue-4.19/scsi-hpsa-fix-possible-memory-leak-in-hpsa_init_one.patch @@ -0,0 +1,42 @@ +From 2d25a39c38deb41862b9f0c3f6a70469b965a3e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 01:57:51 +0000 +Subject: scsi: hpsa: Fix possible memory leak in hpsa_init_one() + +From: Yuan Can + +[ Upstream commit 9c9ff300e0de07475796495d86f449340d454a0c ] + +The hpda_alloc_ctlr_info() allocates h and its field reply_map. However, in +hpsa_init_one(), if alloc_percpu() failed, the hpsa_init_one() jumps to +clean1 directly, which frees h and leaks the h->reply_map. + +Fix by calling hpda_free_ctlr_info() to release h->replay_map and h instead +free h directly. + +Fixes: 8b834bff1b73 ("scsi: hpsa: fix selection of reply queue") +Signed-off-by: Yuan Can +Link: https://lore.kernel.org/r/20221122015751.87284-1-yuancan@huawei.com +Reviewed-by: Ming Lei +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 19d9c30be09d..1a4fc8b8a9cd 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -8841,7 +8841,7 @@ static int hpsa_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + destroy_workqueue(h->monitor_ctlr_wq); + h->monitor_ctlr_wq = NULL; + } +- kfree(h); ++ hpda_free_ctlr_info(h); + return rc; + } + +-- +2.35.1 + diff --git a/queue-4.19/scsi-hpsa-use-local-workqueues-instead-of-system-wor.patch b/queue-4.19/scsi-hpsa-use-local-workqueues-instead-of-system-wor.patch new file mode 100644 index 00000000000..c80d1d14a2c --- /dev/null +++ b/queue-4.19/scsi-hpsa-use-local-workqueues-instead-of-system-wor.patch @@ -0,0 +1,106 @@ +From 9db79e70fddb2093df5d58e33ec933aaeecb6706 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2019 13:32:07 -0500 +Subject: scsi: hpsa: use local workqueues instead of system workqueues + +From: Don Brace + +[ Upstream commit 0119208885b3faf2459de6d3fcc6d090580b906f ] + +Avoid system stalls by switching to local workqueue. + +Reviewed-by: Justin Lindley +Reviewed-by: David Carroll +Reviewed-by: Scott Teel +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Stable-dep-of: 9c9ff300e0de ("scsi: hpsa: Fix possible memory leak in hpsa_init_one()") +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 22 +++++++++++++++++++--- + drivers/scsi/hpsa.h | 1 + + 2 files changed, 20 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 0fe21cbdf0ca..19d9c30be09d 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -8133,6 +8133,11 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h) + destroy_workqueue(h->rescan_ctlr_wq); + h->rescan_ctlr_wq = NULL; + } ++ if (h->monitor_ctlr_wq) { ++ destroy_workqueue(h->monitor_ctlr_wq); ++ h->monitor_ctlr_wq = NULL; ++ } ++ + kfree(h); /* init_one 1 */ + } + +@@ -8481,8 +8486,8 @@ static void hpsa_event_monitor_worker(struct work_struct *work) + + spin_lock_irqsave(&h->lock, flags); + if (!h->remove_in_progress) +- schedule_delayed_work(&h->event_monitor_work, +- HPSA_EVENT_MONITOR_INTERVAL); ++ queue_delayed_work(h->monitor_ctlr_wq, &h->event_monitor_work, ++ HPSA_EVENT_MONITOR_INTERVAL); + spin_unlock_irqrestore(&h->lock, flags); + } + +@@ -8527,7 +8532,7 @@ static void hpsa_monitor_ctlr_worker(struct work_struct *work) + + spin_lock_irqsave(&h->lock, flags); + if (!h->remove_in_progress) +- schedule_delayed_work(&h->monitor_ctlr_work, ++ queue_delayed_work(h->monitor_ctlr_wq, &h->monitor_ctlr_work, + h->heartbeat_sample_interval); + spin_unlock_irqrestore(&h->lock, flags); + } +@@ -8695,6 +8700,12 @@ static int hpsa_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + goto clean7; /* aer/h */ + } + ++ h->monitor_ctlr_wq = hpsa_create_controller_wq(h, "monitor"); ++ if (!h->monitor_ctlr_wq) { ++ rc = -ENOMEM; ++ goto clean7; ++ } ++ + /* + * At this point, the controller is ready to take commands. + * Now, if reset_devices and the hard reset didn't work, try +@@ -8826,6 +8837,10 @@ static int hpsa_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + destroy_workqueue(h->rescan_ctlr_wq); + h->rescan_ctlr_wq = NULL; + } ++ if (h->monitor_ctlr_wq) { ++ destroy_workqueue(h->monitor_ctlr_wq); ++ h->monitor_ctlr_wq = NULL; ++ } + kfree(h); + return rc; + } +@@ -8973,6 +8988,7 @@ static void hpsa_remove_one(struct pci_dev *pdev) + cancel_delayed_work_sync(&h->event_monitor_work); + destroy_workqueue(h->rescan_ctlr_wq); + destroy_workqueue(h->resubmit_wq); ++ destroy_workqueue(h->monitor_ctlr_wq); + + hpsa_delete_sas_host(h); + +diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h +index 59e023696fff..7aa7378f70dd 100644 +--- a/drivers/scsi/hpsa.h ++++ b/drivers/scsi/hpsa.h +@@ -300,6 +300,7 @@ struct ctlr_info { + int needs_abort_tags_swizzled; + struct workqueue_struct *resubmit_wq; + struct workqueue_struct *rescan_ctlr_wq; ++ struct workqueue_struct *monitor_ctlr_wq; + atomic_t abort_cmds_available; + wait_queue_head_t event_sync_wait_queue; + struct mutex reset_mutex; +-- +2.35.1 + diff --git a/queue-4.19/scsi-ipr-fix-warning-in-ipr_init.patch b/queue-4.19/scsi-ipr-fix-warning-in-ipr_init.patch new file mode 100644 index 00000000000..0835b708206 --- /dev/null +++ b/queue-4.19/scsi-ipr-fix-warning-in-ipr_init.patch @@ -0,0 +1,73 @@ +From 8578bbdc5cc745737e8b72973331ce137514d661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Nov 2022 14:45:13 +0800 +Subject: scsi: ipr: Fix WARNING in ipr_init() + +From: Shang XiaoJing + +[ Upstream commit e6f108bffc3708ddcff72324f7d40dfcd0204894 ] + +ipr_init() will not call unregister_reboot_notifier() when +pci_register_driver() fails, which causes a WARNING. Call +unregister_reboot_notifier() when pci_register_driver() fails. + +notifier callback ipr_halt [ipr] already registered +WARNING: CPU: 3 PID: 299 at kernel/notifier.c:29 +notifier_chain_register+0x16d/0x230 +Modules linked in: ipr(+) xhci_pci_renesas xhci_hcd ehci_hcd usbcore +led_class gpu_sched drm_buddy video wmi drm_ttm_helper ttm +drm_display_helper drm_kms_helper drm drm_panel_orientation_quirks +agpgart cfbft +CPU: 3 PID: 299 Comm: modprobe Tainted: G W +6.1.0-rc1-00190-g39508d23b672-dirty #332 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 +RIP: 0010:notifier_chain_register+0x16d/0x230 +Call Trace: + + __blocking_notifier_chain_register+0x73/0xb0 + ipr_init+0x30/0x1000 [ipr] + do_one_initcall+0xdb/0x480 + do_init_module+0x1cf/0x680 + load_module+0x6a50/0x70a0 + __do_sys_finit_module+0x12f/0x1c0 + do_syscall_64+0x3f/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: f72919ec2bbb ("[SCSI] ipr: implement shutdown changes and remove obsolete write cache parameter") +Signed-off-by: Shang XiaoJing +Link: https://lore.kernel.org/r/20221113064513.14028-1-shangxiaojing@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ipr.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c +index c6cde552b995..5989c868bfe0 100644 +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -10854,11 +10854,19 @@ static struct notifier_block ipr_notifier = { + **/ + static int __init ipr_init(void) + { ++ int rc; ++ + ipr_info("IBM Power RAID SCSI Device Driver version: %s %s\n", + IPR_DRIVER_VERSION, IPR_DRIVER_DATE); + + register_reboot_notifier(&ipr_notifier); +- return pci_register_driver(&ipr_driver); ++ rc = pci_register_driver(&ipr_driver); ++ if (rc) { ++ unregister_reboot_notifier(&ipr_notifier); ++ return rc; ++ } ++ ++ return 0; + } + + /** +-- +2.35.1 + diff --git a/queue-4.19/scsi-mpt3sas-add-ioc_-level-logging-macros.patch b/queue-4.19/scsi-mpt3sas-add-ioc_-level-logging-macros.patch new file mode 100644 index 00000000000..ae2d69f7487 --- /dev/null +++ b/queue-4.19/scsi-mpt3sas-add-ioc_-level-logging-macros.patch @@ -0,0 +1,44 @@ +From 606bc1c2ad9c6e99973d4ea0bdfc7e639e1dad7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 08:01:08 -0700 +Subject: scsi: mpt3sas: Add ioc_ logging macros + +From: Joe Perches + +[ Upstream commit 645a20c6821cd1ab58af8a1f99659e619c216efd ] + +These macros can help identify specific logging uses and eventually perhaps +reduce object sizes. + +Signed-off-by: Joe Perches +Acked-by: Suganath Prabu +Signed-off-by: Martin K. Petersen +Stable-dep-of: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h +index 96dc15e90bd8..941a4faf20be 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.h ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.h +@@ -160,6 +160,15 @@ struct mpt3sas_nvme_cmd { + */ + #define MPT3SAS_FMT "%s: " + ++#define ioc_err(ioc, fmt, ...) \ ++ pr_err("%s: " fmt, (ioc)->name, ##__VA_ARGS__) ++#define ioc_notice(ioc, fmt, ...) \ ++ pr_notice("%s: " fmt, (ioc)->name, ##__VA_ARGS__) ++#define ioc_warn(ioc, fmt, ...) \ ++ pr_warn("%s: " fmt, (ioc)->name, ##__VA_ARGS__) ++#define ioc_info(ioc, fmt, ...) \ ++ pr_info("%s: " fmt, (ioc)->name, ##__VA_ARGS__) ++ + /* + * WarpDrive Specific Log codes + */ +-- +2.35.1 + diff --git a/queue-4.19/scsi-mpt3sas-convert-uses-of-pr_-level-with-mpt3sas_.patch b/queue-4.19/scsi-mpt3sas-convert-uses-of-pr_-level-with-mpt3sas_.patch new file mode 100644 index 00000000000..7d2ae63b46a --- /dev/null +++ b/queue-4.19/scsi-mpt3sas-convert-uses-of-pr_-level-with-mpt3sas_.patch @@ -0,0 +1,7538 @@ +From 0070f73cdb3430d48e829df84e8dcfd686179f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Sep 2018 08:01:09 -0700 +Subject: scsi: mpt3sas: Convert uses of pr_ with MPT3SAS_FMT to + ioc_ + +From: Joe Perches + +[ Upstream commit 919d8a3f3fef9910fda7e0549004cbd4243cf744 ] + +Use a more common logging style. + +Done using the perl script below and some typing + +$ git grep --name-only -w MPT3SAS_FMT -- "*.c" | \ + xargs perl -i -e 'local $/; while (<>) { s/\bpr_(info|err|notice|warn)\s*\(\s*MPT3SAS_FMT\s*("[^"]+"(?:\s*\\?\s*"[^"]+"\s*){0,5}\s*),\s*ioc->name\s*/ioc_\1(ioc, \2/g; print;}' + +Miscellanea for these conversions: + +o Coalesce formats +o Realign arguments +o Remove unnecessary parentheses +o Use casts to u64 instead of unsigned long long where appropriate +o Convert broken pr_info uses to pr_cont +o Fix broken format string concatenation with line continuations and + excess whitespace + +Signed-off-by: Joe Perches +Acked-by: Suganath Prabu +Signed-off-by: Martin K. Petersen +Stable-dep-of: 78316e9dfc24 ("scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()") +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 1065 ++++++-------- + drivers/scsi/mpt3sas/mpt3sas_config.c | 48 +- + drivers/scsi/mpt3sas/mpt3sas_ctl.c | 493 +++---- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 1425 ++++++++----------- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 313 ++-- + drivers/scsi/mpt3sas/mpt3sas_trigger_diag.c | 101 +- + drivers/scsi/mpt3sas/mpt3sas_warpdrive.c | 70 +- + 7 files changed, 1533 insertions(+), 1982 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 447ac667f4b2..27ddc128af99 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -122,8 +122,8 @@ mpt3sas_base_check_cmd_timeout(struct MPT3SAS_ADAPTER *ioc, + if (!(status & MPT3_CMD_RESET)) + issue_reset = 1; + +- pr_err(MPT3SAS_FMT "Command %s\n", ioc->name, +- ((issue_reset == 0) ? "terminated due to Host Reset" : "Timeout")); ++ ioc_err(ioc, "Command %s\n", ++ issue_reset == 0 ? "terminated due to Host Reset" : "Timeout"); + _debug_dump_mf(mpi_request, sz); + + return issue_reset; +@@ -336,9 +336,7 @@ _base_get_chain_buffer_dma_to_chain_buffer(struct MPT3SAS_ADAPTER *ioc, + return ct->chain_buffer; + } + } +- pr_info(MPT3SAS_FMT +- "Provided chain_buffer_dma address is not in the lookup list\n", +- ioc->name); ++ ioc_info(ioc, "Provided chain_buffer_dma address is not in the lookup list\n"); + return NULL; + } + +@@ -394,7 +392,7 @@ static void _clone_sg_entries(struct MPT3SAS_ADAPTER *ioc, + /* Get scsi_cmd using smid */ + scmd = mpt3sas_scsih_scsi_lookup_get(ioc, smid); + if (scmd == NULL) { +- pr_err(MPT3SAS_FMT "scmd is NULL\n", ioc->name); ++ ioc_err(ioc, "scmd is NULL\n"); + return; + } + +@@ -566,8 +564,7 @@ _base_fault_reset_work(struct work_struct *work) + + doorbell = mpt3sas_base_get_iocstate(ioc, 0); + if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_MASK) { +- pr_err(MPT3SAS_FMT "SAS host is non-operational !!!!\n", +- ioc->name); ++ ioc_err(ioc, "SAS host is non-operational !!!!\n"); + + /* It may be possible that EEH recovery can resolve some of + * pci bus failure issues rather removing the dead ioc function +@@ -600,13 +597,11 @@ _base_fault_reset_work(struct work_struct *work) + p = kthread_run(mpt3sas_remove_dead_ioc_func, ioc, + "%s_dead_ioc_%d", ioc->driver_name, ioc->id); + if (IS_ERR(p)) +- pr_err(MPT3SAS_FMT +- "%s: Running mpt3sas_dead_ioc thread failed !!!!\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: Running mpt3sas_dead_ioc thread failed !!!!\n", ++ __func__); + else +- pr_err(MPT3SAS_FMT +- "%s: Running mpt3sas_dead_ioc thread success !!!!\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: Running mpt3sas_dead_ioc thread success !!!!\n", ++ __func__); + return; /* don't rearm timer */ + } + +@@ -614,8 +609,8 @@ _base_fault_reset_work(struct work_struct *work) + + if ((doorbell & MPI2_IOC_STATE_MASK) != MPI2_IOC_STATE_OPERATIONAL) { + rc = mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); +- pr_warn(MPT3SAS_FMT "%s: hard reset: %s\n", ioc->name, +- __func__, (rc == 0) ? "success" : "failed"); ++ ioc_warn(ioc, "%s: hard reset: %s\n", ++ __func__, rc == 0 ? "success" : "failed"); + doorbell = mpt3sas_base_get_iocstate(ioc, 0); + if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) + mpt3sas_base_fault_info(ioc, doorbell & +@@ -657,8 +652,7 @@ mpt3sas_base_start_watchdog(struct MPT3SAS_ADAPTER *ioc) + ioc->fault_reset_work_q = + create_singlethread_workqueue(ioc->fault_reset_work_q_name); + if (!ioc->fault_reset_work_q) { +- pr_err(MPT3SAS_FMT "%s: failed (line=%d)\n", +- ioc->name, __func__, __LINE__); ++ ioc_err(ioc, "%s: failed (line=%d)\n", __func__, __LINE__); + return; + } + spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); +@@ -700,8 +694,7 @@ mpt3sas_base_stop_watchdog(struct MPT3SAS_ADAPTER *ioc) + void + mpt3sas_base_fault_info(struct MPT3SAS_ADAPTER *ioc , u16 fault_code) + { +- pr_err(MPT3SAS_FMT "fault_state(0x%04x)!\n", +- ioc->name, fault_code); ++ ioc_err(ioc, "fault_state(0x%04x)!\n", fault_code); + } + + /** +@@ -728,8 +721,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) + mpt3sas_base_fault_info(ioc , doorbell); + else { + writel(0xC0FFEE00, &ioc->chip->Doorbell); +- pr_err(MPT3SAS_FMT "Firmware is halted due to command timeout\n", +- ioc->name); ++ ioc_err(ioc, "Firmware is halted due to command timeout\n"); + } + + if (ioc->fwfault_debug == 2) +@@ -956,8 +948,8 @@ _base_sas_ioc_info(struct MPT3SAS_ADAPTER *ioc, MPI2DefaultReply_t *mpi_reply, + break; + } + +- pr_warn(MPT3SAS_FMT "ioc_status: %s(0x%04x), request(0x%p),(%s)\n", +- ioc->name, desc, ioc_status, request_hdr, func_str); ++ ioc_warn(ioc, "ioc_status: %s(0x%04x), request(0x%p),(%s)\n", ++ desc, ioc_status, request_hdr, func_str); + + _debug_dump_mf(request_hdr, frame_sz/4); + } +@@ -1003,9 +995,9 @@ _base_display_event_data(struct MPT3SAS_ADAPTER *ioc, + { + Mpi2EventDataSasDiscovery_t *event_data = + (Mpi2EventDataSasDiscovery_t *)mpi_reply->EventData; +- pr_info(MPT3SAS_FMT "Discovery: (%s)", ioc->name, +- (event_data->ReasonCode == MPI2_EVENT_SAS_DISC_RC_STARTED) ? +- "start" : "stop"); ++ ioc_info(ioc, "Discovery: (%s)", ++ event_data->ReasonCode == MPI2_EVENT_SAS_DISC_RC_STARTED ? ++ "start" : "stop"); + if (event_data->DiscoveryStatus) + pr_cont(" discovery_status(0x%08x)", + le32_to_cpu(event_data->DiscoveryStatus)); +@@ -1059,14 +1051,13 @@ _base_display_event_data(struct MPT3SAS_ADAPTER *ioc, + { + Mpi26EventDataPCIeEnumeration_t *event_data = + (Mpi26EventDataPCIeEnumeration_t *)mpi_reply->EventData; +- pr_info(MPT3SAS_FMT "PCIE Enumeration: (%s)", ioc->name, +- (event_data->ReasonCode == +- MPI26_EVENT_PCIE_ENUM_RC_STARTED) ? +- "start" : "stop"); ++ ioc_info(ioc, "PCIE Enumeration: (%s)", ++ event_data->ReasonCode == MPI26_EVENT_PCIE_ENUM_RC_STARTED ? ++ "start" : "stop"); + if (event_data->EnumerationStatus) +- pr_info("enumeration_status(0x%08x)", +- le32_to_cpu(event_data->EnumerationStatus)); +- pr_info("\n"); ++ pr_cont("enumeration_status(0x%08x)", ++ le32_to_cpu(event_data->EnumerationStatus)); ++ pr_cont("\n"); + return; + } + case MPI2_EVENT_PCIE_TOPOLOGY_CHANGE_LIST: +@@ -1077,7 +1068,7 @@ _base_display_event_data(struct MPT3SAS_ADAPTER *ioc, + if (!desc) + return; + +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, desc); ++ ioc_info(ioc, "%s\n", desc); + } + + /** +@@ -1128,11 +1119,9 @@ _base_sas_log_info(struct MPT3SAS_ADAPTER *ioc , u32 log_info) + break; + } + +- pr_warn(MPT3SAS_FMT +- "log_info(0x%08x): originator(%s), code(0x%02x), sub_code(0x%04x)\n", +- ioc->name, log_info, +- originator_str, sas_loginfo.dw.code, +- sas_loginfo.dw.subcode); ++ ioc_warn(ioc, "log_info(0x%08x): originator(%s), code(0x%02x), sub_code(0x%04x)\n", ++ log_info, ++ originator_str, sas_loginfo.dw.code, sas_loginfo.dw.subcode); + } + + /** +@@ -1152,8 +1141,8 @@ _base_display_reply_info(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, + + mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply); + if (unlikely(!mpi_reply)) { +- pr_err(MPT3SAS_FMT "mpi_reply not valid at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "mpi_reply not valid at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + ioc_status = le16_to_cpu(mpi_reply->IOCStatus); +@@ -1249,9 +1238,9 @@ _base_async_event(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, u32 reply) + delayed_event_ack->EventContext = mpi_reply->EventContext; + list_add_tail(&delayed_event_ack->list, + &ioc->delayed_event_ack_list); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "DELAYED: EVENT ACK: event (0x%04x)\n", +- ioc->name, le16_to_cpu(mpi_reply->Event))); ++ dewtprintk(ioc, ++ ioc_info(ioc, "DELAYED: EVENT ACK: event (0x%04x)\n", ++ le16_to_cpu(mpi_reply->Event))); + goto out; + } + +@@ -2600,9 +2589,8 @@ _base_config_dma_addressing(struct MPT3SAS_ADAPTER *ioc, struct pci_dev *pdev) + + out: + si_meminfo(&s); +- pr_info(MPT3SAS_FMT +- "%d BIT PCI BUS DMA ADDRESSING SUPPORTED, total mem (%ld kB)\n", +- ioc->name, ioc->dma_mask, convert_to_kb(s.totalram)); ++ ioc_info(ioc, "%d BIT PCI BUS DMA ADDRESSING SUPPORTED, total mem (%ld kB)\n", ++ ioc->dma_mask, convert_to_kb(s.totalram)); + + return 0; + } +@@ -2641,8 +2629,7 @@ _base_check_enable_msix(struct MPT3SAS_ADAPTER *ioc) + + base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX); + if (!base) { +- dfailprintk(ioc, pr_info(MPT3SAS_FMT "msix not supported\n", +- ioc->name)); ++ dfailprintk(ioc, ioc_info(ioc, "msix not supported\n")); + return -EINVAL; + } + +@@ -2660,9 +2647,8 @@ _base_check_enable_msix(struct MPT3SAS_ADAPTER *ioc) + pci_read_config_word(ioc->pdev, base + 2, &message_control); + ioc->msix_vector_count = (message_control & 0x3FF) + 1; + } +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "msix is supported, vector_count(%d)\n", +- ioc->name, ioc->msix_vector_count)); ++ dinitprintk(ioc, ioc_info(ioc, "msix is supported, vector_count(%d)\n", ++ ioc->msix_vector_count)); + return 0; + } + +@@ -2704,8 +2690,8 @@ _base_request_irq(struct MPT3SAS_ADAPTER *ioc, u8 index) + + reply_q = kzalloc(sizeof(struct adapter_reply_queue), GFP_KERNEL); + if (!reply_q) { +- pr_err(MPT3SAS_FMT "unable to allocate memory %d!\n", +- ioc->name, (int)sizeof(struct adapter_reply_queue)); ++ ioc_err(ioc, "unable to allocate memory %zu!\n", ++ sizeof(struct adapter_reply_queue)); + return -ENOMEM; + } + reply_q->ioc = ioc; +@@ -2763,8 +2749,8 @@ _base_assign_reply_queues(struct MPT3SAS_ADAPTER *ioc) + const cpumask_t *mask = pci_irq_get_affinity(ioc->pdev, + reply_q->msix_index); + if (!mask) { +- pr_warn(MPT3SAS_FMT "no affinity for msi %x\n", +- ioc->name, reply_q->msix_index); ++ ioc_warn(ioc, "no affinity for msi %x\n", ++ reply_q->msix_index); + continue; + } + +@@ -2859,9 +2845,9 @@ _base_enable_msix(struct MPT3SAS_ADAPTER *ioc) + r = pci_alloc_irq_vectors(ioc->pdev, 1, ioc->reply_queue_count, + irq_flags); + if (r < 0) { +- dfailprintk(ioc, pr_info(MPT3SAS_FMT +- "pci_alloc_irq_vectors failed (r=%d) !!!\n", +- ioc->name, r)); ++ dfailprintk(ioc, ++ ioc_info(ioc, "pci_alloc_irq_vectors failed (r=%d) !!!\n", ++ r)); + goto try_ioapic; + } + +@@ -2884,9 +2870,9 @@ _base_enable_msix(struct MPT3SAS_ADAPTER *ioc) + ioc->reply_queue_count = 1; + r = pci_alloc_irq_vectors(ioc->pdev, 1, 1, PCI_IRQ_LEGACY); + if (r < 0) { +- dfailprintk(ioc, pr_info(MPT3SAS_FMT +- "pci_alloc_irq_vector(legacy) failed (r=%d) !!!\n", +- ioc->name, r)); ++ dfailprintk(ioc, ++ ioc_info(ioc, "pci_alloc_irq_vector(legacy) failed (r=%d) !!!\n", ++ r)); + } else + r = _base_request_irq(ioc, 0); + +@@ -2941,13 +2927,11 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc) + phys_addr_t chip_phys = 0; + struct adapter_reply_queue *reply_q; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", +- ioc->name, __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + ioc->bars = pci_select_bars(pdev, IORESOURCE_MEM); + if (pci_enable_device_mem(pdev)) { +- pr_warn(MPT3SAS_FMT "pci_enable_device_mem: failed\n", +- ioc->name); ++ ioc_warn(ioc, "pci_enable_device_mem: failed\n"); + ioc->bars = 0; + return -ENODEV; + } +@@ -2955,8 +2939,7 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc) + + if (pci_request_selected_regions(pdev, ioc->bars, + ioc->driver_name)) { +- pr_warn(MPT3SAS_FMT "pci_request_selected_regions: failed\n", +- ioc->name); ++ ioc_warn(ioc, "pci_request_selected_regions: failed\n"); + ioc->bars = 0; + r = -ENODEV; + goto out_fail; +@@ -2969,8 +2952,7 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc) + + + if (_base_config_dma_addressing(ioc, pdev) != 0) { +- pr_warn(MPT3SAS_FMT "no suitable DMA mask for %s\n", +- ioc->name, pci_name(pdev)); ++ ioc_warn(ioc, "no suitable DMA mask for %s\n", pci_name(pdev)); + r = -ENODEV; + goto out_fail; + } +@@ -2993,8 +2975,7 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc) + } + + if (ioc->chip == NULL) { +- pr_err(MPT3SAS_FMT "unable to map adapter memory! " +- " or resource not found\n", ioc->name); ++ ioc_err(ioc, "unable to map adapter memory! or resource not found\n"); + r = -EINVAL; + goto out_fail; + } +@@ -3060,10 +3041,10 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc) + "IO-APIC enabled"), + pci_irq_vector(ioc->pdev, reply_q->msix_index)); + +- pr_info(MPT3SAS_FMT "iomem(%pap), mapped(0x%p), size(%d)\n", +- ioc->name, &chip_phys, ioc->chip, memap_sz); +- pr_info(MPT3SAS_FMT "ioport(0x%016llx), size(%d)\n", +- ioc->name, (unsigned long long)pio_chip, pio_sz); ++ ioc_info(ioc, "iomem(%pap), mapped(0x%p), size(%d)\n", ++ &chip_phys, ioc->chip, memap_sz); ++ ioc_info(ioc, "ioport(0x%016llx), size(%d)\n", ++ (unsigned long long)pio_chip, pio_sz); + + /* Save PCI configuration state for recovery from PCI AER/EEH errors */ + pci_save_state(pdev); +@@ -3178,8 +3159,7 @@ mpt3sas_base_get_smid(struct MPT3SAS_ADAPTER *ioc, u8 cb_idx) + spin_lock_irqsave(&ioc->scsi_lookup_lock, flags); + if (list_empty(&ioc->internal_free_list)) { + spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags); +- pr_err(MPT3SAS_FMT "%s: smid not available\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: smid not available\n", __func__); + return 0; + } + +@@ -3554,89 +3534,85 @@ _base_display_OEMs_branding(struct MPT3SAS_ADAPTER *ioc) + case MPI2_MFGPAGE_DEVID_SAS2008: + switch (ioc->pdev->subsystem_device) { + case MPT2SAS_INTEL_RMS2LL080_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS2LL080_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS2LL080_BRANDING); + break; + case MPT2SAS_INTEL_RMS2LL040_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS2LL040_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS2LL040_BRANDING); + break; + case MPT2SAS_INTEL_SSD910_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_SSD910_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_SSD910_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "Intel(R) Controller: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Intel(R) Controller: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + case MPI2_MFGPAGE_DEVID_SAS2308_2: + switch (ioc->pdev->subsystem_device) { + case MPT2SAS_INTEL_RS25GB008_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RS25GB008_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RS25GB008_BRANDING); + break; + case MPT2SAS_INTEL_RMS25JB080_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS25JB080_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS25JB080_BRANDING); + break; + case MPT2SAS_INTEL_RMS25JB040_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS25JB040_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS25JB040_BRANDING); + break; + case MPT2SAS_INTEL_RMS25KB080_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS25KB080_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS25KB080_BRANDING); + break; + case MPT2SAS_INTEL_RMS25KB040_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS25KB040_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS25KB040_BRANDING); + break; + case MPT2SAS_INTEL_RMS25LB040_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS25LB040_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS25LB040_BRANDING); + break; + case MPT2SAS_INTEL_RMS25LB080_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_INTEL_RMS25LB080_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_INTEL_RMS25LB080_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "Intel(R) Controller: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Intel(R) Controller: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + case MPI25_MFGPAGE_DEVID_SAS3008: + switch (ioc->pdev->subsystem_device) { + case MPT3SAS_INTEL_RMS3JC080_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_INTEL_RMS3JC080_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_INTEL_RMS3JC080_BRANDING); + break; + + case MPT3SAS_INTEL_RS3GC008_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_INTEL_RS3GC008_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_INTEL_RS3GC008_BRANDING); + break; + case MPT3SAS_INTEL_RS3FC044_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_INTEL_RS3FC044_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_INTEL_RS3FC044_BRANDING); + break; + case MPT3SAS_INTEL_RS3UC080_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_INTEL_RS3UC080_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_INTEL_RS3UC080_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "Intel(R) Controller: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Intel(R) Controller: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; + default: +- pr_info(MPT3SAS_FMT +- "Intel(R) Controller: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Intel(R) Controller: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; +@@ -3645,57 +3621,54 @@ _base_display_OEMs_branding(struct MPT3SAS_ADAPTER *ioc) + case MPI2_MFGPAGE_DEVID_SAS2008: + switch (ioc->pdev->subsystem_device) { + case MPT2SAS_DELL_6GBPS_SAS_HBA_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_DELL_6GBPS_SAS_HBA_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_DELL_6GBPS_SAS_HBA_BRANDING); + break; + case MPT2SAS_DELL_PERC_H200_ADAPTER_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_DELL_PERC_H200_ADAPTER_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_DELL_PERC_H200_ADAPTER_BRANDING); + break; + case MPT2SAS_DELL_PERC_H200_INTEGRATED_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_DELL_PERC_H200_INTEGRATED_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_DELL_PERC_H200_INTEGRATED_BRANDING); + break; + case MPT2SAS_DELL_PERC_H200_MODULAR_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_DELL_PERC_H200_MODULAR_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_DELL_PERC_H200_MODULAR_BRANDING); + break; + case MPT2SAS_DELL_PERC_H200_EMBEDDED_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_DELL_PERC_H200_EMBEDDED_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_DELL_PERC_H200_EMBEDDED_BRANDING); + break; + case MPT2SAS_DELL_PERC_H200_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_DELL_PERC_H200_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_DELL_PERC_H200_BRANDING); + break; + case MPT2SAS_DELL_6GBPS_SAS_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_DELL_6GBPS_SAS_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_DELL_6GBPS_SAS_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "Dell 6Gbps HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Dell 6Gbps HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; + case MPI25_MFGPAGE_DEVID_SAS3008: + switch (ioc->pdev->subsystem_device) { + case MPT3SAS_DELL_12G_HBA_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_DELL_12G_HBA_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_DELL_12G_HBA_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "Dell 12Gbps HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Dell 12Gbps HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; + default: +- pr_info(MPT3SAS_FMT +- "Dell HBA: Subsystem ID: 0x%X\n", ioc->name, +- ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Dell HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; +@@ -3704,46 +3677,42 @@ _base_display_OEMs_branding(struct MPT3SAS_ADAPTER *ioc) + case MPI25_MFGPAGE_DEVID_SAS3008: + switch (ioc->pdev->subsystem_device) { + case MPT3SAS_CISCO_12G_8E_HBA_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_CISCO_12G_8E_HBA_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_CISCO_12G_8E_HBA_BRANDING); + break; + case MPT3SAS_CISCO_12G_8I_HBA_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_CISCO_12G_8I_HBA_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_CISCO_12G_8I_HBA_BRANDING); + break; + case MPT3SAS_CISCO_12G_AVILA_HBA_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_CISCO_12G_AVILA_HBA_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_CISCO_12G_AVILA_HBA_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "Cisco 12Gbps SAS HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Cisco 12Gbps SAS HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; + case MPI25_MFGPAGE_DEVID_SAS3108_1: + switch (ioc->pdev->subsystem_device) { + case MPT3SAS_CISCO_12G_AVILA_HBA_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_CISCO_12G_AVILA_HBA_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_CISCO_12G_AVILA_HBA_BRANDING); + break; + case MPT3SAS_CISCO_12G_COLUSA_MEZZANINE_HBA_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT3SAS_CISCO_12G_COLUSA_MEZZANINE_HBA_BRANDING +- ); ++ ioc_info(ioc, "%s\n", ++ MPT3SAS_CISCO_12G_COLUSA_MEZZANINE_HBA_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "Cisco 12Gbps SAS HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Cisco 12Gbps SAS HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; + default: +- pr_info(MPT3SAS_FMT +- "Cisco SAS HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "Cisco SAS HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + break; +@@ -3752,43 +3721,40 @@ _base_display_OEMs_branding(struct MPT3SAS_ADAPTER *ioc) + case MPI2_MFGPAGE_DEVID_SAS2004: + switch (ioc->pdev->subsystem_device) { + case MPT2SAS_HP_DAUGHTER_2_4_INTERNAL_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_HP_DAUGHTER_2_4_INTERNAL_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_HP_DAUGHTER_2_4_INTERNAL_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "HP 6Gbps SAS HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "HP 6Gbps SAS HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + case MPI2_MFGPAGE_DEVID_SAS2308_2: + switch (ioc->pdev->subsystem_device) { + case MPT2SAS_HP_2_4_INTERNAL_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_HP_2_4_INTERNAL_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_HP_2_4_INTERNAL_BRANDING); + break; + case MPT2SAS_HP_2_4_EXTERNAL_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_HP_2_4_EXTERNAL_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_HP_2_4_EXTERNAL_BRANDING); + break; + case MPT2SAS_HP_1_4_INTERNAL_1_4_EXTERNAL_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_HP_1_4_INTERNAL_1_4_EXTERNAL_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_HP_1_4_INTERNAL_1_4_EXTERNAL_BRANDING); + break; + case MPT2SAS_HP_EMBEDDED_2_4_INTERNAL_SSDID: +- pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- MPT2SAS_HP_EMBEDDED_2_4_INTERNAL_BRANDING); ++ ioc_info(ioc, "%s\n", ++ MPT2SAS_HP_EMBEDDED_2_4_INTERNAL_BRANDING); + break; + default: +- pr_info(MPT3SAS_FMT +- "HP 6Gbps SAS HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "HP 6Gbps SAS HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + default: +- pr_info(MPT3SAS_FMT +- "HP SAS HBA: Subsystem ID: 0x%X\n", +- ioc->name, ioc->pdev->subsystem_device); ++ ioc_info(ioc, "HP SAS HBA: Subsystem ID: 0x%X\n", ++ ioc->pdev->subsystem_device); + break; + } + default: +@@ -3815,12 +3781,10 @@ _base_display_fwpkg_version(struct MPT3SAS_ADAPTER *ioc) + u16 smid, ioc_status; + size_t data_length; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + if (ioc->base_cmds.status & MPT3_CMD_PENDING) { +- pr_err(MPT3SAS_FMT "%s: internal command already in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: internal command already in use\n", __func__); + return -EAGAIN; + } + +@@ -3828,15 +3792,14 @@ _base_display_fwpkg_version(struct MPT3SAS_ADAPTER *ioc) + fwpkg_data = pci_alloc_consistent(ioc->pdev, data_length, + &fwpkg_data_dma); + if (!fwpkg_data) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -ENOMEM; + } + + smid = mpt3sas_base_get_smid(ioc, ioc->base_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + r = -EAGAIN; + goto out; + } +@@ -3855,11 +3818,9 @@ _base_display_fwpkg_version(struct MPT3SAS_ADAPTER *ioc) + /* Wait for 15 seconds */ + wait_for_completion_timeout(&ioc->base_cmds.done, + FW_IMG_HDR_READ_TIMEOUT*HZ); +- pr_info(MPT3SAS_FMT "%s: complete\n", +- ioc->name, __func__); ++ ioc_info(ioc, "%s: complete\n", __func__); + if (!(ioc->base_cmds.status & MPT3_CMD_COMPLETE)) { +- pr_err(MPT3SAS_FMT "%s: timeout\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: timeout\n", __func__); + _debug_dump_mf(mpi_request, + sizeof(Mpi25FWUploadRequest_t)/4); + r = -ETIME; +@@ -3873,13 +3834,11 @@ _base_display_fwpkg_version(struct MPT3SAS_ADAPTER *ioc) + if (ioc_status == MPI2_IOCSTATUS_SUCCESS) { + FWImgHdr = (Mpi2FWImageHeader_t *)fwpkg_data; + if (FWImgHdr->PackageVersion.Word) { +- pr_info(MPT3SAS_FMT "FW Package Version" +- "(%02d.%02d.%02d.%02d)\n", +- ioc->name, +- FWImgHdr->PackageVersion.Struct.Major, +- FWImgHdr->PackageVersion.Struct.Minor, +- FWImgHdr->PackageVersion.Struct.Unit, +- FWImgHdr->PackageVersion.Struct.Dev); ++ ioc_info(ioc, "FW Package Version (%02d.%02d.%02d.%02d)\n", ++ FWImgHdr->PackageVersion.Struct.Major, ++ FWImgHdr->PackageVersion.Struct.Minor, ++ FWImgHdr->PackageVersion.Struct.Unit, ++ FWImgHdr->PackageVersion.Struct.Dev); + } + } else { + _debug_dump_mf(&mpi_reply, +@@ -3909,18 +3868,17 @@ _base_display_ioc_capabilities(struct MPT3SAS_ADAPTER *ioc) + + bios_version = le32_to_cpu(ioc->bios_pg3.BiosVersion); + strncpy(desc, ioc->manu_pg0.ChipName, 16); +- pr_info(MPT3SAS_FMT "%s: FWVersion(%02d.%02d.%02d.%02d), "\ +- "ChipRevision(0x%02x), BiosVersion(%02d.%02d.%02d.%02d)\n", +- ioc->name, desc, +- (ioc->facts.FWVersion.Word & 0xFF000000) >> 24, +- (ioc->facts.FWVersion.Word & 0x00FF0000) >> 16, +- (ioc->facts.FWVersion.Word & 0x0000FF00) >> 8, +- ioc->facts.FWVersion.Word & 0x000000FF, +- ioc->pdev->revision, +- (bios_version & 0xFF000000) >> 24, +- (bios_version & 0x00FF0000) >> 16, +- (bios_version & 0x0000FF00) >> 8, +- bios_version & 0x000000FF); ++ ioc_info(ioc, "%s: FWVersion(%02d.%02d.%02d.%02d), ChipRevision(0x%02x), BiosVersion(%02d.%02d.%02d.%02d)\n", ++ desc, ++ (ioc->facts.FWVersion.Word & 0xFF000000) >> 24, ++ (ioc->facts.FWVersion.Word & 0x00FF0000) >> 16, ++ (ioc->facts.FWVersion.Word & 0x0000FF00) >> 8, ++ ioc->facts.FWVersion.Word & 0x000000FF, ++ ioc->pdev->revision, ++ (bios_version & 0xFF000000) >> 24, ++ (bios_version & 0x00FF0000) >> 16, ++ (bios_version & 0x0000FF00) >> 8, ++ bios_version & 0x000000FF); + + _base_display_OEMs_branding(ioc); + +@@ -3929,82 +3887,81 @@ _base_display_ioc_capabilities(struct MPT3SAS_ADAPTER *ioc) + i++; + } + +- pr_info(MPT3SAS_FMT "Protocol=(", ioc->name); ++ ioc_info(ioc, "Protocol=("); + + if (ioc->facts.ProtocolFlags & MPI2_IOCFACTS_PROTOCOL_SCSI_INITIATOR) { +- pr_info("Initiator"); ++ pr_cont("Initiator"); + i++; + } + + if (ioc->facts.ProtocolFlags & MPI2_IOCFACTS_PROTOCOL_SCSI_TARGET) { +- pr_info("%sTarget", i ? "," : ""); ++ pr_cont("%sTarget", i ? "," : ""); + i++; + } + + i = 0; +- pr_info("), "); +- pr_info("Capabilities=("); ++ pr_cont("), Capabilities=("); + + if (!ioc->hide_ir_msg) { + if (ioc->facts.IOCCapabilities & + MPI2_IOCFACTS_CAPABILITY_INTEGRATED_RAID) { +- pr_info("Raid"); ++ pr_cont("Raid"); + i++; + } + } + + if (ioc->facts.IOCCapabilities & MPI2_IOCFACTS_CAPABILITY_TLR) { +- pr_info("%sTLR", i ? "," : ""); ++ pr_cont("%sTLR", i ? "," : ""); + i++; + } + + if (ioc->facts.IOCCapabilities & MPI2_IOCFACTS_CAPABILITY_MULTICAST) { +- pr_info("%sMulticast", i ? "," : ""); ++ pr_cont("%sMulticast", i ? "," : ""); + i++; + } + + if (ioc->facts.IOCCapabilities & + MPI2_IOCFACTS_CAPABILITY_BIDIRECTIONAL_TARGET) { +- pr_info("%sBIDI Target", i ? "," : ""); ++ pr_cont("%sBIDI Target", i ? "," : ""); + i++; + } + + if (ioc->facts.IOCCapabilities & MPI2_IOCFACTS_CAPABILITY_EEDP) { +- pr_info("%sEEDP", i ? "," : ""); ++ pr_cont("%sEEDP", i ? "," : ""); + i++; + } + + if (ioc->facts.IOCCapabilities & + MPI2_IOCFACTS_CAPABILITY_SNAPSHOT_BUFFER) { +- pr_info("%sSnapshot Buffer", i ? "," : ""); ++ pr_cont("%sSnapshot Buffer", i ? "," : ""); + i++; + } + + if (ioc->facts.IOCCapabilities & + MPI2_IOCFACTS_CAPABILITY_DIAG_TRACE_BUFFER) { +- pr_info("%sDiag Trace Buffer", i ? "," : ""); ++ pr_cont("%sDiag Trace Buffer", i ? "," : ""); + i++; + } + + if (ioc->facts.IOCCapabilities & + MPI2_IOCFACTS_CAPABILITY_EXTENDED_BUFFER) { +- pr_info("%sDiag Extended Buffer", i ? "," : ""); ++ pr_cont("%sDiag Extended Buffer", i ? "," : ""); + i++; + } + + if (ioc->facts.IOCCapabilities & + MPI2_IOCFACTS_CAPABILITY_TASK_SET_FULL_HANDLING) { +- pr_info("%sTask Set Full", i ? "," : ""); ++ pr_cont("%sTask Set Full", i ? "," : ""); + i++; + } + + iounit_pg1_flags = le32_to_cpu(ioc->iounit_pg1.Flags); + if (!(iounit_pg1_flags & MPI2_IOUNITPAGE1_NATIVE_COMMAND_Q_DISABLE)) { +- pr_info("%sNCQ", i ? "," : ""); ++ pr_cont("%sNCQ", i ? "," : ""); + i++; + } + +- pr_info(")\n"); ++ pr_cont(")\n"); + } + + /** +@@ -4037,21 +3994,21 @@ mpt3sas_base_update_missing_delay(struct MPT3SAS_ADAPTER *ioc, + sizeof(Mpi2SasIOUnit1PhyData_t)); + sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); + if (!sas_iounit_pg1) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + if ((mpt3sas_config_get_sas_iounit_pg1(ioc, &mpi_reply, + sas_iounit_pg1, sz))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + +@@ -4083,11 +4040,11 @@ mpt3sas_base_update_missing_delay(struct MPT3SAS_ADAPTER *ioc, + else + dmd_new = + dmd & MPI2_SASIOUNIT1_REPORT_MISSING_TIMEOUT_MASK; +- pr_info(MPT3SAS_FMT "device_missing_delay: old(%d), new(%d)\n", +- ioc->name, dmd_orignal, dmd_new); +- pr_info(MPT3SAS_FMT "ioc_missing_delay: old(%d), new(%d)\n", +- ioc->name, io_missing_delay_original, +- io_missing_delay); ++ ioc_info(ioc, "device_missing_delay: old(%d), new(%d)\n", ++ dmd_orignal, dmd_new); ++ ioc_info(ioc, "ioc_missing_delay: old(%d), new(%d)\n", ++ io_missing_delay_original, ++ io_missing_delay); + ioc->device_missing_delay = dmd_new; + ioc->io_missing_delay = io_missing_delay; + } +@@ -4198,33 +4155,32 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) + struct chain_tracker *ct; + struct reply_post_struct *rps; + +- dexitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dexitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + if (ioc->request) { + pci_free_consistent(ioc->pdev, ioc->request_dma_sz, + ioc->request, ioc->request_dma); +- dexitprintk(ioc, pr_info(MPT3SAS_FMT +- "request_pool(0x%p): free\n", +- ioc->name, ioc->request)); ++ dexitprintk(ioc, ++ ioc_info(ioc, "request_pool(0x%p): free\n", ++ ioc->request)); + ioc->request = NULL; + } + + if (ioc->sense) { + dma_pool_free(ioc->sense_dma_pool, ioc->sense, ioc->sense_dma); + dma_pool_destroy(ioc->sense_dma_pool); +- dexitprintk(ioc, pr_info(MPT3SAS_FMT +- "sense_pool(0x%p): free\n", +- ioc->name, ioc->sense)); ++ dexitprintk(ioc, ++ ioc_info(ioc, "sense_pool(0x%p): free\n", ++ ioc->sense)); + ioc->sense = NULL; + } + + if (ioc->reply) { + dma_pool_free(ioc->reply_dma_pool, ioc->reply, ioc->reply_dma); + dma_pool_destroy(ioc->reply_dma_pool); +- dexitprintk(ioc, pr_info(MPT3SAS_FMT +- "reply_pool(0x%p): free\n", +- ioc->name, ioc->reply)); ++ dexitprintk(ioc, ++ ioc_info(ioc, "reply_pool(0x%p): free\n", ++ ioc->reply)); + ioc->reply = NULL; + } + +@@ -4232,9 +4188,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) + dma_pool_free(ioc->reply_free_dma_pool, ioc->reply_free, + ioc->reply_free_dma); + dma_pool_destroy(ioc->reply_free_dma_pool); +- dexitprintk(ioc, pr_info(MPT3SAS_FMT +- "reply_free_pool(0x%p): free\n", +- ioc->name, ioc->reply_free)); ++ dexitprintk(ioc, ++ ioc_info(ioc, "reply_free_pool(0x%p): free\n", ++ ioc->reply_free)); + ioc->reply_free = NULL; + } + +@@ -4246,9 +4202,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->reply_post_free_dma_pool, + rps->reply_post_free, + rps->reply_post_free_dma); +- dexitprintk(ioc, pr_info(MPT3SAS_FMT +- "reply_post_free_pool(0x%p): free\n", +- ioc->name, rps->reply_post_free)); ++ dexitprintk(ioc, ++ ioc_info(ioc, "reply_post_free_pool(0x%p): free\n", ++ rps->reply_post_free)); + rps->reply_post_free = NULL; + } + } while (ioc->rdpq_array_enable && +@@ -4276,9 +4232,9 @@ _base_release_memory_pools(struct MPT3SAS_ADAPTER *ioc) + } + + if (ioc->config_page) { +- dexitprintk(ioc, pr_info(MPT3SAS_FMT +- "config_page(0x%p): free\n", ioc->name, +- ioc->config_page)); ++ dexitprintk(ioc, ++ ioc_info(ioc, "config_page(0x%p): free\n", ++ ioc->config_page)); + pci_free_consistent(ioc->pdev, ioc->config_page_sz, + ioc->config_page, ioc->config_page_dma); + } +@@ -4349,8 +4305,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + int i, j; + struct chain_tracker *ct; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + + retry_sz = 0; +@@ -4379,10 +4334,8 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + else if (sg_tablesize > MPT_MAX_PHYS_SEGMENTS) { + sg_tablesize = min_t(unsigned short, sg_tablesize, + SG_MAX_SEGMENTS); +- pr_warn(MPT3SAS_FMT +- "sg_tablesize(%u) is bigger than kernel " +- "defined SG_CHUNK_SIZE(%u)\n", ioc->name, +- sg_tablesize, MPT_MAX_PHYS_SEGMENTS); ++ ioc_warn(ioc, "sg_tablesize(%u) is bigger than kernel defined SG_CHUNK_SIZE(%u)\n", ++ sg_tablesize, MPT_MAX_PHYS_SEGMENTS); + } + ioc->shost->sg_tablesize = sg_tablesize; + } +@@ -4392,9 +4345,8 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + if (ioc->internal_depth < INTERNAL_CMDS_COUNT) { + if (facts->RequestCredit <= (INTERNAL_CMDS_COUNT + + INTERNAL_SCSIIO_CMDS_COUNT)) { +- pr_err(MPT3SAS_FMT "IOC doesn't have enough Request \ +- Credits, it has just %d number of credits\n", +- ioc->name, facts->RequestCredit); ++ ioc_err(ioc, "IOC doesn't have enough Request Credits, it has just %d number of credits\n", ++ facts->RequestCredit); + return -ENOMEM; + } + ioc->internal_depth = 10; +@@ -4493,11 +4445,12 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->reply_free_queue_depth = ioc->hba_queue_depth + 64; + } + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "scatter gather: " \ +- "sge_in_main_msg(%d), sge_per_chain(%d), sge_per_io(%d), " +- "chains_per_io(%d)\n", ioc->name, ioc->max_sges_in_main_message, +- ioc->max_sges_in_chain_message, ioc->shost->sg_tablesize, +- ioc->chains_needed_per_io)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "scatter gather: sge_in_main_msg(%d), sge_per_chain(%d), sge_per_io(%d), chains_per_io(%d)\n", ++ ioc->max_sges_in_main_message, ++ ioc->max_sges_in_chain_message, ++ ioc->shost->sg_tablesize, ++ ioc->chains_needed_per_io)); + + /* reply post queue, 16 byte align */ + reply_post_free_sz = ioc->reply_post_queue_depth * +@@ -4512,16 +4465,13 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + sizeof(struct reply_post_struct), GFP_KERNEL); + + if (!ioc->reply_post) { +- pr_err(MPT3SAS_FMT "reply_post_free pool: kcalloc failed\n", +- ioc->name); ++ ioc_err(ioc, "reply_post_free pool: kcalloc failed\n"); + goto out; + } + ioc->reply_post_free_dma_pool = dma_pool_create("reply_post_free pool", + &ioc->pdev->dev, sz, 16, 0); + if (!ioc->reply_post_free_dma_pool) { +- pr_err(MPT3SAS_FMT +- "reply_post_free pool: dma_pool_create failed\n", +- ioc->name); ++ ioc_err(ioc, "reply_post_free pool: dma_pool_create failed\n"); + goto out; + } + i = 0; +@@ -4531,29 +4481,25 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + GFP_KERNEL, + &ioc->reply_post[i].reply_post_free_dma); + if (!ioc->reply_post[i].reply_post_free) { +- pr_err(MPT3SAS_FMT +- "reply_post_free pool: dma_pool_alloc failed\n", +- ioc->name); ++ ioc_err(ioc, "reply_post_free pool: dma_pool_alloc failed\n"); + goto out; + } + memset(ioc->reply_post[i].reply_post_free, 0, sz); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "reply post free pool (0x%p): depth(%d)," +- "element_size(%d), pool_size(%d kB)\n", ioc->name, +- ioc->reply_post[i].reply_post_free, +- ioc->reply_post_queue_depth, 8, sz/1024)); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "reply_post_free_dma = (0x%llx)\n", ioc->name, +- (unsigned long long) +- ioc->reply_post[i].reply_post_free_dma)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "reply post free pool (0x%p): depth(%d), element_size(%d), pool_size(%d kB)\n", ++ ioc->reply_post[i].reply_post_free, ++ ioc->reply_post_queue_depth, ++ 8, sz / 1024)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "reply_post_free_dma = (0x%llx)\n", ++ (u64)ioc->reply_post[i].reply_post_free_dma)); + total_sz += sz; + } while (ioc->rdpq_array_enable && (++i < ioc->reply_queue_count)); + + if (ioc->dma_mask > 32) { + if (_base_change_consistent_dma_mask(ioc, ioc->pdev) != 0) { +- pr_warn(MPT3SAS_FMT +- "no suitable consistent DMA mask for %s\n", +- ioc->name, pci_name(ioc->pdev)); ++ ioc_warn(ioc, "no suitable consistent DMA mask for %s\n", ++ pci_name(ioc->pdev)); + goto out; + } + } +@@ -4565,9 +4511,9 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + * with some internal commands that could be outstanding + */ + ioc->shost->can_queue = ioc->scsiio_depth - INTERNAL_SCSIIO_CMDS_COUNT; +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "scsi host: can_queue depth (%d)\n", +- ioc->name, ioc->shost->can_queue)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "scsi host: can_queue depth (%d)\n", ++ ioc->shost->can_queue)); + + + /* contiguous pool for request and chains, 16 byte align, one extra " +@@ -4585,10 +4531,9 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->request_dma_sz = sz; + ioc->request = pci_alloc_consistent(ioc->pdev, sz, &ioc->request_dma); + if (!ioc->request) { +- pr_err(MPT3SAS_FMT "request pool: pci_alloc_consistent " \ +- "failed: hba_depth(%d), chains_per_io(%d), frame_sz(%d), " +- "total(%d kB)\n", ioc->name, ioc->hba_queue_depth, +- ioc->chains_needed_per_io, ioc->request_sz, sz/1024); ++ ioc_err(ioc, "request pool: pci_alloc_consistent failed: hba_depth(%d), chains_per_io(%d), frame_sz(%d), total(%d kB)\n", ++ ioc->hba_queue_depth, ioc->chains_needed_per_io, ++ ioc->request_sz, sz / 1024); + if (ioc->scsiio_depth < MPT3SAS_SAS_QUEUE_DEPTH) + goto out; + retry_sz = 64; +@@ -4598,10 +4543,9 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + } + + if (retry_sz) +- pr_err(MPT3SAS_FMT "request pool: pci_alloc_consistent " \ +- "succeed: hba_depth(%d), chains_per_io(%d), frame_sz(%d), " +- "total(%d kb)\n", ioc->name, ioc->hba_queue_depth, +- ioc->chains_needed_per_io, ioc->request_sz, sz/1024); ++ ioc_err(ioc, "request pool: pci_alloc_consistent succeed: hba_depth(%d), chains_per_io(%d), frame_sz(%d), total(%d kb)\n", ++ ioc->hba_queue_depth, ioc->chains_needed_per_io, ++ ioc->request_sz, sz / 1024); + + /* hi-priority queue */ + ioc->hi_priority = ioc->request + ((ioc->scsiio_depth + 1) * +@@ -4615,24 +4559,26 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->internal_dma = ioc->hi_priority_dma + (ioc->hi_priority_depth * + ioc->request_sz); + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "request pool(0x%p): depth(%d), frame_size(%d), pool_size(%d kB)\n", +- ioc->name, ioc->request, ioc->hba_queue_depth, ioc->request_sz, +- (ioc->hba_queue_depth * ioc->request_sz)/1024)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "request pool(0x%p): depth(%d), frame_size(%d), pool_size(%d kB)\n", ++ ioc->request, ioc->hba_queue_depth, ++ ioc->request_sz, ++ (ioc->hba_queue_depth * ioc->request_sz) / 1024)); + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "request pool: dma(0x%llx)\n", +- ioc->name, (unsigned long long) ioc->request_dma)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "request pool: dma(0x%llx)\n", ++ (unsigned long long)ioc->request_dma)); + total_sz += sz; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "scsiio(0x%p): depth(%d)\n", +- ioc->name, ioc->request, ioc->scsiio_depth)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "scsiio(0x%p): depth(%d)\n", ++ ioc->request, ioc->scsiio_depth)); + + ioc->chain_depth = min_t(u32, ioc->chain_depth, MAX_CHAIN_DEPTH); + sz = ioc->scsiio_depth * sizeof(struct chain_lookup); + ioc->chain_lookup = kzalloc(sz, GFP_KERNEL); + if (!ioc->chain_lookup) { +- pr_err(MPT3SAS_FMT "chain_lookup: __get_free_pages " +- "failed\n", ioc->name); ++ ioc_err(ioc, "chain_lookup: __get_free_pages failed\n"); + goto out; + } + +@@ -4640,8 +4586,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + for (i = 0; i < ioc->scsiio_depth; i++) { + ioc->chain_lookup[i].chains_per_smid = kzalloc(sz, GFP_KERNEL); + if (!ioc->chain_lookup[i].chains_per_smid) { +- pr_err(MPT3SAS_FMT "chain_lookup: " +- " kzalloc failed\n", ioc->name); ++ ioc_err(ioc, "chain_lookup: kzalloc failed\n"); + goto out; + } + } +@@ -4650,29 +4595,27 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->hpr_lookup = kcalloc(ioc->hi_priority_depth, + sizeof(struct request_tracker), GFP_KERNEL); + if (!ioc->hpr_lookup) { +- pr_err(MPT3SAS_FMT "hpr_lookup: kcalloc failed\n", +- ioc->name); ++ ioc_err(ioc, "hpr_lookup: kcalloc failed\n"); + goto out; + } + ioc->hi_priority_smid = ioc->scsiio_depth + 1; +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "hi_priority(0x%p): depth(%d), start smid(%d)\n", +- ioc->name, ioc->hi_priority, +- ioc->hi_priority_depth, ioc->hi_priority_smid)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "hi_priority(0x%p): depth(%d), start smid(%d)\n", ++ ioc->hi_priority, ++ ioc->hi_priority_depth, ioc->hi_priority_smid)); + + /* initialize internal queue smid's */ + ioc->internal_lookup = kcalloc(ioc->internal_depth, + sizeof(struct request_tracker), GFP_KERNEL); + if (!ioc->internal_lookup) { +- pr_err(MPT3SAS_FMT "internal_lookup: kcalloc failed\n", +- ioc->name); ++ ioc_err(ioc, "internal_lookup: kcalloc failed\n"); + goto out; + } + ioc->internal_smid = ioc->hi_priority_smid + ioc->hi_priority_depth; +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "internal(0x%p): depth(%d), start smid(%d)\n", +- ioc->name, ioc->internal, +- ioc->internal_depth, ioc->internal_smid)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "internal(0x%p): depth(%d), start smid(%d)\n", ++ ioc->internal, ++ ioc->internal_depth, ioc->internal_smid)); + /* + * The number of NVMe page sized blocks needed is: + * (((sg_tablesize * 8) - 1) / (page_size - 8)) + 1 +@@ -4696,17 +4639,14 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + sz = sizeof(struct pcie_sg_list) * ioc->scsiio_depth; + ioc->pcie_sg_lookup = kzalloc(sz, GFP_KERNEL); + if (!ioc->pcie_sg_lookup) { +- pr_info(MPT3SAS_FMT +- "PCIe SGL lookup: kzalloc failed\n", ioc->name); ++ ioc_info(ioc, "PCIe SGL lookup: kzalloc failed\n"); + goto out; + } + sz = nvme_blocks_needed * ioc->page_size; + ioc->pcie_sgl_dma_pool = + dma_pool_create("PCIe SGL pool", &ioc->pdev->dev, sz, 16, 0); + if (!ioc->pcie_sgl_dma_pool) { +- pr_info(MPT3SAS_FMT +- "PCIe SGL pool: dma_pool_create failed\n", +- ioc->name); ++ ioc_info(ioc, "PCIe SGL pool: dma_pool_create failed\n"); + goto out; + } + +@@ -4719,9 +4659,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->pcie_sgl_dma_pool, GFP_KERNEL, + &ioc->pcie_sg_lookup[i].pcie_sgl_dma); + if (!ioc->pcie_sg_lookup[i].pcie_sgl) { +- pr_info(MPT3SAS_FMT +- "PCIe SGL pool: dma_pool_alloc failed\n", +- ioc->name); ++ ioc_info(ioc, "PCIe SGL pool: dma_pool_alloc failed\n"); + goto out; + } + for (j = 0; j < ioc->chains_per_prp_buffer; j++) { +@@ -4735,20 +4673,20 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + } + } + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "PCIe sgl pool depth(%d), " +- "element_size(%d), pool_size(%d kB)\n", ioc->name, +- ioc->scsiio_depth, sz, (sz * ioc->scsiio_depth)/1024)); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "Number of chains can " +- "fit in a PRP page(%d)\n", ioc->name, +- ioc->chains_per_prp_buffer)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "PCIe sgl pool depth(%d), element_size(%d), pool_size(%d kB)\n", ++ ioc->scsiio_depth, sz, ++ (sz * ioc->scsiio_depth) / 1024)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "Number of chains can fit in a PRP page(%d)\n", ++ ioc->chains_per_prp_buffer)); + total_sz += sz * ioc->scsiio_depth; + } + + ioc->chain_dma_pool = dma_pool_create("chain pool", &ioc->pdev->dev, + ioc->chain_segment_sz, 16, 0); + if (!ioc->chain_dma_pool) { +- pr_err(MPT3SAS_FMT "chain_dma_pool: dma_pool_create failed\n", +- ioc->name); ++ ioc_err(ioc, "chain_dma_pool: dma_pool_create failed\n"); + goto out; + } + for (i = 0; i < ioc->scsiio_depth; i++) { +@@ -4759,8 +4697,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->chain_dma_pool, GFP_KERNEL, + &ct->chain_buffer_dma); + if (!ct->chain_buffer) { +- pr_err(MPT3SAS_FMT "chain_lookup: " +- " pci_pool_alloc failed\n", ioc->name); ++ ioc_err(ioc, "chain_lookup: pci_pool_alloc failed\n"); + _base_release_memory_pools(ioc); + goto out; + } +@@ -4768,25 +4705,23 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + total_sz += ioc->chain_segment_sz; + } + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "chain pool depth(%d), frame_size(%d), pool_size(%d kB)\n", +- ioc->name, ioc->chain_depth, ioc->chain_segment_sz, +- ((ioc->chain_depth * ioc->chain_segment_sz))/1024)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "chain pool depth(%d), frame_size(%d), pool_size(%d kB)\n", ++ ioc->chain_depth, ioc->chain_segment_sz, ++ (ioc->chain_depth * ioc->chain_segment_sz) / 1024)); + + /* sense buffers, 4 byte align */ + sz = ioc->scsiio_depth * SCSI_SENSE_BUFFERSIZE; + ioc->sense_dma_pool = dma_pool_create("sense pool", &ioc->pdev->dev, sz, + 4, 0); + if (!ioc->sense_dma_pool) { +- pr_err(MPT3SAS_FMT "sense pool: dma_pool_create failed\n", +- ioc->name); ++ ioc_err(ioc, "sense pool: dma_pool_create failed\n"); + goto out; + } + ioc->sense = dma_pool_alloc(ioc->sense_dma_pool, GFP_KERNEL, + &ioc->sense_dma); + if (!ioc->sense) { +- pr_err(MPT3SAS_FMT "sense pool: dma_pool_alloc failed\n", +- ioc->name); ++ ioc_err(ioc, "sense pool: dma_pool_alloc failed\n"); + goto out; + } + /* sense buffer requires to be in same 4 gb region. +@@ -4808,24 +4743,23 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + dma_pool_create("sense pool", &ioc->pdev->dev, sz, + roundup_pow_of_two(sz), 0); + if (!ioc->sense_dma_pool) { +- pr_err(MPT3SAS_FMT "sense pool: pci_pool_create failed\n", +- ioc->name); ++ ioc_err(ioc, "sense pool: pci_pool_create failed\n"); + goto out; + } + ioc->sense = dma_pool_alloc(ioc->sense_dma_pool, GFP_KERNEL, + &ioc->sense_dma); + if (!ioc->sense) { +- pr_err(MPT3SAS_FMT "sense pool: pci_pool_alloc failed\n", +- ioc->name); ++ ioc_err(ioc, "sense pool: pci_pool_alloc failed\n"); + goto out; + } + } +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "sense pool(0x%p): depth(%d), element_size(%d), pool_size" +- "(%d kB)\n", ioc->name, ioc->sense, ioc->scsiio_depth, +- SCSI_SENSE_BUFFERSIZE, sz/1024)); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "sense_dma(0x%llx)\n", +- ioc->name, (unsigned long long)ioc->sense_dma)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "sense pool(0x%p): depth(%d), element_size(%d), pool_size(%d kB)\n", ++ ioc->sense, ioc->scsiio_depth, ++ SCSI_SENSE_BUFFERSIZE, sz / 1024)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "sense_dma(0x%llx)\n", ++ (unsigned long long)ioc->sense_dma)); + total_sz += sz; + + /* reply pool, 4 byte align */ +@@ -4833,25 +4767,24 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->reply_dma_pool = dma_pool_create("reply pool", &ioc->pdev->dev, sz, + 4, 0); + if (!ioc->reply_dma_pool) { +- pr_err(MPT3SAS_FMT "reply pool: dma_pool_create failed\n", +- ioc->name); ++ ioc_err(ioc, "reply pool: dma_pool_create failed\n"); + goto out; + } + ioc->reply = dma_pool_alloc(ioc->reply_dma_pool, GFP_KERNEL, + &ioc->reply_dma); + if (!ioc->reply) { +- pr_err(MPT3SAS_FMT "reply pool: dma_pool_alloc failed\n", +- ioc->name); ++ ioc_err(ioc, "reply pool: dma_pool_alloc failed\n"); + goto out; + } + ioc->reply_dma_min_address = (u32)(ioc->reply_dma); + ioc->reply_dma_max_address = (u32)(ioc->reply_dma) + sz; +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "reply pool(0x%p): depth(%d), frame_size(%d), pool_size(%d kB)\n", +- ioc->name, ioc->reply, +- ioc->reply_free_queue_depth, ioc->reply_sz, sz/1024)); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "reply_dma(0x%llx)\n", +- ioc->name, (unsigned long long)ioc->reply_dma)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "reply pool(0x%p): depth(%d), frame_size(%d), pool_size(%d kB)\n", ++ ioc->reply, ioc->reply_free_queue_depth, ++ ioc->reply_sz, sz / 1024)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "reply_dma(0x%llx)\n", ++ (unsigned long long)ioc->reply_dma)); + total_sz += sz; + + /* reply free queue, 16 byte align */ +@@ -4859,24 +4792,23 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->reply_free_dma_pool = dma_pool_create("reply_free pool", + &ioc->pdev->dev, sz, 16, 0); + if (!ioc->reply_free_dma_pool) { +- pr_err(MPT3SAS_FMT "reply_free pool: dma_pool_create failed\n", +- ioc->name); ++ ioc_err(ioc, "reply_free pool: dma_pool_create failed\n"); + goto out; + } + ioc->reply_free = dma_pool_alloc(ioc->reply_free_dma_pool, GFP_KERNEL, + &ioc->reply_free_dma); + if (!ioc->reply_free) { +- pr_err(MPT3SAS_FMT "reply_free pool: dma_pool_alloc failed\n", +- ioc->name); ++ ioc_err(ioc, "reply_free pool: dma_pool_alloc failed\n"); + goto out; + } + memset(ioc->reply_free, 0, sz); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "reply_free pool(0x%p): " \ +- "depth(%d), element_size(%d), pool_size(%d kB)\n", ioc->name, +- ioc->reply_free, ioc->reply_free_queue_depth, 4, sz/1024)); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "reply_free_dma (0x%llx)\n", +- ioc->name, (unsigned long long)ioc->reply_free_dma)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "reply_free pool(0x%p): depth(%d), element_size(%d), pool_size(%d kB)\n", ++ ioc->reply_free, ioc->reply_free_queue_depth, ++ 4, sz / 1024)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "reply_free_dma (0x%llx)\n", ++ (unsigned long long)ioc->reply_free_dma)); + total_sz += sz; + + if (ioc->rdpq_array_enable) { +@@ -4887,8 +4819,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + &ioc->pdev->dev, reply_post_free_array_sz, 16, 0); + if (!ioc->reply_post_free_array_dma_pool) { + dinitprintk(ioc, +- pr_info(MPT3SAS_FMT "reply_post_free_array pool: " +- "dma_pool_create failed\n", ioc->name)); ++ ioc_info(ioc, "reply_post_free_array pool: dma_pool_create failed\n")); + goto out; + } + ioc->reply_post_free_array = +@@ -4896,8 +4827,7 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + GFP_KERNEL, &ioc->reply_post_free_array_dma); + if (!ioc->reply_post_free_array) { + dinitprintk(ioc, +- pr_info(MPT3SAS_FMT "reply_post_free_array pool: " +- "dma_pool_alloc failed\n", ioc->name)); ++ ioc_info(ioc, "reply_post_free_array pool: dma_pool_alloc failed\n")); + goto out; + } + } +@@ -4905,25 +4835,23 @@ _base_allocate_memory_pools(struct MPT3SAS_ADAPTER *ioc) + ioc->config_page = pci_alloc_consistent(ioc->pdev, + ioc->config_page_sz, &ioc->config_page_dma); + if (!ioc->config_page) { +- pr_err(MPT3SAS_FMT +- "config page: dma_pool_alloc failed\n", +- ioc->name); ++ ioc_err(ioc, "config page: dma_pool_alloc failed\n"); + goto out; + } +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "config page(0x%p): size(%d)\n", +- ioc->name, ioc->config_page, ioc->config_page_sz)); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "config_page_dma(0x%llx)\n", +- ioc->name, (unsigned long long)ioc->config_page_dma)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "config page(0x%p): size(%d)\n", ++ ioc->config_page, ioc->config_page_sz)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "config_page_dma(0x%llx)\n", ++ (unsigned long long)ioc->config_page_dma)); + total_sz += ioc->config_page_sz; + +- pr_info(MPT3SAS_FMT "Allocated physical memory: size(%d kB)\n", +- ioc->name, total_sz/1024); +- pr_info(MPT3SAS_FMT +- "Current Controller Queue Depth(%d),Max Controller Queue Depth(%d)\n", +- ioc->name, ioc->shost->can_queue, facts->RequestCredit); +- pr_info(MPT3SAS_FMT "Scatter Gather Elements per IO(%d)\n", +- ioc->name, ioc->shost->sg_tablesize); ++ ioc_info(ioc, "Allocated physical memory: size(%d kB)\n", ++ total_sz / 1024); ++ ioc_info(ioc, "Current Controller Queue Depth(%d),Max Controller Queue Depth(%d)\n", ++ ioc->shost->can_queue, facts->RequestCredit); ++ ioc_info(ioc, "Scatter Gather Elements per IO(%d)\n", ++ ioc->shost->sg_tablesize); + return 0; + + out: +@@ -5001,9 +4929,9 @@ _base_wait_for_doorbell_int(struct MPT3SAS_ADAPTER *ioc, int timeout) + do { + int_status = readl(&ioc->chip->HostInterruptStatus); + if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { +- dhsprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: successful count(%d), timeout(%d)\n", +- ioc->name, __func__, count, timeout)); ++ dhsprintk(ioc, ++ ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", ++ __func__, count, timeout)); + return 0; + } + +@@ -5011,9 +4939,8 @@ _base_wait_for_doorbell_int(struct MPT3SAS_ADAPTER *ioc, int timeout) + count++; + } while (--cntdn); + +- pr_err(MPT3SAS_FMT +- "%s: failed due to timeout count(%d), int_status(%x)!\n", +- ioc->name, __func__, count, int_status); ++ ioc_err(ioc, "%s: failed due to timeout count(%d), int_status(%x)!\n", ++ __func__, count, int_status); + return -EFAULT; + } + +@@ -5028,9 +4955,9 @@ _base_spin_on_doorbell_int(struct MPT3SAS_ADAPTER *ioc, int timeout) + do { + int_status = readl(&ioc->chip->HostInterruptStatus); + if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { +- dhsprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: successful count(%d), timeout(%d)\n", +- ioc->name, __func__, count, timeout)); ++ dhsprintk(ioc, ++ ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", ++ __func__, count, timeout)); + return 0; + } + +@@ -5038,9 +4965,8 @@ _base_spin_on_doorbell_int(struct MPT3SAS_ADAPTER *ioc, int timeout) + count++; + } while (--cntdn); + +- pr_err(MPT3SAS_FMT +- "%s: failed due to timeout count(%d), int_status(%x)!\n", +- ioc->name, __func__, count, int_status); ++ ioc_err(ioc, "%s: failed due to timeout count(%d), int_status(%x)!\n", ++ __func__, count, int_status); + return -EFAULT; + + } +@@ -5067,9 +4993,9 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) + do { + int_status = readl(&ioc->chip->HostInterruptStatus); + if (!(int_status & MPI2_HIS_SYS2IOC_DB_STATUS)) { +- dhsprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: successful count(%d), timeout(%d)\n", +- ioc->name, __func__, count, timeout)); ++ dhsprintk(ioc, ++ ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", ++ __func__, count, timeout)); + return 0; + } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { + doorbell = readl(&ioc->chip->Doorbell); +@@ -5086,9 +5012,8 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) + } while (--cntdn); + + out: +- pr_err(MPT3SAS_FMT +- "%s: failed due to timeout count(%d), int_status(%x)!\n", +- ioc->name, __func__, count, int_status); ++ ioc_err(ioc, "%s: failed due to timeout count(%d), int_status(%x)!\n", ++ __func__, count, int_status); + return -EFAULT; + } + +@@ -5110,9 +5035,9 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) + do { + doorbell_reg = readl(&ioc->chip->Doorbell); + if (!(doorbell_reg & MPI2_DOORBELL_USED)) { +- dhsprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: successful count(%d), timeout(%d)\n", +- ioc->name, __func__, count, timeout)); ++ dhsprintk(ioc, ++ ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", ++ __func__, count, timeout)); + return 0; + } + +@@ -5120,9 +5045,8 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) + count++; + } while (--cntdn); + +- pr_err(MPT3SAS_FMT +- "%s: failed due to timeout count(%d), doorbell_reg(%x)!\n", +- ioc->name, __func__, count, doorbell_reg); ++ ioc_err(ioc, "%s: failed due to timeout count(%d), doorbell_reg(%x)!\n", ++ __func__, count, doorbell_reg); + return -EFAULT; + } + +@@ -5141,8 +5065,7 @@ _base_send_ioc_reset(struct MPT3SAS_ADAPTER *ioc, u8 reset_type, int timeout) + int r = 0; + + if (reset_type != MPI2_FUNCTION_IOC_MESSAGE_UNIT_RESET) { +- pr_err(MPT3SAS_FMT "%s: unknown reset_type\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: unknown reset_type\n", __func__); + return -EFAULT; + } + +@@ -5150,7 +5073,7 @@ _base_send_ioc_reset(struct MPT3SAS_ADAPTER *ioc, u8 reset_type, int timeout) + MPI2_IOCFACTS_CAPABILITY_EVENT_REPLAY)) + return -EFAULT; + +- pr_info(MPT3SAS_FMT "sending message unit reset !!\n", ioc->name); ++ ioc_info(ioc, "sending message unit reset !!\n"); + + writel(reset_type << MPI2_DOORBELL_FUNCTION_SHIFT, + &ioc->chip->Doorbell); +@@ -5160,15 +5083,14 @@ _base_send_ioc_reset(struct MPT3SAS_ADAPTER *ioc, u8 reset_type, int timeout) + } + ioc_state = _base_wait_on_iocstate(ioc, MPI2_IOC_STATE_READY, timeout); + if (ioc_state) { +- pr_err(MPT3SAS_FMT +- "%s: failed going to ready state (ioc_state=0x%x)\n", +- ioc->name, __func__, ioc_state); ++ ioc_err(ioc, "%s: failed going to ready state (ioc_state=0x%x)\n", ++ __func__, ioc_state); + r = -EFAULT; + goto out; + } + out: +- pr_info(MPT3SAS_FMT "message unit reset: %s\n", +- ioc->name, ((r == 0) ? "SUCCESS" : "FAILED")); ++ ioc_info(ioc, "message unit reset: %s\n", ++ r == 0 ? "SUCCESS" : "FAILED"); + return r; + } + +@@ -5194,9 +5116,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + + /* make sure doorbell is not in use */ + if ((readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { +- pr_err(MPT3SAS_FMT +- "doorbell is in use (line=%d)\n", +- ioc->name, __LINE__); ++ ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); + return -EFAULT; + } + +@@ -5211,17 +5131,15 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + &ioc->chip->Doorbell); + + if ((_base_spin_on_doorbell_int(ioc, 5))) { +- pr_err(MPT3SAS_FMT +- "doorbell handshake int failed (line=%d)\n", +- ioc->name, __LINE__); ++ ioc_err(ioc, "doorbell handshake int failed (line=%d)\n", ++ __LINE__); + return -EFAULT; + } + writel(0, &ioc->chip->HostInterruptStatus); + + if ((_base_wait_for_doorbell_ack(ioc, 5))) { +- pr_err(MPT3SAS_FMT +- "doorbell handshake ack failed (line=%d)\n", +- ioc->name, __LINE__); ++ ioc_err(ioc, "doorbell handshake ack failed (line=%d)\n", ++ __LINE__); + return -EFAULT; + } + +@@ -5233,17 +5151,15 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + } + + if (failed) { +- pr_err(MPT3SAS_FMT +- "doorbell handshake sending request failed (line=%d)\n", +- ioc->name, __LINE__); ++ ioc_err(ioc, "doorbell handshake sending request failed (line=%d)\n", ++ __LINE__); + return -EFAULT; + } + + /* now wait for the reply */ + if ((_base_wait_for_doorbell_int(ioc, timeout))) { +- pr_err(MPT3SAS_FMT +- "doorbell handshake int failed (line=%d)\n", +- ioc->name, __LINE__); ++ ioc_err(ioc, "doorbell handshake int failed (line=%d)\n", ++ __LINE__); + return -EFAULT; + } + +@@ -5252,9 +5168,8 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + & MPI2_DOORBELL_DATA_MASK); + writel(0, &ioc->chip->HostInterruptStatus); + if ((_base_wait_for_doorbell_int(ioc, 5))) { +- pr_err(MPT3SAS_FMT +- "doorbell handshake int failed (line=%d)\n", +- ioc->name, __LINE__); ++ ioc_err(ioc, "doorbell handshake int failed (line=%d)\n", ++ __LINE__); + return -EFAULT; + } + reply[1] = le16_to_cpu(readl(&ioc->chip->Doorbell) +@@ -5263,9 +5178,8 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + + for (i = 2; i < default_reply->MsgLength * 2; i++) { + if ((_base_wait_for_doorbell_int(ioc, 5))) { +- pr_err(MPT3SAS_FMT +- "doorbell handshake int failed (line=%d)\n", +- ioc->name, __LINE__); ++ ioc_err(ioc, "doorbell handshake int failed (line=%d)\n", ++ __LINE__); + return -EFAULT; + } + if (i >= reply_bytes/2) /* overflow case */ +@@ -5278,8 +5192,9 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, + + _base_wait_for_doorbell_int(ioc, 5); + if (_base_wait_for_doorbell_not_used(ioc, 5) != 0) { +- dhsprintk(ioc, pr_info(MPT3SAS_FMT +- "doorbell is in use (line=%d)\n", ioc->name, __LINE__)); ++ dhsprintk(ioc, ++ ioc_info(ioc, "doorbell is in use (line=%d)\n", ++ __LINE__)); + } + writel(0, &ioc->chip->HostInterruptStatus); + +@@ -5319,14 +5234,12 @@ mpt3sas_base_sas_iounit_control(struct MPT3SAS_ADAPTER *ioc, + void *request; + u16 wait_state_count; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + mutex_lock(&ioc->base_cmds.mutex); + + if (ioc->base_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: base_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: base_cmd in use\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -5335,23 +5248,20 @@ mpt3sas_base_sas_iounit_control(struct MPT3SAS_ADAPTER *ioc, + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + rc = -EFAULT; + goto out; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + + smid = mpt3sas_base_get_smid(ioc, ioc->base_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -5419,14 +5329,12 @@ mpt3sas_base_scsi_enclosure_processor(struct MPT3SAS_ADAPTER *ioc, + void *request; + u16 wait_state_count; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + mutex_lock(&ioc->base_cmds.mutex); + + if (ioc->base_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: base_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: base_cmd in use\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -5435,24 +5343,20 @@ mpt3sas_base_scsi_enclosure_processor(struct MPT3SAS_ADAPTER *ioc, + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + rc = -EFAULT; + goto out; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, +- __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + + smid = mpt3sas_base_get_smid(ioc, ioc->base_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -5506,8 +5410,7 @@ _base_get_port_facts(struct MPT3SAS_ADAPTER *ioc, int port) + struct mpt3sas_port_facts *pfacts; + int mpi_reply_sz, mpi_request_sz, r; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + mpi_reply_sz = sizeof(Mpi2PortFactsReply_t); + mpi_request_sz = sizeof(Mpi2PortFactsRequest_t); +@@ -5518,8 +5421,7 @@ _base_get_port_facts(struct MPT3SAS_ADAPTER *ioc, int port) + (u32 *)&mpi_request, mpi_reply_sz, (u16 *)&mpi_reply, 5); + + if (r != 0) { +- pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n", +- ioc->name, __func__, r); ++ ioc_err(ioc, "%s: handshake failed (r=%d)\n", __func__, r); + return r; + } + +@@ -5603,8 +5505,7 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc) + struct mpt3sas_facts *facts; + int mpi_reply_sz, mpi_request_sz, r; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + r = _base_wait_for_iocstate(ioc, 10); + if (r) { +@@ -5621,8 +5522,7 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc) + (u32 *)&mpi_request, mpi_reply_sz, (u16 *)&mpi_reply, 5); + + if (r != 0) { +- pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n", +- ioc->name, __func__, r); ++ ioc_err(ioc, "%s: handshake failed (r=%d)\n", __func__, r); + return r; + } + +@@ -5674,20 +5574,20 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc) + */ + ioc->page_size = 1 << facts->CurrentHostPageSize; + if (ioc->page_size == 1) { +- pr_info(MPT3SAS_FMT "CurrentHostPageSize is 0: Setting " +- "default host page size to 4k\n", ioc->name); ++ ioc_info(ioc, "CurrentHostPageSize is 0: Setting default host page size to 4k\n"); + ioc->page_size = 1 << MPT3SAS_HOST_PAGE_SIZE_4K; + } +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "CurrentHostPageSize(%d)\n", +- ioc->name, facts->CurrentHostPageSize)); +- +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "hba queue depth(%d), max chains per io(%d)\n", +- ioc->name, facts->RequestCredit, +- facts->MaxChainDepth)); +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "request frame size(%d), reply frame size(%d)\n", ioc->name, +- facts->IOCRequestFrameSize * 4, facts->ReplyFrameSize * 4)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "CurrentHostPageSize(%d)\n", ++ facts->CurrentHostPageSize)); ++ ++ dinitprintk(ioc, ++ ioc_info(ioc, "hba queue depth(%d), max chains per io(%d)\n", ++ facts->RequestCredit, facts->MaxChainDepth)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "request frame size(%d), reply frame size(%d)\n", ++ facts->IOCRequestFrameSize * 4, ++ facts->ReplyFrameSize * 4)); + return 0; + } + +@@ -5707,8 +5607,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc) + u16 ioc_status; + u32 reply_post_free_array_sz = 0; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + memset(&mpi_request, 0, sizeof(Mpi2IOCInitRequest_t)); + mpi_request.Function = MPI2_FUNCTION_IOC_INIT; +@@ -5774,15 +5673,14 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc) + sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30); + + if (r != 0) { +- pr_err(MPT3SAS_FMT "%s: handshake failed (r=%d)\n", +- ioc->name, __func__, r); ++ ioc_err(ioc, "%s: handshake failed (r=%d)\n", __func__, r); + return r; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS || + mpi_reply.IOCLogInfo) { +- pr_err(MPT3SAS_FMT "%s: failed\n", ioc->name, __func__); ++ ioc_err(ioc, "%s: failed\n", __func__); + r = -EIO; + } + +@@ -5853,18 +5751,16 @@ _base_send_port_enable(struct MPT3SAS_ADAPTER *ioc) + u16 smid; + u16 ioc_status; + +- pr_info(MPT3SAS_FMT "sending port enable !!\n", ioc->name); ++ ioc_info(ioc, "sending port enable !!\n"); + + if (ioc->port_enable_cmds.status & MPT3_CMD_PENDING) { +- pr_err(MPT3SAS_FMT "%s: internal command already in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: internal command already in use\n", __func__); + return -EAGAIN; + } + + smid = mpt3sas_base_get_smid(ioc, ioc->port_enable_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + return -EAGAIN; + } + +@@ -5878,8 +5774,7 @@ _base_send_port_enable(struct MPT3SAS_ADAPTER *ioc) + mpt3sas_base_put_smid_default(ioc, smid); + wait_for_completion_timeout(&ioc->port_enable_cmds.done, 300*HZ); + if (!(ioc->port_enable_cmds.status & MPT3_CMD_COMPLETE)) { +- pr_err(MPT3SAS_FMT "%s: timeout\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: timeout\n", __func__); + _debug_dump_mf(mpi_request, + sizeof(Mpi2PortEnableRequest_t)/4); + if (ioc->port_enable_cmds.status & MPT3_CMD_RESET) +@@ -5892,16 +5787,15 @@ _base_send_port_enable(struct MPT3SAS_ADAPTER *ioc) + mpi_reply = ioc->port_enable_cmds.reply; + ioc_status = le16_to_cpu(mpi_reply->IOCStatus) & MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "%s: failed with (ioc_status=0x%08x)\n", +- ioc->name, __func__, ioc_status); ++ ioc_err(ioc, "%s: failed with (ioc_status=0x%08x)\n", ++ __func__, ioc_status); + r = -EFAULT; + goto out; + } + + out: + ioc->port_enable_cmds.status = MPT3_CMD_NOT_USED; +- pr_info(MPT3SAS_FMT "port enable: %s\n", ioc->name, ((r == 0) ? +- "SUCCESS" : "FAILED")); ++ ioc_info(ioc, "port enable: %s\n", r == 0 ? "SUCCESS" : "FAILED"); + return r; + } + +@@ -5917,18 +5811,16 @@ mpt3sas_port_enable(struct MPT3SAS_ADAPTER *ioc) + Mpi2PortEnableRequest_t *mpi_request; + u16 smid; + +- pr_info(MPT3SAS_FMT "sending port enable !!\n", ioc->name); ++ ioc_info(ioc, "sending port enable !!\n"); + + if (ioc->port_enable_cmds.status & MPT3_CMD_PENDING) { +- pr_err(MPT3SAS_FMT "%s: internal command already in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: internal command already in use\n", __func__); + return -EAGAIN; + } + + smid = mpt3sas_base_get_smid(ioc, ioc->port_enable_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + return -EAGAIN; + } + +@@ -6031,19 +5923,16 @@ _base_event_notification(struct MPT3SAS_ADAPTER *ioc) + int r = 0; + int i; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + if (ioc->base_cmds.status & MPT3_CMD_PENDING) { +- pr_err(MPT3SAS_FMT "%s: internal command already in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: internal command already in use\n", __func__); + return -EAGAIN; + } + + smid = mpt3sas_base_get_smid(ioc, ioc->base_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + return -EAGAIN; + } + ioc->base_cmds.status = MPT3_CMD_PENDING; +@@ -6060,8 +5949,7 @@ _base_event_notification(struct MPT3SAS_ADAPTER *ioc) + mpt3sas_base_put_smid_default(ioc, smid); + wait_for_completion_timeout(&ioc->base_cmds.done, 30*HZ); + if (!(ioc->base_cmds.status & MPT3_CMD_COMPLETE)) { +- pr_err(MPT3SAS_FMT "%s: timeout\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: timeout\n", __func__); + _debug_dump_mf(mpi_request, + sizeof(Mpi2EventNotificationRequest_t)/4); + if (ioc->base_cmds.status & MPT3_CMD_RESET) +@@ -6069,8 +5957,7 @@ _base_event_notification(struct MPT3SAS_ADAPTER *ioc) + else + r = -ETIME; + } else +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s: complete\n", +- ioc->name, __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s: complete\n", __func__)); + ioc->base_cmds.status = MPT3_CMD_NOT_USED; + return r; + } +@@ -6126,18 +6013,16 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) + u32 count; + u32 hcb_size; + +- pr_info(MPT3SAS_FMT "sending diag reset !!\n", ioc->name); ++ ioc_info(ioc, "sending diag reset !!\n"); + +- drsprintk(ioc, pr_info(MPT3SAS_FMT "clear interrupts\n", +- ioc->name)); ++ drsprintk(ioc, ioc_info(ioc, "clear interrupts\n")); + + count = 0; + do { + /* Write magic sequence to WriteSequence register + * Loop until in diagnostic mode + */ +- drsprintk(ioc, pr_info(MPT3SAS_FMT +- "write magic sequence\n", ioc->name)); ++ drsprintk(ioc, ioc_info(ioc, "write magic sequence\n")); + writel(MPI2_WRSEQ_FLUSH_KEY_VALUE, &ioc->chip->WriteSequence); + writel(MPI2_WRSEQ_1ST_KEY_VALUE, &ioc->chip->WriteSequence); + writel(MPI2_WRSEQ_2ND_KEY_VALUE, &ioc->chip->WriteSequence); +@@ -6153,16 +6038,15 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) + goto out; + + host_diagnostic = readl(&ioc->chip->HostDiagnostic); +- drsprintk(ioc, pr_info(MPT3SAS_FMT +- "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", +- ioc->name, count, host_diagnostic)); ++ drsprintk(ioc, ++ ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", ++ count, host_diagnostic)); + + } while ((host_diagnostic & MPI2_DIAG_DIAG_WRITE_ENABLE) == 0); + + hcb_size = readl(&ioc->chip->HCBSize); + +- drsprintk(ioc, pr_info(MPT3SAS_FMT "diag reset: issued\n", +- ioc->name)); ++ drsprintk(ioc, ioc_info(ioc, "diag reset: issued\n")); + writel(host_diagnostic | MPI2_DIAG_RESET_ADAPTER, + &ioc->chip->HostDiagnostic); + +@@ -6185,43 +6069,38 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) + + if (host_diagnostic & MPI2_DIAG_HCB_MODE) { + +- drsprintk(ioc, pr_info(MPT3SAS_FMT +- "restart the adapter assuming the HCB Address points to good F/W\n", +- ioc->name)); ++ drsprintk(ioc, ++ ioc_info(ioc, "restart the adapter assuming the HCB Address points to good F/W\n")); + host_diagnostic &= ~MPI2_DIAG_BOOT_DEVICE_SELECT_MASK; + host_diagnostic |= MPI2_DIAG_BOOT_DEVICE_SELECT_HCDW; + writel(host_diagnostic, &ioc->chip->HostDiagnostic); + +- drsprintk(ioc, pr_info(MPT3SAS_FMT +- "re-enable the HCDW\n", ioc->name)); ++ drsprintk(ioc, ioc_info(ioc, "re-enable the HCDW\n")); + writel(hcb_size | MPI2_HCB_SIZE_HCB_ENABLE, + &ioc->chip->HCBSize); + } + +- drsprintk(ioc, pr_info(MPT3SAS_FMT "restart the adapter\n", +- ioc->name)); ++ drsprintk(ioc, ioc_info(ioc, "restart the adapter\n")); + writel(host_diagnostic & ~MPI2_DIAG_HOLD_IOC_RESET, + &ioc->chip->HostDiagnostic); + +- drsprintk(ioc, pr_info(MPT3SAS_FMT +- "disable writes to the diagnostic register\n", ioc->name)); ++ drsprintk(ioc, ++ ioc_info(ioc, "disable writes to the diagnostic register\n")); + writel(MPI2_WRSEQ_FLUSH_KEY_VALUE, &ioc->chip->WriteSequence); + +- drsprintk(ioc, pr_info(MPT3SAS_FMT +- "Wait for FW to go to the READY state\n", ioc->name)); ++ drsprintk(ioc, ioc_info(ioc, "Wait for FW to go to the READY state\n")); + ioc_state = _base_wait_on_iocstate(ioc, MPI2_IOC_STATE_READY, 20); + if (ioc_state) { +- pr_err(MPT3SAS_FMT +- "%s: failed going to ready state (ioc_state=0x%x)\n", +- ioc->name, __func__, ioc_state); ++ ioc_err(ioc, "%s: failed going to ready state (ioc_state=0x%x)\n", ++ __func__, ioc_state); + goto out; + } + +- pr_info(MPT3SAS_FMT "diag reset: SUCCESS\n", ioc->name); ++ ioc_info(ioc, "diag reset: SUCCESS\n"); + return 0; + + out: +- pr_err(MPT3SAS_FMT "diag reset: FAILED\n", ioc->name); ++ ioc_err(ioc, "diag reset: FAILED\n"); + return -EFAULT; + } + +@@ -6239,15 +6118,15 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, enum reset_type type) + int rc; + int count; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + if (ioc->pci_error_recovery) + return 0; + + ioc_state = mpt3sas_base_get_iocstate(ioc, 0); +- dhsprintk(ioc, pr_info(MPT3SAS_FMT "%s: ioc_state(0x%08x)\n", +- ioc->name, __func__, ioc_state)); ++ dhsprintk(ioc, ++ ioc_info(ioc, "%s: ioc_state(0x%08x)\n", ++ __func__, ioc_state)); + + /* if in RESET state, it should move to READY state shortly */ + count = 0; +@@ -6255,9 +6134,8 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, enum reset_type type) + while ((ioc_state & MPI2_IOC_STATE_MASK) != + MPI2_IOC_STATE_READY) { + if (count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed going to ready state (ioc_state=0x%x)\n", +- ioc->name, __func__, ioc_state); ++ ioc_err(ioc, "%s: failed going to ready state (ioc_state=0x%x)\n", ++ __func__, ioc_state); + return -EFAULT; + } + ssleep(1); +@@ -6269,9 +6147,7 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, enum reset_type type) + return 0; + + if (ioc_state & MPI2_DOORBELL_USED) { +- dhsprintk(ioc, pr_info(MPT3SAS_FMT +- "unexpected doorbell active!\n", +- ioc->name)); ++ dhsprintk(ioc, ioc_info(ioc, "unexpected doorbell active!\n")); + goto issue_diag_reset; + } + +@@ -6315,8 +6191,7 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc) + struct adapter_reply_queue *reply_q; + Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + /* clean the delayed target reset list */ + list_for_each_entry_safe(delayed_tr, delayed_tr_next, +@@ -6476,8 +6351,7 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc) + void + mpt3sas_base_free_resources(struct MPT3SAS_ADAPTER *ioc) + { +- dexitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dexitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + /* synchronizing freeing resource with pci_access_mutex lock */ + mutex_lock(&ioc->pci_access_mutex); +@@ -6505,8 +6379,7 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) + int r, i; + int cpu_id, last_cpu_id = 0; + +- dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dinitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + /* setup cpu_msix_table */ + ioc->cpu_count = num_online_cpus(); +@@ -6516,9 +6389,8 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) + ioc->cpu_msix_table = kzalloc(ioc->cpu_msix_table_sz, GFP_KERNEL); + ioc->reply_queue_count = 1; + if (!ioc->cpu_msix_table) { +- dfailprintk(ioc, pr_info(MPT3SAS_FMT +- "allocation for cpu_msix_table failed!!!\n", +- ioc->name)); ++ dfailprintk(ioc, ++ ioc_info(ioc, "allocation for cpu_msix_table failed!!!\n")); + r = -ENOMEM; + goto out_free_resources; + } +@@ -6527,9 +6399,8 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) + ioc->reply_post_host_index = kcalloc(ioc->cpu_msix_table_sz, + sizeof(resource_size_t *), GFP_KERNEL); + if (!ioc->reply_post_host_index) { +- dfailprintk(ioc, pr_info(MPT3SAS_FMT "allocation " +- "for reply_post_host_index failed!!!\n", +- ioc->name)); ++ dfailprintk(ioc, ++ ioc_info(ioc, "allocation for reply_post_host_index failed!!!\n")); + r = -ENOMEM; + goto out_free_resources; + } +@@ -6762,8 +6633,7 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) + void + mpt3sas_base_detach(struct MPT3SAS_ADAPTER *ioc) + { +- dexitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dexitprintk(ioc, ioc_info(ioc, "%s\n", __func__)); + + mpt3sas_base_stop_watchdog(ioc); + mpt3sas_base_free_resources(ioc); +@@ -6796,8 +6666,7 @@ static void _base_pre_reset_handler(struct MPT3SAS_ADAPTER *ioc) + { + mpt3sas_scsih_pre_reset_handler(ioc); + mpt3sas_ctl_pre_reset_handler(ioc); +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_PRE_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_PRE_RESET\n", __func__)); + } + + /** +@@ -6808,8 +6677,7 @@ static void _base_after_reset_handler(struct MPT3SAS_ADAPTER *ioc) + { + mpt3sas_scsih_after_reset_handler(ioc); + mpt3sas_ctl_after_reset_handler(ioc); +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_AFTER_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_AFTER_RESET\n", __func__)); + if (ioc->transport_cmds.status & MPT3_CMD_PENDING) { + ioc->transport_cmds.status |= MPT3_CMD_RESET; + mpt3sas_base_free_smid(ioc, ioc->transport_cmds.smid); +@@ -6850,8 +6718,7 @@ static void _base_reset_done_handler(struct MPT3SAS_ADAPTER *ioc) + { + mpt3sas_scsih_reset_done_handler(ioc); + mpt3sas_ctl_reset_done_handler(ioc); +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_DONE_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_DONE_RESET\n", __func__)); + } + + /** +@@ -6898,12 +6765,10 @@ mpt3sas_base_hard_reset_handler(struct MPT3SAS_ADAPTER *ioc, + u32 ioc_state; + u8 is_fault = 0, is_trigger = 0; + +- dtmprintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", ioc->name, +- __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: enter\n", __func__)); + + if (ioc->pci_error_recovery) { +- pr_err(MPT3SAS_FMT "%s: pci error recovery reset\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: pci error recovery reset\n", __func__); + r = 0; + goto out_unlocked; + } +@@ -6957,8 +6822,9 @@ mpt3sas_base_hard_reset_handler(struct MPT3SAS_ADAPTER *ioc, + _base_reset_done_handler(ioc); + + out: +- dtmprintk(ioc, pr_info(MPT3SAS_FMT "%s: %s\n", +- ioc->name, __func__, ((r == 0) ? "SUCCESS" : "FAILED"))); ++ dtmprintk(ioc, ++ ioc_info(ioc, "%s: %s\n", ++ __func__, r == 0 ? "SUCCESS" : "FAILED")); + + spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags); + ioc->shost_recovery = 0; +@@ -6974,7 +6840,6 @@ mpt3sas_base_hard_reset_handler(struct MPT3SAS_ADAPTER *ioc, + mpt3sas_trigger_master(ioc, + MASTER_TRIGGER_ADAPTER_RESET); + } +- dtmprintk(ioc, pr_info(MPT3SAS_FMT "%s: exit\n", ioc->name, +- __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: exit\n", __func__)); + return r; + } +diff --git a/drivers/scsi/mpt3sas/mpt3sas_config.c b/drivers/scsi/mpt3sas/mpt3sas_config.c +index 9b01c5a7aebd..fff7d5cd266d 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_config.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_config.c +@@ -175,20 +175,18 @@ _config_display_some_debug(struct MPT3SAS_ADAPTER *ioc, u16 smid, + if (!desc) + return; + +- pr_info(MPT3SAS_FMT +- "%s: %s(%d), action(%d), form(0x%08x), smid(%d)\n", +- ioc->name, calling_function_name, desc, +- mpi_request->Header.PageNumber, mpi_request->Action, +- le32_to_cpu(mpi_request->PageAddress), smid); ++ ioc_info(ioc, "%s: %s(%d), action(%d), form(0x%08x), smid(%d)\n", ++ calling_function_name, desc, ++ mpi_request->Header.PageNumber, mpi_request->Action, ++ le32_to_cpu(mpi_request->PageAddress), smid); + + if (!mpi_reply) + return; + + if (mpi_reply->IOCStatus || mpi_reply->IOCLogInfo) +- pr_info(MPT3SAS_FMT +- "\tiocstatus(0x%04x), loginfo(0x%08x)\n", +- ioc->name, le16_to_cpu(mpi_reply->IOCStatus), +- le32_to_cpu(mpi_reply->IOCLogInfo)); ++ ioc_info(ioc, "\tiocstatus(0x%04x), loginfo(0x%08x)\n", ++ le16_to_cpu(mpi_reply->IOCStatus), ++ le32_to_cpu(mpi_reply->IOCLogInfo)); + } + + /** +@@ -210,9 +208,8 @@ _config_alloc_config_dma_memory(struct MPT3SAS_ADAPTER *ioc, + mem->page = dma_alloc_coherent(&ioc->pdev->dev, mem->sz, + &mem->page_dma, GFP_KERNEL); + if (!mem->page) { +- pr_err(MPT3SAS_FMT +- "%s: dma_alloc_coherent failed asking for (%d) bytes!!\n", +- ioc->name, __func__, mem->sz); ++ ioc_err(ioc, "%s: dma_alloc_coherent failed asking for (%d) bytes!!\n", ++ __func__, mem->sz); + r = -ENOMEM; + } + } else { /* use tmp buffer if less than 512 bytes */ +@@ -313,8 +310,7 @@ _config_request(struct MPT3SAS_ADAPTER *ioc, Mpi2ConfigRequest_t + + mutex_lock(&ioc->config_cmds.mutex); + if (ioc->config_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: config_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: config_cmd in use\n", __func__); + mutex_unlock(&ioc->config_cmds.mutex); + return -EAGAIN; + } +@@ -362,34 +358,30 @@ _config_request(struct MPT3SAS_ADAPTER *ioc, Mpi2ConfigRequest_t + r = -EFAULT; + goto free_mem; + } +- pr_info(MPT3SAS_FMT "%s: attempting retry (%d)\n", +- ioc->name, __func__, retry_count); ++ ioc_info(ioc, "%s: attempting retry (%d)\n", ++ __func__, retry_count); + } + wait_state_count = 0; + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + ioc->config_cmds.status = MPT3_CMD_NOT_USED; + r = -EFAULT; + goto free_mem; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + if (wait_state_count) +- pr_info(MPT3SAS_FMT "%s: ioc is operational\n", +- ioc->name, __func__); ++ ioc_info(ioc, "%s: ioc is operational\n", __func__); + + smid = mpt3sas_base_get_smid(ioc, ioc->config_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + ioc->config_cmds.status = MPT3_CMD_NOT_USED; + r = -EAGAIN; + goto free_mem; +@@ -453,8 +445,8 @@ _config_request(struct MPT3SAS_ADAPTER *ioc, Mpi2ConfigRequest_t + } + + if (retry_count) +- pr_info(MPT3SAS_FMT "%s: retry (%d) completed!!\n", \ +- ioc->name, __func__, retry_count); ++ ioc_info(ioc, "%s: retry (%d) completed!!\n", ++ __func__, retry_count); + + if ((ioc_status == MPI2_IOCSTATUS_SUCCESS) && + config_page && mpi_request->Action == +diff --git a/drivers/scsi/mpt3sas/mpt3sas_ctl.c b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +index 8cfb4f12c68c..af7f705ebecf 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_ctl.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_ctl.c +@@ -185,17 +185,15 @@ _ctl_display_some_debug(struct MPT3SAS_ADAPTER *ioc, u16 smid, + if (!desc) + return; + +- pr_info(MPT3SAS_FMT "%s: %s, smid(%d)\n", +- ioc->name, calling_function_name, desc, smid); ++ ioc_info(ioc, "%s: %s, smid(%d)\n", calling_function_name, desc, smid); + + if (!mpi_reply) + return; + + if (mpi_reply->IOCStatus || mpi_reply->IOCLogInfo) +- pr_info(MPT3SAS_FMT +- "\tiocstatus(0x%04x), loginfo(0x%08x)\n", +- ioc->name, le16_to_cpu(mpi_reply->IOCStatus), +- le32_to_cpu(mpi_reply->IOCLogInfo)); ++ ioc_info(ioc, "\tiocstatus(0x%04x), loginfo(0x%08x)\n", ++ le16_to_cpu(mpi_reply->IOCStatus), ++ le32_to_cpu(mpi_reply->IOCLogInfo)); + + if (mpi_request->Function == MPI2_FUNCTION_SCSI_IO_REQUEST || + mpi_request->Function == +@@ -208,38 +206,32 @@ _ctl_display_some_debug(struct MPT3SAS_ADAPTER *ioc, u16 smid, + sas_device = mpt3sas_get_sdev_by_handle(ioc, + le16_to_cpu(scsi_reply->DevHandle)); + if (sas_device) { +- pr_warn(MPT3SAS_FMT "\tsas_address(0x%016llx), phy(%d)\n", +- ioc->name, (unsigned long long) +- sas_device->sas_address, sas_device->phy); +- pr_warn(MPT3SAS_FMT +- "\tenclosure_logical_id(0x%016llx), slot(%d)\n", +- ioc->name, (unsigned long long) +- sas_device->enclosure_logical_id, sas_device->slot); ++ ioc_warn(ioc, "\tsas_address(0x%016llx), phy(%d)\n", ++ (u64)sas_device->sas_address, ++ sas_device->phy); ++ ioc_warn(ioc, "\tenclosure_logical_id(0x%016llx), slot(%d)\n", ++ (u64)sas_device->enclosure_logical_id, ++ sas_device->slot); + sas_device_put(sas_device); + } + if (!sas_device) { + pcie_device = mpt3sas_get_pdev_by_handle(ioc, + le16_to_cpu(scsi_reply->DevHandle)); + if (pcie_device) { +- pr_warn(MPT3SAS_FMT +- "\tWWID(0x%016llx), port(%d)\n", ioc->name, +- (unsigned long long)pcie_device->wwid, +- pcie_device->port_num); ++ ioc_warn(ioc, "\tWWID(0x%016llx), port(%d)\n", ++ (unsigned long long)pcie_device->wwid, ++ pcie_device->port_num); + if (pcie_device->enclosure_handle != 0) +- pr_warn(MPT3SAS_FMT +- "\tenclosure_logical_id(0x%016llx), slot(%d)\n", +- ioc->name, (unsigned long long) +- pcie_device->enclosure_logical_id, +- pcie_device->slot); ++ ioc_warn(ioc, "\tenclosure_logical_id(0x%016llx), slot(%d)\n", ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot); + pcie_device_put(pcie_device); + } + } + if (scsi_reply->SCSIState || scsi_reply->SCSIStatus) +- pr_info(MPT3SAS_FMT +- "\tscsi_state(0x%02x), scsi_status" +- "(0x%02x)\n", ioc->name, +- scsi_reply->SCSIState, +- scsi_reply->SCSIStatus); ++ ioc_info(ioc, "\tscsi_state(0x%02x), scsi_status(0x%02x)\n", ++ scsi_reply->SCSIState, ++ scsi_reply->SCSIStatus); + } + } + +@@ -466,8 +458,7 @@ void mpt3sas_ctl_pre_reset_handler(struct MPT3SAS_ADAPTER *ioc) + int i; + u8 issue_reset; + +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_PRE_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_PRE_RESET\n", __func__)); + for (i = 0; i < MPI2_DIAG_BUF_TYPE_COUNT; i++) { + if (!(ioc->diag_buffer_status[i] & + MPT3_DIAG_BUFFER_IS_REGISTERED)) +@@ -487,8 +478,7 @@ void mpt3sas_ctl_pre_reset_handler(struct MPT3SAS_ADAPTER *ioc) + */ + void mpt3sas_ctl_after_reset_handler(struct MPT3SAS_ADAPTER *ioc) + { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_AFTER_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_AFTER_RESET\n", __func__)); + if (ioc->ctl_cmds.status & MPT3_CMD_PENDING) { + ioc->ctl_cmds.status |= MPT3_CMD_RESET; + mpt3sas_base_free_smid(ioc, ioc->ctl_cmds.smid); +@@ -506,8 +496,7 @@ void mpt3sas_ctl_reset_done_handler(struct MPT3SAS_ADAPTER *ioc) + { + int i; + +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_DONE_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_DONE_RESET\n", __func__)); + + for (i = 0; i < MPI2_DIAG_BUF_TYPE_COUNT; i++) { + if (!(ioc->diag_buffer_status[i] & +@@ -612,10 +601,10 @@ _ctl_set_task_mid(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command *karg, + } + + if (!found) { +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle(0x%04x), lun(%d), no active mid!!\n", +- ioc->name, +- desc, le16_to_cpu(tm_request->DevHandle), lun)); ++ dctlprintk(ioc, ++ ioc_info(ioc, "%s: handle(0x%04x), lun(%d), no active mid!!\n", ++ desc, le16_to_cpu(tm_request->DevHandle), ++ lun)); + tm_reply = ioc->ctl_cmds.reply; + tm_reply->DevHandle = tm_request->DevHandle; + tm_reply->Function = MPI2_FUNCTION_SCSI_TASK_MGMT; +@@ -631,10 +620,10 @@ _ctl_set_task_mid(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command *karg, + return 1; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle(0x%04x), lun(%d), task_mid(%d)\n", ioc->name, +- desc, le16_to_cpu(tm_request->DevHandle), lun, +- le16_to_cpu(tm_request->TaskMID))); ++ dctlprintk(ioc, ++ ioc_info(ioc, "%s: handle(0x%04x), lun(%d), task_mid(%d)\n", ++ desc, le16_to_cpu(tm_request->DevHandle), lun, ++ le16_to_cpu(tm_request->TaskMID))); + return 0; + } + +@@ -672,8 +661,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + issue_reset = 0; + + if (ioc->ctl_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: ctl_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: ctl_cmd in use\n", __func__); + ret = -EAGAIN; + goto out; + } +@@ -682,28 +670,23 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + ret = -EFAULT; + goto out; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, +- __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + if (wait_state_count) +- pr_info(MPT3SAS_FMT "%s: ioc is operational\n", +- ioc->name, __func__); ++ ioc_info(ioc, "%s: ioc is operational\n", __func__); + + mpi_request = kzalloc(ioc->request_sz, GFP_KERNEL); + if (!mpi_request) { +- pr_err(MPT3SAS_FMT +- "%s: failed obtaining a memory for mpi_request\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a memory for mpi_request\n", ++ __func__); + ret = -ENOMEM; + goto out; + } +@@ -726,8 +709,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + if (mpi_request->Function == MPI2_FUNCTION_SCSI_TASK_MGMT) { + smid = mpt3sas_base_get_smid_hpr(ioc, ioc->ctl_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + ret = -EAGAIN; + goto out; + } +@@ -823,9 +805,9 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + ioc->build_nvme_prp(ioc, smid, nvme_encap_request, + data_out_dma, data_out_sz, data_in_dma, data_in_sz); + if (test_bit(device_handle, ioc->device_remove_in_progress)) { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT "handle(0x%04x) :" +- "ioctl failed due to device removal in progress\n", +- ioc->name, device_handle)); ++ dtmprintk(ioc, ++ ioc_info(ioc, "handle(0x%04x): ioctl failed due to device removal in progress\n", ++ device_handle)); + mpt3sas_base_free_smid(ioc, smid); + ret = -EINVAL; + goto out; +@@ -843,9 +825,9 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + mpt3sas_base_get_sense_buffer_dma(ioc, smid); + memset(ioc->ctl_cmds.sense, 0, SCSI_SENSE_BUFFERSIZE); + if (test_bit(device_handle, ioc->device_remove_in_progress)) { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "handle(0x%04x) :ioctl failed due to device removal in progress\n", +- ioc->name, device_handle)); ++ dtmprintk(ioc, ++ ioc_info(ioc, "handle(0x%04x) :ioctl failed due to device removal in progress\n", ++ device_handle)); + mpt3sas_base_free_smid(ioc, smid); + ret = -EINVAL; + goto out; +@@ -863,10 +845,10 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + Mpi2SCSITaskManagementRequest_t *tm_request = + (Mpi2SCSITaskManagementRequest_t *)request; + +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "TASK_MGMT: handle(0x%04x), task_type(0x%02x)\n", +- ioc->name, +- le16_to_cpu(tm_request->DevHandle), tm_request->TaskType)); ++ dtmprintk(ioc, ++ ioc_info(ioc, "TASK_MGMT: handle(0x%04x), task_type(0x%02x)\n", ++ le16_to_cpu(tm_request->DevHandle), ++ tm_request->TaskType)); + ioc->got_task_abort_from_ioctl = 1; + if (tm_request->TaskType == + MPI2_SCSITASKMGMT_TASKTYPE_ABORT_TASK || +@@ -881,9 +863,9 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + ioc->got_task_abort_from_ioctl = 0; + + if (test_bit(device_handle, ioc->device_remove_in_progress)) { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "handle(0x%04x) :ioctl failed due to device removal in progress\n", +- ioc->name, device_handle)); ++ dtmprintk(ioc, ++ ioc_info(ioc, "handle(0x%04x) :ioctl failed due to device removal in progress\n", ++ device_handle)); + mpt3sas_base_free_smid(ioc, smid); + ret = -EINVAL; + goto out; +@@ -929,9 +911,9 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + case MPI2_FUNCTION_SATA_PASSTHROUGH: + { + if (test_bit(device_handle, ioc->device_remove_in_progress)) { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "handle(0x%04x) :ioctl failed due to device removal in progress\n", +- ioc->name, device_handle)); ++ dtmprintk(ioc, ++ ioc_info(ioc, "handle(0x%04x) :ioctl failed due to device removal in progress\n", ++ device_handle)); + mpt3sas_base_free_smid(ioc, smid); + ret = -EINVAL; + goto out; +@@ -1017,12 +999,10 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + Mpi2SCSITaskManagementReply_t *tm_reply = + (Mpi2SCSITaskManagementReply_t *)mpi_reply; + +- pr_info(MPT3SAS_FMT "TASK_MGMT: " \ +- "IOCStatus(0x%04x), IOCLogInfo(0x%08x), " +- "TerminationCount(0x%08x)\n", ioc->name, +- le16_to_cpu(tm_reply->IOCStatus), +- le32_to_cpu(tm_reply->IOCLogInfo), +- le32_to_cpu(tm_reply->TerminationCount)); ++ ioc_info(ioc, "TASK_MGMT: IOCStatus(0x%04x), IOCLogInfo(0x%08x), TerminationCount(0x%08x)\n", ++ le16_to_cpu(tm_reply->IOCStatus), ++ le32_to_cpu(tm_reply->IOCLogInfo), ++ le32_to_cpu(tm_reply->TerminationCount)); + } + + /* copy out xdata to user */ +@@ -1054,9 +1034,7 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH || mpi_request->Function == + MPI2_FUNCTION_NVME_ENCAPSULATED)) { + if (karg.sense_data_ptr == NULL) { +- pr_info(MPT3SAS_FMT "Response buffer provided" +- " by application is NULL; Response data will" +- " not be returned.\n", ioc->name); ++ ioc_info(ioc, "Response buffer provided by application is NULL; Response data will not be returned\n"); + goto out; + } + sz_arg = (mpi_request->Function == +@@ -1079,9 +1057,8 @@ _ctl_do_mpt_command(struct MPT3SAS_ADAPTER *ioc, struct mpt3_ioctl_command karg, + mpi_request->Function == + MPI2_FUNCTION_RAID_SCSI_IO_PASSTHROUGH || + mpi_request->Function == MPI2_FUNCTION_SATA_PASSTHROUGH)) { +- pr_info(MPT3SAS_FMT "issue target reset: handle = (0x%04x)\n", +- ioc->name, +- le16_to_cpu(mpi_request->FunctionDependent1)); ++ ioc_info(ioc, "issue target reset: handle = (0x%04x)\n", ++ le16_to_cpu(mpi_request->FunctionDependent1)); + mpt3sas_halt_firmware(ioc); + pcie_device = mpt3sas_get_pdev_by_handle(ioc, + le16_to_cpu(mpi_request->FunctionDependent1)); +@@ -1128,8 +1105,8 @@ _ctl_getiocinfo(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + { + struct mpt3_ioctl_iocinfo karg; + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: enter\n", ++ __func__)); + + memset(&karg, 0 , sizeof(karg)); + if (ioc->pfacts) +@@ -1188,8 +1165,8 @@ _ctl_eventquery(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: enter\n", ++ __func__)); + + karg.event_entries = MPT3SAS_CTL_EVENT_LOG_SIZE; + memcpy(karg.event_types, ioc->event_type, +@@ -1219,8 +1196,8 @@ _ctl_eventenable(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: enter\n", ++ __func__)); + + memcpy(ioc->event_type, karg.event_types, + MPI2_EVENT_NOTIFY_EVENTMASK_WORDS * sizeof(u32)); +@@ -1259,8 +1236,8 @@ _ctl_eventreport(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: enter\n", ++ __func__)); + + number_bytes = karg.hdr.max_data_size - + sizeof(struct mpt3_ioctl_header); +@@ -1306,12 +1283,11 @@ _ctl_do_reset(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + ioc->is_driver_loading) + return -EAGAIN; + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: enter\n", ++ __func__)); + + retval = mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); +- pr_info(MPT3SAS_FMT "host reset: %s\n", +- ioc->name, ((!retval) ? "SUCCESS" : "FAILED")); ++ ioc_info(ioc, "host reset: %s\n", ((!retval) ? "SUCCESS" : "FAILED")); + return 0; + } + +@@ -1440,8 +1416,8 @@ _ctl_btdh_mapping(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s\n", ++ __func__)); + + rc = _ctl_btdh_search_sas_device(ioc, &karg); + if (!rc) +@@ -1512,53 +1488,46 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, + u32 ioc_state; + u8 issue_reset = 0; + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s\n", ++ __func__)); + + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + if (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + rc = -EAGAIN; + goto out; + } + + if (ioc->ctl_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: ctl_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: ctl_cmd in use\n", __func__); + rc = -EAGAIN; + goto out; + } + + buffer_type = diag_register->buffer_type; + if (!_ctl_diag_capability(ioc, buffer_type)) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have capability for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have capability for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -EPERM; + } + + if (ioc->diag_buffer_status[buffer_type] & + MPT3_DIAG_BUFFER_IS_REGISTERED) { +- pr_err(MPT3SAS_FMT +- "%s: already has a registered buffer for buffer_type(0x%02x)\n", +- ioc->name, __func__, +- buffer_type); ++ ioc_err(ioc, "%s: already has a registered buffer for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -EINVAL; + } + + if (diag_register->requested_buffer_size % 4) { +- pr_err(MPT3SAS_FMT +- "%s: the requested_buffer_size is not 4 byte aligned\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: the requested_buffer_size is not 4 byte aligned\n", ++ __func__); + return -EINVAL; + } + + smid = mpt3sas_base_get_smid(ioc, ioc->ctl_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -1593,9 +1562,8 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, + request_data = pci_alloc_consistent( + ioc->pdev, request_data_sz, &request_data_dma); + if (request_data == NULL) { +- pr_err(MPT3SAS_FMT "%s: failed allocating memory" \ +- " for diag buffers, requested size(%d)\n", +- ioc->name, __func__, request_data_sz); ++ ioc_err(ioc, "%s: failed allocating memory for diag buffers, requested size(%d)\n", ++ __func__, request_data_sz); + mpt3sas_base_free_smid(ioc, smid); + rc = -ENOMEM; + goto out; +@@ -1613,11 +1581,11 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, + mpi_request->VF_ID = 0; /* TODO */ + mpi_request->VP_ID = 0; + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: diag_buffer(0x%p), dma(0x%llx), sz(%d)\n", +- ioc->name, __func__, request_data, +- (unsigned long long)request_data_dma, +- le32_to_cpu(mpi_request->BufferLength))); ++ dctlprintk(ioc, ++ ioc_info(ioc, "%s: diag_buffer(0x%p), dma(0x%llx), sz(%d)\n", ++ __func__, request_data, ++ (unsigned long long)request_data_dma, ++ le32_to_cpu(mpi_request->BufferLength))); + + for (i = 0; i < MPT3_PRODUCT_SPECIFIC_DWORDS; i++) + mpi_request->ProductSpecific[i] = +@@ -1638,8 +1606,7 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, + + /* process the completed Reply Message Frame */ + if ((ioc->ctl_cmds.status & MPT3_CMD_REPLY_VALID) == 0) { +- pr_err(MPT3SAS_FMT "%s: no reply message\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: no reply message\n", __func__); + rc = -EFAULT; + goto out; + } +@@ -1650,13 +1617,11 @@ _ctl_diag_register_2(struct MPT3SAS_ADAPTER *ioc, + if (ioc_status == MPI2_IOCSTATUS_SUCCESS) { + ioc->diag_buffer_status[buffer_type] |= + MPT3_DIAG_BUFFER_IS_REGISTERED; +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: success\n", +- ioc->name, __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: success\n", __func__)); + } else { +- pr_info(MPT3SAS_FMT +- "%s: ioc_status(0x%04x) log_info(0x%08x)\n", +- ioc->name, __func__, +- ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo)); ++ ioc_info(ioc, "%s: ioc_status(0x%04x) log_info(0x%08x)\n", ++ __func__, ++ ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo)); + rc = -EFAULT; + } + +@@ -1690,8 +1655,7 @@ mpt3sas_enable_diag_buffer(struct MPT3SAS_ADAPTER *ioc, u8 bits_to_register) + memset(&diag_register, 0, sizeof(struct mpt3_diag_register)); + + if (bits_to_register & 1) { +- pr_info(MPT3SAS_FMT "registering trace buffer support\n", +- ioc->name); ++ ioc_info(ioc, "registering trace buffer support\n"); + ioc->diag_trigger_master.MasterData = + (MASTER_TRIGGER_FW_FAULT + MASTER_TRIGGER_ADAPTER_RESET); + diag_register.buffer_type = MPI2_DIAG_BUF_TYPE_TRACE; +@@ -1702,8 +1666,7 @@ mpt3sas_enable_diag_buffer(struct MPT3SAS_ADAPTER *ioc, u8 bits_to_register) + } + + if (bits_to_register & 2) { +- pr_info(MPT3SAS_FMT "registering snapshot buffer support\n", +- ioc->name); ++ ioc_info(ioc, "registering snapshot buffer support\n"); + diag_register.buffer_type = MPI2_DIAG_BUF_TYPE_SNAPSHOT; + /* register for 2MB buffers */ + diag_register.requested_buffer_size = 2 * (1024 * 1024); +@@ -1712,8 +1675,7 @@ mpt3sas_enable_diag_buffer(struct MPT3SAS_ADAPTER *ioc, u8 bits_to_register) + } + + if (bits_to_register & 4) { +- pr_info(MPT3SAS_FMT "registering extended buffer support\n", +- ioc->name); ++ ioc_info(ioc, "registering extended buffer support\n"); + diag_register.buffer_type = MPI2_DIAG_BUF_TYPE_EXTENDED; + /* register for 2MB buffers */ + diag_register.requested_buffer_size = 2 * (1024 * 1024); +@@ -1769,44 +1731,39 @@ _ctl_diag_unregister(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s\n", ++ __func__)); + + buffer_type = karg.unique_id & 0x000000ff; + if (!_ctl_diag_capability(ioc, buffer_type)) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have capability for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have capability for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -EPERM; + } + + if ((ioc->diag_buffer_status[buffer_type] & + MPT3_DIAG_BUFFER_IS_REGISTERED) == 0) { +- pr_err(MPT3SAS_FMT +- "%s: buffer_type(0x%02x) is not registered\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: buffer_type(0x%02x) is not registered\n", ++ __func__, buffer_type); + return -EINVAL; + } + if ((ioc->diag_buffer_status[buffer_type] & + MPT3_DIAG_BUFFER_IS_RELEASED) == 0) { +- pr_err(MPT3SAS_FMT +- "%s: buffer_type(0x%02x) has not been released\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: buffer_type(0x%02x) has not been released\n", ++ __func__, buffer_type); + return -EINVAL; + } + + if (karg.unique_id != ioc->unique_id[buffer_type]) { +- pr_err(MPT3SAS_FMT +- "%s: unique_id(0x%08x) is not registered\n", +- ioc->name, __func__, karg.unique_id); ++ ioc_err(ioc, "%s: unique_id(0x%08x) is not registered\n", ++ __func__, karg.unique_id); + return -EINVAL; + } + + request_data = ioc->diag_buffer[buffer_type]; + if (!request_data) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have memory allocated for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have memory allocated for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -ENOMEM; + } + +@@ -1842,41 +1799,37 @@ _ctl_diag_query(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s\n", ++ __func__)); + + karg.application_flags = 0; + buffer_type = karg.buffer_type; + + if (!_ctl_diag_capability(ioc, buffer_type)) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have capability for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have capability for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -EPERM; + } + + if ((ioc->diag_buffer_status[buffer_type] & + MPT3_DIAG_BUFFER_IS_REGISTERED) == 0) { +- pr_err(MPT3SAS_FMT +- "%s: buffer_type(0x%02x) is not registered\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: buffer_type(0x%02x) is not registered\n", ++ __func__, buffer_type); + return -EINVAL; + } + + if (karg.unique_id & 0xffffff00) { + if (karg.unique_id != ioc->unique_id[buffer_type]) { +- pr_err(MPT3SAS_FMT +- "%s: unique_id(0x%08x) is not registered\n", +- ioc->name, __func__, karg.unique_id); ++ ioc_err(ioc, "%s: unique_id(0x%08x) is not registered\n", ++ __func__, karg.unique_id); + return -EINVAL; + } + } + + request_data = ioc->diag_buffer[buffer_type]; + if (!request_data) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have buffer for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have buffer for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -ENOMEM; + } + +@@ -1898,9 +1851,8 @@ _ctl_diag_query(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + karg.diagnostic_flags = ioc->diagnostic_flags[buffer_type]; + + if (copy_to_user(arg, &karg, sizeof(struct mpt3_diag_query))) { +- pr_err(MPT3SAS_FMT +- "%s: unable to write mpt3_diag_query data @ %p\n", +- ioc->name, __func__, arg); ++ ioc_err(ioc, "%s: unable to write mpt3_diag_query data @ %p\n", ++ __func__, arg); + return -EFAULT; + } + return 0; +@@ -1924,8 +1876,8 @@ mpt3sas_send_diag_release(struct MPT3SAS_ADAPTER *ioc, u8 buffer_type, + u32 ioc_state; + int rc; + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s\n", ++ __func__)); + + rc = 0; + *issue_reset = 0; +@@ -1936,24 +1888,22 @@ mpt3sas_send_diag_release(struct MPT3SAS_ADAPTER *ioc, u8 buffer_type, + MPT3_DIAG_BUFFER_IS_REGISTERED) + ioc->diag_buffer_status[buffer_type] |= + MPT3_DIAG_BUFFER_IS_RELEASED; +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: skipping due to FAULT state\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ++ ioc_info(ioc, "%s: skipping due to FAULT state\n", ++ __func__)); + rc = -EAGAIN; + goto out; + } + + if (ioc->ctl_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: ctl_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: ctl_cmd in use\n", __func__); + rc = -EAGAIN; + goto out; + } + + smid = mpt3sas_base_get_smid(ioc, ioc->ctl_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -1983,8 +1933,7 @@ mpt3sas_send_diag_release(struct MPT3SAS_ADAPTER *ioc, u8 buffer_type, + + /* process the completed Reply Message Frame */ + if ((ioc->ctl_cmds.status & MPT3_CMD_REPLY_VALID) == 0) { +- pr_err(MPT3SAS_FMT "%s: no reply message\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: no reply message\n", __func__); + rc = -EFAULT; + goto out; + } +@@ -1995,13 +1944,11 @@ mpt3sas_send_diag_release(struct MPT3SAS_ADAPTER *ioc, u8 buffer_type, + if (ioc_status == MPI2_IOCSTATUS_SUCCESS) { + ioc->diag_buffer_status[buffer_type] |= + MPT3_DIAG_BUFFER_IS_RELEASED; +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: success\n", +- ioc->name, __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: success\n", __func__)); + } else { +- pr_info(MPT3SAS_FMT +- "%s: ioc_status(0x%04x) log_info(0x%08x)\n", +- ioc->name, __func__, +- ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo)); ++ ioc_info(ioc, "%s: ioc_status(0x%04x) log_info(0x%08x)\n", ++ __func__, ++ ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo)); + rc = -EFAULT; + } + +@@ -2034,47 +1981,41 @@ _ctl_diag_release(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s\n", ++ __func__)); + + buffer_type = karg.unique_id & 0x000000ff; + if (!_ctl_diag_capability(ioc, buffer_type)) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have capability for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have capability for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -EPERM; + } + + if ((ioc->diag_buffer_status[buffer_type] & + MPT3_DIAG_BUFFER_IS_REGISTERED) == 0) { +- pr_err(MPT3SAS_FMT +- "%s: buffer_type(0x%02x) is not registered\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: buffer_type(0x%02x) is not registered\n", ++ __func__, buffer_type); + return -EINVAL; + } + + if (karg.unique_id != ioc->unique_id[buffer_type]) { +- pr_err(MPT3SAS_FMT +- "%s: unique_id(0x%08x) is not registered\n", +- ioc->name, __func__, karg.unique_id); ++ ioc_err(ioc, "%s: unique_id(0x%08x) is not registered\n", ++ __func__, karg.unique_id); + return -EINVAL; + } + + if (ioc->diag_buffer_status[buffer_type] & + MPT3_DIAG_BUFFER_IS_RELEASED) { +- pr_err(MPT3SAS_FMT +- "%s: buffer_type(0x%02x) is already released\n", +- ioc->name, __func__, +- buffer_type); ++ ioc_err(ioc, "%s: buffer_type(0x%02x) is already released\n", ++ __func__, buffer_type); + return 0; + } + + request_data = ioc->diag_buffer[buffer_type]; + + if (!request_data) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have memory allocated for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have memory allocated for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -ENOMEM; + } + +@@ -2085,9 +2026,8 @@ _ctl_diag_release(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + MPT3_DIAG_BUFFER_IS_RELEASED; + ioc->diag_buffer_status[buffer_type] &= + ~MPT3_DIAG_BUFFER_IS_DIAG_RESET; +- pr_err(MPT3SAS_FMT +- "%s: buffer_type(0x%02x) was released due to host reset\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: buffer_type(0x%02x) was released due to host reset\n", ++ __func__, buffer_type); + return 0; + } + +@@ -2125,38 +2065,34 @@ _ctl_diag_read_buffer(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EFAULT; + } + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, +- __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s\n", ++ __func__)); + + buffer_type = karg.unique_id & 0x000000ff; + if (!_ctl_diag_capability(ioc, buffer_type)) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have capability for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have capability for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -EPERM; + } + + if (karg.unique_id != ioc->unique_id[buffer_type]) { +- pr_err(MPT3SAS_FMT +- "%s: unique_id(0x%08x) is not registered\n", +- ioc->name, __func__, karg.unique_id); ++ ioc_err(ioc, "%s: unique_id(0x%08x) is not registered\n", ++ __func__, karg.unique_id); + return -EINVAL; + } + + request_data = ioc->diag_buffer[buffer_type]; + if (!request_data) { +- pr_err(MPT3SAS_FMT +- "%s: doesn't have buffer for buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type); ++ ioc_err(ioc, "%s: doesn't have buffer for buffer_type(0x%02x)\n", ++ __func__, buffer_type); + return -ENOMEM; + } + + request_size = ioc->diag_buffer_sz[buffer_type]; + + if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) { +- pr_err(MPT3SAS_FMT "%s: either the starting_offset " \ +- "or bytes_to_read are not 4 byte aligned\n", ioc->name, +- __func__); ++ ioc_err(ioc, "%s: either the starting_offset or bytes_to_read are not 4 byte aligned\n", ++ __func__); + return -EINVAL; + } + +@@ -2164,10 +2100,10 @@ _ctl_diag_read_buffer(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + return -EINVAL; + + diag_data = (void *)(request_data + karg.starting_offset); +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: diag_buffer(%p), offset(%d), sz(%d)\n", +- ioc->name, __func__, +- diag_data, karg.starting_offset, karg.bytes_to_read)); ++ dctlprintk(ioc, ++ ioc_info(ioc, "%s: diag_buffer(%p), offset(%d), sz(%d)\n", ++ __func__, diag_data, karg.starting_offset, ++ karg.bytes_to_read)); + + /* Truncate data on requests that are too large */ + if ((diag_data + karg.bytes_to_read < diag_data) || +@@ -2178,39 +2114,36 @@ _ctl_diag_read_buffer(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + + if (copy_to_user((void __user *)uarg->diagnostic_data, + diag_data, copy_size)) { +- pr_err(MPT3SAS_FMT +- "%s: Unable to write mpt_diag_read_buffer_t data @ %p\n", +- ioc->name, __func__, diag_data); ++ ioc_err(ioc, "%s: Unable to write mpt_diag_read_buffer_t data @ %p\n", ++ __func__, diag_data); + return -EFAULT; + } + + if ((karg.flags & MPT3_FLAGS_REREGISTER) == 0) + return 0; + +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: Reregister buffer_type(0x%02x)\n", +- ioc->name, __func__, buffer_type)); ++ dctlprintk(ioc, ++ ioc_info(ioc, "%s: Reregister buffer_type(0x%02x)\n", ++ __func__, buffer_type)); + if ((ioc->diag_buffer_status[buffer_type] & + MPT3_DIAG_BUFFER_IS_RELEASED) == 0) { +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: buffer_type(0x%02x) is still registered\n", +- ioc->name, __func__, buffer_type)); ++ dctlprintk(ioc, ++ ioc_info(ioc, "%s: buffer_type(0x%02x) is still registered\n", ++ __func__, buffer_type)); + return 0; + } + /* Get a free request frame and save the message context. + */ + + if (ioc->ctl_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: ctl_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: ctl_cmd in use\n", __func__); + rc = -EAGAIN; + goto out; + } + + smid = mpt3sas_base_get_smid(ioc, ioc->ctl_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -2248,8 +2181,7 @@ _ctl_diag_read_buffer(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + + /* process the completed Reply Message Frame */ + if ((ioc->ctl_cmds.status & MPT3_CMD_REPLY_VALID) == 0) { +- pr_err(MPT3SAS_FMT "%s: no reply message\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: no reply message\n", __func__); + rc = -EFAULT; + goto out; + } +@@ -2260,13 +2192,11 @@ _ctl_diag_read_buffer(struct MPT3SAS_ADAPTER *ioc, void __user *arg) + if (ioc_status == MPI2_IOCSTATUS_SUCCESS) { + ioc->diag_buffer_status[buffer_type] |= + MPT3_DIAG_BUFFER_IS_REGISTERED; +- dctlprintk(ioc, pr_info(MPT3SAS_FMT "%s: success\n", +- ioc->name, __func__)); ++ dctlprintk(ioc, ioc_info(ioc, "%s: success\n", __func__)); + } else { +- pr_info(MPT3SAS_FMT +- "%s: ioc_status(0x%04x) log_info(0x%08x)\n", +- ioc->name, __func__, +- ioc_status, le32_to_cpu(mpi_reply->IOCLogInfo)); ++ ioc_info(ioc, "%s: ioc_status(0x%04x) log_info(0x%08x)\n", ++ __func__, ioc_status, ++ le32_to_cpu(mpi_reply->IOCLogInfo)); + rc = -EFAULT; + } + +@@ -2451,8 +2381,9 @@ _ctl_ioctl_main(struct file *file, unsigned int cmd, void __user *arg, + ret = _ctl_diag_read_buffer(ioc, arg); + break; + default: +- dctlprintk(ioc, pr_info(MPT3SAS_FMT +- "unsupported ioctl opcode(0x%08x)\n", ioc->name, cmd)); ++ dctlprintk(ioc, ++ ioc_info(ioc, "unsupported ioctl opcode(0x%08x)\n", ++ cmd)); + break; + } + +@@ -2841,8 +2772,8 @@ _ctl_logging_level_store(struct device *cdev, struct device_attribute *attr, + return -EINVAL; + + ioc->logging_level = val; +- pr_info(MPT3SAS_FMT "logging_level=%08xh\n", ioc->name, +- ioc->logging_level); ++ ioc_info(ioc, "logging_level=%08xh\n", ++ ioc->logging_level); + return strlen(buf); + } + static DEVICE_ATTR(logging_level, S_IRUGO | S_IWUSR, _ctl_logging_level_show, +@@ -2878,8 +2809,8 @@ _ctl_fwfault_debug_store(struct device *cdev, struct device_attribute *attr, + return -EINVAL; + + ioc->fwfault_debug = val; +- pr_info(MPT3SAS_FMT "fwfault_debug=%d\n", ioc->name, +- ioc->fwfault_debug); ++ ioc_info(ioc, "fwfault_debug=%d\n", ++ ioc->fwfault_debug); + return strlen(buf); + } + static DEVICE_ATTR(fwfault_debug, S_IRUGO | S_IWUSR, +@@ -2959,8 +2890,8 @@ _ctl_BRM_status_show(struct device *cdev, struct device_attribute *attr, + ssize_t rc = 0; + + if (!ioc->is_warpdrive) { +- pr_err(MPT3SAS_FMT "%s: BRM attribute is only for" +- " warpdrive\n", ioc->name, __func__); ++ ioc_err(ioc, "%s: BRM attribute is only for warpdrive\n", ++ __func__); + goto out; + } + /* pci_access_mutex lock acquired by sysfs show path */ +@@ -2974,30 +2905,28 @@ _ctl_BRM_status_show(struct device *cdev, struct device_attribute *attr, + sz = offsetof(Mpi2IOUnitPage3_t, GPIOVal) + (sizeof(u16) * 36); + io_unit_pg3 = kzalloc(sz, GFP_KERNEL); + if (!io_unit_pg3) { +- pr_err(MPT3SAS_FMT "%s: failed allocating memory " +- "for iounit_pg3: (%d) bytes\n", ioc->name, __func__, sz); ++ ioc_err(ioc, "%s: failed allocating memory for iounit_pg3: (%d) bytes\n", ++ __func__, sz); + goto out; + } + + if (mpt3sas_config_get_iounit_pg3(ioc, &mpi_reply, io_unit_pg3, sz) != + 0) { +- pr_err(MPT3SAS_FMT +- "%s: failed reading iounit_pg3\n", ioc->name, +- __func__); ++ ioc_err(ioc, "%s: failed reading iounit_pg3\n", ++ __func__); + goto out; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "%s: iounit_pg3 failed with " +- "ioc_status(0x%04x)\n", ioc->name, __func__, ioc_status); ++ ioc_err(ioc, "%s: iounit_pg3 failed with ioc_status(0x%04x)\n", ++ __func__, ioc_status); + goto out; + } + + if (io_unit_pg3->GPIOCount < 25) { +- pr_err(MPT3SAS_FMT "%s: iounit_pg3->GPIOCount less than " +- "25 entries, detected (%d) entries\n", ioc->name, __func__, +- io_unit_pg3->GPIOCount); ++ ioc_err(ioc, "%s: iounit_pg3->GPIOCount less than 25 entries, detected (%d) entries\n", ++ __func__, io_unit_pg3->GPIOCount); + goto out; + } + +@@ -3040,17 +2969,15 @@ _ctl_host_trace_buffer_size_show(struct device *cdev, + struct DIAG_BUFFER_START *request_data; + + if (!ioc->diag_buffer[MPI2_DIAG_BUF_TYPE_TRACE]) { +- pr_err(MPT3SAS_FMT +- "%s: host_trace_buffer is not registered\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: host_trace_buffer is not registered\n", ++ __func__); + return 0; + } + + if ((ioc->diag_buffer_status[MPI2_DIAG_BUF_TYPE_TRACE] & + MPT3_DIAG_BUFFER_IS_REGISTERED) == 0) { +- pr_err(MPT3SAS_FMT +- "%s: host_trace_buffer is not registered\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: host_trace_buffer is not registered\n", ++ __func__); + return 0; + } + +@@ -3090,17 +3017,15 @@ _ctl_host_trace_buffer_show(struct device *cdev, struct device_attribute *attr, + u32 size; + + if (!ioc->diag_buffer[MPI2_DIAG_BUF_TYPE_TRACE]) { +- pr_err(MPT3SAS_FMT +- "%s: host_trace_buffer is not registered\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: host_trace_buffer is not registered\n", ++ __func__); + return 0; + } + + if ((ioc->diag_buffer_status[MPI2_DIAG_BUF_TYPE_TRACE] & + MPT3_DIAG_BUFFER_IS_REGISTERED) == 0) { +- pr_err(MPT3SAS_FMT +- "%s: host_trace_buffer is not registered\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: host_trace_buffer is not registered\n", ++ __func__); + return 0; + } + +@@ -3189,8 +3114,7 @@ _ctl_host_trace_buffer_enable_store(struct device *cdev, + MPT3_DIAG_BUFFER_IS_RELEASED) == 0)) + goto out; + memset(&diag_register, 0, sizeof(struct mpt3_diag_register)); +- pr_info(MPT3SAS_FMT "posting host trace buffers\n", +- ioc->name); ++ ioc_info(ioc, "posting host trace buffers\n"); + diag_register.buffer_type = MPI2_DIAG_BUF_TYPE_TRACE; + diag_register.requested_buffer_size = (1024 * 1024); + diag_register.unique_id = 0x7075900; +@@ -3206,8 +3130,7 @@ _ctl_host_trace_buffer_enable_store(struct device *cdev, + if ((ioc->diag_buffer_status[MPI2_DIAG_BUF_TYPE_TRACE] & + MPT3_DIAG_BUFFER_IS_RELEASED)) + goto out; +- pr_info(MPT3SAS_FMT "releasing host trace buffer\n", +- ioc->name); ++ ioc_info(ioc, "releasing host trace buffer\n"); + mpt3sas_send_diag_release(ioc, MPI2_DIAG_BUF_TYPE_TRACE, + &issue_reset); + } +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index c8d97dc2ca63..8ec997b4ee34 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -418,8 +418,8 @@ _scsih_get_sas_address(struct MPT3SAS_ADAPTER *ioc, u16 handle, + + if ((mpt3sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0, + MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -ENXIO; + } + +@@ -442,10 +442,8 @@ _scsih_get_sas_address(struct MPT3SAS_ADAPTER *ioc, u16 handle, + return -ENXIO; + + /* else error case */ +- pr_err(MPT3SAS_FMT +- "handle(0x%04x), ioc_status(0x%04x), failure at %s:%d/%s()!\n", +- ioc->name, handle, ioc_status, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "handle(0x%04x), ioc_status(0x%04x), failure at %s:%d/%s()!\n", ++ handle, ioc_status, __FILE__, __LINE__, __func__); + return -EIO; + } + +@@ -508,10 +506,9 @@ _scsih_determine_boot_device(struct MPT3SAS_ADAPTER *ioc, void *device, + (ioc->bios_pg2.ReqBootDeviceForm & + MPI2_BIOSPAGE2_FORM_MASK), + &ioc->bios_pg2.RequestedBootDevice)) { +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: req_boot_device(0x%016llx)\n", +- ioc->name, __func__, +- (unsigned long long)sas_address)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "%s: req_boot_device(0x%016llx)\n", ++ __func__, (u64)sas_address)); + ioc->req_boot_device.device = device; + ioc->req_boot_device.channel = channel; + } +@@ -523,10 +520,9 @@ _scsih_determine_boot_device(struct MPT3SAS_ADAPTER *ioc, void *device, + (ioc->bios_pg2.ReqAltBootDeviceForm & + MPI2_BIOSPAGE2_FORM_MASK), + &ioc->bios_pg2.RequestedAltBootDevice)) { +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: req_alt_boot_device(0x%016llx)\n", +- ioc->name, __func__, +- (unsigned long long)sas_address)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "%s: req_alt_boot_device(0x%016llx)\n", ++ __func__, (u64)sas_address)); + ioc->req_alt_boot_device.device = device; + ioc->req_alt_boot_device.channel = channel; + } +@@ -538,10 +534,9 @@ _scsih_determine_boot_device(struct MPT3SAS_ADAPTER *ioc, void *device, + (ioc->bios_pg2.CurrentBootDeviceForm & + MPI2_BIOSPAGE2_FORM_MASK), + &ioc->bios_pg2.CurrentBootDevice)) { +- dinitprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: current_boot_device(0x%016llx)\n", +- ioc->name, __func__, +- (unsigned long long)sas_address)); ++ dinitprintk(ioc, ++ ioc_info(ioc, "%s: current_boot_device(0x%016llx)\n", ++ __func__, (u64)sas_address)); + ioc->current_boot_device.device = device; + ioc->current_boot_device.channel = channel; + } +@@ -752,19 +747,16 @@ _scsih_display_enclosure_chassis_info(struct MPT3SAS_ADAPTER *ioc, + sas_device->chassis_slot); + } else { + if (sas_device->enclosure_handle != 0) +- pr_info(MPT3SAS_FMT +- "enclosure logical id(0x%016llx), slot(%d) \n", +- ioc->name, (unsigned long long) +- sas_device->enclosure_logical_id, +- sas_device->slot); ++ ioc_info(ioc, "enclosure logical id(0x%016llx), slot(%d)\n", ++ (u64)sas_device->enclosure_logical_id, ++ sas_device->slot); + if (sas_device->connector_name[0] != '\0') +- pr_info(MPT3SAS_FMT +- "enclosure level(0x%04x), connector name( %s)\n", +- ioc->name, sas_device->enclosure_level, +- sas_device->connector_name); ++ ioc_info(ioc, "enclosure level(0x%04x), connector name( %s)\n", ++ sas_device->enclosure_level, ++ sas_device->connector_name); + if (sas_device->is_chassis_slot_valid) +- pr_info(MPT3SAS_FMT "chassis slot(0x%04x)\n", +- ioc->name, sas_device->chassis_slot); ++ ioc_info(ioc, "chassis slot(0x%04x)\n", ++ sas_device->chassis_slot); + } + } + +@@ -784,10 +776,8 @@ _scsih_sas_device_remove(struct MPT3SAS_ADAPTER *ioc, + + if (!sas_device) + return; +- pr_info(MPT3SAS_FMT +- "removing handle(0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, sas_device->handle, +- (unsigned long long) sas_device->sas_address); ++ ioc_info(ioc, "removing handle(0x%04x), sas_addr(0x%016llx)\n", ++ sas_device->handle, (u64)sas_device->sas_address); + + _scsih_display_enclosure_chassis_info(ioc, sas_device, NULL, NULL); + +@@ -872,10 +862,10 @@ _scsih_sas_device_add(struct MPT3SAS_ADAPTER *ioc, + { + unsigned long flags; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle(0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, __func__, sas_device->handle, +- (unsigned long long)sas_device->sas_address)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: handle(0x%04x), sas_addr(0x%016llx)\n", ++ __func__, sas_device->handle, ++ (u64)sas_device->sas_address)); + + dewtprintk(ioc, _scsih_display_enclosure_chassis_info(ioc, sas_device, + NULL, NULL)); +@@ -923,10 +913,10 @@ _scsih_sas_device_init_add(struct MPT3SAS_ADAPTER *ioc, + { + unsigned long flags; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle(0x%04x), sas_addr(0x%016llx)\n", ioc->name, +- __func__, sas_device->handle, +- (unsigned long long)sas_device->sas_address)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: handle(0x%04x), sas_addr(0x%016llx)\n", ++ __func__, sas_device->handle, ++ (u64)sas_device->sas_address)); + + dewtprintk(ioc, _scsih_display_enclosure_chassis_info(ioc, sas_device, + NULL, NULL)); +@@ -1073,21 +1063,16 @@ _scsih_pcie_device_remove(struct MPT3SAS_ADAPTER *ioc, + + if (!pcie_device) + return; +- pr_info(MPT3SAS_FMT +- "removing handle(0x%04x), wwid(0x%016llx)\n", +- ioc->name, pcie_device->handle, +- (unsigned long long) pcie_device->wwid); ++ ioc_info(ioc, "removing handle(0x%04x), wwid(0x%016llx)\n", ++ pcie_device->handle, (u64)pcie_device->wwid); + if (pcie_device->enclosure_handle != 0) +- pr_info(MPT3SAS_FMT +- "removing enclosure logical id(0x%016llx), slot(%d)\n", +- ioc->name, +- (unsigned long long)pcie_device->enclosure_logical_id, +- pcie_device->slot); ++ ioc_info(ioc, "removing enclosure logical id(0x%016llx), slot(%d)\n", ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot); + if (pcie_device->connector_name[0] != '\0') +- pr_info(MPT3SAS_FMT +- "removing enclosure level(0x%04x), connector name( %s)\n", +- ioc->name, pcie_device->enclosure_level, +- pcie_device->connector_name); ++ ioc_info(ioc, "removing enclosure level(0x%04x), connector name( %s)\n", ++ pcie_device->enclosure_level, ++ pcie_device->connector_name); + + spin_lock_irqsave(&ioc->pcie_device_lock, flags); + if (!list_empty(&pcie_device->list)) { +@@ -1146,20 +1131,21 @@ _scsih_pcie_device_add(struct MPT3SAS_ADAPTER *ioc, + { + unsigned long flags; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle (0x%04x), wwid(0x%016llx)\n", ioc->name, __func__, +- pcie_device->handle, (unsigned long long)pcie_device->wwid)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: handle (0x%04x), wwid(0x%016llx)\n", ++ __func__, ++ pcie_device->handle, (u64)pcie_device->wwid)); + if (pcie_device->enclosure_handle != 0) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enclosure logical id(0x%016llx), slot( %d)\n", +- ioc->name, __func__, +- (unsigned long long)pcie_device->enclosure_logical_id, +- pcie_device->slot)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enclosure logical id(0x%016llx), slot( %d)\n", ++ __func__, ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot)); + if (pcie_device->connector_name[0] != '\0') +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enclosure level(0x%04x), connector name( %s)\n", +- ioc->name, __func__, pcie_device->enclosure_level, +- pcie_device->connector_name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enclosure level(0x%04x), connector name( %s)\n", ++ __func__, pcie_device->enclosure_level, ++ pcie_device->connector_name)); + + spin_lock_irqsave(&ioc->pcie_device_lock, flags); + pcie_device_get(pcie_device); +@@ -1191,20 +1177,21 @@ _scsih_pcie_device_init_add(struct MPT3SAS_ADAPTER *ioc, + { + unsigned long flags; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle (0x%04x), wwid(0x%016llx)\n", ioc->name, __func__, +- pcie_device->handle, (unsigned long long)pcie_device->wwid)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: handle (0x%04x), wwid(0x%016llx)\n", ++ __func__, ++ pcie_device->handle, (u64)pcie_device->wwid)); + if (pcie_device->enclosure_handle != 0) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enclosure logical id(0x%016llx), slot( %d)\n", +- ioc->name, __func__, +- (unsigned long long)pcie_device->enclosure_logical_id, +- pcie_device->slot)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enclosure logical id(0x%016llx), slot( %d)\n", ++ __func__, ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot)); + if (pcie_device->connector_name[0] != '\0') +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enclosure level(0x%04x), connector name( %s)\n", +- ioc->name, __func__, pcie_device->enclosure_level, +- pcie_device->connector_name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enclosure level(0x%04x), connector name( %s)\n", ++ __func__, pcie_device->enclosure_level, ++ pcie_device->connector_name)); + + spin_lock_irqsave(&ioc->pcie_device_lock, flags); + pcie_device_get(pcie_device); +@@ -1304,9 +1291,10 @@ _scsih_raid_device_add(struct MPT3SAS_ADAPTER *ioc, + { + unsigned long flags; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle(0x%04x), wwid(0x%016llx)\n", ioc->name, __func__, +- raid_device->handle, (unsigned long long)raid_device->wwid)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: handle(0x%04x), wwid(0x%016llx)\n", ++ __func__, ++ raid_device->handle, (u64)raid_device->wwid)); + + spin_lock_irqsave(&ioc->raid_device_lock, flags); + list_add_tail(&raid_device->list, &ioc->raid_device_list); +@@ -1869,16 +1857,16 @@ _scsih_display_sata_capabilities(struct MPT3SAS_ADAPTER *ioc, + + if ((mpt3sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0, + MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + +@@ -1964,8 +1952,8 @@ scsih_get_resync(struct device *dev) + if (mpt3sas_config_get_raid_volume_pg0(ioc, &mpi_reply, &vol_pg0, + MPI2_RAID_VOLUME_PGAD_FORM_HANDLE, handle, + sizeof(Mpi2RaidVolPage0_t))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + percent_complete = 0; + goto out; + } +@@ -2018,8 +2006,8 @@ scsih_get_state(struct device *dev) + if (mpt3sas_config_get_raid_volume_pg0(ioc, &mpi_reply, &vol_pg0, + MPI2_RAID_VOLUME_PGAD_FORM_HANDLE, handle, + sizeof(Mpi2RaidVolPage0_t))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + +@@ -2115,9 +2103,9 @@ _scsih_get_volume_capabilities(struct MPT3SAS_ADAPTER *ioc, + + if ((mpt3sas_config_get_number_pds(ioc, raid_device->handle, + &num_pds)) || !num_pds) { +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, __FILE__, __LINE__, +- __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + +@@ -2126,17 +2114,17 @@ _scsih_get_volume_capabilities(struct MPT3SAS_ADAPTER *ioc, + sizeof(Mpi2RaidVol0PhysDisk_t)); + vol_pg0 = kzalloc(sz, GFP_KERNEL); + if (!vol_pg0) { +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, __FILE__, __LINE__, +- __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + + if ((mpt3sas_config_get_raid_volume_pg0(ioc, &mpi_reply, vol_pg0, + MPI2_RAID_VOLUME_PGAD_FORM_HANDLE, raid_device->handle, sz))) { +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, __FILE__, __LINE__, +- __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + kfree(vol_pg0); + return 1; + } +@@ -2227,16 +2215,16 @@ scsih_slave_configure(struct scsi_device *sdev) + raid_device = mpt3sas_raid_device_find_by_handle(ioc, handle); + spin_unlock_irqrestore(&ioc->raid_device_lock, flags); + if (!raid_device) { +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, __FILE__, +- __LINE__, __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + + if (_scsih_get_volume_capabilities(ioc, raid_device)) { +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, __FILE__, +- __LINE__, __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + +@@ -2320,16 +2308,16 @@ scsih_slave_configure(struct scsi_device *sdev) + if (sas_target_priv_data->flags & MPT_TARGET_FLAGS_RAID_COMPONENT) { + if (mpt3sas_config_get_volume_handle(ioc, handle, + &volume_handle)) { +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + if (volume_handle && mpt3sas_config_get_volume_wwid(ioc, + volume_handle, &volume_wwid)) { +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + } +@@ -2341,9 +2329,9 @@ scsih_slave_configure(struct scsi_device *sdev) + sas_device_priv_data->sas_target->sas_address); + if (!pcie_device) { + spin_unlock_irqrestore(&ioc->pcie_device_lock, flags); +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, __FILE__, +- __LINE__, __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + +@@ -2389,9 +2377,9 @@ scsih_slave_configure(struct scsi_device *sdev) + sas_device_priv_data->sas_target->sas_address); + if (!sas_device) { + spin_unlock_irqrestore(&ioc->sas_device_lock, flags); +- dfailprintk(ioc, pr_warn(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, __FILE__, __LINE__, +- __func__)); ++ dfailprintk(ioc, ++ ioc_warn(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__)); + return 1; + } + +@@ -2527,8 +2515,7 @@ _scsih_response_code(struct MPT3SAS_ADAPTER *ioc, u8 response_code) + desc = "unknown"; + break; + } +- pr_warn(MPT3SAS_FMT "response_code(0x%01x): %s\n", +- ioc->name, response_code, desc); ++ ioc_warn(ioc, "response_code(0x%01x): %s\n", response_code, desc); + } + + /** +@@ -2666,8 +2653,7 @@ mpt3sas_scsih_issue_tm(struct MPT3SAS_ADAPTER *ioc, u16 handle, u64 lun, + + ioc_state = mpt3sas_base_get_iocstate(ioc, 0); + if (ioc_state & MPI2_DOORBELL_USED) { +- dhsprintk(ioc, pr_info(MPT3SAS_FMT +- "unexpected doorbell active!\n", ioc->name)); ++ dhsprintk(ioc, ioc_info(ioc, "unexpected doorbell active!\n")); + rc = mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); + return (!rc) ? SUCCESS : FAILED; + } +@@ -2681,14 +2667,13 @@ mpt3sas_scsih_issue_tm(struct MPT3SAS_ADAPTER *ioc, u16 handle, u64 lun, + + smid = mpt3sas_base_get_smid_hpr(ioc, ioc->tm_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + return FAILED; + } + +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "sending tm: handle(0x%04x), task_type(0x%02x), smid(%d), timeout(%d), tr_method(0x%x)\n", +- ioc->name, handle, type, smid_task, timeout, tr_method)); ++ dtmprintk(ioc, ++ ioc_info(ioc, "sending tm: handle(0x%04x), task_type(0x%02x), smid(%d), timeout(%d), tr_method(0x%x)\n", ++ handle, type, smid_task, timeout, tr_method)); + ioc->tm_cmds.status = MPT3_CMD_PENDING; + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); + ioc->tm_cmds.smid = smid; +@@ -2721,11 +2706,11 @@ mpt3sas_scsih_issue_tm(struct MPT3SAS_ADAPTER *ioc, u16 handle, u64 lun, + if (ioc->tm_cmds.status & MPT3_CMD_REPLY_VALID) { + mpt3sas_trigger_master(ioc, MASTER_TRIGGER_TASK_MANAGMENT); + mpi_reply = ioc->tm_cmds.reply; +- dtmprintk(ioc, pr_info(MPT3SAS_FMT "complete tm: " \ +- "ioc_status(0x%04x), loginfo(0x%08x), term_count(0x%08x)\n", +- ioc->name, le16_to_cpu(mpi_reply->IOCStatus), +- le32_to_cpu(mpi_reply->IOCLogInfo), +- le32_to_cpu(mpi_reply->TerminationCount))); ++ dtmprintk(ioc, ++ ioc_info(ioc, "complete tm: ioc_status(0x%04x), loginfo(0x%08x), term_count(0x%08x)\n", ++ le16_to_cpu(mpi_reply->IOCStatus), ++ le32_to_cpu(mpi_reply->IOCLogInfo), ++ le32_to_cpu(mpi_reply->TerminationCount))); + if (ioc->logging_level & MPT_DEBUG_TM) { + _scsih_response_code(ioc, mpi_reply->ResponseCode); + if (mpi_reply->IOCStatus) +@@ -3072,13 +3057,11 @@ scsih_host_reset(struct scsi_cmnd *scmd) + struct MPT3SAS_ADAPTER *ioc = shost_priv(scmd->device->host); + int r, retval; + +- pr_info(MPT3SAS_FMT "attempting host reset! scmd(%p)\n", +- ioc->name, scmd); ++ ioc_info(ioc, "attempting host reset! scmd(%p)\n", scmd); + scsi_print_command(scmd); + + if (ioc->is_driver_loading || ioc->remove_host) { +- pr_info(MPT3SAS_FMT "Blocking the host reset\n", +- ioc->name); ++ ioc_info(ioc, "Blocking the host reset\n"); + r = FAILED; + goto out; + } +@@ -3086,8 +3069,8 @@ scsih_host_reset(struct scsi_cmnd *scmd) + retval = mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); + r = (retval < 0) ? FAILED : SUCCESS; + out: +- pr_info(MPT3SAS_FMT "host reset: %s scmd(%p)\n", +- ioc->name, ((r == SUCCESS) ? "SUCCESS" : "FAILED"), scmd); ++ ioc_info(ioc, "host reset: %s scmd(%p)\n", ++ r == SUCCESS ? "SUCCESS" : "FAILED", scmd); + + return r; + } +@@ -3626,39 +3609,31 @@ _scsih_tm_tr_send(struct MPT3SAS_ADAPTER *ioc, u16 handle) + tr_method = MPI2_SCSITASKMGMT_MSGFLAGS_LINK_RESET; + } + if (sas_target_priv_data) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting delete flag: handle(0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, handle, +- (unsigned long long)sas_address)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting delete flag: handle(0x%04x), sas_addr(0x%016llx)\n", ++ handle, (u64)sas_address)); + if (sas_device) { + if (sas_device->enclosure_handle != 0) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting delete flag:enclosure logical " +- "id(0x%016llx), slot(%d)\n", ioc->name, +- (unsigned long long) +- sas_device->enclosure_logical_id, +- sas_device->slot)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting delete flag:enclosure logical id(0x%016llx), slot(%d)\n", ++ (u64)sas_device->enclosure_logical_id, ++ sas_device->slot)); + if (sas_device->connector_name[0] != '\0') +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting delete flag: enclosure " +- "level(0x%04x), connector name( %s)\n", +- ioc->name, sas_device->enclosure_level, +- sas_device->connector_name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting delete flag: enclosure level(0x%04x), connector name( %s)\n", ++ sas_device->enclosure_level, ++ sas_device->connector_name)); + } else if (pcie_device) { + if (pcie_device->enclosure_handle != 0) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting delete flag: logical " +- "id(0x%016llx), slot(%d)\n", ioc->name, +- (unsigned long long) +- pcie_device->enclosure_logical_id, +- pcie_device->slot)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting delete flag: logical id(0x%016llx), slot(%d)\n", ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot)); + if (pcie_device->connector_name[0] != '\0') +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting delete flag:, enclosure " +- "level(0x%04x), " +- "connector name( %s)\n", ioc->name, +- pcie_device->enclosure_level, +- pcie_device->connector_name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting delete flag:, enclosure level(0x%04x), connector name( %s)\n", ++ pcie_device->enclosure_level, ++ pcie_device->connector_name)); + } + _scsih_ublock_io_device(ioc, sas_address); + sas_target_priv_data->handle = MPT3SAS_INVALID_DEVICE_HANDLE; +@@ -3672,16 +3647,15 @@ _scsih_tm_tr_send(struct MPT3SAS_ADAPTER *ioc, u16 handle) + INIT_LIST_HEAD(&delayed_tr->list); + delayed_tr->handle = handle; + list_add_tail(&delayed_tr->list, &ioc->delayed_tr_list); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "DELAYED:tr:handle(0x%04x), (open)\n", +- ioc->name, handle)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "DELAYED:tr:handle(0x%04x), (open)\n", ++ handle)); + goto out; + } + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "tr_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", +- ioc->name, handle, smid, +- ioc->tm_tr_cb_idx)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "tr_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", ++ handle, smid, ioc->tm_tr_cb_idx)); + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); + memset(mpi_request, 0, sizeof(Mpi2SCSITaskManagementRequest_t)); + mpi_request->Function = MPI2_FUNCTION_SCSI_TASK_MGMT; +@@ -3729,39 +3703,39 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, + struct _sc_list *delayed_sc; + + if (ioc->pci_error_recovery) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: host in pci error recovery\n", __func__, +- ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: host in pci error recovery\n", ++ __func__)); + return 1; + } + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + if (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: host is not operational\n", __func__, ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: host is not operational\n", ++ __func__)); + return 1; + } + if (unlikely(!mpi_reply)) { +- pr_err(MPT3SAS_FMT "mpi_reply not valid at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "mpi_reply not valid at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 1; + } + mpi_request_tm = mpt3sas_base_get_msg_frame(ioc, smid); + handle = le16_to_cpu(mpi_request_tm->DevHandle); + if (handle != le16_to_cpu(mpi_reply->DevHandle)) { +- dewtprintk(ioc, pr_err(MPT3SAS_FMT +- "spurious interrupt: handle(0x%04x:0x%04x), smid(%d)!!!\n", +- ioc->name, handle, +- le16_to_cpu(mpi_reply->DevHandle), smid)); ++ dewtprintk(ioc, ++ ioc_err(ioc, "spurious interrupt: handle(0x%04x:0x%04x), smid(%d)!!!\n", ++ handle, ++ le16_to_cpu(mpi_reply->DevHandle), smid)); + return 0; + } + + mpt3sas_trigger_master(ioc, MASTER_TRIGGER_TASK_MANAGMENT); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "tr_complete:handle(0x%04x), (open) smid(%d), ioc_status(0x%04x), " +- "loginfo(0x%08x), completed(%d)\n", ioc->name, +- handle, smid, le16_to_cpu(mpi_reply->IOCStatus), +- le32_to_cpu(mpi_reply->IOCLogInfo), +- le32_to_cpu(mpi_reply->TerminationCount))); ++ dewtprintk(ioc, ++ ioc_info(ioc, "tr_complete:handle(0x%04x), (open) smid(%d), ioc_status(0x%04x), loginfo(0x%08x), completed(%d)\n", ++ handle, smid, le16_to_cpu(mpi_reply->IOCStatus), ++ le32_to_cpu(mpi_reply->IOCLogInfo), ++ le32_to_cpu(mpi_reply->TerminationCount))); + + smid_sas_ctrl = mpt3sas_base_get_smid(ioc, ioc->tm_sas_control_cb_idx); + if (!smid_sas_ctrl) { +@@ -3771,16 +3745,15 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, + INIT_LIST_HEAD(&delayed_sc->list); + delayed_sc->handle = le16_to_cpu(mpi_request_tm->DevHandle); + list_add_tail(&delayed_sc->list, &ioc->delayed_sc_list); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "DELAYED:sc:handle(0x%04x), (open)\n", +- ioc->name, handle)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "DELAYED:sc:handle(0x%04x), (open)\n", ++ handle)); + return _scsih_check_for_pending_tm(ioc, smid); + } + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "sc_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", +- ioc->name, handle, smid_sas_ctrl, +- ioc->tm_sas_control_cb_idx)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "sc_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", ++ handle, smid_sas_ctrl, ioc->tm_sas_control_cb_idx)); + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid_sas_ctrl); + memset(mpi_request, 0, sizeof(Mpi2SasIoUnitControlRequest_t)); + mpi_request->Function = MPI2_FUNCTION_SAS_IO_UNIT_CONTROL; +@@ -3849,20 +3822,19 @@ _scsih_sas_control_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, + mpt3sas_base_get_reply_virt_addr(ioc, reply); + + if (likely(mpi_reply)) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "sc_complete:handle(0x%04x), (open) " +- "smid(%d), ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, le16_to_cpu(mpi_reply->DevHandle), smid, +- le16_to_cpu(mpi_reply->IOCStatus), +- le32_to_cpu(mpi_reply->IOCLogInfo))); ++ dewtprintk(ioc, ++ ioc_info(ioc, "sc_complete:handle(0x%04x), (open) smid(%d), ioc_status(0x%04x), loginfo(0x%08x)\n", ++ le16_to_cpu(mpi_reply->DevHandle), smid, ++ le16_to_cpu(mpi_reply->IOCStatus), ++ le32_to_cpu(mpi_reply->IOCLogInfo))); + if (le16_to_cpu(mpi_reply->IOCStatus) == + MPI2_IOCSTATUS_SUCCESS) { + clear_bit(le16_to_cpu(mpi_reply->DevHandle), + ioc->device_remove_in_progress); + } + } else { +- pr_err(MPT3SAS_FMT "mpi_reply not valid at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "mpi_reply not valid at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + } + return mpt3sas_check_for_pending_internal_cmds(ioc, smid); + } +@@ -3899,16 +3871,15 @@ _scsih_tm_tr_volume_send(struct MPT3SAS_ADAPTER *ioc, u16 handle) + INIT_LIST_HEAD(&delayed_tr->list); + delayed_tr->handle = handle; + list_add_tail(&delayed_tr->list, &ioc->delayed_tr_volume_list); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "DELAYED:tr:handle(0x%04x), (open)\n", +- ioc->name, handle)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "DELAYED:tr:handle(0x%04x), (open)\n", ++ handle)); + return; + } + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "tr_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", +- ioc->name, handle, smid, +- ioc->tm_tr_volume_cb_idx)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "tr_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", ++ handle, smid, ioc->tm_tr_volume_cb_idx)); + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); + memset(mpi_request, 0, sizeof(Mpi2SCSITaskManagementRequest_t)); + mpi_request->Function = MPI2_FUNCTION_SCSI_TASK_MGMT; +@@ -3944,27 +3915,26 @@ _scsih_tm_volume_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, + return 1; + } + if (unlikely(!mpi_reply)) { +- pr_err(MPT3SAS_FMT "mpi_reply not valid at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "mpi_reply not valid at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 1; + } + + mpi_request_tm = mpt3sas_base_get_msg_frame(ioc, smid); + handle = le16_to_cpu(mpi_request_tm->DevHandle); + if (handle != le16_to_cpu(mpi_reply->DevHandle)) { +- dewtprintk(ioc, pr_err(MPT3SAS_FMT +- "spurious interrupt: handle(0x%04x:0x%04x), smid(%d)!!!\n", +- ioc->name, handle, +- le16_to_cpu(mpi_reply->DevHandle), smid)); ++ dewtprintk(ioc, ++ ioc_err(ioc, "spurious interrupt: handle(0x%04x:0x%04x), smid(%d)!!!\n", ++ handle, le16_to_cpu(mpi_reply->DevHandle), ++ smid)); + return 0; + } + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "tr_complete:handle(0x%04x), (open) smid(%d), ioc_status(0x%04x), " +- "loginfo(0x%08x), completed(%d)\n", ioc->name, +- handle, smid, le16_to_cpu(mpi_reply->IOCStatus), +- le32_to_cpu(mpi_reply->IOCLogInfo), +- le32_to_cpu(mpi_reply->TerminationCount))); ++ dewtprintk(ioc, ++ ioc_info(ioc, "tr_complete:handle(0x%04x), (open) smid(%d), ioc_status(0x%04x), loginfo(0x%08x), completed(%d)\n", ++ handle, smid, le16_to_cpu(mpi_reply->IOCStatus), ++ le32_to_cpu(mpi_reply->IOCLogInfo), ++ le32_to_cpu(mpi_reply->TerminationCount))); + + return _scsih_check_for_pending_tm(ioc, smid); + } +@@ -3994,10 +3964,9 @@ _scsih_issue_delayed_event_ack(struct MPT3SAS_ADAPTER *ioc, u16 smid, U16 event, + ioc->internal_lookup[i].cb_idx = ioc->base_cb_idx; + spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags); + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "EVENT ACK: event(0x%04x), smid(%d), cb(%d)\n", +- ioc->name, le16_to_cpu(event), smid, +- ioc->base_cb_idx)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "EVENT ACK: event(0x%04x), smid(%d), cb(%d)\n", ++ le16_to_cpu(event), smid, ioc->base_cb_idx)); + ack_request = mpt3sas_base_get_msg_frame(ioc, smid); + memset(ack_request, 0, sizeof(Mpi2EventAckRequest_t)); + ack_request->Function = MPI2_FUNCTION_EVENT_ACK; +@@ -4053,10 +4022,9 @@ _scsih_issue_delayed_sas_io_unit_ctrl(struct MPT3SAS_ADAPTER *ioc, + ioc->internal_lookup[i].cb_idx = ioc->tm_sas_control_cb_idx; + spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags); + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "sc_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", +- ioc->name, handle, smid, +- ioc->tm_sas_control_cb_idx)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "sc_send:handle(0x%04x), (open), smid(%d), cb(%d)\n", ++ handle, smid, ioc->tm_sas_control_cb_idx)); + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); + memset(mpi_request, 0, sizeof(Mpi2SasIoUnitControlRequest_t)); + mpi_request->Function = MPI2_FUNCTION_SAS_IO_UNIT_CONTROL; +@@ -4217,8 +4185,8 @@ _scsih_check_topo_delete_events(struct MPT3SAS_ADAPTER *ioc, + MPI2_EVENT_SAS_TOPO_ES_RESPONDING) { + if (le16_to_cpu(local_event_data->ExpanderDevHandle) == + expander_handle) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting ignoring flag\n", ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting ignoring flag\n")); + fw_event->ignore = 1; + } + } +@@ -4289,9 +4257,8 @@ _scsih_check_pcie_topo_remove_events(struct MPT3SAS_ADAPTER *ioc, + MPI2_EVENT_SAS_TOPO_ES_RESPONDING) { + if (le16_to_cpu(local_event_data->SwitchDevHandle) == + switch_handle) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting ignoring flag for switch event\n", +- ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting ignoring flag for switch event\n")); + fw_event->ignore = 1; + } + } +@@ -4320,10 +4287,9 @@ _scsih_set_volume_delete_flag(struct MPT3SAS_ADAPTER *ioc, u16 handle) + sas_target_priv_data = + raid_device->starget->hostdata; + sas_target_priv_data->deleted = 1; +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "setting delete flag: handle(0x%04x), " +- "wwid(0x%016llx)\n", ioc->name, handle, +- (unsigned long long) raid_device->wwid)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "setting delete flag: handle(0x%04x), wwid(0x%016llx)\n", ++ handle, (u64)raid_device->wwid)); + } + spin_unlock_irqrestore(&ioc->raid_device_lock, flags); + } +@@ -4425,9 +4391,9 @@ _scsih_check_ir_config_unhide_events(struct MPT3SAS_ADAPTER *ioc, + INIT_LIST_HEAD(&delayed_tr->list); + delayed_tr->handle = handle; + list_add_tail(&delayed_tr->list, &ioc->delayed_tr_list); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "DELAYED:tr:handle(0x%04x), (open)\n", ioc->name, +- handle)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "DELAYED:tr:handle(0x%04x), (open)\n", ++ handle)); + } else + _scsih_tm_tr_send(ioc, handle); + } +@@ -4470,15 +4436,14 @@ _scsih_temp_threshold_events(struct MPT3SAS_ADAPTER *ioc, + Mpi2EventDataTemperature_t *event_data) + { + if (ioc->temp_sensors_count >= event_data->SensorNum) { +- pr_err(MPT3SAS_FMT "Temperature Threshold flags %s%s%s%s" +- " exceeded for Sensor: %d !!!\n", ioc->name, +- ((le16_to_cpu(event_data->Status) & 0x1) == 1) ? "0 " : " ", +- ((le16_to_cpu(event_data->Status) & 0x2) == 2) ? "1 " : " ", +- ((le16_to_cpu(event_data->Status) & 0x4) == 4) ? "2 " : " ", +- ((le16_to_cpu(event_data->Status) & 0x8) == 8) ? "3 " : " ", +- event_data->SensorNum); +- pr_err(MPT3SAS_FMT "Current Temp In Celsius: %d\n", +- ioc->name, event_data->CurrentTemperature); ++ ioc_err(ioc, "Temperature Threshold flags %s%s%s%s exceeded for Sensor: %d !!!\n", ++ le16_to_cpu(event_data->Status) & 0x1 ? "0 " : " ", ++ le16_to_cpu(event_data->Status) & 0x2 ? "1 " : " ", ++ le16_to_cpu(event_data->Status) & 0x4 ? "2 " : " ", ++ le16_to_cpu(event_data->Status) & 0x8 ? "3 " : " ", ++ event_data->SensorNum); ++ ioc_err(ioc, "Current Temp In Celsius: %d\n", ++ event_data->CurrentTemperature); + } + } + +@@ -4526,8 +4491,7 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc) + scmd->result = DID_RESET << 16; + scmd->scsi_done(scmd); + } +- dtmprintk(ioc, pr_info(MPT3SAS_FMT "completing %d cmds\n", +- ioc->name, count)); ++ dtmprintk(ioc, ioc_info(ioc, "completing %d cmds\n", count)); + } + + /** +@@ -4726,8 +4690,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + + smid = mpt3sas_base_get_smid_scsiio(ioc, ioc->scsi_io_cb_idx, scmd); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + _scsih_set_satl_pending(scmd, false); + goto out; + } +@@ -4965,37 +4928,28 @@ _scsih_scsi_ioc_info(struct MPT3SAS_ADAPTER *ioc, struct scsi_cmnd *scmd, + scsi_print_command(scmd); + + if (priv_target->flags & MPT_TARGET_FLAGS_VOLUME) { +- pr_warn(MPT3SAS_FMT "\t%s wwid(0x%016llx)\n", ioc->name, +- device_str, (unsigned long long)priv_target->sas_address); ++ ioc_warn(ioc, "\t%s wwid(0x%016llx)\n", ++ device_str, (u64)priv_target->sas_address); + } else if (priv_target->flags & MPT_TARGET_FLAGS_PCIE_DEVICE) { + pcie_device = mpt3sas_get_pdev_from_target(ioc, priv_target); + if (pcie_device) { +- pr_info(MPT3SAS_FMT "\twwid(0x%016llx), port(%d)\n", +- ioc->name, +- (unsigned long long)pcie_device->wwid, +- pcie_device->port_num); ++ ioc_info(ioc, "\twwid(0x%016llx), port(%d)\n", ++ (u64)pcie_device->wwid, pcie_device->port_num); + if (pcie_device->enclosure_handle != 0) +- pr_info(MPT3SAS_FMT +- "\tenclosure logical id(0x%016llx), " +- "slot(%d)\n", ioc->name, +- (unsigned long long) +- pcie_device->enclosure_logical_id, +- pcie_device->slot); ++ ioc_info(ioc, "\tenclosure logical id(0x%016llx), slot(%d)\n", ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot); + if (pcie_device->connector_name[0]) +- pr_info(MPT3SAS_FMT +- "\tenclosure level(0x%04x)," +- "connector name( %s)\n", +- ioc->name, pcie_device->enclosure_level, +- pcie_device->connector_name); ++ ioc_info(ioc, "\tenclosure level(0x%04x), connector name( %s)\n", ++ pcie_device->enclosure_level, ++ pcie_device->connector_name); + pcie_device_put(pcie_device); + } + } else { + sas_device = mpt3sas_get_sdev_from_target(ioc, priv_target); + if (sas_device) { +- pr_warn(MPT3SAS_FMT +- "\tsas_address(0x%016llx), phy(%d)\n", +- ioc->name, (unsigned long long) +- sas_device->sas_address, sas_device->phy); ++ ioc_warn(ioc, "\tsas_address(0x%016llx), phy(%d)\n", ++ (u64)sas_device->sas_address, sas_device->phy); + + _scsih_display_enclosure_chassis_info(ioc, sas_device, + NULL, NULL); +@@ -5004,30 +4958,23 @@ _scsih_scsi_ioc_info(struct MPT3SAS_ADAPTER *ioc, struct scsi_cmnd *scmd, + } + } + +- pr_warn(MPT3SAS_FMT +- "\thandle(0x%04x), ioc_status(%s)(0x%04x), smid(%d)\n", +- ioc->name, le16_to_cpu(mpi_reply->DevHandle), +- desc_ioc_state, ioc_status, smid); +- pr_warn(MPT3SAS_FMT +- "\trequest_len(%d), underflow(%d), resid(%d)\n", +- ioc->name, scsi_bufflen(scmd), scmd->underflow, +- scsi_get_resid(scmd)); +- pr_warn(MPT3SAS_FMT +- "\ttag(%d), transfer_count(%d), sc->result(0x%08x)\n", +- ioc->name, le16_to_cpu(mpi_reply->TaskTag), +- le32_to_cpu(mpi_reply->TransferCount), scmd->result); +- pr_warn(MPT3SAS_FMT +- "\tscsi_status(%s)(0x%02x), scsi_state(%s)(0x%02x)\n", +- ioc->name, desc_scsi_status, +- scsi_status, desc_scsi_state, scsi_state); ++ ioc_warn(ioc, "\thandle(0x%04x), ioc_status(%s)(0x%04x), smid(%d)\n", ++ le16_to_cpu(mpi_reply->DevHandle), ++ desc_ioc_state, ioc_status, smid); ++ ioc_warn(ioc, "\trequest_len(%d), underflow(%d), resid(%d)\n", ++ scsi_bufflen(scmd), scmd->underflow, scsi_get_resid(scmd)); ++ ioc_warn(ioc, "\ttag(%d), transfer_count(%d), sc->result(0x%08x)\n", ++ le16_to_cpu(mpi_reply->TaskTag), ++ le32_to_cpu(mpi_reply->TransferCount), scmd->result); ++ ioc_warn(ioc, "\tscsi_status(%s)(0x%02x), scsi_state(%s)(0x%02x)\n", ++ desc_scsi_status, scsi_status, desc_scsi_state, scsi_state); + + if (scsi_state & MPI2_SCSI_STATE_AUTOSENSE_VALID) { + struct sense_info data; + _scsih_normalize_sense(scmd->sense_buffer, &data); +- pr_warn(MPT3SAS_FMT +- "\t[sense_key,asc,ascq]: [0x%02x,0x%02x,0x%02x], count(%d)\n", +- ioc->name, data.skey, +- data.asc, data.ascq, le32_to_cpu(mpi_reply->SenseCount)); ++ ioc_warn(ioc, "\t[sense_key,asc,ascq]: [0x%02x,0x%02x,0x%02x], count(%d)\n", ++ data.skey, data.asc, data.ascq, ++ le32_to_cpu(mpi_reply->SenseCount)); + } + if (scsi_state & MPI2_SCSI_STATE_RESPONSE_INFO_VALID) { + response_info = le32_to_cpu(mpi_reply->ResponseInfo); +@@ -5062,17 +5009,17 @@ _scsih_turn_on_pfa_led(struct MPT3SAS_ADAPTER *ioc, u16 handle) + mpi_request.Flags = MPI2_SEP_REQ_FLAGS_DEVHANDLE_ADDRESS; + if ((mpt3sas_base_scsi_enclosure_processor(ioc, &mpi_reply, + &mpi_request)) != 0) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + sas_device->pfa_led_on = 1; + + if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "enclosure_processor: ioc_status (0x%04x), loginfo(0x%08x)\n", +- ioc->name, le16_to_cpu(mpi_reply.IOCStatus), +- le32_to_cpu(mpi_reply.IOCLogInfo))); ++ dewtprintk(ioc, ++ ioc_info(ioc, "enclosure_processor: ioc_status (0x%04x), loginfo(0x%08x)\n", ++ le16_to_cpu(mpi_reply.IOCStatus), ++ le32_to_cpu(mpi_reply.IOCLogInfo))); + goto out; + } + out: +@@ -5179,8 +5126,8 @@ _scsih_smart_predicted_fault(struct MPT3SAS_ADAPTER *ioc, u16 handle) + sizeof(Mpi2EventDataSasDeviceStatusChange_t); + event_reply = kzalloc(sz, GFP_KERNEL); + if (!event_reply) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + +@@ -5470,16 +5417,16 @@ _scsih_sas_host_refresh(struct MPT3SAS_ADAPTER *ioc) + u16 attached_handle; + u8 link_rate; + +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "updating handles for sas_host(0x%016llx)\n", +- ioc->name, (unsigned long long)ioc->sas_hba.sas_address)); ++ dtmprintk(ioc, ++ ioc_info(ioc, "updating handles for sas_host(0x%016llx)\n", ++ (u64)ioc->sas_hba.sas_address)); + + sz = offsetof(Mpi2SasIOUnitPage0_t, PhyData) + (ioc->sas_hba.num_phys + * sizeof(Mpi2SasIOUnit0PhyData_t)); + sas_iounit_pg0 = kzalloc(sz, GFP_KERNEL); + if (!sas_iounit_pg0) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + +@@ -5529,15 +5476,15 @@ _scsih_sas_host_add(struct MPT3SAS_ADAPTER *ioc) + + mpt3sas_config_get_number_hba_phys(ioc, &num_phys); + if (!num_phys) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + ioc->sas_hba.phy = kcalloc(num_phys, + sizeof(struct _sas_phy), GFP_KERNEL); + if (!ioc->sas_hba.phy) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + ioc->sas_hba.num_phys = num_phys; +@@ -5547,21 +5494,21 @@ _scsih_sas_host_add(struct MPT3SAS_ADAPTER *ioc) + sizeof(Mpi2SasIOUnit0PhyData_t)); + sas_iounit_pg0 = kzalloc(sz, GFP_KERNEL); + if (!sas_iounit_pg0) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + if ((mpt3sas_config_get_sas_iounit_pg0(ioc, &mpi_reply, + sas_iounit_pg0, sz))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + +@@ -5570,21 +5517,21 @@ _scsih_sas_host_add(struct MPT3SAS_ADAPTER *ioc) + sizeof(Mpi2SasIOUnit1PhyData_t)); + sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); + if (!sas_iounit_pg1) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + if ((mpt3sas_config_get_sas_iounit_pg1(ioc, &mpi_reply, + sas_iounit_pg1, sz))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + +@@ -5603,15 +5550,15 @@ _scsih_sas_host_add(struct MPT3SAS_ADAPTER *ioc) + for (i = 0; i < ioc->sas_hba.num_phys ; i++) { + if ((mpt3sas_config_get_phy_pg0(ioc, &mpi_reply, &phy_pg0, + i))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + +@@ -5625,18 +5572,17 @@ _scsih_sas_host_add(struct MPT3SAS_ADAPTER *ioc) + } + if ((mpt3sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0, + MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, ioc->sas_hba.handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out; + } + ioc->sas_hba.enclosure_handle = + le16_to_cpu(sas_device_pg0.EnclosureHandle); + ioc->sas_hba.sas_address = le64_to_cpu(sas_device_pg0.SASAddress); +- pr_info(MPT3SAS_FMT +- "host_add: handle(0x%04x), sas_addr(0x%016llx), phys(%d)\n", +- ioc->name, ioc->sas_hba.handle, +- (unsigned long long) ioc->sas_hba.sas_address, +- ioc->sas_hba.num_phys) ; ++ ioc_info(ioc, "host_add: handle(0x%04x), sas_addr(0x%016llx), phys(%d)\n", ++ ioc->sas_hba.handle, ++ (u64)ioc->sas_hba.sas_address, ++ ioc->sas_hba.num_phys); + + if (ioc->sas_hba.enclosure_handle) { + if (!(mpt3sas_config_get_enclosure_pg0(ioc, &mpi_reply, +@@ -5685,16 +5631,16 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + + if ((mpt3sas_config_get_expander_pg0(ioc, &mpi_reply, &expander_pg0, + MPI2_SAS_EXPAND_PGAD_FORM_HNDL, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + +@@ -5702,8 +5648,8 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + parent_handle = le16_to_cpu(expander_pg0.ParentDevHandle); + if (_scsih_get_sas_address(ioc, parent_handle, &sas_address_parent) + != 0) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + if (sas_address_parent != ioc->sas_hba.sas_address) { +@@ -5730,8 +5676,8 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + sas_expander = kzalloc(sizeof(struct _sas_node), + GFP_KERNEL); + if (!sas_expander) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + +@@ -5740,10 +5686,9 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + sas_expander->sas_address_parent = sas_address_parent; + sas_expander->sas_address = sas_address; + +- pr_info(MPT3SAS_FMT "expander_add: handle(0x%04x)," \ +- " parent(0x%04x), sas_addr(0x%016llx), phys(%d)\n", ioc->name, +- handle, parent_handle, (unsigned long long) +- sas_expander->sas_address, sas_expander->num_phys); ++ ioc_info(ioc, "expander_add: handle(0x%04x), parent(0x%04x), sas_addr(0x%016llx), phys(%d)\n", ++ handle, parent_handle, ++ (u64)sas_expander->sas_address, sas_expander->num_phys); + + if (!sas_expander->num_phys) { + rc = -1; +@@ -5752,8 +5697,8 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + sas_expander->phy = kcalloc(sas_expander->num_phys, + sizeof(struct _sas_phy), GFP_KERNEL); + if (!sas_expander->phy) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -1; + goto out_fail; + } +@@ -5762,8 +5707,8 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + mpt3sas_port = mpt3sas_transport_port_add(ioc, handle, + sas_address_parent); + if (!mpt3sas_port) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -1; + goto out_fail; + } +@@ -5772,8 +5717,8 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + for (i = 0 ; i < sas_expander->num_phys ; i++) { + if ((mpt3sas_config_get_expander_pg1(ioc, &mpi_reply, + &expander_pg1, i, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -1; + goto out_fail; + } +@@ -5783,8 +5728,8 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + if ((mpt3sas_transport_add_expander_phy(ioc, + &sas_expander->phy[i], expander_pg1, + sas_expander->parent_dev))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -1; + goto out_fail; + } +@@ -5931,9 +5876,8 @@ _scsih_check_access_status(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + if (!rc) + return 0; + +- pr_err(MPT3SAS_FMT +- "discovery errors(%s): sas_address(0x%016llx), handle(0x%04x)\n", +- ioc->name, desc, (unsigned long long)sas_address, handle); ++ ioc_err(ioc, "discovery errors(%s): sas_address(0x%016llx), handle(0x%04x)\n", ++ desc, (u64)sas_address, handle); + return rc; + } + +@@ -6027,9 +5971,8 @@ _scsih_check_device(struct MPT3SAS_ADAPTER *ioc, + /* check if device is present */ + if (!(le16_to_cpu(sas_device_pg0.Flags) & + MPI2_SAS_DEVICE0_FLAGS_DEVICE_PRESENT)) { +- pr_err(MPT3SAS_FMT +- "device is not present handle(0x%04x), flags!!!\n", +- ioc->name, handle); ++ ioc_err(ioc, "device is not present handle(0x%04x), flags!!!\n", ++ handle); + goto out_unlock; + } + +@@ -6076,16 +6019,16 @@ _scsih_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phy_num, + + if ((mpt3sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0, + MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + +@@ -6099,8 +6042,8 @@ _scsih_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phy_num, + /* check if device is present */ + if (!(le16_to_cpu(sas_device_pg0.Flags) & + MPI2_SAS_DEVICE0_FLAGS_DEVICE_PRESENT)) { +- pr_err(MPT3SAS_FMT "device is not present handle(0x04%x)!!!\n", +- ioc->name, handle); ++ ioc_err(ioc, "device is not present handle(0x04%x)!!!\n", ++ handle); + return -1; + } + +@@ -6122,16 +6065,15 @@ _scsih_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phy_num, + mpt3sas_scsih_enclosure_find_by_handle(ioc, + le16_to_cpu(sas_device_pg0.EnclosureHandle)); + if (enclosure_dev == NULL) +- pr_info(MPT3SAS_FMT "Enclosure handle(0x%04x)" +- "doesn't match with enclosure device!\n", +- ioc->name, sas_device_pg0.EnclosureHandle); ++ ioc_info(ioc, "Enclosure handle(0x%04x) doesn't match with enclosure device!\n", ++ sas_device_pg0.EnclosureHandle); + } + + sas_device = kzalloc(sizeof(struct _sas_device), + GFP_KERNEL); + if (!sas_device) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 0; + } + +@@ -6140,8 +6082,8 @@ _scsih_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phy_num, + if (_scsih_get_sas_address(ioc, + le16_to_cpu(sas_device_pg0.ParentDevHandle), + &sas_device->sas_address_parent) != 0) +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + sas_device->enclosure_handle = + le16_to_cpu(sas_device_pg0.EnclosureHandle); + if (sas_device->enclosure_handle != 0) +@@ -6206,11 +6148,10 @@ _scsih_remove_device(struct MPT3SAS_ADAPTER *ioc, + sas_device->pfa_led_on = 0; + } + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter: handle(0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, __func__, +- sas_device->handle, (unsigned long long) +- sas_device->sas_address)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enter: handle(0x%04x), sas_addr(0x%016llx)\n", ++ __func__, ++ sas_device->handle, (u64)sas_device->sas_address)); + + dewtprintk(ioc, _scsih_display_enclosure_chassis_info(ioc, sas_device, + NULL, NULL)); +@@ -6228,18 +6169,15 @@ _scsih_remove_device(struct MPT3SAS_ADAPTER *ioc, + sas_device->sas_address, + sas_device->sas_address_parent); + +- pr_info(MPT3SAS_FMT +- "removing handle(0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, sas_device->handle, +- (unsigned long long) sas_device->sas_address); ++ ioc_info(ioc, "removing handle(0x%04x), sas_addr(0x%016llx)\n", ++ sas_device->handle, (u64)sas_device->sas_address); + + _scsih_display_enclosure_chassis_info(ioc, sas_device, NULL, NULL); + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: exit: handle(0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, __func__, +- sas_device->handle, (unsigned long long) +- sas_device->sas_address)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: exit: handle(0x%04x), sas_addr(0x%016llx)\n", ++ __func__, ++ sas_device->handle, (u64)sas_device->sas_address)); + dewtprintk(ioc, _scsih_display_enclosure_chassis_info(ioc, sas_device, + NULL, NULL)); + } +@@ -6279,8 +6217,7 @@ _scsih_sas_topology_change_event_debug(struct MPT3SAS_ADAPTER *ioc, + status_str = "unknown status"; + break; + } +- pr_info(MPT3SAS_FMT "sas topology change: (%s)\n", +- ioc->name, status_str); ++ ioc_info(ioc, "sas topology change: (%s)\n", status_str); + pr_info("\thandle(0x%04x), enclosure_handle(0x%04x) " \ + "start_phy(%02d), count(%d)\n", + le16_to_cpu(event_data->ExpanderDevHandle), +@@ -6357,8 +6294,7 @@ _scsih_sas_topology_change_event(struct MPT3SAS_ADAPTER *ioc, + _scsih_sas_host_refresh(ioc); + + if (fw_event->ignore) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "ignoring expander event\n", ioc->name)); ++ dewtprintk(ioc, ioc_info(ioc, "ignoring expander event\n")); + return 0; + } + +@@ -6387,8 +6323,8 @@ _scsih_sas_topology_change_event(struct MPT3SAS_ADAPTER *ioc, + /* handle siblings events */ + for (i = 0; i < event_data->NumEntries; i++) { + if (fw_event->ignore) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "ignoring expander event\n", ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "ignoring expander event\n")); + return 0; + } + if (ioc->remove_host || ioc->pci_error_recovery) +@@ -6512,15 +6448,14 @@ _scsih_sas_device_status_change_event_debug(struct MPT3SAS_ADAPTER *ioc, + reason_str = "unknown reason"; + break; + } +- pr_info(MPT3SAS_FMT "device status change: (%s)\n" +- "\thandle(0x%04x), sas address(0x%016llx), tag(%d)", +- ioc->name, reason_str, le16_to_cpu(event_data->DevHandle), +- (unsigned long long)le64_to_cpu(event_data->SASAddress), +- le16_to_cpu(event_data->TaskTag)); ++ ioc_info(ioc, "device status change: (%s)\thandle(0x%04x), sas address(0x%016llx), tag(%d)", ++ reason_str, le16_to_cpu(event_data->DevHandle), ++ (u64)le64_to_cpu(event_data->SASAddress), ++ le16_to_cpu(event_data->TaskTag)); + if (event_data->ReasonCode == MPI2_EVENT_SAS_DEV_STAT_RC_SMART_DATA) +- pr_info(MPT3SAS_FMT ", ASC(0x%x), ASCQ(0x%x)\n", ioc->name, +- event_data->ASC, event_data->ASCQ); +- pr_info("\n"); ++ pr_cont(", ASC(0x%x), ASCQ(0x%x)\n", ++ event_data->ASC, event_data->ASCQ); ++ pr_cont("\n"); + } + + /** +@@ -6653,20 +6588,16 @@ _scsih_check_pcie_access_status(struct MPT3SAS_ADAPTER *ioc, u64 wwid, + desc = "nvme failure status"; + break; + default: +- pr_err(MPT3SAS_FMT +- " NVMe discovery error(0x%02x): wwid(0x%016llx)," +- "handle(0x%04x)\n", ioc->name, access_status, +- (unsigned long long)wwid, handle); ++ ioc_err(ioc, "NVMe discovery error(0x%02x): wwid(0x%016llx), handle(0x%04x)\n", ++ access_status, (u64)wwid, handle); + return rc; + } + + if (!rc) + return rc; + +- pr_info(MPT3SAS_FMT +- "NVMe discovery error(%s): wwid(0x%016llx), handle(0x%04x)\n", +- ioc->name, desc, +- (unsigned long long)wwid, handle); ++ ioc_info(ioc, "NVMe discovery error(%s): wwid(0x%016llx), handle(0x%04x)\n", ++ desc, (u64)wwid, handle); + return rc; + } + +@@ -6682,22 +6613,22 @@ _scsih_pcie_device_remove_from_sml(struct MPT3SAS_ADAPTER *ioc, + { + struct MPT3SAS_TARGET *sas_target_priv_data; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter: handle(0x%04x), wwid(0x%016llx)\n", ioc->name, __func__, +- pcie_device->handle, (unsigned long long) +- pcie_device->wwid)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enter: handle(0x%04x), wwid(0x%016llx)\n", ++ __func__, ++ pcie_device->handle, (u64)pcie_device->wwid)); + if (pcie_device->enclosure_handle != 0) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter: enclosure logical id(0x%016llx), slot(%d)\n", +- ioc->name, __func__, +- (unsigned long long)pcie_device->enclosure_logical_id, +- pcie_device->slot)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enter: enclosure logical id(0x%016llx), slot(%d)\n", ++ __func__, ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot)); + if (pcie_device->connector_name[0] != '\0') +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter: enclosure level(0x%04x), connector name( %s)\n", +- ioc->name, __func__, +- pcie_device->enclosure_level, +- pcie_device->connector_name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: enter: enclosure level(0x%04x), connector name(%s)\n", ++ __func__, ++ pcie_device->enclosure_level, ++ pcie_device->connector_name)); + + if (pcie_device->starget && pcie_device->starget->hostdata) { + sas_target_priv_data = pcie_device->starget->hostdata; +@@ -6706,39 +6637,35 @@ _scsih_pcie_device_remove_from_sml(struct MPT3SAS_ADAPTER *ioc, + sas_target_priv_data->handle = MPT3SAS_INVALID_DEVICE_HANDLE; + } + +- pr_info(MPT3SAS_FMT +- "removing handle(0x%04x), wwid (0x%016llx)\n", +- ioc->name, pcie_device->handle, +- (unsigned long long) pcie_device->wwid); ++ ioc_info(ioc, "removing handle(0x%04x), wwid(0x%016llx)\n", ++ pcie_device->handle, (u64)pcie_device->wwid); + if (pcie_device->enclosure_handle != 0) +- pr_info(MPT3SAS_FMT +- "removing : enclosure logical id(0x%016llx), slot(%d)\n", +- ioc->name, +- (unsigned long long)pcie_device->enclosure_logical_id, +- pcie_device->slot); ++ ioc_info(ioc, "removing : enclosure logical id(0x%016llx), slot(%d)\n", ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot); + if (pcie_device->connector_name[0] != '\0') +- pr_info(MPT3SAS_FMT +- "removing: enclosure level(0x%04x), connector name( %s)\n", +- ioc->name, pcie_device->enclosure_level, +- pcie_device->connector_name); ++ ioc_info(ioc, "removing: enclosure level(0x%04x), connector name( %s)\n", ++ pcie_device->enclosure_level, ++ pcie_device->connector_name); + + if (pcie_device->starget) + scsi_remove_target(&pcie_device->starget->dev); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: exit: handle(0x%04x), wwid(0x%016llx)\n", ioc->name, __func__, +- pcie_device->handle, (unsigned long long) +- pcie_device->wwid)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: exit: handle(0x%04x), wwid(0x%016llx)\n", ++ __func__, ++ pcie_device->handle, (u64)pcie_device->wwid)); + if (pcie_device->enclosure_handle != 0) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: exit: enclosure logical id(0x%016llx), slot(%d)\n", +- ioc->name, __func__, +- (unsigned long long)pcie_device->enclosure_logical_id, +- pcie_device->slot)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: exit: enclosure logical id(0x%016llx), slot(%d)\n", ++ __func__, ++ (u64)pcie_device->enclosure_logical_id, ++ pcie_device->slot)); + if (pcie_device->connector_name[0] != '\0') +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: exit: enclosure level(0x%04x), connector name( %s)\n", +- ioc->name, __func__, pcie_device->enclosure_level, +- pcie_device->connector_name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: exit: enclosure level(0x%04x), connector name( %s)\n", ++ __func__, ++ pcie_device->enclosure_level, ++ pcie_device->connector_name)); + + kfree(pcie_device->serial_number); + } +@@ -6808,9 +6735,8 @@ _scsih_pcie_check_device(struct MPT3SAS_ADAPTER *ioc, u16 handle) + /* check if device is present */ + if (!(le32_to_cpu(pcie_device_pg0.Flags) & + MPI26_PCIEDEV0_FLAGS_DEVICE_PRESENT)) { +- pr_info(MPT3SAS_FMT +- "device is not present handle(0x%04x), flags!!!\n", +- ioc->name, handle); ++ ioc_info(ioc, "device is not present handle(0x%04x), flags!!!\n", ++ handle); + spin_unlock_irqrestore(&ioc->pcie_device_lock, flags); + pcie_device_put(pcie_device); + return; +@@ -6854,16 +6780,15 @@ _scsih_pcie_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle) + + if ((mpt3sas_config_get_pcie_device_pg0(ioc, &mpi_reply, + &pcie_device_pg0, MPI26_PCIE_DEVICE_PGAD_FORM_HANDLE, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 0; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 0; + } + +@@ -6873,9 +6798,8 @@ _scsih_pcie_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle) + /* check if device is present */ + if (!(le32_to_cpu(pcie_device_pg0.Flags) & + MPI26_PCIEDEV0_FLAGS_DEVICE_PRESENT)) { +- pr_err(MPT3SAS_FMT +- "device is not present handle(0x04%x)!!!\n", +- ioc->name, handle); ++ ioc_err(ioc, "device is not present handle(0x04%x)!!!\n", ++ handle); + return 0; + } + +@@ -6896,8 +6820,8 @@ _scsih_pcie_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle) + + pcie_device = kzalloc(sizeof(struct _pcie_device), GFP_KERNEL); + if (!pcie_device) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 0; + } + +@@ -6938,16 +6862,16 @@ _scsih_pcie_add_device(struct MPT3SAS_ADAPTER *ioc, u16 handle) + /* TODO -- Add device name once FW supports it */ + if (mpt3sas_config_get_pcie_device_pg2(ioc, &mpi_reply, + &pcie_device_pg2, MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle)) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + kfree(pcie_device); + return 0; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + kfree(pcie_device); + return 0; + } +@@ -7004,8 +6928,7 @@ _scsih_pcie_topology_change_event_debug(struct MPT3SAS_ADAPTER *ioc, + status_str = "unknown status"; + break; + } +- pr_info(MPT3SAS_FMT "pcie topology change: (%s)\n", +- ioc->name, status_str); ++ ioc_info(ioc, "pcie topology change: (%s)\n", status_str); + pr_info("\tswitch_handle(0x%04x), enclosure_handle(0x%04x)" + "start_port(%02d), count(%d)\n", + le16_to_cpu(event_data->SwitchDevHandle), +@@ -7078,16 +7001,15 @@ _scsih_pcie_topology_change_event(struct MPT3SAS_ADAPTER *ioc, + return; + + if (fw_event->ignore) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT "ignoring switch event\n", +- ioc->name)); ++ dewtprintk(ioc, ioc_info(ioc, "ignoring switch event\n")); + return; + } + + /* handle siblings events */ + for (i = 0; i < event_data->NumEntries; i++) { + if (fw_event->ignore) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "ignoring switch event\n", ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "ignoring switch event\n")); + return; + } + if (ioc->remove_host || ioc->pci_error_recovery) +@@ -7132,9 +7054,9 @@ _scsih_pcie_topology_change_event(struct MPT3SAS_ADAPTER *ioc, + if (!test_bit(handle, ioc->pend_os_device_add)) + break; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "handle(0x%04x) device not found: convert " +- "event to a device add\n", ioc->name, handle)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "handle(0x%04x) device not found: convert event to a device add\n", ++ handle)); + event_data->PortEntry[i].PortStatus &= 0xF0; + event_data->PortEntry[i].PortStatus |= + MPI26_EVENT_PCIE_TOPO_PS_DEV_ADDED; +@@ -7217,15 +7139,15 @@ _scsih_pcie_device_status_change_event_debug(struct MPT3SAS_ADAPTER *ioc, + break; + } + +- pr_info(MPT3SAS_FMT "PCIE device status change: (%s)\n" +- "\thandle(0x%04x), WWID(0x%016llx), tag(%d)", +- ioc->name, reason_str, le16_to_cpu(event_data->DevHandle), +- (unsigned long long)le64_to_cpu(event_data->WWID), +- le16_to_cpu(event_data->TaskTag)); ++ ioc_info(ioc, "PCIE device status change: (%s)\n" ++ "\thandle(0x%04x), WWID(0x%016llx), tag(%d)", ++ reason_str, le16_to_cpu(event_data->DevHandle), ++ (u64)le64_to_cpu(event_data->WWID), ++ le16_to_cpu(event_data->TaskTag)); + if (event_data->ReasonCode == MPI26_EVENT_PCIDEV_STAT_RC_SMART_DATA) +- pr_info(MPT3SAS_FMT ", ASC(0x%x), ASCQ(0x%x)\n", ioc->name, ++ pr_cont(", ASC(0x%x), ASCQ(0x%x)\n", + event_data->ASC, event_data->ASCQ); +- pr_info("\n"); ++ pr_cont("\n"); + } + + /** +@@ -7303,12 +7225,12 @@ _scsih_sas_enclosure_dev_status_change_event_debug(struct MPT3SAS_ADAPTER *ioc, + break; + } + +- pr_info(MPT3SAS_FMT "enclosure status change: (%s)\n" +- "\thandle(0x%04x), enclosure logical id(0x%016llx)" +- " number slots(%d)\n", ioc->name, reason_str, +- le16_to_cpu(event_data->EnclosureHandle), +- (unsigned long long)le64_to_cpu(event_data->EnclosureLogicalID), +- le16_to_cpu(event_data->StartSlot)); ++ ioc_info(ioc, "enclosure status change: (%s)\n" ++ "\thandle(0x%04x), enclosure logical id(0x%016llx) number slots(%d)\n", ++ reason_str, ++ le16_to_cpu(event_data->EnclosureHandle), ++ (u64)le64_to_cpu(event_data->EnclosureLogicalID), ++ le16_to_cpu(event_data->StartSlot)); + } + + /** +@@ -7346,9 +7268,8 @@ _scsih_sas_enclosure_dev_status_change_event(struct MPT3SAS_ADAPTER *ioc, + kzalloc(sizeof(struct _enclosure_node), + GFP_KERNEL); + if (!enclosure_dev) { +- pr_info(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__); ++ ioc_info(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + rc = mpt3sas_config_get_enclosure_pg0(ioc, &mpi_reply, +@@ -7406,10 +7327,8 @@ _scsih_sas_broadcast_primitive_event(struct MPT3SAS_ADAPTER *ioc, + u8 task_abort_retries; + + mutex_lock(&ioc->tm_cmds.mutex); +- pr_info(MPT3SAS_FMT +- "%s: enter: phy number(%d), width(%d)\n", +- ioc->name, __func__, event_data->PhyNum, +- event_data->PortWidth); ++ ioc_info(ioc, "%s: enter: phy number(%d), width(%d)\n", ++ __func__, event_data->PhyNum, event_data->PortWidth); + + _scsih_block_io_all_device(ioc); + +@@ -7419,12 +7338,12 @@ _scsih_sas_broadcast_primitive_event(struct MPT3SAS_ADAPTER *ioc, + + /* sanity checks for retrying this loop */ + if (max_retries++ == 5) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT "%s: giving up\n", +- ioc->name, __func__)); ++ dewtprintk(ioc, ioc_info(ioc, "%s: giving up\n", __func__)); + goto out; + } else if (max_retries > 1) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT "%s: %d retry\n", +- ioc->name, __func__, max_retries - 1)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: %d retry\n", ++ __func__, max_retries - 1)); + + termination_count = 0; + query_count = 0; +@@ -7491,9 +7410,9 @@ _scsih_sas_broadcast_primitive_event(struct MPT3SAS_ADAPTER *ioc, + task_abort_retries = 0; + tm_retry: + if (task_abort_retries++ == 60) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: ABORT_TASK: giving up\n", ioc->name, +- __func__)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: ABORT_TASK: giving up\n", ++ __func__)); + spin_lock_irqsave(&ioc->scsi_lookup_lock, flags); + goto broadcast_aen_retry; + } +@@ -7522,9 +7441,10 @@ _scsih_sas_broadcast_primitive_event(struct MPT3SAS_ADAPTER *ioc, + } + + if (ioc->broadcast_aen_pending) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: loop back due to pending AEN\n", +- ioc->name, __func__)); ++ dewtprintk(ioc, ++ ioc_info(ioc, ++ "%s: loop back due to pending AEN\n", ++ __func__)); + ioc->broadcast_aen_pending = 0; + goto broadcast_aen_retry; + } +@@ -7533,9 +7453,9 @@ _scsih_sas_broadcast_primitive_event(struct MPT3SAS_ADAPTER *ioc, + spin_unlock_irqrestore(&ioc->scsi_lookup_lock, flags); + out_no_lock: + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s - exit, query_count = %d termination_count = %d\n", +- ioc->name, __func__, query_count, termination_count)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s - exit, query_count = %d termination_count = %d\n", ++ __func__, query_count, termination_count)); + + ioc->broadcast_aen_busy = 0; + if (!ioc->shost_recovery) +@@ -7557,13 +7477,13 @@ _scsih_sas_discovery_event(struct MPT3SAS_ADAPTER *ioc, + (Mpi2EventDataSasDiscovery_t *) fw_event->event_data; + + if (ioc->logging_level & MPT_DEBUG_EVENT_WORK_TASK) { +- pr_info(MPT3SAS_FMT "discovery event: (%s)", ioc->name, +- (event_data->ReasonCode == MPI2_EVENT_SAS_DISC_RC_STARTED) ? +- "start" : "stop"); ++ ioc_info(ioc, "discovery event: (%s)", ++ event_data->ReasonCode == MPI2_EVENT_SAS_DISC_RC_STARTED ? ++ "start" : "stop"); + if (event_data->DiscoveryStatus) +- pr_info("discovery_status(0x%08x)", +- le32_to_cpu(event_data->DiscoveryStatus)); +- pr_info("\n"); ++ pr_cont("discovery_status(0x%08x)", ++ le32_to_cpu(event_data->DiscoveryStatus)); ++ pr_cont("\n"); + } + + if (event_data->ReasonCode == MPI2_EVENT_SAS_DISC_RC_STARTED && +@@ -7593,20 +7513,16 @@ _scsih_sas_device_discovery_error_event(struct MPT3SAS_ADAPTER *ioc, + + switch (event_data->ReasonCode) { + case MPI25_EVENT_SAS_DISC_ERR_SMP_FAILED: +- pr_warn(MPT3SAS_FMT "SMP command sent to the expander" +- "(handle:0x%04x, sas_address:0x%016llx," +- "physical_port:0x%02x) has failed", +- ioc->name, le16_to_cpu(event_data->DevHandle), +- (unsigned long long)le64_to_cpu(event_data->SASAddress), +- event_data->PhysicalPort); ++ ioc_warn(ioc, "SMP command sent to the expander (handle:0x%04x, sas_address:0x%016llx, physical_port:0x%02x) has failed\n", ++ le16_to_cpu(event_data->DevHandle), ++ (u64)le64_to_cpu(event_data->SASAddress), ++ event_data->PhysicalPort); + break; + case MPI25_EVENT_SAS_DISC_ERR_SMP_TIMEOUT: +- pr_warn(MPT3SAS_FMT "SMP command sent to the expander" +- "(handle:0x%04x, sas_address:0x%016llx," +- "physical_port:0x%02x) has timed out", +- ioc->name, le16_to_cpu(event_data->DevHandle), +- (unsigned long long)le64_to_cpu(event_data->SASAddress), +- event_data->PhysicalPort); ++ ioc_warn(ioc, "SMP command sent to the expander (handle:0x%04x, sas_address:0x%016llx, physical_port:0x%02x) has timed out\n", ++ le16_to_cpu(event_data->DevHandle), ++ (u64)le64_to_cpu(event_data->SASAddress), ++ event_data->PhysicalPort); + break; + default: + break; +@@ -7629,11 +7545,10 @@ _scsih_pcie_enumeration_event(struct MPT3SAS_ADAPTER *ioc, + if (!(ioc->logging_level & MPT_DEBUG_EVENT_WORK_TASK)) + return; + +- pr_info(MPT3SAS_FMT "pcie enumeration event: (%s) Flag 0x%02x", +- ioc->name, +- (event_data->ReasonCode == MPI26_EVENT_PCIE_ENUM_RC_STARTED) ? +- "started" : "completed", +- event_data->Flags); ++ ioc_info(ioc, "pcie enumeration event: (%s) Flag 0x%02x", ++ (event_data->ReasonCode == MPI26_EVENT_PCIE_ENUM_RC_STARTED) ? ++ "started" : "completed", ++ event_data->Flags); + if (event_data->EnumerationStatus) + pr_cont("enumeration_status(0x%08x)", + le32_to_cpu(event_data->EnumerationStatus)); +@@ -7665,8 +7580,7 @@ _scsih_ir_fastpath(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phys_disk_num) + mutex_lock(&ioc->scsih_cmds.mutex); + + if (ioc->scsih_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: scsih_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: scsih_cmd in use\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -7674,8 +7588,7 @@ _scsih_ir_fastpath(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phys_disk_num) + + smid = mpt3sas_base_get_smid(ioc, ioc->scsih_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + ioc->scsih_cmds.status = MPT3_CMD_NOT_USED; + rc = -EAGAIN; + goto out; +@@ -7689,9 +7602,9 @@ _scsih_ir_fastpath(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phys_disk_num) + mpi_request->Action = MPI2_RAID_ACTION_PHYSDISK_HIDDEN; + mpi_request->PhysDiskNum = phys_disk_num; + +- dewtprintk(ioc, pr_info(MPT3SAS_FMT "IR RAID_ACTION: turning fast "\ +- "path on for handle(0x%04x), phys_disk_num (0x%02x)\n", ioc->name, +- handle, phys_disk_num)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "IR RAID_ACTION: turning fast path on for handle(0x%04x), phys_disk_num (0x%02x)\n", ++ handle, phys_disk_num)); + + init_completion(&ioc->scsih_cmds.done); + mpt3sas_base_put_smid_default(ioc, smid); +@@ -7716,15 +7629,13 @@ _scsih_ir_fastpath(struct MPT3SAS_ADAPTER *ioc, u16 handle, u8 phys_disk_num) + log_info = 0; + ioc_status &= MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "IR RAID_ACTION: failed: ioc_status(0x%04x), " +- "loginfo(0x%08x)!!!\n", ioc->name, ioc_status, +- log_info)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "IR RAID_ACTION: failed: ioc_status(0x%04x), loginfo(0x%08x)!!!\n", ++ ioc_status, log_info)); + rc = -EFAULT; + } else +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "IR RAID_ACTION: completed successfully\n", +- ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "IR RAID_ACTION: completed successfully\n")); + } + + out: +@@ -7769,9 +7680,8 @@ _scsih_sas_volume_add(struct MPT3SAS_ADAPTER *ioc, + + mpt3sas_config_get_volume_wwid(ioc, handle, &wwid); + if (!wwid) { +- pr_err(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + +@@ -7784,9 +7694,8 @@ _scsih_sas_volume_add(struct MPT3SAS_ADAPTER *ioc, + + raid_device = kzalloc(sizeof(struct _raid_device), GFP_KERNEL); + if (!raid_device) { +- pr_err(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + +@@ -7829,9 +7738,8 @@ _scsih_sas_volume_delete(struct MPT3SAS_ADAPTER *ioc, u16 handle) + sas_target_priv_data = starget->hostdata; + sas_target_priv_data->deleted = 1; + } +- pr_info(MPT3SAS_FMT "removing handle(0x%04x), wwid(0x%016llx)\n", +- ioc->name, raid_device->handle, +- (unsigned long long) raid_device->wwid); ++ ioc_info(ioc, "removing handle(0x%04x), wwid(0x%016llx)\n", ++ raid_device->handle, (u64)raid_device->wwid); + list_del(&raid_device->list); + kfree(raid_device); + } +@@ -7973,16 +7881,16 @@ _scsih_sas_pd_add(struct MPT3SAS_ADAPTER *ioc, + + if ((mpt3sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0, + MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + +@@ -8012,10 +7920,10 @@ _scsih_sas_ir_config_change_event_debug(struct MPT3SAS_ADAPTER *ioc, + + element = (Mpi2EventIrConfigElement_t *)&event_data->ConfigElement[0]; + +- pr_info(MPT3SAS_FMT "raid config change: (%s), elements(%d)\n", +- ioc->name, (le32_to_cpu(event_data->Flags) & +- MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG) ? +- "foreign" : "native", event_data->NumElements); ++ ioc_info(ioc, "raid config change: (%s), elements(%d)\n", ++ le32_to_cpu(event_data->Flags) & MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG ? ++ "foreign" : "native", ++ event_data->NumElements); + for (i = 0; i < event_data->NumElements; i++, element++) { + switch (element->ReasonCode) { + case MPI2_EVENT_IR_CHANGE_RC_ADDED: +@@ -8171,10 +8079,11 @@ _scsih_sas_ir_volume_event(struct MPT3SAS_ADAPTER *ioc, + handle = le16_to_cpu(event_data->VolDevHandle); + state = le32_to_cpu(event_data->NewValue); + if (!ioc->hide_ir_msg) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle(0x%04x), old(0x%08x), new(0x%08x)\n", +- ioc->name, __func__, handle, +- le32_to_cpu(event_data->PreviousValue), state)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: handle(0x%04x), old(0x%08x), new(0x%08x)\n", ++ __func__, handle, ++ le32_to_cpu(event_data->PreviousValue), ++ state)); + switch (state) { + case MPI2_RAID_VOL_STATE_MISSING: + case MPI2_RAID_VOL_STATE_FAILED: +@@ -8194,17 +8103,15 @@ _scsih_sas_ir_volume_event(struct MPT3SAS_ADAPTER *ioc, + + mpt3sas_config_get_volume_wwid(ioc, handle, &wwid); + if (!wwid) { +- pr_err(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + break; + } + + raid_device = kzalloc(sizeof(struct _raid_device), GFP_KERNEL); + if (!raid_device) { +- pr_err(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + break; + } + +@@ -8255,10 +8162,11 @@ _scsih_sas_ir_physical_disk_event(struct MPT3SAS_ADAPTER *ioc, + state = le32_to_cpu(event_data->NewValue); + + if (!ioc->hide_ir_msg) +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: handle(0x%04x), old(0x%08x), new(0x%08x)\n", +- ioc->name, __func__, handle, +- le32_to_cpu(event_data->PreviousValue), state)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "%s: handle(0x%04x), old(0x%08x), new(0x%08x)\n", ++ __func__, handle, ++ le32_to_cpu(event_data->PreviousValue), ++ state)); + + switch (state) { + case MPI2_RAID_PD_STATE_ONLINE: +@@ -8279,16 +8187,16 @@ _scsih_sas_ir_physical_disk_event(struct MPT3SAS_ADAPTER *ioc, + if ((mpt3sas_config_get_sas_device_pg0(ioc, &mpi_reply, + &sas_device_pg0, MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, + handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + +@@ -8342,11 +8250,10 @@ _scsih_sas_ir_operation_status_event_debug(struct MPT3SAS_ADAPTER *ioc, + if (!reason_str) + return; + +- pr_info(MPT3SAS_FMT "raid operational status: (%s)" \ +- "\thandle(0x%04x), percent complete(%d)\n", +- ioc->name, reason_str, +- le16_to_cpu(event_data->VolDevHandle), +- event_data->PercentComplete); ++ ioc_info(ioc, "raid operational status: (%s)\thandle(0x%04x), percent complete(%d)\n", ++ reason_str, ++ le16_to_cpu(event_data->VolDevHandle), ++ event_data->PercentComplete); + } + + /** +@@ -8427,9 +8334,8 @@ Mpi2SasDevicePage0_t *sas_device_pg0) + mpt3sas_scsih_enclosure_find_by_handle(ioc, + le16_to_cpu(sas_device_pg0->EnclosureHandle)); + if (enclosure_dev == NULL) +- pr_info(MPT3SAS_FMT "Enclosure handle(0x%04x)" +- "doesn't match with enclosure device!\n", +- ioc->name, sas_device_pg0->EnclosureHandle); ++ ioc_info(ioc, "Enclosure handle(0x%04x) doesn't match with enclosure device!\n", ++ sas_device_pg0->EnclosureHandle); + } + spin_lock_irqsave(&ioc->sas_device_lock, flags); + list_for_each_entry(sas_device, &ioc->sas_device_list, list) { +@@ -8523,8 +8429,7 @@ _scsih_create_enclosure_list_after_reset(struct MPT3SAS_ADAPTER *ioc) + enclosure_dev = + kzalloc(sizeof(struct _enclosure_node), GFP_KERNEL); + if (!enclosure_dev) { +- pr_err(MPT3SAS_FMT +- "failure at %s:%d/%s()!\n", ioc->name, ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); + return; + } +@@ -8561,7 +8466,7 @@ _scsih_search_responding_sas_devices(struct MPT3SAS_ADAPTER *ioc) + u16 handle; + u32 device_info; + +- pr_info(MPT3SAS_FMT "search for end-devices: start\n", ioc->name); ++ ioc_info(ioc, "search for end-devices: start\n"); + + if (list_empty(&ioc->sas_device_list)) + goto out; +@@ -8582,8 +8487,7 @@ _scsih_search_responding_sas_devices(struct MPT3SAS_ADAPTER *ioc) + } + + out: +- pr_info(MPT3SAS_FMT "search for end-devices: complete\n", +- ioc->name); ++ ioc_info(ioc, "search for end-devices: complete\n"); + } + + /** +@@ -8676,7 +8580,7 @@ _scsih_search_responding_pcie_devices(struct MPT3SAS_ADAPTER *ioc) + u16 handle; + u32 device_info; + +- pr_info(MPT3SAS_FMT "search for end-devices: start\n", ioc->name); ++ ioc_info(ioc, "search for end-devices: start\n"); + + if (list_empty(&ioc->pcie_device_list)) + goto out; +@@ -8688,10 +8592,9 @@ _scsih_search_responding_pcie_devices(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from %s: " +- "ioc_status(0x%04x), loginfo(0x%08x)\n", ioc->name, +- __func__, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from %s: ioc_status(0x%04x), loginfo(0x%08x)\n", ++ __func__, ioc_status, ++ le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + handle = le16_to_cpu(pcie_device_pg0.DevHandle); +@@ -8701,8 +8604,7 @@ _scsih_search_responding_pcie_devices(struct MPT3SAS_ADAPTER *ioc) + _scsih_mark_responding_pcie_device(ioc, &pcie_device_pg0); + } + out: +- pr_info(MPT3SAS_FMT "search for PCIe end-devices: complete\n", +- ioc->name); ++ ioc_info(ioc, "search for PCIe end-devices: complete\n"); + } + + /** +@@ -8783,8 +8685,7 @@ _scsih_search_responding_raid_devices(struct MPT3SAS_ADAPTER *ioc) + if (!ioc->ir_firmware) + return; + +- pr_info(MPT3SAS_FMT "search for raid volumes: start\n", +- ioc->name); ++ ioc_info(ioc, "search for raid volumes: start\n"); + + if (list_empty(&ioc->raid_device_list)) + goto out; +@@ -8827,8 +8728,7 @@ _scsih_search_responding_raid_devices(struct MPT3SAS_ADAPTER *ioc) + } + } + out: +- pr_info(MPT3SAS_FMT "search for responding raid volumes: complete\n", +- ioc->name); ++ ioc_info(ioc, "search for responding raid volumes: complete\n"); + } + + /** +@@ -8900,7 +8800,7 @@ _scsih_search_responding_expanders(struct MPT3SAS_ADAPTER *ioc) + u64 sas_address; + u16 handle; + +- pr_info(MPT3SAS_FMT "search for expanders: start\n", ioc->name); ++ ioc_info(ioc, "search for expanders: start\n"); + + if (list_empty(&ioc->sas_expander_list)) + goto out; +@@ -8923,7 +8823,7 @@ _scsih_search_responding_expanders(struct MPT3SAS_ADAPTER *ioc) + } + + out: +- pr_info(MPT3SAS_FMT "search for expanders: complete\n", ioc->name); ++ ioc_info(ioc, "search for expanders: complete\n"); + } + + /** +@@ -8941,12 +8841,10 @@ _scsih_remove_unresponding_devices(struct MPT3SAS_ADAPTER *ioc) + unsigned long flags; + LIST_HEAD(head); + +- pr_info(MPT3SAS_FMT "removing unresponding devices: start\n", +- ioc->name); ++ ioc_info(ioc, "removing unresponding devices: start\n"); + + /* removing unresponding end devices */ +- pr_info(MPT3SAS_FMT "removing unresponding devices: end-devices\n", +- ioc->name); ++ ioc_info(ioc, "removing unresponding devices: end-devices\n"); + /* + * Iterate, pulling off devices marked as non-responding. We become the + * owner for the reference the list had on any object we prune. +@@ -8970,9 +8868,7 @@ _scsih_remove_unresponding_devices(struct MPT3SAS_ADAPTER *ioc) + sas_device_put(sas_device); + } + +- pr_info(MPT3SAS_FMT +- " Removing unresponding devices: pcie end-devices\n" +- , ioc->name); ++ ioc_info(ioc, "Removing unresponding devices: pcie end-devices\n"); + INIT_LIST_HEAD(&head); + spin_lock_irqsave(&ioc->pcie_device_lock, flags); + list_for_each_entry_safe(pcie_device, pcie_device_next, +@@ -8992,8 +8888,7 @@ _scsih_remove_unresponding_devices(struct MPT3SAS_ADAPTER *ioc) + + /* removing unresponding volumes */ + if (ioc->ir_firmware) { +- pr_info(MPT3SAS_FMT "removing unresponding devices: volumes\n", +- ioc->name); ++ ioc_info(ioc, "removing unresponding devices: volumes\n"); + list_for_each_entry_safe(raid_device, raid_device_next, + &ioc->raid_device_list, list) { + if (!raid_device->responding) +@@ -9005,8 +8900,7 @@ _scsih_remove_unresponding_devices(struct MPT3SAS_ADAPTER *ioc) + } + + /* removing unresponding expanders */ +- pr_info(MPT3SAS_FMT "removing unresponding devices: expanders\n", +- ioc->name); ++ ioc_info(ioc, "removing unresponding devices: expanders\n"); + spin_lock_irqsave(&ioc->sas_node_lock, flags); + INIT_LIST_HEAD(&tmp_list); + list_for_each_entry_safe(sas_expander, sas_expander_next, +@@ -9022,8 +8916,7 @@ _scsih_remove_unresponding_devices(struct MPT3SAS_ADAPTER *ioc) + _scsih_expander_node_remove(ioc, sas_expander); + } + +- pr_info(MPT3SAS_FMT "removing unresponding devices: complete\n", +- ioc->name); ++ ioc_info(ioc, "removing unresponding devices: complete\n"); + + /* unblock devices */ + _scsih_ublock_io_all_device(ioc); +@@ -9040,8 +8933,8 @@ _scsih_refresh_expander_links(struct MPT3SAS_ADAPTER *ioc, + for (i = 0 ; i < sas_expander->num_phys ; i++) { + if ((mpt3sas_config_get_expander_pg1(ioc, &mpi_reply, + &expander_pg1, i, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return; + } + +@@ -9077,11 +8970,11 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + u8 retry_count; + unsigned long flags; + +- pr_info(MPT3SAS_FMT "scan devices: start\n", ioc->name); ++ ioc_info(ioc, "scan devices: start\n"); + + _scsih_sas_host_refresh(ioc); + +- pr_info(MPT3SAS_FMT "\tscan devices: expanders start\n", ioc->name); ++ ioc_info(ioc, "\tscan devices: expanders start\n"); + + /* expanders */ + handle = 0xFFFF; +@@ -9090,10 +8983,8 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from expander scan: " \ +- "ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from expander scan: ioc_status(0x%04x), loginfo(0x%08x)\n", ++ ioc_status, le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + handle = le16_to_cpu(expander_pg0.DevHandle); +@@ -9105,25 +8996,22 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + _scsih_refresh_expander_links(ioc, expander_device, + handle); + else { +- pr_info(MPT3SAS_FMT "\tBEFORE adding expander: " \ +- "handle (0x%04x), sas_addr(0x%016llx)\n", ioc->name, +- handle, (unsigned long long) +- le64_to_cpu(expander_pg0.SASAddress)); ++ ioc_info(ioc, "\tBEFORE adding expander: handle (0x%04x), sas_addr(0x%016llx)\n", ++ handle, ++ (u64)le64_to_cpu(expander_pg0.SASAddress)); + _scsih_expander_add(ioc, handle); +- pr_info(MPT3SAS_FMT "\tAFTER adding expander: " \ +- "handle (0x%04x), sas_addr(0x%016llx)\n", ioc->name, +- handle, (unsigned long long) +- le64_to_cpu(expander_pg0.SASAddress)); ++ ioc_info(ioc, "\tAFTER adding expander: handle (0x%04x), sas_addr(0x%016llx)\n", ++ handle, ++ (u64)le64_to_cpu(expander_pg0.SASAddress)); + } + } + +- pr_info(MPT3SAS_FMT "\tscan devices: expanders complete\n", +- ioc->name); ++ ioc_info(ioc, "\tscan devices: expanders complete\n"); + + if (!ioc->ir_firmware) + goto skip_to_sas; + +- pr_info(MPT3SAS_FMT "\tscan devices: phys disk start\n", ioc->name); ++ ioc_info(ioc, "\tscan devices: phys disk start\n"); + + /* phys disk */ + phys_disk_num = 0xFF; +@@ -9133,10 +9021,8 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from phys disk scan: "\ +- "ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from phys disk scan: ioc_status(0x%04x), loginfo(0x%08x)\n", ++ ioc_status, le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + phys_disk_num = pd_pg0.PhysDiskNum; +@@ -9153,19 +9039,16 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from phys disk scan " \ +- "ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from phys disk scan ioc_status(0x%04x), loginfo(0x%08x)\n", ++ ioc_status, le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + parent_handle = le16_to_cpu(sas_device_pg0.ParentDevHandle); + if (!_scsih_get_sas_address(ioc, parent_handle, + &sas_address)) { +- pr_info(MPT3SAS_FMT "\tBEFORE adding phys disk: " \ +- " handle (0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, handle, (unsigned long long) +- le64_to_cpu(sas_device_pg0.SASAddress)); ++ ioc_info(ioc, "\tBEFORE adding phys disk: handle (0x%04x), sas_addr(0x%016llx)\n", ++ handle, ++ (u64)le64_to_cpu(sas_device_pg0.SASAddress)); + mpt3sas_transport_update_links(ioc, sas_address, + handle, sas_device_pg0.PhyNum, + MPI2_SAS_NEG_LINK_RATE_1_5); +@@ -9179,17 +9062,15 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + 1)) { + ssleep(1); + } +- pr_info(MPT3SAS_FMT "\tAFTER adding phys disk: " \ +- " handle (0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, handle, (unsigned long long) +- le64_to_cpu(sas_device_pg0.SASAddress)); ++ ioc_info(ioc, "\tAFTER adding phys disk: handle (0x%04x), sas_addr(0x%016llx)\n", ++ handle, ++ (u64)le64_to_cpu(sas_device_pg0.SASAddress)); + } + } + +- pr_info(MPT3SAS_FMT "\tscan devices: phys disk complete\n", +- ioc->name); ++ ioc_info(ioc, "\tscan devices: phys disk complete\n"); + +- pr_info(MPT3SAS_FMT "\tscan devices: volumes start\n", ioc->name); ++ ioc_info(ioc, "\tscan devices: volumes start\n"); + + /* volumes */ + handle = 0xFFFF; +@@ -9198,10 +9079,8 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from volume scan: " \ +- "ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from volume scan: ioc_status(0x%04x), loginfo(0x%08x)\n", ++ ioc_status, le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + handle = le16_to_cpu(volume_pg1.DevHandle); +@@ -9218,10 +9097,8 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from volume scan: " \ +- "ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from volume scan: ioc_status(0x%04x), loginfo(0x%08x)\n", ++ ioc_status, le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + if (volume_pg0.VolumeState == MPI2_RAID_VOL_STATE_OPTIMAL || +@@ -9230,23 +9107,19 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + memset(&element, 0, sizeof(Mpi2EventIrConfigElement_t)); + element.ReasonCode = MPI2_EVENT_IR_CHANGE_RC_ADDED; + element.VolDevHandle = volume_pg1.DevHandle; +- pr_info(MPT3SAS_FMT +- "\tBEFORE adding volume: handle (0x%04x)\n", +- ioc->name, volume_pg1.DevHandle); ++ ioc_info(ioc, "\tBEFORE adding volume: handle (0x%04x)\n", ++ volume_pg1.DevHandle); + _scsih_sas_volume_add(ioc, &element); +- pr_info(MPT3SAS_FMT +- "\tAFTER adding volume: handle (0x%04x)\n", +- ioc->name, volume_pg1.DevHandle); ++ ioc_info(ioc, "\tAFTER adding volume: handle (0x%04x)\n", ++ volume_pg1.DevHandle); + } + } + +- pr_info(MPT3SAS_FMT "\tscan devices: volumes complete\n", +- ioc->name); ++ ioc_info(ioc, "\tscan devices: volumes complete\n"); + + skip_to_sas: + +- pr_info(MPT3SAS_FMT "\tscan devices: end devices start\n", +- ioc->name); ++ ioc_info(ioc, "\tscan devices: end devices start\n"); + + /* sas devices */ + handle = 0xFFFF; +@@ -9256,10 +9129,8 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from end device scan:"\ +- " ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from end device scan: ioc_status(0x%04x), loginfo(0x%08x)\n", ++ ioc_status, le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + handle = le16_to_cpu(sas_device_pg0.DevHandle); +@@ -9274,10 +9145,9 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + } + parent_handle = le16_to_cpu(sas_device_pg0.ParentDevHandle); + if (!_scsih_get_sas_address(ioc, parent_handle, &sas_address)) { +- pr_info(MPT3SAS_FMT "\tBEFORE adding end device: " \ +- "handle (0x%04x), sas_addr(0x%016llx)\n", ioc->name, +- handle, (unsigned long long) +- le64_to_cpu(sas_device_pg0.SASAddress)); ++ ioc_info(ioc, "\tBEFORE adding end device: handle (0x%04x), sas_addr(0x%016llx)\n", ++ handle, ++ (u64)le64_to_cpu(sas_device_pg0.SASAddress)); + mpt3sas_transport_update_links(ioc, sas_address, handle, + sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5); + retry_count = 0; +@@ -9289,16 +9159,13 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + 0)) { + ssleep(1); + } +- pr_info(MPT3SAS_FMT "\tAFTER adding end device: " \ +- "handle (0x%04x), sas_addr(0x%016llx)\n", ioc->name, +- handle, (unsigned long long) +- le64_to_cpu(sas_device_pg0.SASAddress)); ++ ioc_info(ioc, "\tAFTER adding end device: handle (0x%04x), sas_addr(0x%016llx)\n", ++ handle, ++ (u64)le64_to_cpu(sas_device_pg0.SASAddress)); + } + } +- pr_info(MPT3SAS_FMT "\tscan devices: end devices complete\n", +- ioc->name); +- pr_info(MPT3SAS_FMT "\tscan devices: pcie end devices start\n", +- ioc->name); ++ ioc_info(ioc, "\tscan devices: end devices complete\n"); ++ ioc_info(ioc, "\tscan devices: pcie end devices start\n"); + + /* pcie devices */ + handle = 0xFFFF; +@@ -9308,10 +9175,8 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) + & MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_info(MPT3SAS_FMT "\tbreak from pcie end device" +- " scan: ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, ioc_status, +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "\tbreak from pcie end device scan: ioc_status(0x%04x), loginfo(0x%08x)\n", ++ ioc_status, le32_to_cpu(mpi_reply.IOCLogInfo)); + break; + } + handle = le16_to_cpu(pcie_device_pg0.DevHandle); +@@ -9328,14 +9193,11 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + parent_handle = le16_to_cpu(pcie_device_pg0.ParentDevHandle); + _scsih_pcie_add_device(ioc, handle); + +- pr_info(MPT3SAS_FMT "\tAFTER adding pcie end device: " +- "handle (0x%04x), wwid(0x%016llx)\n", ioc->name, +- handle, +- (unsigned long long) le64_to_cpu(pcie_device_pg0.WWID)); ++ ioc_info(ioc, "\tAFTER adding pcie end device: handle (0x%04x), wwid(0x%016llx)\n", ++ handle, (u64)le64_to_cpu(pcie_device_pg0.WWID)); + } +- pr_info(MPT3SAS_FMT "\tpcie devices: pcie end devices complete\n", +- ioc->name); +- pr_info(MPT3SAS_FMT "scan devices: complete\n", ioc->name); ++ ioc_info(ioc, "\tpcie devices: pcie end devices complete\n"); ++ ioc_info(ioc, "scan devices: complete\n"); + } + + /** +@@ -9346,8 +9208,7 @@ _scsih_scan_for_devices_after_reset(struct MPT3SAS_ADAPTER *ioc) + */ + void mpt3sas_scsih_pre_reset_handler(struct MPT3SAS_ADAPTER *ioc) + { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_PRE_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_PRE_RESET\n", __func__)); + } + + /** +@@ -9359,8 +9220,7 @@ void mpt3sas_scsih_pre_reset_handler(struct MPT3SAS_ADAPTER *ioc) + void + mpt3sas_scsih_after_reset_handler(struct MPT3SAS_ADAPTER *ioc) + { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_AFTER_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_AFTER_RESET\n", __func__)); + if (ioc->scsih_cmds.status & MPT3_CMD_PENDING) { + ioc->scsih_cmds.status |= MPT3_CMD_RESET; + mpt3sas_base_free_smid(ioc, ioc->scsih_cmds.smid); +@@ -9388,8 +9248,7 @@ mpt3sas_scsih_after_reset_handler(struct MPT3SAS_ADAPTER *ioc) + void + mpt3sas_scsih_reset_done_handler(struct MPT3SAS_ADAPTER *ioc) + { +- dtmprintk(ioc, pr_info(MPT3SAS_FMT +- "%s: MPT3_IOC_DONE_RESET\n", ioc->name, __func__)); ++ dtmprintk(ioc, ioc_info(ioc, "%s: MPT3_IOC_DONE_RESET\n", __func__)); + if ((!ioc->is_driver_loading) && !(disable_discovery > 0 && + !ioc->sas_hba.num_phys)) { + _scsih_prep_device_scan(ioc); +@@ -9444,9 +9303,8 @@ _mpt3sas_fw_work(struct MPT3SAS_ADAPTER *ioc, struct fw_event_work *fw_event) + if (missing_delay[0] != -1 && missing_delay[1] != -1) + mpt3sas_base_update_missing_delay(ioc, missing_delay[0], + missing_delay[1]); +- dewtprintk(ioc, pr_info(MPT3SAS_FMT +- "port enable: complete from worker thread\n", +- ioc->name)); ++ dewtprintk(ioc, ++ ioc_info(ioc, "port enable: complete from worker thread\n")); + break; + case MPT3SAS_TURN_ON_PFA_LED: + _scsih_turn_on_pfa_led(ioc, fw_event->device_handle); +@@ -9544,8 +9402,8 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, + mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply); + + if (unlikely(!mpi_reply)) { +- pr_err(MPT3SAS_FMT "mpi_reply not valid at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "mpi_reply not valid at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 1; + } + +@@ -9612,30 +9470,16 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, + + switch (le32_to_cpu(*log_code)) { + case MPT2_WARPDRIVE_LC_SSDT: +- pr_warn(MPT3SAS_FMT "WarpDrive Warning: " +- "IO Throttling has occurred in the WarpDrive " +- "subsystem. Check WarpDrive documentation for " +- "additional details.\n", ioc->name); ++ ioc_warn(ioc, "WarpDrive Warning: IO Throttling has occurred in the WarpDrive subsystem. Check WarpDrive documentation for additional details.\n"); + break; + case MPT2_WARPDRIVE_LC_SSDLW: +- pr_warn(MPT3SAS_FMT "WarpDrive Warning: " +- "Program/Erase Cycles for the WarpDrive subsystem " +- "in degraded range. Check WarpDrive documentation " +- "for additional details.\n", ioc->name); ++ ioc_warn(ioc, "WarpDrive Warning: Program/Erase Cycles for the WarpDrive subsystem in degraded range. Check WarpDrive documentation for additional details.\n"); + break; + case MPT2_WARPDRIVE_LC_SSDLF: +- pr_err(MPT3SAS_FMT "WarpDrive Fatal Error: " +- "There are no Program/Erase Cycles for the " +- "WarpDrive subsystem. The storage device will be " +- "in read-only mode. Check WarpDrive documentation " +- "for additional details.\n", ioc->name); ++ ioc_err(ioc, "WarpDrive Fatal Error: There are no Program/Erase Cycles for the WarpDrive subsystem. The storage device will be in read-only mode. Check WarpDrive documentation for additional details.\n"); + break; + case MPT2_WARPDRIVE_LC_BRMF: +- pr_err(MPT3SAS_FMT "WarpDrive Fatal Error: " +- "The Backup Rail Monitor has failed on the " +- "WarpDrive subsystem. Check WarpDrive " +- "documentation for additional details.\n", +- ioc->name); ++ ioc_err(ioc, "WarpDrive Fatal Error: The Backup Rail Monitor has failed on the WarpDrive subsystem. Check WarpDrive documentation for additional details.\n"); + break; + } + +@@ -9661,9 +9505,8 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, + (Mpi26EventDataActiveCableExcept_t *) mpi_reply->EventData; + switch (ActiveCableEventData->ReasonCode) { + case MPI26_EVENT_ACTIVE_CABLE_INSUFFICIENT_POWER: +- pr_notice(MPT3SAS_FMT +- "Currently an active cable with ReceptacleID %d\n", +- ioc->name, ActiveCableEventData->ReceptacleID); ++ ioc_notice(ioc, "Currently an active cable with ReceptacleID %d\n", ++ ActiveCableEventData->ReceptacleID); + pr_notice("cannot be powered and devices connected\n"); + pr_notice("to this active cable will not be seen\n"); + pr_notice("This active cable requires %d mW of power\n", +@@ -9671,9 +9514,8 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, + break; + + case MPI26_EVENT_ACTIVE_CABLE_DEGRADED: +- pr_notice(MPT3SAS_FMT +- "Currently a cable with ReceptacleID %d\n", +- ioc->name, ActiveCableEventData->ReceptacleID); ++ ioc_notice(ioc, "Currently a cable with ReceptacleID %d\n", ++ ActiveCableEventData->ReceptacleID); + pr_notice( + "is not running at optimal speed(12 Gb/s rate)\n"); + break; +@@ -9688,8 +9530,8 @@ mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, + sz = le16_to_cpu(mpi_reply->EventDataLength) * 4; + fw_event = alloc_fw_event_work(sz); + if (!fw_event) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return 1; + } + +@@ -9738,11 +9580,9 @@ _scsih_expander_node_remove(struct MPT3SAS_ADAPTER *ioc, + mpt3sas_transport_port_remove(ioc, sas_expander->sas_address, + sas_expander->sas_address_parent); + +- pr_info(MPT3SAS_FMT +- "expander_remove: handle(0x%04x), sas_addr(0x%016llx)\n", +- ioc->name, +- sas_expander->handle, (unsigned long long) +- sas_expander->sas_address); ++ ioc_info(ioc, "expander_remove: handle(0x%04x), sas_addr(0x%016llx)\n", ++ sas_expander->handle, (unsigned long long) ++ sas_expander->sas_address); + + spin_lock_irqsave(&ioc->sas_node_lock, flags); + list_del(&sas_expander->list); +@@ -9777,16 +9617,14 @@ _scsih_ir_shutdown(struct MPT3SAS_ADAPTER *ioc) + mutex_lock(&ioc->scsih_cmds.mutex); + + if (ioc->scsih_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: scsih_cmd in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: scsih_cmd in use\n", __func__); + goto out; + } + ioc->scsih_cmds.status = MPT3_CMD_PENDING; + + smid = mpt3sas_base_get_smid(ioc, ioc->scsih_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + ioc->scsih_cmds.status = MPT3_CMD_NOT_USED; + goto out; + } +@@ -9799,24 +9637,22 @@ _scsih_ir_shutdown(struct MPT3SAS_ADAPTER *ioc) + mpi_request->Action = MPI2_RAID_ACTION_SYSTEM_SHUTDOWN_INITIATED; + + if (!ioc->hide_ir_msg) +- pr_info(MPT3SAS_FMT "IR shutdown (sending)\n", ioc->name); ++ ioc_info(ioc, "IR shutdown (sending)\n"); + init_completion(&ioc->scsih_cmds.done); + mpt3sas_base_put_smid_default(ioc, smid); + wait_for_completion_timeout(&ioc->scsih_cmds.done, 10*HZ); + + if (!(ioc->scsih_cmds.status & MPT3_CMD_COMPLETE)) { +- pr_err(MPT3SAS_FMT "%s: timeout\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: timeout\n", __func__); + goto out; + } + + if (ioc->scsih_cmds.status & MPT3_CMD_REPLY_VALID) { + mpi_reply = ioc->scsih_cmds.reply; + if (!ioc->hide_ir_msg) +- pr_info(MPT3SAS_FMT "IR shutdown " +- "(complete): ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, le16_to_cpu(mpi_reply->IOCStatus), +- le32_to_cpu(mpi_reply->IOCLogInfo)); ++ ioc_info(ioc, "IR shutdown (complete): ioc_status(0x%04x), loginfo(0x%08x)\n", ++ le16_to_cpu(mpi_reply->IOCStatus), ++ le32_to_cpu(mpi_reply->IOCLogInfo)); + } + + out: +@@ -9866,9 +9702,8 @@ static void scsih_remove(struct pci_dev *pdev) + sas_target_priv_data->deleted = 1; + scsi_remove_target(&raid_device->starget->dev); + } +- pr_info(MPT3SAS_FMT "removing handle(0x%04x), wwid(0x%016llx)\n", +- ioc->name, raid_device->handle, +- (unsigned long long) raid_device->wwid); ++ ioc_info(ioc, "removing handle(0x%04x), wwid(0x%016llx)\n", ++ raid_device->handle, (u64)raid_device->wwid); + _scsih_raid_device_remove(ioc, raid_device); + } + list_for_each_entry_safe(pcie_device, pcienext, &ioc->pcie_device_list, +@@ -10278,7 +10113,7 @@ scsih_scan_start(struct Scsi_Host *shost) + rc = mpt3sas_port_enable(ioc); + + if (rc != 0) +- pr_info(MPT3SAS_FMT "port enable: FAILED\n", ioc->name); ++ ioc_info(ioc, "port enable: FAILED\n"); + } + + /** +@@ -10303,9 +10138,7 @@ scsih_scan_finished(struct Scsi_Host *shost, unsigned long time) + + if (time >= (300 * HZ)) { + ioc->port_enable_cmds.status = MPT3_CMD_NOT_USED; +- pr_info(MPT3SAS_FMT +- "port enable: FAILED with timeout (timeout=300s)\n", +- ioc->name); ++ ioc_info(ioc, "port enable: FAILED with timeout (timeout=300s)\n"); + ioc->is_driver_loading = 0; + return 1; + } +@@ -10314,16 +10147,15 @@ scsih_scan_finished(struct Scsi_Host *shost, unsigned long time) + return 0; + + if (ioc->start_scan_failed) { +- pr_info(MPT3SAS_FMT +- "port enable: FAILED with (ioc_status=0x%08x)\n", +- ioc->name, ioc->start_scan_failed); ++ ioc_info(ioc, "port enable: FAILED with (ioc_status=0x%08x)\n", ++ ioc->start_scan_failed); + ioc->is_driver_loading = 0; + ioc->wait_for_discovery_to_complete = 0; + ioc->remove_host = 1; + return 1; + } + +- pr_info(MPT3SAS_FMT "port enable: SUCCESS\n", ioc->name); ++ ioc_info(ioc, "port enable: SUCCESS\n"); + ioc->port_enable_cmds.status = MPT3_CMD_NOT_USED; + + if (ioc->wait_for_discovery_to_complete) { +@@ -10634,28 +10466,22 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (ioc->is_mcpu_endpoint) { + /* mCPU MPI support 64K max IO */ + shost->max_sectors = 128; +- pr_info(MPT3SAS_FMT +- "The max_sectors value is set to %d\n", +- ioc->name, shost->max_sectors); ++ ioc_info(ioc, "The max_sectors value is set to %d\n", ++ shost->max_sectors); + } else { + if (max_sectors != 0xFFFF) { + if (max_sectors < 64) { + shost->max_sectors = 64; +- pr_warn(MPT3SAS_FMT "Invalid value %d passed " \ +- "for max_sectors, range is 64 to 32767. " \ +- "Assigning value of 64.\n", \ +- ioc->name, max_sectors); ++ ioc_warn(ioc, "Invalid value %d passed for max_sectors, range is 64 to 32767. Assigning value of 64.\n", ++ max_sectors); + } else if (max_sectors > 32767) { + shost->max_sectors = 32767; +- pr_warn(MPT3SAS_FMT "Invalid value %d passed " \ +- "for max_sectors, range is 64 to 32767." \ +- "Assigning default value of 32767.\n", \ +- ioc->name, max_sectors); ++ ioc_warn(ioc, "Invalid value %d passed for max_sectors, range is 64 to 32767.Assigning default value of 32767.\n", ++ max_sectors); + } else { + shost->max_sectors = max_sectors & 0xFFFE; +- pr_info(MPT3SAS_FMT +- "The max_sectors value is set to %d\n", +- ioc->name, shost->max_sectors); ++ ioc_info(ioc, "The max_sectors value is set to %d\n", ++ shost->max_sectors); + } + } + } +@@ -10675,16 +10501,16 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id) + ioc->firmware_event_thread = alloc_ordered_workqueue( + ioc->firmware_event_name, 0); + if (!ioc->firmware_event_thread) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rv = -ENODEV; + goto out_thread_fail; + } + + ioc->is_driver_loading = 1; + if ((mpt3sas_base_attach(ioc))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rv = -ENODEV; + goto out_attach_fail; + } +@@ -10705,8 +10531,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + rv = scsi_add_host(shost, &pdev->dev); + if (rv) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out_add_shost_fail; + } + +@@ -10743,9 +10569,8 @@ scsih_suspend(struct pci_dev *pdev, pm_message_t state) + flush_scheduled_work(); + scsi_block_requests(shost); + device_state = pci_choose_state(pdev, state); +- pr_info(MPT3SAS_FMT +- "pdev=0x%p, slot=%s, entering operating state [D%d]\n", +- ioc->name, pdev, pci_name(pdev), device_state); ++ ioc_info(ioc, "pdev=0x%p, slot=%s, entering operating state [D%d]\n", ++ pdev, pci_name(pdev), device_state); + + pci_save_state(pdev); + mpt3sas_base_free_resources(ioc); +@@ -10767,9 +10592,8 @@ scsih_resume(struct pci_dev *pdev) + pci_power_t device_state = pdev->current_state; + int r; + +- pr_info(MPT3SAS_FMT +- "pdev=0x%p, slot=%s, previous operating state [D%d]\n", +- ioc->name, pdev, pci_name(pdev), device_state); ++ ioc_info(ioc, "pdev=0x%p, slot=%s, previous operating state [D%d]\n", ++ pdev, pci_name(pdev), device_state); + + pci_set_power_state(pdev, PCI_D0); + pci_enable_wake(pdev, PCI_D0, 0); +@@ -10801,8 +10625,7 @@ scsih_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state) + struct Scsi_Host *shost = pci_get_drvdata(pdev); + struct MPT3SAS_ADAPTER *ioc = shost_priv(shost); + +- pr_info(MPT3SAS_FMT "PCI error: detected callback, state(%d)!!\n", +- ioc->name, state); ++ ioc_info(ioc, "PCI error: detected callback, state(%d)!!\n", state); + + switch (state) { + case pci_channel_io_normal: +@@ -10839,8 +10662,7 @@ scsih_pci_slot_reset(struct pci_dev *pdev) + struct MPT3SAS_ADAPTER *ioc = shost_priv(shost); + int rc; + +- pr_info(MPT3SAS_FMT "PCI error: slot reset callback!!\n", +- ioc->name); ++ ioc_info(ioc, "PCI error: slot reset callback!!\n"); + + ioc->pci_error_recovery = 0; + ioc->pdev = pdev; +@@ -10851,8 +10673,8 @@ scsih_pci_slot_reset(struct pci_dev *pdev) + + rc = mpt3sas_base_hard_reset_handler(ioc, FORCE_BIG_HAMMER); + +- pr_warn(MPT3SAS_FMT "hard reset: %s\n", ioc->name, +- (rc == 0) ? "success" : "failed"); ++ ioc_warn(ioc, "hard reset: %s\n", ++ (rc == 0) ? "success" : "failed"); + + if (!rc) + return PCI_ERS_RESULT_RECOVERED; +@@ -10874,7 +10696,7 @@ scsih_pci_resume(struct pci_dev *pdev) + struct Scsi_Host *shost = pci_get_drvdata(pdev); + struct MPT3SAS_ADAPTER *ioc = shost_priv(shost); + +- pr_info(MPT3SAS_FMT "PCI error: resume callback!!\n", ioc->name); ++ ioc_info(ioc, "PCI error: resume callback!!\n"); + + pci_cleanup_aer_uncorrect_error_status(pdev); + mpt3sas_base_start_watchdog(ioc); +@@ -10891,8 +10713,7 @@ scsih_pci_mmio_enabled(struct pci_dev *pdev) + struct Scsi_Host *shost = pci_get_drvdata(pdev); + struct MPT3SAS_ADAPTER *ioc = shost_priv(shost); + +- pr_info(MPT3SAS_FMT "PCI error: mmio enabled callback!!\n", +- ioc->name); ++ ioc_info(ioc, "PCI error: mmio enabled callback!!\n"); + + /* TODO - dump whatever for debugging purposes */ + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index 20d36061c217..9fd89e85227a 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -153,18 +153,16 @@ _transport_set_identify(struct MPT3SAS_ADAPTER *ioc, u16 handle, + + if ((mpt3sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0, + MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -ENXIO; + } + + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT +- "handle(0x%04x), ioc_status(0x%04x)\nfailure at %s:%d/%s()!\n", +- ioc->name, handle, ioc_status, +- __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "handle(0x%04x), ioc_status(0x%04x) failure at %s:%d/%s()!\n", ++ handle, ioc_status, __FILE__, __LINE__, __func__); + return -EIO; + } + +@@ -318,8 +316,7 @@ _transport_expander_report_manufacture(struct MPT3SAS_ADAPTER *ioc, + mutex_lock(&ioc->transport_cmds.mutex); + + if (ioc->transport_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: transport_cmds in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: transport_cmds in use\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -329,26 +326,22 @@ _transport_expander_report_manufacture(struct MPT3SAS_ADAPTER *ioc, + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + rc = -EFAULT; + goto out; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + if (wait_state_count) +- pr_info(MPT3SAS_FMT "%s: ioc is operational\n", +- ioc->name, __func__); ++ ioc_info(ioc, "%s: ioc is operational\n", __func__); + + smid = mpt3sas_base_get_smid(ioc, ioc->transport_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -388,16 +381,15 @@ _transport_expander_report_manufacture(struct MPT3SAS_ADAPTER *ioc, + ioc->build_sg(ioc, psge, data_out_dma, data_out_sz, data_in_dma, + data_in_sz); + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "report_manufacture - send to sas_addr(0x%016llx)\n", +- ioc->name, (unsigned long long)sas_address)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "report_manufacture - send to sas_addr(0x%016llx)\n", ++ (u64)sas_address)); + init_completion(&ioc->transport_cmds.done); + mpt3sas_base_put_smid_default(ioc, smid); + wait_for_completion_timeout(&ioc->transport_cmds.done, 10*HZ); + + if (!(ioc->transport_cmds.status & MPT3_CMD_COMPLETE)) { +- pr_err(MPT3SAS_FMT "%s: timeout\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: timeout\n", __func__); + _debug_dump_mf(mpi_request, + sizeof(Mpi2SmpPassthroughRequest_t)/4); + if (!(ioc->transport_cmds.status & MPT3_CMD_RESET)) +@@ -405,17 +397,16 @@ _transport_expander_report_manufacture(struct MPT3SAS_ADAPTER *ioc, + goto issue_host_reset; + } + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "report_manufacture - complete\n", ioc->name)); ++ dtransportprintk(ioc, ioc_info(ioc, "report_manufacture - complete\n")); + + if (ioc->transport_cmds.status & MPT3_CMD_REPLY_VALID) { + u8 *tmp; + + mpi_reply = ioc->transport_cmds.reply; + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "report_manufacture - reply data transfer size(%d)\n", +- ioc->name, le16_to_cpu(mpi_reply->ResponseDataLength))); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "report_manufacture - reply data transfer size(%d)\n", ++ le16_to_cpu(mpi_reply->ResponseDataLength))); + + if (le16_to_cpu(mpi_reply->ResponseDataLength) != + sizeof(struct rep_manu_reply)) +@@ -439,8 +430,8 @@ _transport_expander_report_manufacture(struct MPT3SAS_ADAPTER *ioc, + manufacture_reply->component_revision_id; + } + } else +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "report_manufacture - no reply\n", ioc->name)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "report_manufacture - no reply\n")); + + issue_host_reset: + if (issue_reset) +@@ -643,8 +634,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, + mpt3sas_port = kzalloc(sizeof(struct _sas_port), + GFP_KERNEL); + if (!mpt3sas_port) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return NULL; + } + +@@ -655,22 +646,21 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, + spin_unlock_irqrestore(&ioc->sas_node_lock, flags); + + if (!sas_node) { +- pr_err(MPT3SAS_FMT +- "%s: Could not find parent sas_address(0x%016llx)!\n", +- ioc->name, __func__, (unsigned long long)sas_address); ++ ioc_err(ioc, "%s: Could not find parent sas_address(0x%016llx)!\n", ++ __func__, (u64)sas_address); + goto out_fail; + } + + if ((_transport_set_identify(ioc, handle, + &mpt3sas_port->remote_identify))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out_fail; + } + + if (mpt3sas_port->remote_identify.device_type == SAS_PHY_UNUSED) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out_fail; + } + +@@ -687,20 +677,20 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, + } + + if (!mpt3sas_port->num_phys) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out_fail; + } + + if (!sas_node->parent_dev) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out_fail; + } + port = sas_port_alloc_num(sas_node->parent_dev); + if ((sas_port_add(port))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + goto out_fail; + } + +@@ -738,8 +728,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, + } + + if ((sas_rphy_add(rphy))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + } + + if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { +@@ -864,14 +854,14 @@ mpt3sas_transport_add_host_phy(struct MPT3SAS_ADAPTER *ioc, struct _sas_phy + INIT_LIST_HEAD(&mpt3sas_phy->port_siblings); + phy = sas_phy_alloc(parent_dev, phy_index); + if (!phy) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + if ((_transport_set_identify(ioc, mpt3sas_phy->handle, + &mpt3sas_phy->identify))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + sas_phy_free(phy); + return -1; + } +@@ -893,8 +883,8 @@ mpt3sas_transport_add_host_phy(struct MPT3SAS_ADAPTER *ioc, struct _sas_phy + phy_pg0.ProgrammedLinkRate >> 4); + + if ((sas_phy_add(phy))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + sas_phy_free(phy); + return -1; + } +@@ -932,14 +922,14 @@ mpt3sas_transport_add_expander_phy(struct MPT3SAS_ADAPTER *ioc, struct _sas_phy + INIT_LIST_HEAD(&mpt3sas_phy->port_siblings); + phy = sas_phy_alloc(parent_dev, phy_index); + if (!phy) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -1; + } + if ((_transport_set_identify(ioc, mpt3sas_phy->handle, + &mpt3sas_phy->identify))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + sas_phy_free(phy); + return -1; + } +@@ -963,8 +953,8 @@ mpt3sas_transport_add_expander_phy(struct MPT3SAS_ADAPTER *ioc, struct _sas_phy + expander_pg1.ProgrammedLinkRate >> 4); + + if ((sas_phy_add(phy))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + sas_phy_free(phy); + return -1; + } +@@ -1109,8 +1099,7 @@ _transport_get_expander_phy_error_log(struct MPT3SAS_ADAPTER *ioc, + mutex_lock(&ioc->transport_cmds.mutex); + + if (ioc->transport_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: transport_cmds in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: transport_cmds in use\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -1120,26 +1109,22 @@ _transport_get_expander_phy_error_log(struct MPT3SAS_ADAPTER *ioc, + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + rc = -EFAULT; + goto out; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + if (wait_state_count) +- pr_info(MPT3SAS_FMT "%s: ioc is operational\n", +- ioc->name, __func__); ++ ioc_info(ioc, "%s: ioc is operational\n", __func__); + + smid = mpt3sas_base_get_smid(ioc, ioc->transport_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -1182,17 +1167,16 @@ _transport_get_expander_phy_error_log(struct MPT3SAS_ADAPTER *ioc, + data_out_dma + sizeof(struct phy_error_log_request), + sizeof(struct phy_error_log_reply)); + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_error_log - send to sas_addr(0x%016llx), phy(%d)\n", +- ioc->name, (unsigned long long)phy->identify.sas_address, +- phy->number)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_error_log - send to sas_addr(0x%016llx), phy(%d)\n", ++ (u64)phy->identify.sas_address, ++ phy->number)); + init_completion(&ioc->transport_cmds.done); + mpt3sas_base_put_smid_default(ioc, smid); + wait_for_completion_timeout(&ioc->transport_cmds.done, 10*HZ); + + if (!(ioc->transport_cmds.status & MPT3_CMD_COMPLETE)) { +- pr_err(MPT3SAS_FMT "%s: timeout\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: timeout\n", __func__); + _debug_dump_mf(mpi_request, + sizeof(Mpi2SmpPassthroughRequest_t)/4); + if (!(ioc->transport_cmds.status & MPT3_CMD_RESET)) +@@ -1200,16 +1184,15 @@ _transport_get_expander_phy_error_log(struct MPT3SAS_ADAPTER *ioc, + goto issue_host_reset; + } + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_error_log - complete\n", ioc->name)); ++ dtransportprintk(ioc, ioc_info(ioc, "phy_error_log - complete\n")); + + if (ioc->transport_cmds.status & MPT3_CMD_REPLY_VALID) { + + mpi_reply = ioc->transport_cmds.reply; + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_error_log - reply data transfer size(%d)\n", +- ioc->name, le16_to_cpu(mpi_reply->ResponseDataLength))); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_error_log - reply data transfer size(%d)\n", ++ le16_to_cpu(mpi_reply->ResponseDataLength))); + + if (le16_to_cpu(mpi_reply->ResponseDataLength) != + sizeof(struct phy_error_log_reply)) +@@ -1218,9 +1201,9 @@ _transport_get_expander_phy_error_log(struct MPT3SAS_ADAPTER *ioc, + phy_error_log_reply = data_out + + sizeof(struct phy_error_log_request); + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_error_log - function_result(%d)\n", +- ioc->name, phy_error_log_reply->function_result)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_error_log - function_result(%d)\n", ++ phy_error_log_reply->function_result)); + + phy->invalid_dword_count = + be32_to_cpu(phy_error_log_reply->invalid_dword); +@@ -1232,8 +1215,8 @@ _transport_get_expander_phy_error_log(struct MPT3SAS_ADAPTER *ioc, + be32_to_cpu(phy_error_log_reply->phy_reset_problem); + rc = 0; + } else +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_error_log - no reply\n", ioc->name)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_error_log - no reply\n")); + + issue_host_reset: + if (issue_reset) +@@ -1276,17 +1259,16 @@ _transport_get_linkerrors(struct sas_phy *phy) + /* get hba phy error logs */ + if ((mpt3sas_config_get_phy_pg1(ioc, &mpi_reply, &phy_pg1, + phy->number))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -ENXIO; + } + + if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) +- pr_info(MPT3SAS_FMT +- "phy(%d), ioc_status (0x%04x), loginfo(0x%08x)\n", +- ioc->name, phy->number, +- le16_to_cpu(mpi_reply.IOCStatus), +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "phy(%d), ioc_status (0x%04x), loginfo(0x%08x)\n", ++ phy->number, ++ le16_to_cpu(mpi_reply.IOCStatus), ++ le32_to_cpu(mpi_reply.IOCLogInfo)); + + phy->invalid_dword_count = le32_to_cpu(phy_pg1.InvalidDwordCount); + phy->running_disparity_error_count = +@@ -1422,8 +1404,7 @@ _transport_expander_phy_control(struct MPT3SAS_ADAPTER *ioc, + mutex_lock(&ioc->transport_cmds.mutex); + + if (ioc->transport_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: transport_cmds in use\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: transport_cmds in use\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -1433,26 +1414,22 @@ _transport_expander_phy_control(struct MPT3SAS_ADAPTER *ioc, + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + rc = -EFAULT; + goto out; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + if (wait_state_count) +- pr_info(MPT3SAS_FMT "%s: ioc is operational\n", +- ioc->name, __func__); ++ ioc_info(ioc, "%s: ioc is operational\n", __func__); + + smid = mpt3sas_base_get_smid(ioc, ioc->transport_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto out; + } +@@ -1500,17 +1477,16 @@ _transport_expander_phy_control(struct MPT3SAS_ADAPTER *ioc, + data_out_dma + sizeof(struct phy_control_request), + sizeof(struct phy_control_reply)); + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_control - send to sas_addr(0x%016llx), phy(%d), opcode(%d)\n", +- ioc->name, (unsigned long long)phy->identify.sas_address, +- phy->number, phy_operation)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_control - send to sas_addr(0x%016llx), phy(%d), opcode(%d)\n", ++ (u64)phy->identify.sas_address, ++ phy->number, phy_operation)); + init_completion(&ioc->transport_cmds.done); + mpt3sas_base_put_smid_default(ioc, smid); + wait_for_completion_timeout(&ioc->transport_cmds.done, 10*HZ); + + if (!(ioc->transport_cmds.status & MPT3_CMD_COMPLETE)) { +- pr_err(MPT3SAS_FMT "%s: timeout\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: timeout\n", __func__); + _debug_dump_mf(mpi_request, + sizeof(Mpi2SmpPassthroughRequest_t)/4); + if (!(ioc->transport_cmds.status & MPT3_CMD_RESET)) +@@ -1518,16 +1494,15 @@ _transport_expander_phy_control(struct MPT3SAS_ADAPTER *ioc, + goto issue_host_reset; + } + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_control - complete\n", ioc->name)); ++ dtransportprintk(ioc, ioc_info(ioc, "phy_control - complete\n")); + + if (ioc->transport_cmds.status & MPT3_CMD_REPLY_VALID) { + + mpi_reply = ioc->transport_cmds.reply; + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_control - reply data transfer size(%d)\n", +- ioc->name, le16_to_cpu(mpi_reply->ResponseDataLength))); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_control - reply data transfer size(%d)\n", ++ le16_to_cpu(mpi_reply->ResponseDataLength))); + + if (le16_to_cpu(mpi_reply->ResponseDataLength) != + sizeof(struct phy_control_reply)) +@@ -1536,14 +1511,14 @@ _transport_expander_phy_control(struct MPT3SAS_ADAPTER *ioc, + phy_control_reply = data_out + + sizeof(struct phy_control_request); + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_control - function_result(%d)\n", +- ioc->name, phy_control_reply->function_result)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_control - function_result(%d)\n", ++ phy_control_reply->function_result)); + + rc = 0; + } else +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "phy_control - no reply\n", ioc->name)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "phy_control - no reply\n")); + + issue_host_reset: + if (issue_reset) +@@ -1594,16 +1569,15 @@ _transport_phy_reset(struct sas_phy *phy, int hard_reset) + mpi_request.PhyNum = phy->number; + + if ((mpt3sas_base_sas_iounit_control(ioc, &mpi_reply, &mpi_request))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + return -ENXIO; + } + + if (mpi_reply.IOCStatus || mpi_reply.IOCLogInfo) +- pr_info(MPT3SAS_FMT +- "phy(%d), ioc_status(0x%04x), loginfo(0x%08x)\n", +- ioc->name, phy->number, le16_to_cpu(mpi_reply.IOCStatus), +- le32_to_cpu(mpi_reply.IOCLogInfo)); ++ ioc_info(ioc, "phy(%d), ioc_status(0x%04x), loginfo(0x%08x)\n", ++ phy->number, le16_to_cpu(mpi_reply.IOCStatus), ++ le32_to_cpu(mpi_reply.IOCLogInfo)); + + return 0; + } +@@ -1650,23 +1624,23 @@ _transport_phy_enable(struct sas_phy *phy, int enable) + sizeof(Mpi2SasIOUnit0PhyData_t)); + sas_iounit_pg0 = kzalloc(sz, GFP_KERNEL); + if (!sas_iounit_pg0) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -ENOMEM; + goto out; + } + if ((mpt3sas_config_get_sas_iounit_pg0(ioc, &mpi_reply, + sas_iounit_pg0, sz))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -ENXIO; + goto out; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -EIO; + goto out; + } +@@ -1675,10 +1649,8 @@ _transport_phy_enable(struct sas_phy *phy, int enable) + for (i = 0, discovery_active = 0; i < ioc->sas_hba.num_phys ; i++) { + if (sas_iounit_pg0->PhyData[i].PortFlags & + MPI2_SASIOUNIT0_PORTFLAGS_DISCOVERY_IN_PROGRESS) { +- pr_err(MPT3SAS_FMT "discovery is active on " \ +- "port = %d, phy = %d: unable to enable/disable " +- "phys, try again later!\n", ioc->name, +- sas_iounit_pg0->PhyData[i].Port, i); ++ ioc_err(ioc, "discovery is active on port = %d, phy = %d: unable to enable/disable phys, try again later!\n", ++ sas_iounit_pg0->PhyData[i].Port, i); + discovery_active = 1; + } + } +@@ -1693,23 +1665,23 @@ _transport_phy_enable(struct sas_phy *phy, int enable) + sizeof(Mpi2SasIOUnit1PhyData_t)); + sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); + if (!sas_iounit_pg1) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -ENOMEM; + goto out; + } + if ((mpt3sas_config_get_sas_iounit_pg1(ioc, &mpi_reply, + sas_iounit_pg1, sz))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -ENXIO; + goto out; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -EIO; + goto out; + } +@@ -1801,23 +1773,23 @@ _transport_phy_speed(struct sas_phy *phy, struct sas_phy_linkrates *rates) + sizeof(Mpi2SasIOUnit1PhyData_t)); + sas_iounit_pg1 = kzalloc(sz, GFP_KERNEL); + if (!sas_iounit_pg1) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -ENOMEM; + goto out; + } + if ((mpt3sas_config_get_sas_iounit_pg1(ioc, &mpi_reply, + sas_iounit_pg1, sz))) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -ENXIO; + goto out; + } + ioc_status = le16_to_cpu(mpi_reply.IOCStatus) & + MPI2_IOCSTATUS_MASK; + if (ioc_status != MPI2_IOCSTATUS_SUCCESS) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -EIO; + goto out; + } +@@ -1836,8 +1808,8 @@ _transport_phy_speed(struct sas_phy *phy, struct sas_phy_linkrates *rates) + + if (mpt3sas_config_set_sas_iounit_pg1(ioc, &mpi_reply, sas_iounit_pg1, + sz)) { +- pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", +- ioc->name, __FILE__, __LINE__, __func__); ++ ioc_err(ioc, "failure at %s:%d/%s()!\n", ++ __FILE__, __LINE__, __func__); + rc = -ENXIO; + goto out; + } +@@ -1936,8 +1908,8 @@ _transport_smp_handler(struct bsg_job *job, struct Scsi_Host *shost, + goto job_done; + + if (ioc->transport_cmds.status != MPT3_CMD_NOT_USED) { +- pr_err(MPT3SAS_FMT "%s: transport_cmds in use\n", ioc->name, +- __func__); ++ ioc_err(ioc, "%s: transport_cmds in use\n", ++ __func__); + rc = -EAGAIN; + goto out; + } +@@ -1962,26 +1934,22 @@ _transport_smp_handler(struct bsg_job *job, struct Scsi_Host *shost, + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); + while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) { + if (wait_state_count++ == 10) { +- pr_err(MPT3SAS_FMT +- "%s: failed due to ioc not operational\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed due to ioc not operational\n", ++ __func__); + rc = -EFAULT; + goto unmap_in; + } + ssleep(1); + ioc_state = mpt3sas_base_get_iocstate(ioc, 1); +- pr_info(MPT3SAS_FMT +- "%s: waiting for operational state(count=%d)\n", +- ioc->name, __func__, wait_state_count); ++ ioc_info(ioc, "%s: waiting for operational state(count=%d)\n", ++ __func__, wait_state_count); + } + if (wait_state_count) +- pr_info(MPT3SAS_FMT "%s: ioc is operational\n", +- ioc->name, __func__); ++ ioc_info(ioc, "%s: ioc is operational\n", __func__); + + smid = mpt3sas_base_get_smid(ioc, ioc->transport_cb_idx); + if (!smid) { +- pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", +- ioc->name, __func__); ++ ioc_err(ioc, "%s: failed obtaining a smid\n", __func__); + rc = -EAGAIN; + goto unmap_in; + } +@@ -2002,8 +1970,8 @@ _transport_smp_handler(struct bsg_job *job, struct Scsi_Host *shost, + ioc->build_sg(ioc, psge, dma_addr_out, dma_len_out - 4, dma_addr_in, + dma_len_in - 4); + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "%s - sending smp request\n", ioc->name, __func__)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "%s: sending smp request\n", __func__)); + + init_completion(&ioc->transport_cmds.done); + mpt3sas_base_put_smid_default(ioc, smid); +@@ -2021,12 +1989,11 @@ _transport_smp_handler(struct bsg_job *job, struct Scsi_Host *shost, + } + } + +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "%s - complete\n", ioc->name, __func__)); ++ dtransportprintk(ioc, ioc_info(ioc, "%s - complete\n", __func__)); + + if (!(ioc->transport_cmds.status & MPT3_CMD_REPLY_VALID)) { +- dtransportprintk(ioc, pr_info(MPT3SAS_FMT +- "%s - no reply\n", ioc->name, __func__)); ++ dtransportprintk(ioc, ++ ioc_info(ioc, "%s: no reply\n", __func__)); + rc = -ENXIO; + goto unmap_in; + } +@@ -2034,9 +2001,9 @@ _transport_smp_handler(struct bsg_job *job, struct Scsi_Host *shost, + mpi_reply = ioc->transport_cmds.reply; + + dtransportprintk(ioc, +- pr_info(MPT3SAS_FMT "%s - reply data transfer size(%d)\n", +- ioc->name, __func__, +- le16_to_cpu(mpi_reply->ResponseDataLength))); ++ ioc_info(ioc, "%s: reply data transfer size(%d)\n", ++ __func__, ++ le16_to_cpu(mpi_reply->ResponseDataLength))); + + memcpy(job->reply, mpi_reply, sizeof(*mpi_reply)); + job->reply_len = sizeof(*mpi_reply); +diff --git a/drivers/scsi/mpt3sas/mpt3sas_trigger_diag.c b/drivers/scsi/mpt3sas/mpt3sas_trigger_diag.c +index cae7c1eaef34..6ac453fd5937 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_trigger_diag.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_trigger_diag.c +@@ -72,8 +72,7 @@ _mpt3sas_raise_sigio(struct MPT3SAS_ADAPTER *ioc, + u16 sz, event_data_sz; + unsigned long flags; + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: enter\n", __func__)); + + sz = offsetof(Mpi2EventNotificationReply_t, EventData) + + sizeof(struct SL_WH_TRIGGERS_EVENT_DATA_T) + 4; +@@ -85,23 +84,23 @@ _mpt3sas_raise_sigio(struct MPT3SAS_ADAPTER *ioc, + mpi_reply->EventDataLength = cpu_to_le16(event_data_sz); + memcpy(&mpi_reply->EventData, event_data, + sizeof(struct SL_WH_TRIGGERS_EVENT_DATA_T)); +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: add to driver event log\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: add to driver event log\n", ++ __func__)); + mpt3sas_ctl_add_to_event_log(ioc, mpi_reply); + kfree(mpi_reply); + out: + + /* clearing the diag_trigger_active flag */ + spin_lock_irqsave(&ioc->diag_trigger_lock, flags); +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: clearing diag_trigger_active flag\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: clearing diag_trigger_active flag\n", ++ __func__)); + ioc->diag_trigger_active = 0; + spin_unlock_irqrestore(&ioc->diag_trigger_lock, flags); + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: exit\n", ioc->name, +- __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: exit\n", ++ __func__)); + } + + /** +@@ -115,22 +114,22 @@ mpt3sas_process_trigger_data(struct MPT3SAS_ADAPTER *ioc, + { + u8 issue_reset = 0; + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: enter\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: enter\n", __func__)); + + /* release the diag buffer trace */ + if ((ioc->diag_buffer_status[MPI2_DIAG_BUF_TYPE_TRACE] & + MPT3_DIAG_BUFFER_IS_RELEASED) == 0) { +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: release trace diag buffer\n", ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: release trace diag buffer\n", ++ __func__)); + mpt3sas_send_diag_release(ioc, MPI2_DIAG_BUF_TYPE_TRACE, + &issue_reset); + } + + _mpt3sas_raise_sigio(ioc, event_data); + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: exit\n", ioc->name, +- __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: exit\n", ++ __func__)); + } + + /** +@@ -168,9 +167,9 @@ mpt3sas_trigger_master(struct MPT3SAS_ADAPTER *ioc, u32 trigger_bitmask) + + by_pass_checks: + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter - trigger_bitmask = 0x%08x\n", +- ioc->name, __func__, trigger_bitmask)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: enter - trigger_bitmask = 0x%08x\n", ++ __func__, trigger_bitmask)); + + /* don't send trigger if an trigger is currently active */ + if (ioc->diag_trigger_active) { +@@ -182,9 +181,9 @@ mpt3sas_trigger_master(struct MPT3SAS_ADAPTER *ioc, u32 trigger_bitmask) + if (ioc->diag_trigger_master.MasterData & trigger_bitmask) { + found_match = 1; + ioc->diag_trigger_active = 1; +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: setting diag_trigger_active flag\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: setting diag_trigger_active flag\n", ++ __func__)); + } + spin_unlock_irqrestore(&ioc->diag_trigger_lock, flags); + +@@ -202,8 +201,8 @@ mpt3sas_trigger_master(struct MPT3SAS_ADAPTER *ioc, u32 trigger_bitmask) + mpt3sas_send_trigger_data_event(ioc, &event_data); + + out: +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: exit\n", ioc->name, +- __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: exit\n", ++ __func__)); + } + + /** +@@ -239,9 +238,9 @@ mpt3sas_trigger_event(struct MPT3SAS_ADAPTER *ioc, u16 event, + return; + } + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter - event = 0x%04x, log_entry_qualifier = 0x%04x\n", +- ioc->name, __func__, event, log_entry_qualifier)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: enter - event = 0x%04x, log_entry_qualifier = 0x%04x\n", ++ __func__, event, log_entry_qualifier)); + + /* don't send trigger if an trigger is currently active */ + if (ioc->diag_trigger_active) { +@@ -263,26 +262,26 @@ mpt3sas_trigger_event(struct MPT3SAS_ADAPTER *ioc, u16 event, + } + found_match = 1; + ioc->diag_trigger_active = 1; +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: setting diag_trigger_active flag\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: setting diag_trigger_active flag\n", ++ __func__)); + } + spin_unlock_irqrestore(&ioc->diag_trigger_lock, flags); + + if (!found_match) + goto out; + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: setting diag_trigger_active flag\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: setting diag_trigger_active flag\n", ++ __func__)); + memset(&event_data, 0, sizeof(struct SL_WH_TRIGGERS_EVENT_DATA_T)); + event_data.trigger_type = MPT3SAS_TRIGGER_EVENT; + event_data.u.event.EventValue = event; + event_data.u.event.LogEntryQualifier = log_entry_qualifier; + mpt3sas_send_trigger_data_event(ioc, &event_data); + out: +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: exit\n", ioc->name, +- __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: exit\n", ++ __func__)); + } + + /** +@@ -319,9 +318,9 @@ mpt3sas_trigger_scsi(struct MPT3SAS_ADAPTER *ioc, u8 sense_key, u8 asc, + return; + } + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter - sense_key = 0x%02x, asc = 0x%02x, ascq = 0x%02x\n", +- ioc->name, __func__, sense_key, asc, ascq)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: enter - sense_key = 0x%02x, asc = 0x%02x, ascq = 0x%02x\n", ++ __func__, sense_key, asc, ascq)); + + /* don't send trigger if an trigger is currently active */ + if (ioc->diag_trigger_active) { +@@ -347,9 +346,9 @@ mpt3sas_trigger_scsi(struct MPT3SAS_ADAPTER *ioc, u8 sense_key, u8 asc, + if (!found_match) + goto out; + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: setting diag_trigger_active flag\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: setting diag_trigger_active flag\n", ++ __func__)); + memset(&event_data, 0, sizeof(struct SL_WH_TRIGGERS_EVENT_DATA_T)); + event_data.trigger_type = MPT3SAS_TRIGGER_SCSI; + event_data.u.scsi.SenseKey = sense_key; +@@ -357,8 +356,8 @@ mpt3sas_trigger_scsi(struct MPT3SAS_ADAPTER *ioc, u8 sense_key, u8 asc, + event_data.u.scsi.ASCQ = ascq; + mpt3sas_send_trigger_data_event(ioc, &event_data); + out: +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: exit\n", ioc->name, +- __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: exit\n", ++ __func__)); + } + + /** +@@ -393,9 +392,9 @@ mpt3sas_trigger_mpi(struct MPT3SAS_ADAPTER *ioc, u16 ioc_status, u32 loginfo) + return; + } + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: enter - ioc_status = 0x%04x, loginfo = 0x%08x\n", +- ioc->name, __func__, ioc_status, loginfo)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: enter - ioc_status = 0x%04x, loginfo = 0x%08x\n", ++ __func__, ioc_status, loginfo)); + + /* don't send trigger if an trigger is currently active */ + if (ioc->diag_trigger_active) { +@@ -420,15 +419,15 @@ mpt3sas_trigger_mpi(struct MPT3SAS_ADAPTER *ioc, u16 ioc_status, u32 loginfo) + if (!found_match) + goto out; + +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT +- "%s: setting diag_trigger_active flag\n", +- ioc->name, __func__)); ++ dTriggerDiagPrintk(ioc, ++ ioc_info(ioc, "%s: setting diag_trigger_active flag\n", ++ __func__)); + memset(&event_data, 0, sizeof(struct SL_WH_TRIGGERS_EVENT_DATA_T)); + event_data.trigger_type = MPT3SAS_TRIGGER_MPI; + event_data.u.mpi.IOCStatus = ioc_status; + event_data.u.mpi.IocLogInfo = loginfo; + mpt3sas_send_trigger_data_event(ioc, &event_data); + out: +- dTriggerDiagPrintk(ioc, pr_info(MPT3SAS_FMT "%s: exit\n", ioc->name, +- __func__)); ++ dTriggerDiagPrintk(ioc, ioc_info(ioc, "%s: exit\n", ++ __func__)); + } +diff --git a/drivers/scsi/mpt3sas/mpt3sas_warpdrive.c b/drivers/scsi/mpt3sas/mpt3sas_warpdrive.c +index b4927f2b7677..cc07ba41f507 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_warpdrive.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_warpdrive.c +@@ -127,20 +127,17 @@ mpt3sas_init_warpdrive_properties(struct MPT3SAS_ADAPTER *ioc, + return; + + if (ioc->mfg_pg10_hide_flag == MFG_PAGE10_EXPOSE_ALL_DISKS) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "globally as drives are exposed\n", ioc->name); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled globally as drives are exposed\n"); + return; + } + if (mpt3sas_get_num_volumes(ioc) > 1) { + _warpdrive_disable_ddio(ioc); +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "globally as number of drives > 1\n", ioc->name); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled globally as number of drives > 1\n"); + return; + } + if ((mpt3sas_config_get_number_pds(ioc, raid_device->handle, + &num_pds)) || !num_pds) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "Failure in computing number of drives\n", ioc->name); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled Failure in computing number of drives\n"); + return; + } + +@@ -148,15 +145,13 @@ mpt3sas_init_warpdrive_properties(struct MPT3SAS_ADAPTER *ioc, + sizeof(Mpi2RaidVol0PhysDisk_t)); + vol_pg0 = kzalloc(sz, GFP_KERNEL); + if (!vol_pg0) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "Memory allocation failure for RVPG0\n", ioc->name); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled Memory allocation failure for RVPG0\n"); + return; + } + + if ((mpt3sas_config_get_raid_volume_pg0(ioc, &mpi_reply, vol_pg0, + MPI2_RAID_VOLUME_PGAD_FORM_HANDLE, raid_device->handle, sz))) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "Failure in retrieving RVPG0\n", ioc->name); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled Failure in retrieving RVPG0\n"); + kfree(vol_pg0); + return; + } +@@ -166,10 +161,8 @@ mpt3sas_init_warpdrive_properties(struct MPT3SAS_ADAPTER *ioc, + * assumed for WARPDRIVE, disable direct I/O + */ + if (num_pds > MPT_MAX_WARPDRIVE_PDS) { +- pr_warn(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "for the drive with handle(0x%04x): num_mem=%d, " +- "max_mem_allowed=%d\n", ioc->name, raid_device->handle, +- num_pds, MPT_MAX_WARPDRIVE_PDS); ++ ioc_warn(ioc, "WarpDrive : Direct IO is disabled for the drive with handle(0x%04x): num_mem=%d, max_mem_allowed=%d\n", ++ raid_device->handle, num_pds, MPT_MAX_WARPDRIVE_PDS); + kfree(vol_pg0); + return; + } +@@ -179,22 +172,18 @@ mpt3sas_init_warpdrive_properties(struct MPT3SAS_ADAPTER *ioc, + vol_pg0->PhysDisk[count].PhysDiskNum) || + le16_to_cpu(pd_pg0.DevHandle) == + MPT3SAS_INVALID_DEVICE_HANDLE) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is " +- "disabled for the drive with handle(0x%04x) member" +- "handle retrieval failed for member number=%d\n", +- ioc->name, raid_device->handle, +- vol_pg0->PhysDisk[count].PhysDiskNum); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled for the drive with handle(0x%04x) member handle retrieval failed for member number=%d\n", ++ raid_device->handle, ++ vol_pg0->PhysDisk[count].PhysDiskNum); + goto out_error; + } + /* Disable direct I/O if member drive lba exceeds 4 bytes */ + dev_max_lba = le64_to_cpu(pd_pg0.DeviceMaxLBA); + if (dev_max_lba >> 32) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is " +- "disabled for the drive with handle(0x%04x) member" +- " handle (0x%04x) unsupported max lba 0x%016llx\n", +- ioc->name, raid_device->handle, +- le16_to_cpu(pd_pg0.DevHandle), +- (unsigned long long)dev_max_lba); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled for the drive with handle(0x%04x) member handle (0x%04x) unsupported max lba 0x%016llx\n", ++ raid_device->handle, ++ le16_to_cpu(pd_pg0.DevHandle), ++ (u64)dev_max_lba); + goto out_error; + } + +@@ -206,41 +195,36 @@ mpt3sas_init_warpdrive_properties(struct MPT3SAS_ADAPTER *ioc, + * not RAID0 + */ + if (raid_device->volume_type != MPI2_RAID_VOL_TYPE_RAID0) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "for the drive with handle(0x%04x): type=%d, " +- "s_sz=%uK, blk_size=%u\n", ioc->name, +- raid_device->handle, raid_device->volume_type, +- (le32_to_cpu(vol_pg0->StripeSize) * +- le16_to_cpu(vol_pg0->BlockSize)) / 1024, +- le16_to_cpu(vol_pg0->BlockSize)); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled for the drive with handle(0x%04x): type=%d, s_sz=%uK, blk_size=%u\n", ++ raid_device->handle, raid_device->volume_type, ++ (le32_to_cpu(vol_pg0->StripeSize) * ++ le16_to_cpu(vol_pg0->BlockSize)) / 1024, ++ le16_to_cpu(vol_pg0->BlockSize)); + goto out_error; + } + + stripe_sz = le32_to_cpu(vol_pg0->StripeSize); + stripe_exp = find_first_bit(&stripe_sz, 32); + if (stripe_exp == 32) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "for the drive with handle(0x%04x) invalid stripe sz %uK\n", +- ioc->name, raid_device->handle, +- (le32_to_cpu(vol_pg0->StripeSize) * +- le16_to_cpu(vol_pg0->BlockSize)) / 1024); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled for the drive with handle(0x%04x) invalid stripe sz %uK\n", ++ raid_device->handle, ++ (le32_to_cpu(vol_pg0->StripeSize) * ++ le16_to_cpu(vol_pg0->BlockSize)) / 1024); + goto out_error; + } + raid_device->stripe_exponent = stripe_exp; + block_sz = le16_to_cpu(vol_pg0->BlockSize); + block_exp = find_first_bit(&block_sz, 16); + if (block_exp == 16) { +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is disabled " +- "for the drive with handle(0x%04x) invalid block sz %u\n", +- ioc->name, raid_device->handle, +- le16_to_cpu(vol_pg0->BlockSize)); ++ ioc_info(ioc, "WarpDrive : Direct IO is disabled for the drive with handle(0x%04x) invalid block sz %u\n", ++ raid_device->handle, le16_to_cpu(vol_pg0->BlockSize)); + goto out_error; + } + raid_device->block_exponent = block_exp; + raid_device->direct_io_enabled = 1; + +- pr_info(MPT3SAS_FMT "WarpDrive : Direct IO is Enabled for the drive" +- " with handle(0x%04x)\n", ioc->name, raid_device->handle); ++ ioc_info(ioc, "WarpDrive : Direct IO is Enabled for the drive with handle(0x%04x)\n", ++ raid_device->handle); + /* + * WARPDRIVE: Though the following fields are not used for direct IO, + * stored for future purpose: +-- +2.35.1 + diff --git a/queue-4.19/scsi-mpt3sas-fix-possible-resource-leaks-in-mpt3sas_.patch b/queue-4.19/scsi-mpt3sas-fix-possible-resource-leaks-in-mpt3sas_.patch new file mode 100644 index 00000000000..98b168198f8 --- /dev/null +++ b/queue-4.19/scsi-mpt3sas-fix-possible-resource-leaks-in-mpt3sas_.patch @@ -0,0 +1,67 @@ +From 77ea6ea625c2badd996968798dc5c891b1861b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 11:24:03 +0800 +Subject: scsi: mpt3sas: Fix possible resource leaks in + mpt3sas_transport_port_add() + +From: Yang Yingliang + +[ Upstream commit 78316e9dfc24906dd474630928ed1d3c562b568e ] + +In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, +sas_rphy_free() needs be called to free the resource allocated in +sas_end_device_alloc(). Otherwise a kernel crash will happen: + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 +CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189 +pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +pc : device_del+0x54/0x3d0 +lr : device_del+0x37c/0x3d0 +Call trace: + device_del+0x54/0x3d0 + attribute_container_class_device_del+0x28/0x38 + transport_remove_classdev+0x6c/0x80 + attribute_container_device_trigger+0x108/0x110 + transport_remove_device+0x28/0x38 + sas_rphy_remove+0x50/0x78 [scsi_transport_sas] + sas_port_delete+0x30/0x148 [scsi_transport_sas] + do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] + device_for_each_child+0x68/0xb0 + sas_remove_children+0x30/0x50 [scsi_transport_sas] + sas_rphy_remove+0x38/0x78 [scsi_transport_sas] + sas_port_delete+0x30/0x148 [scsi_transport_sas] + do_sas_phy_delete+0x78/0x80 [scsi_transport_sas] + device_for_each_child+0x68/0xb0 + sas_remove_children+0x30/0x50 [scsi_transport_sas] + sas_remove_host+0x20/0x38 [scsi_transport_sas] + scsih_remove+0xd8/0x420 [mpt3sas] + +Because transport_add_device() is not called when sas_rphy_add() fails, the +device is not added. When sas_rphy_remove() is subsequently called to +remove the device in the remove() path, a NULL pointer dereference happens. + +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20221109032403.1636422-1-yangyingliang@huawei.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index 9fd89e85227a..f2b072831747 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -730,6 +730,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, + if ((sas_rphy_add(rphy))) { + ioc_err(ioc, "failure at %s:%d/%s()!\n", + __FILE__, __LINE__, __func__); ++ sas_rphy_free(rphy); ++ rphy = NULL; + } + + if (mpt3sas_port->remote_identify.device_type == SAS_END_DEVICE) { +-- +2.35.1 + diff --git a/queue-4.19/scsi-scsi_debug-fix-a-warning-in-resp_write_scat.patch b/queue-4.19/scsi-scsi_debug-fix-a-warning-in-resp_write_scat.patch new file mode 100644 index 00000000000..13e1d69347d --- /dev/null +++ b/queue-4.19/scsi-scsi_debug-fix-a-warning-in-resp_write_scat.patch @@ -0,0 +1,66 @@ +From bb5a3193f4adf552587010e2122f22ff2b0cd758 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 02:05:25 -0800 +Subject: scsi: scsi_debug: Fix a warning in resp_write_scat() + +From: Harshit Mogalapalli + +[ Upstream commit 216e179724c1d9f57a8ababf8bd7aaabef67f01b ] + +As 'lbdof_blen' is coming from user, if the size in kzalloc() is >= +MAX_ORDER then we hit a warning. + +Call trace: + +sg_ioctl + sg_ioctl_common + scsi_ioctl + sg_scsi_ioctl + blk_execute_rq + blk_mq_sched_insert_request + blk_mq_run_hw_queue + __blk_mq_delay_run_hw_queue + __blk_mq_run_hw_queue + blk_mq_sched_dispatch_requests + __blk_mq_sched_dispatch_requests + blk_mq_dispatch_rq_list + scsi_queue_rq + scsi_dispatch_cmd + scsi_debug_queuecommand + schedule_resp + resp_write_scat + +If you try to allocate a memory larger than(>=) MAX_ORDER, then kmalloc() +will definitely fail. It creates a stack trace and messes up dmesg. The +user controls the size here so if they specify a too large size it will +fail. + +Add __GFP_NOWARN in order to avoid too large allocation warning. This is +detected by static analysis using smatch. + +Fixes: 481b5e5c7949 ("scsi: scsi_debug: add resp_write_scat function") +Signed-off-by: Harshit Mogalapalli +Link: https://lore.kernel.org/r/20221111100526.1790533-1-harshit.m.mogalapalli@oracle.com +Acked-by: Douglas Gilbert +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index 4d73a7f67dea..0733ecc9f878 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -3156,7 +3156,7 @@ static int resp_write_scat(struct scsi_cmnd *scp, + mk_sense_buffer(scp, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB, 0); + return illegal_condition_result; + } +- lrdp = kzalloc(lbdof_blen, GFP_ATOMIC); ++ lrdp = kzalloc(lbdof_blen, GFP_ATOMIC | __GFP_NOWARN); + if (lrdp == NULL) + return SCSI_MLQUEUE_HOST_BUSY; + if (sdebug_verbose) +-- +2.35.1 + diff --git a/queue-4.19/scsi-snic-fix-possible-uaf-in-snic_tgt_create.patch b/queue-4.19/scsi-snic-fix-possible-uaf-in-snic_tgt_create.patch new file mode 100644 index 00000000000..b1eb59d3484 --- /dev/null +++ b/queue-4.19/scsi-snic-fix-possible-uaf-in-snic_tgt_create.patch @@ -0,0 +1,47 @@ +From 654f1da4d4f01d20bad21788caa310f52c3494ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 11:51:00 +0800 +Subject: scsi: snic: Fix possible UAF in snic_tgt_create() + +From: Gaosheng Cui + +[ Upstream commit e118df492320176af94deec000ae034cc92be754 ] + +Smatch reports a warning as follows: + +drivers/scsi/snic/snic_disc.c:307 snic_tgt_create() warn: + '&tgt->list' not removed from list + +If device_add() fails in snic_tgt_create(), tgt will be freed, but +tgt->list will not be removed from snic->disc.tgt_list, then list traversal +may cause UAF. + +Remove from snic->disc.tgt_list before free(). + +Fixes: c8806b6c9e82 ("snic: driver for Cisco SCSI HBA") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221117035100.2944812-1-cuigaosheng1@huawei.com +Acked-by: Narsimhulu Musini +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/snic/snic_disc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/snic/snic_disc.c b/drivers/scsi/snic/snic_disc.c +index b106596cc0cf..69c5e26a9d5b 100644 +--- a/drivers/scsi/snic/snic_disc.c ++++ b/drivers/scsi/snic/snic_disc.c +@@ -317,6 +317,9 @@ snic_tgt_create(struct snic *snic, struct snic_tgt_id *tgtid) + ret); + + put_device(&snic->shost->shost_gendev); ++ spin_lock_irqsave(snic->shost->host_lock, flags); ++ list_del(&tgt->list); ++ spin_unlock_irqrestore(snic->shost->host_lock, flags); + kfree(tgt); + tgt = NULL; + +-- +2.35.1 + diff --git a/queue-4.19/selftests-ftrace-event_triggers-wait-longer-for-test.patch b/queue-4.19/selftests-ftrace-event_triggers-wait-longer-for-test.patch new file mode 100644 index 00000000000..4fa5bb4702d --- /dev/null +++ b/queue-4.19/selftests-ftrace-event_triggers-wait-longer-for-test.patch @@ -0,0 +1,57 @@ +From b8d9f1c819f6397037216b0acb393647df0eef45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 10:09:31 +0800 +Subject: selftests/ftrace: event_triggers: wait longer for test_event_enable + +From: Yipeng Zou + +[ Upstream commit a1d6cd88c8973cfb08ee85722488b1d6d5d16327 ] + +In some platform, the schedule event may came slowly, delay 100ms can't +cover it. + +I was notice that on my board which running in low cpu_freq,and this +selftests allways gose fail. + +So maybe we can check more times here to wait longer. + +Fixes: 43bb45da82f9 ("selftests: ftrace: Add a selftest to test event enable/disable func trigger") +Signed-off-by: Yipeng Zou +Acked-by: Masami Hiramatsu (Google) +Acked-by: Steven Rostedt (Google) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../ftrace/test.d/ftrace/func_event_triggers.tc | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +index 6fed4cf2db81..79d614f1fe8e 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc +@@ -45,11 +45,18 @@ cnt_trace() { + + test_event_enabled() { + val=$1 ++ check_times=10 # wait for 10 * SLEEP_TIME at most + +- e=`cat $EVENT_ENABLE` +- if [ "$e" != $val ]; then +- fail "Expected $val but found $e" +- fi ++ while [ $check_times -ne 0 ]; do ++ e=`cat $EVENT_ENABLE` ++ if [ "$e" == $val ]; then ++ return 0 ++ fi ++ sleep $SLEEP_TIME ++ check_times=$((check_times - 1)) ++ done ++ ++ fail "Expected $val but found $e" + } + + run_enable_disable() { +-- +2.35.1 + diff --git a/queue-4.19/selftests-powerpc-fix-resource-leaks.patch b/queue-4.19/selftests-powerpc-fix-resource-leaks.patch new file mode 100644 index 00000000000..a879645cb49 --- /dev/null +++ b/queue-4.19/selftests-powerpc-fix-resource-leaks.patch @@ -0,0 +1,51 @@ +From e459240cbf2762acc35dbac912091221460732a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 12:44:27 +0400 +Subject: selftests/powerpc: Fix resource leaks + +From: Miaoqian Lin + +[ Upstream commit 8f4ab7da904ab7027ccd43ddb4f0094e932a5877 ] + +In check_all_cpu_dscr_defaults, opendir() opens the directory stream. +Add missing closedir() in the error path to release it. + +In check_cpu_dscr_default, open() creates an open file descriptor. +Add missing close() in the error path to release it. + +Fixes: ebd5858c904b ("selftests/powerpc: Add test for all DSCR sysfs interfaces") +Signed-off-by: Miaoqian Lin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20221205084429.570654-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c b/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c +index 1899bd85121f..3f6d5be5bd14 100644 +--- a/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c ++++ b/tools/testing/selftests/powerpc/dscr/dscr_sysfs_test.c +@@ -27,6 +27,7 @@ static int check_cpu_dscr_default(char *file, unsigned long val) + rc = read(fd, buf, sizeof(buf)); + if (rc == -1) { + perror("read() failed"); ++ close(fd); + return 1; + } + close(fd); +@@ -68,8 +69,10 @@ static int check_all_cpu_dscr_defaults(unsigned long val) + if (access(file, F_OK)) + continue; + +- if (check_cpu_dscr_default(file, val)) ++ if (check_cpu_dscr_default(file, val)) { ++ closedir(sysfs); + return 1; ++ } + } + closedir(sysfs); + return 0; +-- +2.35.1 + diff --git a/queue-4.19/serial-altera_uart-fix-locking-in-polling-mode.patch b/queue-4.19/serial-altera_uart-fix-locking-in-polling-mode.patch new file mode 100644 index 00000000000..f371f3befec --- /dev/null +++ b/queue-4.19/serial-altera_uart-fix-locking-in-polling-mode.patch @@ -0,0 +1,51 @@ +From 01c2a3a83fbc608f9159406cb7505287a6a7942d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 15:04:26 -0500 +Subject: serial: altera_uart: fix locking in polling mode + +From: Gabriel Somlo + +[ Upstream commit 1307c5d33cce8a41dd77c2571e4df65a5b627feb ] + +Since altera_uart_interrupt() may also be called from +a poll timer in "serving_softirq" context, use +spin_[lock_irqsave|unlock_irqrestore] variants, which +are appropriate for both softirq and hardware interrupt +contexts. + +Fixes: 2f8b9c15cd88 ("altera_uart: Add support for polling mode (IRQ-less)") +Signed-off-by: Gabriel Somlo +Link: https://lore.kernel.org/r/20221122200426.888349-1-gsomlo@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/altera_uart.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c +index 20c610440133..d91f76b1d353 100644 +--- a/drivers/tty/serial/altera_uart.c ++++ b/drivers/tty/serial/altera_uart.c +@@ -280,16 +280,17 @@ static irqreturn_t altera_uart_interrupt(int irq, void *data) + { + struct uart_port *port = data; + struct altera_uart *pp = container_of(port, struct altera_uart, port); ++ unsigned long flags; + unsigned int isr; + + isr = altera_uart_readl(port, ALTERA_UART_STATUS_REG) & pp->imr; + +- spin_lock(&port->lock); ++ spin_lock_irqsave(&port->lock, flags); + if (isr & ALTERA_UART_STATUS_RRDY_MSK) + altera_uart_rx_chars(port); + if (isr & ALTERA_UART_STATUS_TRDY_MSK) + altera_uart_tx_chars(port); +- spin_unlock(&port->lock); ++ spin_unlock_irqrestore(&port->lock, flags); + + return IRQ_RETVAL(isr); + } +-- +2.35.1 + diff --git a/queue-4.19/serial-amba-pl011-avoid-sbsa-uart-accessing-dmacr-re.patch b/queue-4.19/serial-amba-pl011-avoid-sbsa-uart-accessing-dmacr-re.patch new file mode 100644 index 00000000000..3bbe691e8b4 --- /dev/null +++ b/queue-4.19/serial-amba-pl011-avoid-sbsa-uart-accessing-dmacr-re.patch @@ -0,0 +1,93 @@ +From 44c3a3f54e0d8f7b6075cd71199cdb635ed2b90e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 18:32:37 +0800 +Subject: serial: amba-pl011: avoid SBSA UART accessing DMACR register + +From: Jiamei Xie + +[ Upstream commit 94cdb9f33698478b0e7062586633c42c6158a786 ] + +Chapter "B Generic UART" in "ARM Server Base System Architecture" [1] +documentation describes a generic UART interface. Such generic UART +does not support DMA. In current code, sbsa_uart_pops and +amba_pl011_pops share the same stop_rx operation, which will invoke +pl011_dma_rx_stop, leading to an access of the DMACR register. This +commit adds a using_rx_dma check in pl011_dma_rx_stop to avoid the +access to DMACR register for SBSA UARTs which does not support DMA. + +When the kernel enables DMA engine with "CONFIG_DMA_ENGINE=y", Linux +SBSA PL011 driver will access PL011 DMACR register in some functions. +For most real SBSA Pl011 hardware implementations, the DMACR write +behaviour will be ignored. So these DMACR operations will not cause +obvious problems. But for some virtual SBSA PL011 hardware, like Xen +virtual SBSA PL011 (vpl011) device, the behaviour might be different. +Xen vpl011 emulation will inject a data abort to guest, when guest is +accessing an unimplemented UART register. As Xen VPL011 is SBSA +compatible, it will not implement DMACR register. So when Linux SBSA +PL011 driver access DMACR register, it will get an unhandled data abort +fault and the application will get a segmentation fault: +Unhandled fault at 0xffffffc00944d048 +Mem abort info: + ESR = 0x96000000 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x00: ttbr address size fault +Data abort info: + ISV = 0, ISS = 0x00000000 + CM = 0, WnR = 0 +swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000020e2e000 +[ffffffc00944d048] pgd=100000003ffff803, p4d=100000003ffff803, pud=100000003ffff803, pmd=100000003fffa803, pte=006800009c090f13 +Internal error: ttbr address size fault: 96000000 [#1] PREEMPT SMP +... +Call trace: + pl011_stop_rx+0x70/0x80 + tty_port_shutdown+0x7c/0xb4 + tty_port_close+0x60/0xcc + uart_close+0x34/0x8c + tty_release+0x144/0x4c0 + __fput+0x78/0x220 + ____fput+0x1c/0x30 + task_work_run+0x88/0xc0 + do_notify_resume+0x8d0/0x123c + el0_svc+0xa8/0xc0 + el0t_64_sync_handler+0xa4/0x130 + el0t_64_sync+0x1a0/0x1a4 +Code: b9000083 b901f001 794038a0 8b000042 (b9000041) +---[ end trace 83dd93df15c3216f ]--- +note: bootlogd[132] exited with preempt_count 1 +/etc/rcS.d/S07bootlogd: line 47: 132 Segmentation fault start-stop-daemon + +This has been discussed in the Xen community, and we think it should fix +this in Linux. See [2] for more information. + +[1] https://developer.arm.com/documentation/den0094/c/?lang=en +[2] https://lists.xenproject.org/archives/html/xen-devel/2022-11/msg00543.html + +Fixes: 0dd1e247fd39 (drivers: PL011: add support for the ARM SBSA generic UART) +Signed-off-by: Jiamei Xie +Reviewed-by: Andre Przywara +Link: https://lore.kernel.org/r/20221117103237.86856-1-jiamei.xie@arm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/amba-pl011.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 7de4bed1ddba..87d9bfafc82e 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -1053,6 +1053,9 @@ static void pl011_dma_rx_callback(void *data) + */ + static inline void pl011_dma_rx_stop(struct uart_amba_port *uap) + { ++ if (!uap->using_rx_dma) ++ return; ++ + /* FIXME. Just disable the DMA enable */ + uap->dmacr &= ~UART011_RXDMAE; + pl011_write(uap->dmacr, uap, REG_DMACR); +-- +2.35.1 + diff --git a/queue-4.19/serial-pch-fix-pci-device-refcount-leak-in-pch_reque.patch b/queue-4.19/serial-pch-fix-pci-device-refcount-leak-in-pch_reque.patch new file mode 100644 index 00000000000..865a85cecd4 --- /dev/null +++ b/queue-4.19/serial-pch-fix-pci-device-refcount-leak-in-pch_reque.patch @@ -0,0 +1,58 @@ +From 1e21d3061d7385e637b41faff619af3b23416ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 19:45:59 +0800 +Subject: serial: pch: Fix PCI device refcount leak in pch_request_dma() + +From: Xiongfeng Wang + +[ Upstream commit 8be3a7bf773700534a6e8f87f6ed2ed111254be5 ] + +As comment of pci_get_slot() says, it returns a pci_device with its +refcount increased. The caller must decrement the reference count by +calling pci_dev_put(). + +Since 'dma_dev' is only used to filter the channel in filter(), we can +call pci_dev_put() before exiting from pch_request_dma(). Add the +missing pci_dev_put() for the normal and error path. + +Fixes: 3c6a483275f4 ("Serial: EG20T: add PCH_UART driver") +Signed-off-by: Xiongfeng Wang +Link: https://lore.kernel.org/r/20221122114559.27692-1-wangxiongfeng2@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/pch_uart.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c +index e5ff30544bd0..447990006d68 100644 +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -734,6 +734,7 @@ static void pch_request_dma(struct uart_port *port) + if (!chan) { + dev_err(priv->port.dev, "%s:dma_request_channel FAILS(Tx)\n", + __func__); ++ pci_dev_put(dma_dev); + return; + } + priv->chan_tx = chan; +@@ -750,6 +751,7 @@ static void pch_request_dma(struct uart_port *port) + __func__); + dma_release_channel(priv->chan_tx); + priv->chan_tx = NULL; ++ pci_dev_put(dma_dev); + return; + } + +@@ -757,6 +759,8 @@ static void pch_request_dma(struct uart_port *port) + priv->rx_buf_virt = dma_alloc_coherent(port->dev, port->fifosize, + &priv->rx_buf_dma, GFP_KERNEL); + priv->chan_rx = chan; ++ ++ pci_dev_put(dma_dev); + } + + static void pch_dma_rx_complete(void *arg) +-- +2.35.1 + diff --git a/queue-4.19/serial-pl011-do-not-clear-rx-fifo-rx-interrupt-in-un.patch b/queue-4.19/serial-pl011-do-not-clear-rx-fifo-rx-interrupt-in-un.patch new file mode 100644 index 00000000000..88c86a76b77 --- /dev/null +++ b/queue-4.19/serial-pl011-do-not-clear-rx-fifo-rx-interrupt-in-un.patch @@ -0,0 +1,52 @@ +From 85385995b39440d74d8cc381a3e62ec5160a6282 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 10:01:08 +0800 +Subject: serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: delisun + +[ Upstream commit 032d5a71ed378ffc6a2d41a187d8488a4f9fe415 ] + +Clearing the RX FIFO will cause data loss. +Copy the pl011_enabl_interrupts implementation, and remove the clear +interrupt and FIFO part of the code. + +Fixes: 211565b10099 ("serial: pl011: UPSTAT_AUTORTS requires .throttle/unthrottle") +Signed-off-by: delisun +Reviewed-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20221110020108.7700-1-delisun@pateo.com.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/amba-pl011.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 87d9bfafc82e..d1f4882d9f40 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -1771,8 +1771,17 @@ static void pl011_enable_interrupts(struct uart_amba_port *uap) + static void pl011_unthrottle_rx(struct uart_port *port) + { + struct uart_amba_port *uap = container_of(port, struct uart_amba_port, port); ++ unsigned long flags; + +- pl011_enable_interrupts(uap); ++ spin_lock_irqsave(&uap->port.lock, flags); ++ ++ uap->im = UART011_RTIM; ++ if (!pl011_dma_rx_running(uap)) ++ uap->im |= UART011_RXIM; ++ ++ pl011_write(uap->im, uap, REG_IMSC); ++ ++ spin_unlock_irqrestore(&uap->port.lock, flags); + } + + static int pl011_startup(struct uart_port *port) +-- +2.35.1 + diff --git a/queue-4.19/serial-sunsab-fix-error-handling-in-sunsab_init.patch b/queue-4.19/serial-sunsab-fix-error-handling-in-sunsab_init.patch new file mode 100644 index 00000000000..29fbd5befca --- /dev/null +++ b/queue-4.19/serial-sunsab-fix-error-handling-in-sunsab_init.patch @@ -0,0 +1,46 @@ +From b514d56c064141aaf4b433c22175fcee2bb7c2ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 06:12:12 +0000 +Subject: serial: sunsab: Fix error handling in sunsab_init() + +From: Yuan Can + +[ Upstream commit 1a6ec673fb627c26e2267ca0a03849f91dbd9b40 ] + +The sunsab_init() returns the platform_driver_register() directly without +checking its return value, if platform_driver_register() failed, the +allocated sunsab_ports is leaked. +Fix by free sunsab_ports and set it to NULL when platform_driver_register() +failed. + +Fixes: c4d37215a824 ("[SERIAL] sunsab: Convert to of_driver framework.") +Signed-off-by: Yuan Can +Link: https://lore.kernel.org/r/20221123061212.52593-1-yuancan@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sunsab.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c +index 72131b5e132e..beca02c30498 100644 +--- a/drivers/tty/serial/sunsab.c ++++ b/drivers/tty/serial/sunsab.c +@@ -1140,7 +1140,13 @@ static int __init sunsab_init(void) + } + } + +- return platform_driver_register(&sab_driver); ++ err = platform_driver_register(&sab_driver); ++ if (err) { ++ kfree(sunsab_ports); ++ sunsab_ports = NULL; ++ } ++ ++ return err; + } + + static void __exit sunsab_exit(void) +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-add-pio-mode-support.patch b/queue-4.19/serial-tegra-add-pio-mode-support.patch new file mode 100644 index 00000000000..9f40c3d2860 --- /dev/null +++ b/queue-4.19/serial-tegra-add-pio-mode-support.patch @@ -0,0 +1,267 @@ +From 0e2e12675de39e8628e97cb82afa86d74a44092f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 10:13:07 +0530 +Subject: serial: tegra: Add PIO mode support + +From: Krishna Yarlagadda + +[ Upstream commit 1dce2df3ee06e4f10fd9b8919a0f2e90e0ac3188 ] + +Add PIO mode support in receive and transmit path with RX interrupt +trigger of 16 bytes for Tegra194 and older chips. + +Signed-off-by: Shardar Shariff Md +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/1567572187-29820-13-git-send-email-kyarlagadda@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 117 ++++++++++++++++++++++-------- + 1 file changed, 86 insertions(+), 31 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index e11d19742cf6..d6f5d73ba1e8 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -139,6 +139,8 @@ struct tegra_uart_port { + int n_adjustable_baud_rates; + int required_rate; + int configured_rate; ++ bool use_rx_pio; ++ bool use_tx_pio; + }; + + static void tegra_uart_start_next_tx(struct tegra_uart_port *tup); +@@ -524,7 +526,7 @@ static void tegra_uart_start_next_tx(struct tegra_uart_port *tup) + if (!count) + return; + +- if (count < TEGRA_UART_MIN_DMA) ++ if (tup->use_tx_pio || count < TEGRA_UART_MIN_DMA) + tegra_uart_start_pio_tx(tup, count); + else if (BYTES_TO_ALIGN(tail) > 0) + tegra_uart_start_pio_tx(tup, BYTES_TO_ALIGN(tail)); +@@ -746,6 +748,18 @@ static void tegra_uart_handle_modem_signal_change(struct uart_port *u) + uart_handle_cts_change(&tup->uport, msr & UART_MSR_CTS); + } + ++static void do_handle_rx_pio(struct tegra_uart_port *tup) ++{ ++ struct tty_struct *tty = tty_port_tty_get(&tup->uport.state->port); ++ struct tty_port *port = &tup->uport.state->port; ++ ++ tegra_uart_handle_rx_pio(tup, port); ++ if (tty) { ++ tty_flip_buffer_push(port); ++ tty_kref_put(tty); ++ } ++} ++ + static irqreturn_t tegra_uart_isr(int irq, void *data) + { + struct tegra_uart_port *tup = data; +@@ -759,7 +773,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data) + while (1) { + iir = tegra_uart_read(tup, UART_IIR); + if (iir & UART_IIR_NO_INT) { +- if (is_rx_int) { ++ if (!tup->use_rx_pio && is_rx_int) { + tegra_uart_handle_rx_dma(tup); + if (tup->rx_in_progress) { + ier = tup->ier_shadow; +@@ -787,7 +801,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data) + case 4: /* End of data */ + case 6: /* Rx timeout */ + case 2: /* Receive */ +- if (!is_rx_int) { ++ if (!tup->use_rx_pio && !is_rx_int) { + is_rx_int = true; + /* Disable Rx interrupts */ + ier = tup->ier_shadow; +@@ -797,6 +811,8 @@ static irqreturn_t tegra_uart_isr(int irq, void *data) + UART_IER_RTOIE | TEGRA_UART_IER_EORD); + tup->ier_shadow = ier; + tegra_uart_write(tup, ier, UART_IER); ++ } else { ++ do_handle_rx_pio(tup); + } + break; + +@@ -815,6 +831,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data) + static void tegra_uart_stop_rx(struct uart_port *u) + { + struct tegra_uart_port *tup = to_tegra_uport(u); ++ struct tty_port *port = &tup->uport.state->port; + struct dma_tx_state state; + unsigned long ier; + +@@ -832,9 +849,13 @@ static void tegra_uart_stop_rx(struct uart_port *u) + tup->ier_shadow = ier; + tegra_uart_write(tup, ier, UART_IER); + tup->rx_in_progress = 0; +- dmaengine_terminate_all(tup->rx_dma_chan); +- dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state); +- tegra_uart_rx_buffer_push(tup, state.residue); ++ if (tup->rx_dma_chan && !tup->use_rx_pio) { ++ dmaengine_terminate_all(tup->rx_dma_chan); ++ dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state); ++ tegra_uart_rx_buffer_push(tup, state.residue); ++ } else { ++ tegra_uart_handle_rx_pio(tup, port); ++ } + } + + static void tegra_uart_hw_deinit(struct tegra_uart_port *tup) +@@ -885,8 +906,10 @@ static void tegra_uart_hw_deinit(struct tegra_uart_port *tup) + tup->rx_in_progress = 0; + tup->tx_in_progress = 0; + +- tegra_uart_dma_channel_free(tup, true); +- tegra_uart_dma_channel_free(tup, false); ++ if (!tup->use_rx_pio) ++ tegra_uart_dma_channel_free(tup, true); ++ if (!tup->use_tx_pio) ++ tegra_uart_dma_channel_free(tup, false); + + clk_disable_unprepare(tup->uart_clk); + } +@@ -931,10 +954,14 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + */ + tup->fcr_shadow = UART_FCR_ENABLE_FIFO; + +- if (tup->cdata->max_dma_burst_bytes == 8) +- tup->fcr_shadow |= UART_FCR_R_TRIG_10; +- else +- tup->fcr_shadow |= UART_FCR_R_TRIG_01; ++ if (tup->use_rx_pio) { ++ tup->fcr_shadow |= UART_FCR_R_TRIG_11; ++ } else { ++ if (tup->cdata->max_dma_burst_bytes == 8) ++ tup->fcr_shadow |= UART_FCR_R_TRIG_10; ++ else ++ tup->fcr_shadow |= UART_FCR_R_TRIG_01; ++ } + + tup->fcr_shadow |= TEGRA_UART_TX_TRIG_16B; + tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); +@@ -962,19 +989,23 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + * (115200, N, 8, 1) so that the receive DMA buffer may be + * enqueued + */ +- tup->lcr_shadow = TEGRA_UART_DEFAULT_LSR; + ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD); + if (ret < 0) { + dev_err(tup->uport.dev, "Failed to set baud rate\n"); + return ret; + } +- tup->fcr_shadow |= UART_FCR_DMA_SELECT; +- tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); ++ if (!tup->use_rx_pio) { ++ tup->lcr_shadow = TEGRA_UART_DEFAULT_LSR; ++ tup->fcr_shadow |= UART_FCR_DMA_SELECT; ++ tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); + +- ret = tegra_uart_start_rx_dma(tup); +- if (ret < 0) { +- dev_err(tup->uport.dev, "Not able to start Rx DMA\n"); +- return ret; ++ ret = tegra_uart_start_rx_dma(tup); ++ if (ret < 0) { ++ dev_err(tup->uport.dev, "Not able to start Rx DMA\n"); ++ return ret; ++ } ++ } else { ++ tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); + } + tup->rx_in_progress = 1; + +@@ -996,7 +1027,12 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + * both the EORD as well as RX_TIMEOUT - SW sees RX_TIMEOUT first + * then the EORD. + */ +- tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | TEGRA_UART_IER_EORD; ++ if (!tup->use_rx_pio) ++ tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | ++ TEGRA_UART_IER_EORD; ++ else ++ tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | UART_IER_RDI; ++ + tegra_uart_write(tup, tup->ier_shadow, UART_IER); + return 0; + } +@@ -1091,16 +1127,22 @@ static int tegra_uart_startup(struct uart_port *u) + struct tegra_uart_port *tup = to_tegra_uport(u); + int ret; + +- ret = tegra_uart_dma_channel_allocate(tup, false); +- if (ret < 0) { +- dev_err(u->dev, "Tx Dma allocation failed, err = %d\n", ret); +- return ret; ++ if (!tup->use_tx_pio) { ++ ret = tegra_uart_dma_channel_allocate(tup, false); ++ if (ret < 0) { ++ dev_err(u->dev, "Tx Dma allocation failed, err = %d\n", ++ ret); ++ return ret; ++ } + } + +- ret = tegra_uart_dma_channel_allocate(tup, true); +- if (ret < 0) { +- dev_err(u->dev, "Rx Dma allocation failed, err = %d\n", ret); +- goto fail_rx_dma; ++ if (!tup->use_rx_pio) { ++ ret = tegra_uart_dma_channel_allocate(tup, true); ++ if (ret < 0) { ++ dev_err(u->dev, "Rx Dma allocation failed, err = %d\n", ++ ret); ++ goto fail_rx_dma; ++ } + } + + ret = tegra_uart_hw_init(tup); +@@ -1118,9 +1160,11 @@ static int tegra_uart_startup(struct uart_port *u) + return 0; + + fail_hw_init: +- tegra_uart_dma_channel_free(tup, true); ++ if (!tup->use_rx_pio) ++ tegra_uart_dma_channel_free(tup, true); + fail_rx_dma: +- tegra_uart_dma_channel_free(tup, false); ++ if (!tup->use_tx_pio) ++ tegra_uart_dma_channel_free(tup, false); + return ret; + } + +@@ -1317,7 +1361,6 @@ static int tegra_uart_parse_dt(struct platform_device *pdev, + int count; + int n_entries; + +- + port = of_alias_get_id(np, "serial"); + if (port < 0) { + dev_err(&pdev->dev, "failed to get alias id, errno %d\n", port); +@@ -1327,6 +1370,18 @@ static int tegra_uart_parse_dt(struct platform_device *pdev, + + tup->enable_modem_interrupt = of_property_read_bool(np, + "nvidia,enable-modem-interrupt"); ++ ++ index = of_property_match_string(np, "dma-names", "rx"); ++ if (index < 0) { ++ tup->use_rx_pio = true; ++ dev_info(&pdev->dev, "RX in PIO mode\n"); ++ } ++ index = of_property_match_string(np, "dma-names", "tx"); ++ if (index < 0) { ++ tup->use_tx_pio = true; ++ dev_info(&pdev->dev, "TX in PIO mode\n"); ++ } ++ + n_entries = of_property_count_u32_elems(np, "nvidia,adjust-baud-rates"); + if (n_entries > 0) { + tup->n_adjustable_baud_rates = n_entries / 3; +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-add-support-to-adjust-baud-rate.patch b/queue-4.19/serial-tegra-add-support-to-adjust-baud-rate.patch new file mode 100644 index 00000000000..909ab8d30ba --- /dev/null +++ b/queue-4.19/serial-tegra-add-support-to-adjust-baud-rate.patch @@ -0,0 +1,145 @@ +From 6dca047713e7bb3531933b74993743bf512a202d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 10:13:05 +0530 +Subject: serial: tegra: add support to adjust baud rate + +From: Krishna Yarlagadda + +[ Upstream commit f04a3cc8d4550463e0c15be59d91177a5def1ca5 ] + +Add support to adjust baud rates to fall under supported tolerance +range through DT. + +Tegra186 chip has a hardware issue resulting in frame errors when +tolerance level for baud rate is negative. Provided entries to adjust +baud rate to be within acceptable range and work with devices that +can send negative baud rate. Also report error when baud rate set is +out of tolerance range of controller updated in device tree. + +Signed-off-by: Shardar Shariff Md +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/1567572187-29820-11-git-send-email-kyarlagadda@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 68 +++++++++++++++++++++++++++++++ + 1 file changed, 68 insertions(+) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 6a3c6bf5b964..aae4c167f529 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -91,6 +91,12 @@ struct tegra_uart_chip_data { + int max_dma_burst_bytes; + }; + ++struct tegra_baud_tolerance { ++ u32 lower_range_baud; ++ u32 upper_range_baud; ++ s32 tolerance; ++}; ++ + struct tegra_uart_port { + struct uart_port uport; + const struct tegra_uart_chip_data *cdata; +@@ -127,6 +133,8 @@ struct tegra_uart_port { + dma_cookie_t rx_cookie; + unsigned int tx_bytes_requested; + unsigned int rx_bytes_requested; ++ struct tegra_baud_tolerance *baud_tolerance; ++ int n_adjustable_baud_rates; + }; + + static void tegra_uart_start_next_tx(struct tegra_uart_port *tup); +@@ -295,6 +303,21 @@ static void tegra_uart_fifo_reset(struct tegra_uart_port *tup, u8 fcr_bits) + tegra_uart_wait_cycle_time(tup, 32); + } + ++static long tegra_get_tolerance_rate(struct tegra_uart_port *tup, ++ unsigned int baud, long rate) ++{ ++ int i; ++ ++ for (i = 0; i < tup->n_adjustable_baud_rates; ++i) { ++ if (baud >= tup->baud_tolerance[i].lower_range_baud && ++ baud <= tup->baud_tolerance[i].upper_range_baud) ++ return (rate + (rate * ++ tup->baud_tolerance[i].tolerance) / 10000); ++ } ++ ++ return rate; ++} ++ + static int tegra_set_baudrate(struct tegra_uart_port *tup, unsigned int baud) + { + unsigned long rate; +@@ -307,6 +330,9 @@ static int tegra_set_baudrate(struct tegra_uart_port *tup, unsigned int baud) + + if (tup->cdata->support_clk_src_div) { + rate = baud * 16; ++ if (tup->n_adjustable_baud_rates) ++ rate = tegra_get_tolerance_rate(tup, baud, rate); ++ + ret = clk_set_rate(tup->uart_clk, rate); + if (ret < 0) { + dev_err(tup->uport.dev, +@@ -1250,6 +1276,12 @@ static int tegra_uart_parse_dt(struct platform_device *pdev, + { + struct device_node *np = pdev->dev.of_node; + int port; ++ int ret; ++ int index; ++ u32 pval; ++ int count; ++ int n_entries; ++ + + port = of_alias_get_id(np, "serial"); + if (port < 0) { +@@ -1260,6 +1292,42 @@ static int tegra_uart_parse_dt(struct platform_device *pdev, + + tup->enable_modem_interrupt = of_property_read_bool(np, + "nvidia,enable-modem-interrupt"); ++ n_entries = of_property_count_u32_elems(np, "nvidia,adjust-baud-rates"); ++ if (n_entries > 0) { ++ tup->n_adjustable_baud_rates = n_entries / 3; ++ tup->baud_tolerance = ++ devm_kzalloc(&pdev->dev, (tup->n_adjustable_baud_rates) * ++ sizeof(*tup->baud_tolerance), GFP_KERNEL); ++ if (!tup->baud_tolerance) ++ return -ENOMEM; ++ for (count = 0, index = 0; count < n_entries; count += 3, ++ index++) { ++ ret = ++ of_property_read_u32_index(np, ++ "nvidia,adjust-baud-rates", ++ count, &pval); ++ if (!ret) ++ tup->baud_tolerance[index].lower_range_baud = ++ pval; ++ ret = ++ of_property_read_u32_index(np, ++ "nvidia,adjust-baud-rates", ++ count + 1, &pval); ++ if (!ret) ++ tup->baud_tolerance[index].upper_range_baud = ++ pval; ++ ret = ++ of_property_read_u32_index(np, ++ "nvidia,adjust-baud-rates", ++ count + 2, &pval); ++ if (!ret) ++ tup->baud_tolerance[index].tolerance = ++ (s32)pval; ++ } ++ } else { ++ tup->n_adjustable_baud_rates = 0; ++ } ++ + return 0; + } + +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-add-support-to-use-8-bytes-trigger.patch b/queue-4.19/serial-tegra-add-support-to-use-8-bytes-trigger.patch new file mode 100644 index 00000000000..0b92953ca83 --- /dev/null +++ b/queue-4.19/serial-tegra-add-support-to-use-8-bytes-trigger.patch @@ -0,0 +1,83 @@ +From 24b11de6a786dea04b00fa67f43fab73dd0a02d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 10:13:03 +0530 +Subject: serial: tegra: add support to use 8 bytes trigger + +From: Krishna Yarlagadda + +[ Upstream commit 7799a3aa81279637031abad19e56e4bbf1481d4e ] + +Add support to use 8 bytes trigger for Tegra186 SOC. + +Signed-off-by: Shardar Shariff Md +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/1567572187-29820-9-git-send-email-kyarlagadda@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 55415a12d3cc..6a3c6bf5b964 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -88,6 +88,7 @@ struct tegra_uart_chip_data { + bool support_clk_src_div; + bool fifo_mode_enable_status; + int uart_max_port; ++ int max_dma_burst_bytes; + }; + + struct tegra_uart_port { +@@ -877,7 +878,12 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + * programmed in the DMA registers. + */ + tup->fcr_shadow = UART_FCR_ENABLE_FIFO; +- tup->fcr_shadow |= UART_FCR_R_TRIG_01; ++ ++ if (tup->cdata->max_dma_burst_bytes == 8) ++ tup->fcr_shadow |= UART_FCR_R_TRIG_10; ++ else ++ tup->fcr_shadow |= UART_FCR_R_TRIG_01; ++ + tup->fcr_shadow |= TEGRA_UART_TX_TRIG_16B; + tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); + +@@ -991,7 +997,7 @@ static int tegra_uart_dma_channel_allocate(struct tegra_uart_port *tup, + } + dma_sconfig.src_addr = tup->uport.mapbase; + dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; +- dma_sconfig.src_maxburst = 4; ++ dma_sconfig.src_maxburst = tup->cdata->max_dma_burst_bytes; + tup->rx_dma_chan = dma_chan; + tup->rx_dma_buf_virt = dma_buf; + tup->rx_dma_buf_phys = dma_phys; +@@ -1263,6 +1269,7 @@ static struct tegra_uart_chip_data tegra20_uart_chip_data = { + .support_clk_src_div = false, + .fifo_mode_enable_status = false, + .uart_max_port = 5, ++ .max_dma_burst_bytes = 4, + }; + + static struct tegra_uart_chip_data tegra30_uart_chip_data = { +@@ -1271,6 +1278,7 @@ static struct tegra_uart_chip_data tegra30_uart_chip_data = { + .support_clk_src_div = true, + .fifo_mode_enable_status = false, + .uart_max_port = 5, ++ .max_dma_burst_bytes = 4, + }; + + static struct tegra_uart_chip_data tegra186_uart_chip_data = { +@@ -1279,6 +1287,7 @@ static struct tegra_uart_chip_data tegra186_uart_chip_data = { + .support_clk_src_div = true, + .fifo_mode_enable_status = true, + .uart_max_port = 8, ++ .max_dma_burst_bytes = 8, + }; + + static const struct of_device_id tegra_uart_of_match[] = { +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-avoid-reg-access-when-clk-disabled.patch b/queue-4.19/serial-tegra-avoid-reg-access-when-clk-disabled.patch new file mode 100644 index 00000000000..24e8cee7004 --- /dev/null +++ b/queue-4.19/serial-tegra-avoid-reg-access-when-clk-disabled.patch @@ -0,0 +1,91 @@ +From 00965a987eac2e9506fc8c3d98a0fd7a3f96d792 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 10:12:57 +0530 +Subject: serial: tegra: avoid reg access when clk disabled + +From: Ahung Cheng + +[ Upstream commit 494f79bd2365703e4093efa0ecf4b139d83aba97 ] + +This avoids two race conditions from the UART shutdown sequence both +leading to 'Machine check error in AXI2APB' and kernel oops. + +One was that the clock was disabled before the DMA was terminated making +it possible for the DMA callbacks to be called after the clock was +disabled. These callbacks could write to the UART registers causing +timeout. + +The second was that the clock was disabled before the UART was +completely flagged as closed. This is done after the shutdown is called +and a new write could be started after the clock was disabled. +tegra_uart_start_pio_tx could be called causing timeout. + +Given that the baud rate is reset at the end of shutdown sequence, this +fix is to examine the baud rate to avoid register access from both race +conditions. + +Besides, terminate the DMA before disabling the clock. + +Signed-off-by: Ahung Cheng +Signed-off-by: Shardar Mohammed +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/1567572187-29820-3-git-send-email-kyarlagadda@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index ee480a1480e8..c113a0b1ece1 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -126,6 +126,8 @@ struct tegra_uart_port { + + static void tegra_uart_start_next_tx(struct tegra_uart_port *tup); + static int tegra_uart_start_rx_dma(struct tegra_uart_port *tup); ++static void tegra_uart_dma_channel_free(struct tegra_uart_port *tup, ++ bool dma_to_memory); + + static inline unsigned long tegra_uart_read(struct tegra_uart_port *tup, + unsigned long reg) +@@ -440,6 +442,9 @@ static void tegra_uart_start_next_tx(struct tegra_uart_port *tup) + unsigned long count; + struct circ_buf *xmit = &tup->uport.state->xmit; + ++ if (!tup->current_baud) ++ return; ++ + tail = (unsigned long)&xmit->buf[xmit->tail]; + count = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE); + if (!count) +@@ -803,6 +808,12 @@ static void tegra_uart_hw_deinit(struct tegra_uart_port *tup) + tup->current_baud = 0; + spin_unlock_irqrestore(&tup->uport.lock, flags); + ++ tup->rx_in_progress = 0; ++ tup->tx_in_progress = 0; ++ ++ tegra_uart_dma_channel_free(tup, true); ++ tegra_uart_dma_channel_free(tup, false); ++ + clk_disable_unprepare(tup->uart_clk); + } + +@@ -1040,12 +1051,6 @@ static void tegra_uart_shutdown(struct uart_port *u) + struct tegra_uart_port *tup = to_tegra_uport(u); + + tegra_uart_hw_deinit(tup); +- +- tup->rx_in_progress = 0; +- tup->tx_in_progress = 0; +- +- tegra_uart_dma_channel_free(tup, true); +- tegra_uart_dma_channel_free(tup, false); + free_irq(u->irq, tup); + } + +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-check-for-fifo-mode-enabled-status.patch b/queue-4.19/serial-tegra-check-for-fifo-mode-enabled-status.patch new file mode 100644 index 00000000000..de974ab79dd --- /dev/null +++ b/queue-4.19/serial-tegra-check-for-fifo-mode-enabled-status.patch @@ -0,0 +1,139 @@ +From 5fac538a7211ca61f552141574eefd5ffd2a0553 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 10:13:01 +0530 +Subject: serial: tegra: check for FIFO mode enabled status + +From: Krishna Yarlagadda + +[ Upstream commit 222dcdff3405a31803aecd3bf66f62d46b8bda98 ] + +Chips prior to Tegra186 needed delay of 3 UART clock cycles to avoid +data loss. This issue is fixed in Tegra186 and a new flag is added to +check if FIFO mode is enabled. chip data updated to check if this flag +is available for a chip. Tegra186 has new compatible to enable this +flag. + +Signed-off-by: Shardar Shariff Md +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/1567572187-29820-7-git-send-email-kyarlagadda@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 52 +++++++++++++++++++++++++++---- + 1 file changed, 46 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index c113a0b1ece1..5408486be834 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -72,6 +72,8 @@ + #define TEGRA_TX_PIO 1 + #define TEGRA_TX_DMA 2 + ++#define TEGRA_UART_FCR_IIR_FIFO_EN 0x40 ++ + /** + * tegra_uart_chip_data: SOC specific data. + * +@@ -84,6 +86,7 @@ struct tegra_uart_chip_data { + bool tx_fifo_full_status; + bool allow_txfifo_reset_fifo_mode; + bool support_clk_src_div; ++ bool fifo_mode_enable_status; + }; + + struct tegra_uart_port { +@@ -245,6 +248,21 @@ static void tegra_uart_wait_sym_time(struct tegra_uart_port *tup, + tup->current_baud)); + } + ++static int tegra_uart_wait_fifo_mode_enabled(struct tegra_uart_port *tup) ++{ ++ unsigned long iir; ++ unsigned int tmout = 100; ++ ++ do { ++ iir = tegra_uart_read(tup, UART_IIR); ++ if (iir & TEGRA_UART_FCR_IIR_FIFO_EN) ++ return 0; ++ udelay(1); ++ } while (--tmout); ++ ++ return -ETIMEDOUT; ++} ++ + static void tegra_uart_fifo_reset(struct tegra_uart_port *tup, u8 fcr_bits) + { + unsigned long fcr = tup->fcr_shadow; +@@ -260,6 +278,8 @@ static void tegra_uart_fifo_reset(struct tegra_uart_port *tup, u8 fcr_bits) + tegra_uart_write(tup, fcr, UART_FCR); + fcr |= UART_FCR_ENABLE_FIFO; + tegra_uart_write(tup, fcr, UART_FCR); ++ if (tup->cdata->fifo_mode_enable_status) ++ tegra_uart_wait_fifo_mode_enabled(tup); + } + + /* Dummy read to ensure the write is posted */ +@@ -863,12 +883,20 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + /* Dummy read to ensure the write is posted */ + tegra_uart_read(tup, UART_SCR); + +- /* +- * For all tegra devices (up to t210), there is a hardware issue that +- * requires software to wait for 3 UART clock periods after enabling +- * the TX fifo, otherwise data could be lost. +- */ +- tegra_uart_wait_cycle_time(tup, 3); ++ if (tup->cdata->fifo_mode_enable_status) { ++ ret = tegra_uart_wait_fifo_mode_enabled(tup); ++ dev_err(tup->uport.dev, "FIFO mode not enabled\n"); ++ if (ret < 0) ++ return ret; ++ } else { ++ /* ++ * For all tegra devices (up to t210), there is a hardware ++ * issue that requires software to wait for 3 UART clock ++ * periods after enabling the TX fifo, otherwise data could ++ * be lost. ++ */ ++ tegra_uart_wait_cycle_time(tup, 3); ++ } + + /* + * Initialize the UART with default configuration +@@ -1232,12 +1260,21 @@ static struct tegra_uart_chip_data tegra20_uart_chip_data = { + .tx_fifo_full_status = false, + .allow_txfifo_reset_fifo_mode = true, + .support_clk_src_div = false, ++ .fifo_mode_enable_status = false, + }; + + static struct tegra_uart_chip_data tegra30_uart_chip_data = { + .tx_fifo_full_status = true, + .allow_txfifo_reset_fifo_mode = false, + .support_clk_src_div = true, ++ .fifo_mode_enable_status = false, ++}; ++ ++static struct tegra_uart_chip_data tegra186_uart_chip_data = { ++ .tx_fifo_full_status = true, ++ .allow_txfifo_reset_fifo_mode = false, ++ .support_clk_src_div = true, ++ .fifo_mode_enable_status = true, + }; + + static const struct of_device_id tegra_uart_of_match[] = { +@@ -1247,6 +1284,9 @@ static const struct of_device_id tegra_uart_of_match[] = { + }, { + .compatible = "nvidia,tegra20-hsuart", + .data = &tegra20_uart_chip_data, ++ }, { ++ .compatible = "nvidia,tegra186-hsuart", ++ .data = &tegra186_uart_chip_data, + }, { + }, + }; +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-read-dma-status-before-terminating.patch b/queue-4.19/serial-tegra-read-dma-status-before-terminating.patch new file mode 100644 index 00000000000..3374de94f15 --- /dev/null +++ b/queue-4.19/serial-tegra-read-dma-status-before-terminating.patch @@ -0,0 +1,60 @@ +From 7ac4008a0a23e9036c10fce3b8506b5ec91e7b1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 20:28:06 +0530 +Subject: serial: tegra: Read DMA status before terminating +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kartik + +[ Upstream commit 109a951a9f1fd8a34ebd1896cbbd5d5cede880a7 ] + +Read the DMA status before terminating the DMA, as doing so deletes +the DMA desc. + +Also, to get the correct transfer status information, pause the DMA +using dmaengine_pause() before reading the DMA status. + +Fixes: e9ea096dd225 ("serial: tegra: add serial driver") +Reviewed-by: Jon Hunter +Reviewed-by: Ilpo Järvinen +Acked-by: Thierry Reding +Signed-off-by: Akhil R +Signed-off-by: Kartik +Link: https://lore.kernel.org/r/1666105086-17326-1-git-send-email-kkartik@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 1d957144117e..cc613240a351 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -570,8 +570,9 @@ static void tegra_uart_stop_tx(struct uart_port *u) + if (tup->tx_in_progress != TEGRA_UART_TX_DMA) + return; + +- dmaengine_terminate_all(tup->tx_dma_chan); ++ dmaengine_pause(tup->tx_dma_chan); + dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state); ++ dmaengine_terminate_all(tup->tx_dma_chan); + count = tup->tx_bytes_requested - state.residue; + async_tx_ack(tup->tx_dma_desc); + uart_xmit_advance(&tup->uport, count); +@@ -697,8 +698,9 @@ static void tegra_uart_terminate_rx_dma(struct tegra_uart_port *tup) + if (!tup->rx_dma_active) + return; + +- dmaengine_terminate_all(tup->rx_dma_chan); ++ dmaengine_pause(tup->rx_dma_chan); + dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state); ++ dmaengine_terminate_all(tup->rx_dma_chan); + + tegra_uart_rx_buffer_push(tup, state.residue); + tup->rx_dma_active = false; +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-report-clk-rate-errors.patch b/queue-4.19/serial-tegra-report-clk-rate-errors.patch new file mode 100644 index 00000000000..be08f28ed0b --- /dev/null +++ b/queue-4.19/serial-tegra-report-clk-rate-errors.patch @@ -0,0 +1,177 @@ +From 9b19e6478a36fde766a677c3bc87c1b035667c6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 10:13:06 +0530 +Subject: serial: tegra: report clk rate errors + +From: Krishna Yarlagadda + +[ Upstream commit d781ec21bae6ff8f9e07682e8947a654484611f5 ] + +Standard UART controllers support +/-4% baud rate error tolerance. +Tegra186 only supports 0% to +4% error tolerance whereas other Tegra +chips support standard +/-4% rate. Add chip data for knowing error +tolerance level for each soc. Creating new compatible for Tegra194 +chip as it supports baud rate error tolerance of -2 to +2%, different +from older chips. + +Signed-off-by: Shardar Shariff Md +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/1567572187-29820-12-git-send-email-kyarlagadda@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 59 +++++++++++++++++++++++++++++-- + 1 file changed, 57 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index aae4c167f529..e11d19742cf6 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -89,6 +89,8 @@ struct tegra_uart_chip_data { + bool fifo_mode_enable_status; + int uart_max_port; + int max_dma_burst_bytes; ++ int error_tolerance_low_range; ++ int error_tolerance_high_range; + }; + + struct tegra_baud_tolerance { +@@ -135,6 +137,8 @@ struct tegra_uart_port { + unsigned int rx_bytes_requested; + struct tegra_baud_tolerance *baud_tolerance; + int n_adjustable_baud_rates; ++ int required_rate; ++ int configured_rate; + }; + + static void tegra_uart_start_next_tx(struct tegra_uart_port *tup); +@@ -318,6 +322,22 @@ static long tegra_get_tolerance_rate(struct tegra_uart_port *tup, + return rate; + } + ++static int tegra_check_rate_in_range(struct tegra_uart_port *tup) ++{ ++ long diff; ++ ++ diff = ((long)(tup->configured_rate - tup->required_rate) * 10000) ++ / tup->required_rate; ++ if (diff < (tup->cdata->error_tolerance_low_range * 100) || ++ diff > (tup->cdata->error_tolerance_high_range * 100)) { ++ dev_err(tup->uport.dev, ++ "configured baud rate is out of range by %ld", diff); ++ return -EIO; ++ } ++ ++ return 0; ++} ++ + static int tegra_set_baudrate(struct tegra_uart_port *tup, unsigned int baud) + { + unsigned long rate; +@@ -330,6 +350,8 @@ static int tegra_set_baudrate(struct tegra_uart_port *tup, unsigned int baud) + + if (tup->cdata->support_clk_src_div) { + rate = baud * 16; ++ tup->required_rate = rate; ++ + if (tup->n_adjustable_baud_rates) + rate = tegra_get_tolerance_rate(tup, baud, rate); + +@@ -339,7 +361,11 @@ static int tegra_set_baudrate(struct tegra_uart_port *tup, unsigned int baud) + "clk_set_rate() failed for rate %lu\n", rate); + return ret; + } ++ tup->configured_rate = clk_get_rate(tup->uart_clk); + divisor = 1; ++ ret = tegra_check_rate_in_range(tup); ++ if (ret < 0) ++ return ret; + } else { + rate = clk_get_rate(tup->uart_clk); + divisor = DIV_ROUND_CLOSEST(rate, baud * 16); +@@ -937,7 +963,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + * enqueued + */ + tup->lcr_shadow = TEGRA_UART_DEFAULT_LSR; +- tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD); ++ ret = tegra_set_baudrate(tup, TEGRA_UART_DEFAULT_BAUD); ++ if (ret < 0) { ++ dev_err(tup->uport.dev, "Failed to set baud rate\n"); ++ return ret; ++ } + tup->fcr_shadow |= UART_FCR_DMA_SELECT; + tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); + +@@ -1136,6 +1166,7 @@ static void tegra_uart_set_termios(struct uart_port *u, + struct clk *parent_clk = clk_get_parent(tup->uart_clk); + unsigned long parent_clk_rate = clk_get_rate(parent_clk); + int max_divider = (tup->cdata->support_clk_src_div) ? 0x7FFF : 0xFFFF; ++ int ret; + + max_divider *= 16; + spin_lock_irqsave(&u->lock, flags); +@@ -1208,7 +1239,11 @@ static void tegra_uart_set_termios(struct uart_port *u, + parent_clk_rate/max_divider, + parent_clk_rate/16); + spin_unlock_irqrestore(&u->lock, flags); +- tegra_set_baudrate(tup, baud); ++ ret = tegra_set_baudrate(tup, baud); ++ if (ret < 0) { ++ dev_err(tup->uport.dev, "Failed to set baud rate\n"); ++ return; ++ } + if (tty_termios_baud_rate(termios)) + tty_termios_encode_baud_rate(termios, baud, baud); + spin_lock_irqsave(&u->lock, flags); +@@ -1338,6 +1373,8 @@ static struct tegra_uart_chip_data tegra20_uart_chip_data = { + .fifo_mode_enable_status = false, + .uart_max_port = 5, + .max_dma_burst_bytes = 4, ++ .error_tolerance_low_range = 0, ++ .error_tolerance_high_range = 4, + }; + + static struct tegra_uart_chip_data tegra30_uart_chip_data = { +@@ -1347,6 +1384,8 @@ static struct tegra_uart_chip_data tegra30_uart_chip_data = { + .fifo_mode_enable_status = false, + .uart_max_port = 5, + .max_dma_burst_bytes = 4, ++ .error_tolerance_low_range = 0, ++ .error_tolerance_high_range = 4, + }; + + static struct tegra_uart_chip_data tegra186_uart_chip_data = { +@@ -1356,6 +1395,19 @@ static struct tegra_uart_chip_data tegra186_uart_chip_data = { + .fifo_mode_enable_status = true, + .uart_max_port = 8, + .max_dma_burst_bytes = 8, ++ .error_tolerance_low_range = 0, ++ .error_tolerance_high_range = 4, ++}; ++ ++static struct tegra_uart_chip_data tegra194_uart_chip_data = { ++ .tx_fifo_full_status = true, ++ .allow_txfifo_reset_fifo_mode = false, ++ .support_clk_src_div = true, ++ .fifo_mode_enable_status = true, ++ .uart_max_port = 8, ++ .max_dma_burst_bytes = 8, ++ .error_tolerance_low_range = -2, ++ .error_tolerance_high_range = 2, + }; + + static const struct of_device_id tegra_uart_of_match[] = { +@@ -1368,6 +1420,9 @@ static const struct of_device_id tegra_uart_of_match[] = { + }, { + .compatible = "nvidia,tegra186-hsuart", + .data = &tegra186_uart_chip_data, ++ }, { ++ .compatible = "nvidia,tegra194-hsuart", ++ .data = &tegra194_uart_chip_data, + }, { + }, + }; +-- +2.35.1 + diff --git a/queue-4.19/serial-tegra-set-maximum-num-of-uart-ports-to-8.patch b/queue-4.19/serial-tegra-set-maximum-num-of-uart-ports-to-8.patch new file mode 100644 index 00000000000..a5d7c573be0 --- /dev/null +++ b/queue-4.19/serial-tegra-set-maximum-num-of-uart-ports-to-8.patch @@ -0,0 +1,96 @@ +From f365c7b91175cc418ff5e9caa47241cfcbdaa0b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 10:13:02 +0530 +Subject: serial: tegra: set maximum num of uart ports to 8 + +From: Krishna Yarlagadda + +[ Upstream commit 53d0a062cb771d62cd205d9e2845fe26c9989142 ] + +Set maximum number of UART ports to 8 as older chips have 5 ports and +Tergra186 and later chips will have 8 ports. Add this info to chip +data. Read device tree compatible of this driver and register uart +driver with max ports of matching chip data. + +Signed-off-by: Shardar Shariff Md +Signed-off-by: Krishna Yarlagadda +Link: https://lore.kernel.org/r/1567572187-29820-8-git-send-email-kyarlagadda@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index 5408486be834..55415a12d3cc 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -62,7 +62,7 @@ + #define TEGRA_UART_TX_TRIG_4B 0x20 + #define TEGRA_UART_TX_TRIG_1B 0x30 + +-#define TEGRA_UART_MAXIMUM 5 ++#define TEGRA_UART_MAXIMUM 8 + + /* Default UART setting when started: 115200 no parity, stop, 8 data bits */ + #define TEGRA_UART_DEFAULT_BAUD 115200 +@@ -87,6 +87,7 @@ struct tegra_uart_chip_data { + bool allow_txfifo_reset_fifo_mode; + bool support_clk_src_div; + bool fifo_mode_enable_status; ++ int uart_max_port; + }; + + struct tegra_uart_port { +@@ -1261,6 +1262,7 @@ static struct tegra_uart_chip_data tegra20_uart_chip_data = { + .allow_txfifo_reset_fifo_mode = true, + .support_clk_src_div = false, + .fifo_mode_enable_status = false, ++ .uart_max_port = 5, + }; + + static struct tegra_uart_chip_data tegra30_uart_chip_data = { +@@ -1268,6 +1270,7 @@ static struct tegra_uart_chip_data tegra30_uart_chip_data = { + .allow_txfifo_reset_fifo_mode = false, + .support_clk_src_div = true, + .fifo_mode_enable_status = false, ++ .uart_max_port = 5, + }; + + static struct tegra_uart_chip_data tegra186_uart_chip_data = { +@@ -1275,6 +1278,7 @@ static struct tegra_uart_chip_data tegra186_uart_chip_data = { + .allow_txfifo_reset_fifo_mode = false, + .support_clk_src_div = true, + .fifo_mode_enable_status = true, ++ .uart_max_port = 8, + }; + + static const struct of_device_id tegra_uart_of_match[] = { +@@ -1409,11 +1413,22 @@ static struct platform_driver tegra_uart_platform_driver = { + static int __init tegra_uart_init(void) + { + int ret; ++ struct device_node *node; ++ const struct of_device_id *match = NULL; ++ const struct tegra_uart_chip_data *cdata = NULL; ++ ++ node = of_find_matching_node(NULL, tegra_uart_of_match); ++ if (node) ++ match = of_match_node(tegra_uart_of_match, node); ++ if (match) ++ cdata = match->data; ++ if (cdata) ++ tegra_uart_driver.nr = cdata->uart_max_port; + + ret = uart_register_driver(&tegra_uart_driver); + if (ret < 0) { + pr_err("Could not register %s driver\n", +- tegra_uart_driver.driver_name); ++ tegra_uart_driver.driver_name); + return ret; + } + +-- +2.35.1 + diff --git a/queue-4.19/series b/queue-4.19/series index e4c2334327b..3757860d01a 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -19,3 +19,334 @@ usb-serial-f81534-fix-division-by-zero-on-line-speed-change.patch igb-initialize-mailbox-message-for-vf-reset.patch bluetooth-l2cap-fix-u8-overflow.patch net-loopback-use-net_name_predictable-for-name_assig.patch +usb-musb-remove-extra-check-in-musb_gadget_vbus_draw.patch +arm-dts-qcom-apq8064-fix-coresight-compatible.patch +drivers-soc-ti-knav_qmss_queue-mark-knav_acc_firmwar.patch +arm-dts-spear600-fix-clcd-interrupt.patch +soc-ti-smartreflex-fix-pm-disable-depth-imbalance-in.patch +perf-arm_dsu-fix-hotplug-callback-leak-in-dsu_pmu_in.patch +arm64-dts-mt2712e-fix-unit_address_vs_reg-warning-fo.patch +arm64-dts-mt2712e-fix-unit-address-for-pinctrl-node.patch +arm64-dts-mt2712-evb-fix-vproc-fixed-regulators-unit.patch +arm64-dts-mediatek-mt6797-fix-26m-oscillator-unit-na.patch +arm-dts-dove-fix-assigned-addresses-for-every-pcie-r.patch +arm-dts-armada-370-fix-assigned-addresses-for-every-.patch +arm-dts-armada-xp-fix-assigned-addresses-for-every-p.patch +arm-dts-armada-375-fix-assigned-addresses-for-every-.patch +arm-dts-armada-38x-fix-assigned-addresses-for-every-.patch +arm-dts-armada-39x-fix-assigned-addresses-for-every-.patch +arm-dts-turris-omnia-add-ethernet-aliases.patch +arm-dts-turris-omnia-add-switch-port-6-node.patch +arm-dts-armada-38x-fix-compatible-string-for-gpios.patch +arm-dts-armada-39x-fix-compatible-string-for-gpios.patch +pstore-ram-fix-error-return-code-in-ramoops_probe.patch +arm-mmp-fix-timer_read-delay.patch +pstore-avoid-kcore-oops-by-vmap-ing-with-vm_ioremap.patch +tpm-tpm_crb-fix-error-message-in-__crb_relinquish_lo.patch +cpuidle-dt-return-the-correct-numbers-of-parsed-idle.patch +alpha-fix-syscall-entry-in-audut_syscall-case.patch +fs-don-t-audit-the-capability-check-in-simple_xattr_.patch +selftests-ftrace-event_triggers-wait-longer-for-test.patch +perf-fix-possible-memleak-in-pmu_dev_alloc.patch +timerqueue-use-rb_entry_safe-in-timerqueue_getnext.patch +proc-fixup-uptime-selftest.patch +ocfs2-fix-memory-leak-in-ocfs2_stack_glue_init.patch +mips-vpe-mt-fix-possible-memory-leak-while-module-ex.patch +mips-vpe-cmp-fix-possible-memory-leak-while-module-e.patch +pnp-fix-name-memory-leak-in-pnp_alloc_dev.patch +perf-x86-intel-uncore-fix-reference-count-leak-in-hs.patch +irqchip-gic-pm-use-pm_runtime_resume_and_get-in-gic_.patch +cpufreq-amd_freq_sensitivity-add-missing-pci_dev_put.patch +libfs-add-define_simple_attribute_signed-for-signed-.patch +lib-notifier-error-inject-fix-error-when-writing-err.patch +debugfs-fix-error-when-writing-negative-value-to-ato.patch +rapidio-fix-possible-name-leaks-when-rio_add_device-.patch +rapidio-rio-fix-possible-name-leak-in-rio_register_m.patch +clocksource-drivers-sh_cmt-make-sure-channel-clock-s.patch +acpica-fix-use-after-free-in-acpi_ut_copy_ipackage_t.patch +uprobes-x86-allow-to-probe-a-nop-instruction-with-0x.patch +xen-events-only-register-debug-interrupt-for-2-level.patch +x86-xen-fix-memory-leak-in-xen_smp_intr_init-_pv.patch +x86-xen-fix-memory-leak-in-xen_init_lock_cpu.patch +xen-privcmd-fix-a-possible-warning-in-privcmd_ioctl_.patch +pm-runtime-improve-path-in-rpm_idle-when-no-callback.patch +pm-runtime-do-not-call-__rpm_callback-from-rpm_idle.patch +platform-x86-mxm-wmi-fix-memleak-in-mxm_wmi_call_mx-.patch +mips-bcm63xx-add-check-for-null-for-clk-in-clk_enabl.patch +fs-sysv-fix-sysv_nblocks-returns-wrong-value.patch +rapidio-fix-possible-uaf-when-kfifo_alloc-fails.patch +eventfd-change-int-to-__u64-in-eventfd_signal-ifndef.patch +relay-fix-type-mismatch-when-allocating-memory-in-re.patch +hfs-fix-oob-write-in-hfs_asc2mac.patch +rapidio-devices-fix-missing-put_device-in-mport_cdev.patch +wifi-ath9k-hif_usb-fix-memory-leak-of-urbs-in-ath9k_.patch +wifi-ath9k-hif_usb-fix-use-after-free-in-ath9k_hif_u.patch +wifi-rtl8xxxu-fix-reading-the-vendor-of-combo-chips.patch +pata_ipx4xx_cf-fix-unsigned-comparison-with-less-tha.patch +powerpc-dts-t208x-mark-mac1-and-mac2-as-10g.patch +media-i2c-ad5820-fix-error-path.patch +can-kvaser_usb-do-not-increase-tx-statistics-when-se.patch +can-kvaser_usb-kvaser_usb_leaf-get-capabilities-from.patch +can-kvaser_usb-kvaser_usb_leaf-rename-leaf-usbcan-_c.patch +can-kvaser_usb-kvaser_usb_leaf-handle-cmd_error_even.patch +can-kvaser_usb_leaf-set-warning-state-even-without-b.patch +can-kvaser_usb_leaf-fix-improved-state-not-being-rep.patch +can-kvaser_usb_leaf-fix-wrong-can-state-after-stoppi.patch +can-kvaser_usb_leaf-fix-bogus-restart-events.patch +can-kvaser_usb-add-struct-kvaser_usb_busparams.patch +can-kvaser_usb-compare-requested-bittiming-parameter.patch +spi-update-reference-to-struct-spi_controller.patch +media-vivid-fix-compose-size-exceed-boundary.patch +mtd-fix-device-name-leak-when-register-device-failed.patch +wifi-rsi-fix-handling-of-802.3-eapol-frames-sent-via.patch +media-camss-clean-up-received-buffers-on-failed-star.patch +net-proc-provide-proc_fs-n-fallback-for-proc_create_.patch +drm-radeon-add-the-missed-acpi_put_table-to-fix-memo.patch +asoc-pxa-fix-null-pointer-dereference-in-filter.patch +regulator-core-fix-unbalanced-of-node-refcount-in-re.patch +ima-fix-misuse-of-dereference-of-pointer-in-template.patch +wifi-ath10k-fix-return-value-in-ath10k_pci_init.patch +mtd-lpddr2_nvm-fix-possible-null-ptr-deref.patch +input-elants_i2c-properly-handle-the-reset-gpio-when.patch +media-solo6x10-fix-possible-memory-leak-in-solo_sysf.patch +media-platform-exynos4-is-fix-error-handling-in-fimc.patch +hid-hid-sensor-custom-set-fixed-size-for-custom-attr.patch +alsa-seq-fix-undefined-behavior-in-bit-shift-for-snd.patch +clk-rockchip-fix-memory-leak-in-rockchip_clk_registe.patch +bonding-export-skip-slave-logic-to-function.patch +mtd-maps-pxa2xx-flash-fix-memory-leak-in-probe.patch +drbd-remove-call-to-memset-before-free-device-resour.patch +media-imon-fix-a-race-condition-in-send_packet.patch +pinctrl-pinconf-generic-add-missing-of_node_put.patch +media-dvb-core-fix-ignored-return-value-in-dvb_regis.patch +media-dvb-usb-az6027-fix-null-ptr-deref-in-az6027_i2.patch +media-s5p-mfc-add-variant-data-for-mfc-v7-hardware-f.patch +drm-tegra-add-missing-clk_disable_unprepare-in-tegra.patch +nfsv4.2-fix-a-memory-stomp-in-decode_attr_security_l.patch +nfsv4-fix-a-deadlock-between-nfs4_open_recover_helpe.patch +alsa-asihpi-fix-missing-pci_disable_device.patch +drm-radeon-fix-pci-device-refcount-leak-in-radeon_at.patch +drm-amdgpu-fix-pci-device-refcount-leak-in-amdgpu_at.patch +asoc-pcm512x-fix-pm-disable-depth-imbalance-in-pcm51.patch +bonding-uninitialized-variable-in-bond_miimon_inspec.patch +wifi-mac80211-fix-memory-leak-in-ieee80211_if_add.patch +wifi-cfg80211-fix-not-unregister-reg_pdev-when-load_.patch +regulator-core-fix-module-refcount-leak-in-set_suppl.patch +media-saa7164-fix-missing-pci_disable_device.patch +alsa-mts64-fix-possible-null-ptr-defer-in-snd_mts64_.patch +sunrpc-fix-missing-release-socket-in-rpc_sockname.patch +nfsv4.x-fail-client-initialisation-if-state-manager-.patch +mmc-moxart-fix-return-value-check-of-mmc_add_host.patch +mmc-mxcmmc-fix-return-value-check-of-mmc_add_host.patch +mmc-pxamci-fix-return-value-check-of-mmc_add_host.patch +mmc-rtsx_usb_sdmmc-fix-return-value-check-of-mmc_add.patch +mmc-toshsd-fix-return-value-check-of-mmc_add_host.patch +mmc-vub300-fix-return-value-check-of-mmc_add_host.patch +mmc-wmt-sdmmc-fix-return-value-check-of-mmc_add_host.patch +mmc-atmel-mci-fix-return-value-check-of-mmc_add_host.patch +mmc-meson-gx-fix-return-value-check-of-mmc_add_host.patch +mmc-via-sdmmc-fix-return-value-check-of-mmc_add_host.patch +mmc-wbsd-fix-return-value-check-of-mmc_add_host.patch +mmc-mmci-fix-return-value-check-of-mmc_add_host.patch +media-c8sectpfe-add-of_node_put-when-breaking-out-of.patch +media-coda-add-check-for-dcoda_iram_alloc.patch +media-coda-add-check-for-kmalloc.patch +clk-samsung-fix-memory-leak-in-_samsung_clk_register.patch +wifi-rtl8xxxu-add-__packed-to-struct-rtl8723bu_c2h.patch +rtl8xxxu-add-enumeration-for-channel-bandwidth.patch +wifi-brcmfmac-fix-error-return-code-in-brcmf_sdio_do.patch +blktrace-fix-output-non-blktrace-event-when-blk_clas.patch +clk-socfpga-clk-pll-remove-unused-variable-rc.patch +clk-socfpga-use-clk_hw_register-for-a5-c5.patch +net-vmw_vsock-vmci-check-memcpy_from_msg.patch +net-defxx-fix-missing-err-handling-in-dfx_init.patch +drivers-net-qlcnic-fix-potential-memory-leak-in-qlcn.patch +ethernet-s2io-don-t-call-dev_kfree_skb-under-spin_lo.patch +net-farsync-fix-kmemleak-when-rmmods-farsync.patch +net-tunnel-wait-until-all-sk_user_data-reader-finish.patch +net-apple-mace-don-t-call-dev_kfree_skb-under-spin_l.patch +net-apple-bmac-don-t-call-dev_kfree_skb-under-spin_l.patch +net-emaclite-don-t-call-dev_kfree_skb-under-spin_loc.patch +net-ethernet-dnet-don-t-call-dev_kfree_skb-under-spi.patch +hamradio-don-t-call-dev_kfree_skb-under-spin_lock_ir.patch +net-amd-lance-don-t-call-dev_kfree_skb-under-spin_lo.patch +net-amd-xgbe-fix-logic-around-active-and-passive-cab.patch +net-amd-xgbe-check-only-the-minimum-speed-for-active.patch +net-lan9303-fix-read-error-execution-path.patch +ntb_netdev-use-dev_kfree_skb_any-in-interrupt-contex.patch +bluetooth-btusb-don-t-call-kfree_skb-under-spin_lock.patch +bluetooth-hci_qca-don-t-call-kfree_skb-under-spin_lo.patch +bluetooth-hci_h5-don-t-call-kfree_skb-under-spin_loc.patch +bluetooth-hci_bcsp-don-t-call-kfree_skb-under-spin_l.patch +bluetooth-hci_core-don-t-call-kfree_skb-under-spin_l.patch +bluetooth-rfcomm-don-t-call-kfree_skb-under-spin_loc.patch +stmmac-fix-potential-division-by-0.patch +apparmor-fix-a-memleak-in-multi_transaction_new.patch +apparmor-fix-lockdep-warning-when-removing-a-namespa.patch +apparmor-fix-abi-check-to-include-v8-abi.patch +f2fs-fix-normal-discard-process.patch +rdma-nldev-return-eagain-if-the-cm_id-isn-t-from-exp.patch +scsi-scsi_debug-fix-a-warning-in-resp_write_scat.patch +pci-check-for-alloc-failure-in-pci_request_irq.patch +rdma-hfi-decrease-pci-device-reference-count-in-erro.patch +crypto-ccree-make-cc_debugfs_global_fini-available-f.patch +rdma-rxe-fix-null-ptr-deref-in-rxe_qp_do_cleanup-whe.patch +scsi-hpsa-use-local-workqueues-instead-of-system-wor.patch +scsi-hpsa-fix-possible-memory-leak-in-hpsa_init_one.patch +crypto-tcrypt-fix-multibuffer-skcipher-speed-test-me.patch +scsi-mpt3sas-add-ioc_-level-logging-macros.patch +scsi-mpt3sas-convert-uses-of-pr_-level-with-mpt3sas_.patch +scsi-mpt3sas-fix-possible-resource-leaks-in-mpt3sas_.patch +scsi-hpsa-fix-error-handling-in-hpsa_add_sas_host.patch +scsi-hpsa-fix-possible-memory-leak-in-hpsa_add_sas_d.patch +scsi-fcoe-fix-possible-name-leak-when-device_registe.patch +scsi-ipr-fix-warning-in-ipr_init.patch +scsi-fcoe-fix-transport-not-deattached-when-fcoe_if_.patch +scsi-snic-fix-possible-uaf-in-snic_tgt_create.patch +rdma-hfi1-fix-error-return-code-in-parse_platform_co.patch +orangefs-fix-sysfs-not-cleanup-when-dev-init-failed.patch +crypto-img-hash-fix-variable-dereferenced-before-che.patch +hwrng-amd-fix-pci-device-refcount-leak.patch +hwrng-geode-fix-pci-device-refcount-leak.patch +ib-ipoib-fix-queue-count-inconsistency-for-pkey-chil.patch +drivers-dio-fix-possible-memory-leak-in-dio_init.patch +serial-tegra-avoid-reg-access-when-clk-disabled.patch +serial-tegra-check-for-fifo-mode-enabled-status.patch +serial-tegra-set-maximum-num-of-uart-ports-to-8.patch +serial-tegra-add-support-to-use-8-bytes-trigger.patch +serial-tegra-add-support-to-adjust-baud-rate.patch +serial-tegra-report-clk-rate-errors.patch +serial-tegra-add-pio-mode-support.patch +tty-serial-tegra-activate-rx-dma-transfer-by-request.patch +serial-tegra-read-dma-status-before-terminating.patch +class-fix-possible-memory-leak-in-__class_register.patch +vfio-platform-do-not-pass-return-buffer-to-acpi-_rst.patch +uio-uio_dmem_genirq-fix-missing-unlock-in-irq-config.patch +uio-uio_dmem_genirq-fix-deadlock-between-irq-config-.patch +usb-fotg210-udc-fix-ages-old-endianness-issues.patch +staging-vme_user-fix-possible-uaf-in-tsi148_dma_list.patch +usb-typec-check-for-ops-exit-instead-of-ops-enter-in.patch +usb-typec-group-all-tcpci-tcpm-code-together.patch +usb-typec-tcpci-fix-of-node-refcount-leak-in-tcpci_r.patch +serial-amba-pl011-avoid-sbsa-uart-accessing-dmacr-re.patch +serial-pl011-do-not-clear-rx-fifo-rx-interrupt-in-un.patch +serial-pch-fix-pci-device-refcount-leak-in-pch_reque.patch +tty-serial-clean-up-stop-tx-part-in-altera_uart_tx_c.patch +tty-serial-altera_uart_-r-t-x_chars-need-only-uart_p.patch +serial-altera_uart-fix-locking-in-polling-mode.patch +serial-sunsab-fix-error-handling-in-sunsab_init.patch +test_firmware-fix-memory-leak-in-test_firmware_init.patch +misc-tifm-fix-possible-memory-leak-in-tifm_7xx1_swit.patch +misc-sgi-gru-fix-use-after-free-error-in-gru_set_con.patch +cxl-fix-possible-null-ptr-deref-in-cxl_guest_init_af.patch +cxl-fix-possible-null-ptr-deref-in-cxl_pci_init_afu-.patch +usb-gadget-f_hid-optional-setup-set_report-mode.patch +usb-gadget-f_hid-fix-f_hidg-lifetime-vs-cdev.patch +usb-gadget-f_hid-fix-refcount-leak-on-error-path.patch +drivers-mcb-fix-resource-leak-in-mcb_probe.patch +mcb-mcb-parse-fix-error-handing-in-chameleon_parse_g.patch +chardev-fix-error-handling-in-cdev_device_add.patch +i2c-pxa-pci-fix-missing-pci_disable_device-on-error-.patch +staging-rtl8192u-fix-use-after-free-in-ieee80211_rx.patch +staging-rtl8192e-fix-potential-use-after-free-in-rtl.patch +vme-fix-error-not-catched-in-fake_init.patch +drivers-provide-devm_platform_ioremap_resource.patch +drivers-provide-devm_platform_get_and_ioremap_resour.patch +i2c-mux-reg-check-return-value-after-calling-platfor.patch +i2c-ismt-fix-an-out-of-bounds-bug-in-ismt_access.patch +usb-storage-add-check-for-kcalloc.patch +tracing-hist-fix-issue-of-losting-command-info-in-er.patch +samples-vfio-mdev-fix-missing-pci_disable_device-in-.patch +fbdev-ssd1307fb-drop-optional-dependency.patch +fbdev-pm2fb-fix-missing-pci_disable_device.patch +fbdev-via-fix-error-in-via_core_init.patch +fbdev-vermilion-decrease-reference-count-in-error-pa.patch +fbdev-uvesafb-fixes-an-error-handling-path-in-uvesaf.patch +hsi-omap_ssi_core-fix-unbalanced-pm_runtime_disable.patch +hsi-omap_ssi_core-fix-possible-memory-leak-in-ssi_pr.patch +power-supply-fix-residue-sysfs-file-in-error-handle-.patch +perf-symbol-correction-while-adjusting-symbol.patch +hsi-omap_ssi_core-fix-error-handling-in-ssi_init.patch +include-uapi-linux-swab-fix-potentially-missing-__al.patch +rtc-cmos-refactor-code-by-using-the-new-dmi_get_bios.patch +rtc-rtc-cmos-do-not-check-acpi_fadt_low_power_s0.patch +rtc-cmos-fix-event-handler-registration-ordering-iss.patch +rtc-cmos-fix-wake-alarm-breakage.patch +rtc-cmos-fix-build-on-non-acpi-platforms.patch +rtc-cmos-call-cmos_wake_setup-from-cmos_do_probe.patch +rtc-cmos-call-rtc_wake_setup-from-cmos_do_probe.patch +rtc-cmos-eliminate-forward-declarations-of-some-func.patch +rtc-cmos-rename-acpi-related-functions.patch +rtc-cmos-disable-acpi-rtc-event-on-removal.patch +rtc-snvs-allow-a-time-difference-on-clock-register-r.patch +iommu-amd-fix-pci-device-refcount-leak-in-ppr_notifi.patch +iommu-fsl_pamu-fix-resource-leak-in-fsl_pamu_probe.patch +macintosh-fix-possible-memory-leak-in-macio_add_one_.patch +macintosh-macio-adb-check-the-return-value-of-iorema.patch +powerpc-52xx-fix-a-resource-leak-in-an-error-handlin.patch +cxl-fix-refcount-leak-in-cxl_calc_capp_routing.patch +powerpc-xive-add-missing-iounmap-in-error-path-in-xi.patch +powerpc-perf-callchain-validate-kernel-stack-pointer.patch +powerpc-83xx-mpc832x_rdb-call-platform_device_put-in.patch +powerpc-hv-gpci-fix-hv_gpci-event-list.patch +selftests-powerpc-fix-resource-leaks.patch +remoteproc-qcom-rename-hexagon-v5-pas-driver.patch +remoteproc-qcom_q6v5_pas-fix-missing-of_node_put-in-.patch +powerpc-eeh-improve-debug-messages-around-device-add.patch +powerpc-eeh-eeh-for-pseries-hot-plug.patch +powerpc-eeh-fix-pseries_eeh_configure_bridge.patch +powerpc-pseries-pcie-phb-reset.patch +powerpc-pseries-stop-using-eeh_ops-init.patch +powerpc-eeh-drop-redundant-spinlock-initialization.patch +powerpc-pseries-eeh-use-correct-api-for-error-log-si.patch +rtc-st-lpc-add-missing-clk_disable_unprepare-in-st_r.patch +nfsd-under-nfsv4.1-fix-double-svc_xprt_put-on-rpc_cr.patch +misdn-hfcsusb-don-t-call-dev_kfree_skb-kfree_skb-und.patch +misdn-hfcpci-don-t-call-dev_kfree_skb-kfree_skb-unde.patch +misdn-hfcmulti-don-t-call-dev_kfree_skb-kfree_skb-un.patch +nfc-pn533-clear-nfc_target-before-being-used.patch +r6040-fix-kmemleak-in-probe-and-remove.patch +rtc-mxc_v2-add-missing-clk_disable_unprepare.patch +openvswitch-fix-flow-lookup-to-use-unmasked-key.patch +skbuff-account-for-tail-adjustment-during-pull-opera.patch +net_sched-reject-tcf_em_simple-case-for-complex-emat.patch +rxrpc-fix-missing-unlock-in-rxrpc_do_sendmsg.patch +myri10ge-fix-an-error-handling-path-in-myri10ge_prob.patch +net-stream-purge-sk_error_queue-in-sk_stream_kill_qu.patch +binfmt_misc-fix-shift-out-of-bounds-in-check_special.patch +fs-jfs-fix-shift-out-of-bounds-in-dballocag.patch +udf-avoid-double-brelse-in-udf_rename.patch +fs-jfs-fix-shift-out-of-bounds-in-dbdiscardag.patch +acpica-fix-error-code-path-in-acpi_ds_call_control_m.patch +nilfs2-fix-shift-out-of-bounds-overflow-in-nilfs_sb2.patch +acct-fix-potential-integer-overflow-in-encode_comp_t.patch +hfs-fix-oob-read-in-__hfs_brec_find.patch +wifi-ath9k-verify-the-expected-usb_endpoints-are-pre.patch +wifi-ar5523-fix-use-after-free-on-ar5523_cmd-timed-o.patch +asoc-codecs-rt298-add-quirk-for-kbl-r-rvp-platform.patch +ipmi-fix-memleak-when-unload-ipmi-driver.patch +bpf-make-sure-skb-len-0-when-redirecting-to-a-tunnel.patch +net-ethernet-ti-fix-return-type-of-netcp_ndo_start_x.patch +hamradio-baycom_epp-fix-return-type-of-baycom_send_p.patch +wifi-brcmfmac-fix-potential-shift-out-of-bounds-in-b.patch +igb-do-not-free-q_vector-unless-new-one-was-allocate.patch +drm-amdgpu-fix-type-of-second-parameter-in-trans_msg.patch +s390-ctcm-fix-return-type-of-ctc-mp-m_tx.patch +s390-netiucv-fix-return-type-of-netiucv_tx.patch +s390-lcs-fix-return-type-of-lcs_start_xmit.patch +drm-sti-use-drm_mode_copy.patch +drivers-md-md-bitmap-check-the-return-value-of-md_bi.patch +md-raid1-stop-mdx_raid1-thread-when-raid1-array-run-.patch +mrp-introduce-active-flags-to-prevent-uaf-when-appli.patch +ppp-associate-skb-with-a-device-at-tx.patch +media-dvb-frontends-fix-leak-of-memory-fw.patch +media-dvbdev-adopts-refcnt-to-avoid-uaf.patch +media-dvb-usb-fix-memory-leak-in-dvb_usb_adapter_ini.patch +blk-mq-fix-possible-memleak-when-register-hctx-faile.patch +regulator-core-fix-use_count-leakage-when-handling-b.patch +mmc-f-sdh30-add-quirks-for-broken-timeout-clock-capa.patch +media-si470x-fix-use-after-free-in-si470x_int_in_cal.patch +clk-st-fix-memory-leak-in-st_of_quadfs_setup.patch +drm-fsl-dcu-fix-return-type-of-fsl_dcu_drm_connector.patch +drm-sti-fix-return-type-of-sti_-dvo-hda-hdmi-_connec.patch +orangefs-fix-kmemleak-in-orangefs_prepare_debugfs_he.patch diff --git a/queue-4.19/skbuff-account-for-tail-adjustment-during-pull-opera.patch b/queue-4.19/skbuff-account-for-tail-adjustment-during-pull-opera.patch new file mode 100644 index 00000000000..9f46ba36930 --- /dev/null +++ b/queue-4.19/skbuff-account-for-tail-adjustment-during-pull-opera.patch @@ -0,0 +1,66 @@ +From dcb40af8e3b1b9d2ba09cc454d423f0ad8849d12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Dec 2022 23:11:58 -0700 +Subject: skbuff: Account for tail adjustment during pull operations + +From: Subash Abhinov Kasiviswanathan + +[ Upstream commit 2d7afdcbc9d32423f177ee12b7c93783aea338fb ] + +Extending the tail can have some unexpected side effects if a program uses +a helper like BPF_FUNC_skb_pull_data to read partial content beyond the +head skb headlen when all the skbs in the gso frag_list are linear with no +head_frag - + + kernel BUG at net/core/skbuff.c:4219! + pc : skb_segment+0xcf4/0xd2c + lr : skb_segment+0x63c/0xd2c + Call trace: + skb_segment+0xcf4/0xd2c + __udp_gso_segment+0xa4/0x544 + udp4_ufo_fragment+0x184/0x1c0 + inet_gso_segment+0x16c/0x3a4 + skb_mac_gso_segment+0xd4/0x1b0 + __skb_gso_segment+0xcc/0x12c + udp_rcv_segment+0x54/0x16c + udp_queue_rcv_skb+0x78/0x144 + udp_unicast_rcv_skb+0x8c/0xa4 + __udp4_lib_rcv+0x490/0x68c + udp_rcv+0x20/0x30 + ip_protocol_deliver_rcu+0x1b0/0x33c + ip_local_deliver+0xd8/0x1f0 + ip_rcv+0x98/0x1a4 + deliver_ptype_list_skb+0x98/0x1ec + __netif_receive_skb_core+0x978/0xc60 + +Fix this by marking these skbs as GSO_DODGY so segmentation can handle +the tail updates accordingly. + +Fixes: 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list") +Signed-off-by: Sean Tranchetti +Signed-off-by: Subash Abhinov Kasiviswanathan +Reviewed-by: Alexander Duyck +Link: https://lore.kernel.org/r/1671084718-24796-1-git-send-email-quic_subashab@quicinc.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 4178fc28c277..7f501dff4501 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -1953,6 +1953,9 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta) + insp = list; + } else { + /* Eaten partially. */ ++ if (skb_is_gso(skb) && !list->head_frag && ++ skb_headlen(list)) ++ skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY; + + if (skb_shared(list)) { + /* Sucks! We need to fork list. :-( */ +-- +2.35.1 + diff --git a/queue-4.19/soc-ti-smartreflex-fix-pm-disable-depth-imbalance-in.patch b/queue-4.19/soc-ti-smartreflex-fix-pm-disable-depth-imbalance-in.patch new file mode 100644 index 00000000000..ea1c52f1571 --- /dev/null +++ b/queue-4.19/soc-ti-smartreflex-fix-pm-disable-depth-imbalance-in.patch @@ -0,0 +1,37 @@ +From 176e792081cc169ae47ac338495cad1e3f905f37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 16:03:22 +0800 +Subject: soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe + +From: Zhang Qilong + +[ Upstream commit 69460e68eb662064ab4188d4e129ff31c1f23ed9 ] + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. + +Fixes: 984aa6dbf4ca ("OMAP3: PM: Adding smartreflex driver support.") +Signed-off-by: Zhang Qilong +Signed-off-by: Nishanth Menon +Link: https://lore.kernel.org/r/20221108080322.52268-3-zhangqilong3@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/power/avs/smartreflex.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c +index 8760477d0e8a..5ac122cd25b8 100644 +--- a/drivers/power/avs/smartreflex.c ++++ b/drivers/power/avs/smartreflex.c +@@ -984,6 +984,7 @@ static int omap_sr_probe(struct platform_device *pdev) + err_debugfs: + debugfs_remove_recursive(sr_info->dbg_dir); + err_list_del: ++ pm_runtime_disable(&pdev->dev); + list_del(&sr_info->node); + + pm_runtime_put_sync(&pdev->dev); +-- +2.35.1 + diff --git a/queue-4.19/spi-update-reference-to-struct-spi_controller.patch b/queue-4.19/spi-update-reference-to-struct-spi_controller.patch new file mode 100644 index 00000000000..2d934dfaf86 --- /dev/null +++ b/queue-4.19/spi-update-reference-to-struct-spi_controller.patch @@ -0,0 +1,42 @@ +From 977003e09dda5d13d7637784f369f4b8f38d5c97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Nov 2022 18:32:51 +0100 +Subject: spi: Update reference to struct spi_controller +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Neuschäfer + +[ Upstream commit bf585ccee22faf469d82727cf375868105b362f7 ] + +struct spi_master has been renamed to struct spi_controller. Update the +reference in spi.rst to make it clickable again. + +Fixes: 8caab75fd2c2 ("spi: Generalize SPI "master" to "controller"") +Signed-off-by: Jonathan Neuschäfer +Link: https://lore.kernel.org/r/20221101173252.1069294-1-j.neuschaefer@gmx.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + Documentation/driver-api/spi.rst | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Documentation/driver-api/spi.rst b/Documentation/driver-api/spi.rst +index f64cb666498a..f28887045049 100644 +--- a/Documentation/driver-api/spi.rst ++++ b/Documentation/driver-api/spi.rst +@@ -25,8 +25,8 @@ hardware, which may be as simple as a set of GPIO pins or as complex as + a pair of FIFOs connected to dual DMA engines on the other side of the + SPI shift register (maximizing throughput). Such drivers bridge between + whatever bus they sit on (often the platform bus) and SPI, and expose +-the SPI side of their device as a :c:type:`struct spi_master +-`. SPI devices are children of that master, ++the SPI side of their device as a :c:type:`struct spi_controller ++`. SPI devices are children of that master, + represented as a :c:type:`struct spi_device ` and + manufactured from :c:type:`struct spi_board_info + ` descriptors which are usually provided by +-- +2.35.1 + diff --git a/queue-4.19/staging-rtl8192e-fix-potential-use-after-free-in-rtl.patch b/queue-4.19/staging-rtl8192e-fix-potential-use-after-free-in-rtl.patch new file mode 100644 index 00000000000..0c4657618b6 --- /dev/null +++ b/queue-4.19/staging-rtl8192e-fix-potential-use-after-free-in-rtl.patch @@ -0,0 +1,41 @@ +From e1b3cc2880172c81daddaba82726f9de897e74db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 16:12:53 +0800 +Subject: staging: rtl8192e: Fix potential use-after-free in + rtllib_rx_Monitor() + +From: YueHaibing + +[ Upstream commit d30f4436f364b4ad915ca2c09be07cd0f93ceb44 ] + +The skb is delivered to netif_rx() in rtllib_monitor_rx(), which may free it, +after calling this, dereferencing skb may trigger use-after-free. +Found by Smatch. + +Fixes: 94a799425eee ("From: wlanfae [PATCH 1/8] rtl8192e: Import new version of driver from realtek") +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20221123081253.22296-1-yuehaibing@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/rtllib_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192e/rtllib_rx.c b/drivers/staging/rtl8192e/rtllib_rx.c +index 3bfd63fe4ac1..004d89853a68 100644 +--- a/drivers/staging/rtl8192e/rtllib_rx.c ++++ b/drivers/staging/rtl8192e/rtllib_rx.c +@@ -1500,9 +1500,9 @@ static int rtllib_rx_Monitor(struct rtllib_device *ieee, struct sk_buff *skb, + hdrlen += 4; + } + +- rtllib_monitor_rx(ieee, skb, rx_stats, hdrlen); + ieee->stats.rx_packets++; + ieee->stats.rx_bytes += skb->len; ++ rtllib_monitor_rx(ieee, skb, rx_stats, hdrlen); + + return 1; + } +-- +2.35.1 + diff --git a/queue-4.19/staging-rtl8192u-fix-use-after-free-in-ieee80211_rx.patch b/queue-4.19/staging-rtl8192u-fix-use-after-free-in-ieee80211_rx.patch new file mode 100644 index 00000000000..579d501cfd7 --- /dev/null +++ b/queue-4.19/staging-rtl8192u-fix-use-after-free-in-ieee80211_rx.patch @@ -0,0 +1,41 @@ +From d9e05f966c7cb5a24f324cd9a26491a207640c75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 09:43:14 +0300 +Subject: staging: rtl8192u: Fix use after free in ieee80211_rx() + +From: Dan Carpenter + +[ Upstream commit bcc5e2dcf09089b337b76fc1a589f6ff95ca19ac ] + +We cannot dereference the "skb" pointer after calling +ieee80211_monitor_rx(), because it is a use after free. + +Fixes: 8fc8598e61f6 ("Staging: Added Realtek rtl8192u driver to staging") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/Y33BArx3k/aw6yv/@kili +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c +index fb824c517449..14b3daa5f17e 100644 +--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c ++++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c +@@ -961,9 +961,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb, + #endif + + if (ieee->iw_mode == IW_MODE_MONITOR) { ++ unsigned int len = skb->len; ++ + ieee80211_monitor_rx(ieee, skb, rx_stats); + stats->rx_packets++; +- stats->rx_bytes += skb->len; ++ stats->rx_bytes += len; + return 1; + } + +-- +2.35.1 + diff --git a/queue-4.19/staging-vme_user-fix-possible-uaf-in-tsi148_dma_list.patch b/queue-4.19/staging-vme_user-fix-possible-uaf-in-tsi148_dma_list.patch new file mode 100644 index 00000000000..abe9eb77d8d --- /dev/null +++ b/queue-4.19/staging-vme_user-fix-possible-uaf-in-tsi148_dma_list.patch @@ -0,0 +1,44 @@ +From 36a7e9c57934d79a8ce971537852d187924036ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 11:59:14 +0800 +Subject: staging: vme_user: Fix possible UAF in tsi148_dma_list_add + +From: Gaosheng Cui + +[ Upstream commit 357057ee55d3c99a5de5abe8150f7bca04f8e53b ] + +Smatch report warning as follows: + +drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn: + '&entry->list' not removed from list + +In tsi148_dma_list_add(), the error path "goto err_dma" will not +remove entry->list from list->entries, but entry will be freed, +then list traversal may cause UAF. + +Fix by removeing it from list->entries before free(). + +Fixes: b2383c90a9d6 ("vme: tsi148: fix first DMA item mapping") +Signed-off-by: Gaosheng Cui +Link: https://lore.kernel.org/r/20221117035914.2954454-1-cuigaosheng1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/vme/bridges/vme_tsi148.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vme/bridges/vme_tsi148.c b/drivers/vme/bridges/vme_tsi148.c +index 647d231d4422..b1be12dc61eb 100644 +--- a/drivers/vme/bridges/vme_tsi148.c ++++ b/drivers/vme/bridges/vme_tsi148.c +@@ -1775,6 +1775,7 @@ static int tsi148_dma_list_add(struct vme_dma_list *list, + return 0; + + err_dma: ++ list_del(&entry->list); + err_dest: + err_source: + err_align: +-- +2.35.1 + diff --git a/queue-4.19/stmmac-fix-potential-division-by-0.patch b/queue-4.19/stmmac-fix-potential-division-by-0.patch new file mode 100644 index 00000000000..2d57cfd3226 --- /dev/null +++ b/queue-4.19/stmmac-fix-potential-division-by-0.patch @@ -0,0 +1,89 @@ +From 07e0195e932d5a74200ef76e0d8afab93fa645ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Dec 2022 23:37:22 +0100 +Subject: stmmac: fix potential division by 0 + +From: Piergiorgio Beruto + +[ Upstream commit ede5a389852d3640a28e7187fb32b7f204380901 ] + +When the MAC is connected to a 10 Mb/s PHY and the PTP clock is derived +from the MAC reference clock (default), the clk_ptp_rate becomes too +small and the calculated sub second increment becomes 0 when computed by +the stmmac_config_sub_second_increment() function within +stmmac_init_tstamp_counter(). + +Therefore, the subsequent div_u64 in stmmac_init_tstamp_counter() +operation triggers a divide by 0 exception as shown below. + +[ 95.062067] socfpga-dwmac ff700000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 +[ 95.076440] socfpga-dwmac ff700000.ethernet eth0: PHY [stmmac-0:08] driver [NCN26000] (irq=49) +[ 95.095964] dwmac1000: Master AXI performs any burst length +[ 95.101588] socfpga-dwmac ff700000.ethernet eth0: No Safety Features support found +[ 95.109428] Division by zero in kernel. +[ 95.113447] CPU: 0 PID: 239 Comm: ifconfig Not tainted 6.1.0-rc7-centurion3-1.0.3.0-01574-gb624218205b7-dirty #77 +[ 95.123686] Hardware name: Altera SOCFPGA +[ 95.127695] unwind_backtrace from show_stack+0x10/0x14 +[ 95.132938] show_stack from dump_stack_lvl+0x40/0x4c +[ 95.137992] dump_stack_lvl from Ldiv0+0x8/0x10 +[ 95.142527] Ldiv0 from __aeabi_uidivmod+0x8/0x18 +[ 95.147232] __aeabi_uidivmod from div_u64_rem+0x1c/0x40 +[ 95.152552] div_u64_rem from stmmac_init_tstamp_counter+0xd0/0x164 +[ 95.158826] stmmac_init_tstamp_counter from stmmac_hw_setup+0x430/0xf00 +[ 95.165533] stmmac_hw_setup from __stmmac_open+0x214/0x2d4 +[ 95.171117] __stmmac_open from stmmac_open+0x30/0x44 +[ 95.176182] stmmac_open from __dev_open+0x11c/0x134 +[ 95.181172] __dev_open from __dev_change_flags+0x168/0x17c +[ 95.186750] __dev_change_flags from dev_change_flags+0x14/0x50 +[ 95.192662] dev_change_flags from devinet_ioctl+0x2b4/0x604 +[ 95.198321] devinet_ioctl from inet_ioctl+0x1ec/0x214 +[ 95.203462] inet_ioctl from sock_ioctl+0x14c/0x3c4 +[ 95.208354] sock_ioctl from vfs_ioctl+0x20/0x38 +[ 95.212984] vfs_ioctl from sys_ioctl+0x250/0x844 +[ 95.217691] sys_ioctl from ret_fast_syscall+0x0/0x4c +[ 95.222743] Exception stack(0xd0ee1fa8 to 0xd0ee1ff0) +[ 95.227790] 1fa0: 00574c4f be9aeca4 00000003 00008914 be9aeca4 be9aec50 +[ 95.235945] 1fc0: 00574c4f be9aeca4 0059f078 00000036 be9aee8c be9aef7a 00000015 00000000 +[ 95.244096] 1fe0: 005a01f0 be9aec38 004d7484 b6e67d74 + +Signed-off-by: Piergiorgio Beruto +Fixes: 91a2559c1dc5 ("net: stmmac: Fix sub-second increment") +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/de4c64ccac9084952c56a06a8171d738604c4770.1670678513.git.piergiorgio.beruto@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 3 ++- + drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h | 2 +- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +index 08a058e1bc75..541c0449f31c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +@@ -53,7 +53,8 @@ static void config_sub_second_increment(void __iomem *ioaddr, + if (!(value & PTP_TCR_TSCTRLSSR)) + data = (data * 1000) / 465; + +- data &= PTP_SSIR_SSINC_MASK; ++ if (data > PTP_SSIR_SSINC_MAX) ++ data = PTP_SSIR_SSINC_MAX; + + reg_value = data; + if (gmac4) +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h +index ecccf895fd7e..306ebf1a495e 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.h +@@ -66,7 +66,7 @@ + #define PTP_TCR_TSENMACADDR BIT(18) + + /* SSIR defines */ +-#define PTP_SSIR_SSINC_MASK 0xff ++#define PTP_SSIR_SSINC_MAX 0xff + #define GMAC4_PTP_SSIR_SSINC_SHIFT 16 + + #endif /* __STMMAC_PTP_H__ */ +-- +2.35.1 + diff --git a/queue-4.19/sunrpc-fix-missing-release-socket-in-rpc_sockname.patch b/queue-4.19/sunrpc-fix-missing-release-socket-in-rpc_sockname.patch new file mode 100644 index 00000000000..d9fd73332e1 --- /dev/null +++ b/queue-4.19/sunrpc-fix-missing-release-socket-in-rpc_sockname.patch @@ -0,0 +1,37 @@ +From 9a7a3fcc7577e13b988d4d2482261b26cd4f45f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 17:23:42 +0800 +Subject: SUNRPC: Fix missing release socket in rpc_sockname() + +From: Wang ShaoBo + +[ Upstream commit 50fa355bc0d75911fe9d5072a5ba52cdb803aff7 ] + +socket dynamically created is not released when getting an unintended +address family type in rpc_sockname(), direct to out_release for calling +sock_release(). + +Fixes: 2e738fdce22f ("SUNRPC: Add API to acquire source address") +Signed-off-by: Wang ShaoBo +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/clnt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 0d7d149b1b1b..1946bd13d5df 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1267,7 +1267,7 @@ static int rpc_sockname(struct net *net, struct sockaddr *sap, size_t salen, + break; + default: + err = -EAFNOSUPPORT; +- goto out; ++ goto out_release; + } + if (err < 0) { + dprintk("RPC: can't bind UDP socket (%d)\n", err); +-- +2.35.1 + diff --git a/queue-4.19/test_firmware-fix-memory-leak-in-test_firmware_init.patch b/queue-4.19/test_firmware-fix-memory-leak-in-test_firmware_init.patch new file mode 100644 index 00000000000..ebea887856b --- /dev/null +++ b/queue-4.19/test_firmware-fix-memory-leak-in-test_firmware_init.patch @@ -0,0 +1,54 @@ +From 8f6ada054c71f49fc2397011aa1008a119f80b10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Nov 2022 11:57:21 +0800 +Subject: test_firmware: fix memory leak in test_firmware_init() + +From: Zhengchao Shao + +[ Upstream commit 7610615e8cdb3f6f5bbd9d8e7a5d8a63e3cabf2e ] + +When misc_register() failed in test_firmware_init(), the memory pointed +by test_fw_config->name is not released. The memory leak information is +as follows: +unreferenced object 0xffff88810a34cb00 (size 32): + comm "insmod", pid 7952, jiffies 4294948236 (age 49.060s) + hex dump (first 32 bytes): + 74 65 73 74 2d 66 69 72 6d 77 61 72 65 2e 62 69 test-firmware.bi + 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 n............... + backtrace: + [] __kmalloc_node_track_caller+0x4b/0xc0 + [] kstrndup+0x46/0xc0 + [] __test_firmware_config_init+0x29/0x380 [test_firmware] + [] 0xffffffffa040f068 + [] do_one_initcall+0x141/0x780 + [] do_init_module+0x1c3/0x630 + [] load_module+0x623e/0x76a0 + [] __do_sys_finit_module+0x181/0x240 + [] do_syscall_64+0x39/0xb0 + [] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: c92316bf8e94 ("test_firmware: add batched firmware tests") +Signed-off-by: Zhengchao Shao +Acked-by: Luis Chamberlain +Link: https://lore.kernel.org/r/20221119035721.18268-1-shaozhengchao@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/test_firmware.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/test_firmware.c b/lib/test_firmware.c +index a74b1aae7461..f4cc874021da 100644 +--- a/lib/test_firmware.c ++++ b/lib/test_firmware.c +@@ -902,6 +902,7 @@ static int __init test_firmware_init(void) + + rc = misc_register(&test_fw_misc_device); + if (rc) { ++ __test_firmware_config_free(); + kfree(test_fw_config); + pr_err("could not register misc device: %d\n", rc); + return rc; +-- +2.35.1 + diff --git a/queue-4.19/timerqueue-use-rb_entry_safe-in-timerqueue_getnext.patch b/queue-4.19/timerqueue-use-rb_entry_safe-in-timerqueue_getnext.patch new file mode 100644 index 00000000000..0e75a445f5e --- /dev/null +++ b/queue-4.19/timerqueue-use-rb_entry_safe-in-timerqueue_getnext.patch @@ -0,0 +1,44 @@ +From e332650e76485438fb931e982ccbe8678511c095 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 19:54:23 +0000 +Subject: timerqueue: Use rb_entry_safe() in timerqueue_getnext() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Barnabás Pőcze + +[ Upstream commit 2f117484329b233455ee278f2d9b0a4356835060 ] + +When `timerqueue_getnext()` is called on an empty timer queue, it will +use `rb_entry()` on a NULL pointer, which is invalid. Fix that by using +`rb_entry_safe()` which handles NULL pointers. + +This has not caused any issues so far because the offset of the `rb_node` +member in `timerqueue_node` is 0, so `rb_entry()` is essentially a no-op. + +Fixes: 511885d7061e ("lib/timerqueue: Rely on rbtree semantics for next timer") +Signed-off-by: Barnabás Pőcze +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20221114195421.342929-1-pobrn@protonmail.com +Signed-off-by: Sasha Levin +--- + include/linux/timerqueue.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/timerqueue.h b/include/linux/timerqueue.h +index aff122f1062a..e1a843cb16d4 100644 +--- a/include/linux/timerqueue.h ++++ b/include/linux/timerqueue.h +@@ -35,7 +35,7 @@ struct timerqueue_node *timerqueue_getnext(struct timerqueue_head *head) + { + struct rb_node *leftmost = rb_first_cached(&head->rb_root); + +- return rb_entry(leftmost, struct timerqueue_node, node); ++ return rb_entry_safe(leftmost, struct timerqueue_node, node); + } + + static inline void timerqueue_init(struct timerqueue_node *node) +-- +2.35.1 + diff --git a/queue-4.19/tpm-tpm_crb-fix-error-message-in-__crb_relinquish_lo.patch b/queue-4.19/tpm-tpm_crb-fix-error-message-in-__crb_relinquish_lo.patch new file mode 100644 index 00000000000..caae28f3d95 --- /dev/null +++ b/queue-4.19/tpm-tpm_crb-fix-error-message-in-__crb_relinquish_lo.patch @@ -0,0 +1,38 @@ +From c4b3444948cba934b2baec2227051116bda84be2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 11:38:53 -0800 +Subject: tpm/tpm_crb: Fix error message in __crb_relinquish_locality() + +From: Michael Kelley + +[ Upstream commit f5264068071964b56dc02c9dab3d11574aaca6ff ] + +The error message in __crb_relinquish_locality() mentions requestAccess +instead of Relinquish. Fix it. + +Fixes: 888d867df441 ("tpm: cmd_ready command can be issued only after granting locality") +Signed-off-by: Michael Kelley +Acked-by: Tomas Winkler +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_crb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c +index 20f27100708b..101c71c78e2f 100644 +--- a/drivers/char/tpm/tpm_crb.c ++++ b/drivers/char/tpm/tpm_crb.c +@@ -256,7 +256,7 @@ static int __crb_relinquish_locality(struct device *dev, + iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl); + if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value, + TPM2_TIMEOUT_C)) { +- dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n"); ++ dev_warn(dev, "TPM_LOC_STATE_x.Relinquish timed out\n"); + return -ETIME; + } + +-- +2.35.1 + diff --git a/queue-4.19/tracing-hist-fix-issue-of-losting-command-info-in-er.patch b/queue-4.19/tracing-hist-fix-issue-of-losting-command-info-in-er.patch new file mode 100644 index 00000000000..a5d717c7bff --- /dev/null +++ b/queue-4.19/tracing-hist-fix-issue-of-losting-command-info-in-er.patch @@ -0,0 +1,93 @@ +From a796f840124785765566921057fd973bb47c978a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Dec 2022 21:53:26 +0800 +Subject: tracing/hist: Fix issue of losting command info in error_log + +From: Zheng Yejian + +[ Upstream commit 608c6ed3337850c767ab0dd6c583477922233e29 ] + +When input some constructed invalid 'trigger' command, command info +in 'error_log' are lost [1]. + +The root cause is that there is a path that event_hist_trigger_parse() +is recursely called once and 'last_cmd' which save origin command is +cleared, then later calling of hist_err() will no longer record origin +command info: + + event_hist_trigger_parse() { + last_cmd_set() // <1> 'last_cmd' save origin command here at first + create_actions() { + onmatch_create() { + action_create() { + trace_action_create() { + trace_action_create_field_var() { + create_field_var_hist() { + event_hist_trigger_parse() { // <2> recursely called once + hist_err_clear() // <3> 'last_cmd' is cleared here + } + hist_err() // <4> No longer find origin command!!! + +Since 'glob' is empty string while running into the recurse call, we +can trickly check it and bypass the call of hist_err_clear() to solve it. + +[1] + # cd /sys/kernel/tracing + # echo "my_synth_event int v1; int v2; int v3;" >> synthetic_events + # echo 'hist:keys=pid' >> events/sched/sched_waking/trigger + # echo "hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(\ +pid,pid1)" >> events/sched/sched_switch/trigger + # cat error_log +[ 8.405018] hist:sched:sched_switch: error: Couldn't find synthetic event + Command: +hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) + ^ +[ 8.816902] hist:sched:sched_switch: error: Couldn't find field + Command: +hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) + ^ +[ 8.816902] hist:sched:sched_switch: error: Couldn't parse field variable + Command: +hist:keys=next_pid:onmatch(sched.sched_waking).my_synth_event(pid,pid1) + ^ +[ 8.999880] : error: Couldn't find field + Command: + ^ +[ 8.999880] : error: Couldn't parse field variable + Command: + ^ +[ 8.999880] : error: Couldn't find field + Command: + ^ +[ 8.999880] : error: Couldn't create histogram for field + Command: + ^ + +Link: https://lore.kernel.org/linux-trace-kernel/20221207135326.3483216-1-zhengyejian1@huawei.com + +Cc: +Cc: +Fixes: f404da6e1d46 ("tracing: Add 'last error' error facility for hist triggers") +Signed-off-by: Zheng Yejian +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_hist.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 48f85dab9ef1..17b15bd97857 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -5807,7 +5807,7 @@ static int event_hist_trigger_func(struct event_command *cmd_ops, + /* Just return zero, not the number of registered triggers */ + ret = 0; + out: +- if (ret == 0) ++ if (ret == 0 && glob[0]) + hist_err_clear(); + + return ret; +-- +2.35.1 + diff --git a/queue-4.19/tty-serial-altera_uart_-r-t-x_chars-need-only-uart_p.patch b/queue-4.19/tty-serial-altera_uart_-r-t-x_chars-need-only-uart_p.patch new file mode 100644 index 00000000000..07df2bd5f1f --- /dev/null +++ b/queue-4.19/tty-serial-altera_uart_-r-t-x_chars-need-only-uart_p.patch @@ -0,0 +1,71 @@ +From baedaac3920fcc03e342cb74381a96c569462814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 07:20:43 +0200 +Subject: tty: serial: altera_uart_{r,t}x_chars() need only uart_port +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Slaby + +[ Upstream commit 3af44d9bb0539d5fa27d6159d696fda5f3747bff ] + +Both altera_uart_{r,t}x_chars() need only uart_port, not altera_uart. So +pass the former from altera_uart_interrupt() directly. + +Apart it maybe saves a dereference, this makes the transition of +altera_uart_tx_chars() easier to follow in the next patch. + +Cc: Tobias Klauser +Reviewed-by: Ilpo Järvinen +Acked-by: Tobias Klauser +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20220920052049.20507-4-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 1307c5d33cce ("serial: altera_uart: fix locking in polling mode") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/altera_uart.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c +index 508a3c2b7781..20c610440133 100644 +--- a/drivers/tty/serial/altera_uart.c ++++ b/drivers/tty/serial/altera_uart.c +@@ -199,9 +199,8 @@ static void altera_uart_set_termios(struct uart_port *port, + */ + } + +-static void altera_uart_rx_chars(struct altera_uart *pp) ++static void altera_uart_rx_chars(struct uart_port *port) + { +- struct uart_port *port = &pp->port; + unsigned char ch, flag; + unsigned short status; + +@@ -248,9 +247,8 @@ static void altera_uart_rx_chars(struct altera_uart *pp) + spin_lock(&port->lock); + } + +-static void altera_uart_tx_chars(struct altera_uart *pp) ++static void altera_uart_tx_chars(struct uart_port *port) + { +- struct uart_port *port = &pp->port; + struct circ_buf *xmit = &port->state->xmit; + + if (port->x_char) { +@@ -288,9 +286,9 @@ static irqreturn_t altera_uart_interrupt(int irq, void *data) + + spin_lock(&port->lock); + if (isr & ALTERA_UART_STATUS_RRDY_MSK) +- altera_uart_rx_chars(pp); ++ altera_uart_rx_chars(port); + if (isr & ALTERA_UART_STATUS_TRDY_MSK) +- altera_uart_tx_chars(pp); ++ altera_uart_tx_chars(port); + spin_unlock(&port->lock); + + return IRQ_RETVAL(isr); +-- +2.35.1 + diff --git a/queue-4.19/tty-serial-clean-up-stop-tx-part-in-altera_uart_tx_c.patch b/queue-4.19/tty-serial-clean-up-stop-tx-part-in-altera_uart_tx_c.patch new file mode 100644 index 00000000000..df0c12a6173 --- /dev/null +++ b/queue-4.19/tty-serial-clean-up-stop-tx-part-in-altera_uart_tx_c.patch @@ -0,0 +1,48 @@ +From 68a86ac83c368467c6497aef658a77f367c58693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Sep 2022 07:20:42 +0200 +Subject: tty: serial: clean up stop-tx part in altera_uart_tx_chars() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jiri Slaby + +[ Upstream commit d9c128117da41cf4cb0e80ae565b5d3ac79dffac ] + +The "stop TX" path in altera_uart_tx_chars() is open-coded, so: +* use uart_circ_empty() to check if the buffer is empty, and +* when true, call altera_uart_stop_tx(). + +Cc: Tobias Klauser +Reviewed-by: Ilpo Järvinen +Acked-by: Tobias Klauser +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20220920052049.20507-3-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 1307c5d33cce ("serial: altera_uart: fix locking in polling mode") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/altera_uart.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c +index 0e487ce091ac..508a3c2b7781 100644 +--- a/drivers/tty/serial/altera_uart.c ++++ b/drivers/tty/serial/altera_uart.c +@@ -274,10 +274,8 @@ static void altera_uart_tx_chars(struct altera_uart *pp) + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); + +- if (xmit->head == xmit->tail) { +- pp->imr &= ~ALTERA_UART_CONTROL_TRDY_MSK; +- altera_uart_update_ctrl_reg(pp); +- } ++ if (uart_circ_empty(xmit)) ++ altera_uart_stop_tx(port); + } + + static irqreturn_t altera_uart_interrupt(int irq, void *data) +-- +2.35.1 + diff --git a/queue-4.19/tty-serial-tegra-activate-rx-dma-transfer-by-request.patch b/queue-4.19/tty-serial-tegra-activate-rx-dma-transfer-by-request.patch new file mode 100644 index 00000000000..e6b91e9d4a7 --- /dev/null +++ b/queue-4.19/tty-serial-tegra-activate-rx-dma-transfer-by-request.patch @@ -0,0 +1,217 @@ +From 459b578d7bf5bb60ff3513dc09bb127024eac9cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Jan 2020 21:09:18 +0300 +Subject: tty: serial: tegra: Activate RX DMA transfer by request + +From: Dmitry Osipenko + +[ Upstream commit d5e3fadb70125c6c41f692cf1c0e626c12e11de1 ] + +This allows DMA engine to go into runtime-suspended mode whenever there is +no data to receive, instead of keeping DMA active all the time while TTY +is opened (i.e. permanently active in practice, like in the case of UART +Bluetooth). + +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20200112180919.5194-2-digetx@gmail.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 109a951a9f1f ("serial: tegra: Read DMA status before terminating") +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial-tegra.c | 78 ++++++++++++++++++------------- + 1 file changed, 46 insertions(+), 32 deletions(-) + +diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c +index d6f5d73ba1e8..1d957144117e 100644 +--- a/drivers/tty/serial/serial-tegra.c ++++ b/drivers/tty/serial/serial-tegra.c +@@ -141,6 +141,7 @@ struct tegra_uart_port { + int configured_rate; + bool use_rx_pio; + bool use_tx_pio; ++ bool rx_dma_active; + }; + + static void tegra_uart_start_next_tx(struct tegra_uart_port *tup); +@@ -677,6 +678,7 @@ static void tegra_uart_rx_dma_complete(void *args) + if (tup->rts_active) + set_rts(tup, false); + ++ tup->rx_dma_active = false; + tegra_uart_rx_buffer_push(tup, 0); + tegra_uart_start_rx_dma(tup); + +@@ -688,18 +690,27 @@ static void tegra_uart_rx_dma_complete(void *args) + spin_unlock_irqrestore(&u->lock, flags); + } + +-static void tegra_uart_handle_rx_dma(struct tegra_uart_port *tup) ++static void tegra_uart_terminate_rx_dma(struct tegra_uart_port *tup) + { + struct dma_tx_state state; + +- /* Deactivate flow control to stop sender */ +- if (tup->rts_active) +- set_rts(tup, false); ++ if (!tup->rx_dma_active) ++ return; + + dmaengine_terminate_all(tup->rx_dma_chan); + dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state); ++ + tegra_uart_rx_buffer_push(tup, state.residue); +- tegra_uart_start_rx_dma(tup); ++ tup->rx_dma_active = false; ++} ++ ++static void tegra_uart_handle_rx_dma(struct tegra_uart_port *tup) ++{ ++ /* Deactivate flow control to stop sender */ ++ if (tup->rts_active) ++ set_rts(tup, false); ++ ++ tegra_uart_terminate_rx_dma(tup); + + if (tup->rts_active) + set_rts(tup, true); +@@ -709,6 +720,9 @@ static int tegra_uart_start_rx_dma(struct tegra_uart_port *tup) + { + unsigned int count = TEGRA_UART_RX_DMA_BUFFER_SIZE; + ++ if (tup->rx_dma_active) ++ return 0; ++ + tup->rx_dma_desc = dmaengine_prep_slave_single(tup->rx_dma_chan, + tup->rx_dma_buf_phys, count, DMA_DEV_TO_MEM, + DMA_PREP_INTERRUPT); +@@ -717,6 +731,7 @@ static int tegra_uart_start_rx_dma(struct tegra_uart_port *tup) + return -EIO; + } + ++ tup->rx_dma_active = true; + tup->rx_dma_desc->callback = tegra_uart_rx_dma_complete; + tup->rx_dma_desc->callback_param = tup; + dma_sync_single_for_device(tup->uport.dev, tup->rx_dma_buf_phys, +@@ -766,6 +781,7 @@ static irqreturn_t tegra_uart_isr(int irq, void *data) + struct uart_port *u = &tup->uport; + unsigned long iir; + unsigned long ier; ++ bool is_rx_start = false; + bool is_rx_int = false; + unsigned long flags; + +@@ -778,10 +794,12 @@ static irqreturn_t tegra_uart_isr(int irq, void *data) + if (tup->rx_in_progress) { + ier = tup->ier_shadow; + ier |= (UART_IER_RLSI | UART_IER_RTOIE | +- TEGRA_UART_IER_EORD); ++ TEGRA_UART_IER_EORD | UART_IER_RDI); + tup->ier_shadow = ier; + tegra_uart_write(tup, ier, UART_IER); + } ++ } else if (is_rx_start) { ++ tegra_uart_start_rx_dma(tup); + } + spin_unlock_irqrestore(&u->lock, flags); + return IRQ_HANDLED; +@@ -800,17 +818,23 @@ static irqreturn_t tegra_uart_isr(int irq, void *data) + + case 4: /* End of data */ + case 6: /* Rx timeout */ +- case 2: /* Receive */ +- if (!tup->use_rx_pio && !is_rx_int) { +- is_rx_int = true; ++ if (!tup->use_rx_pio) { ++ is_rx_int = tup->rx_in_progress; + /* Disable Rx interrupts */ + ier = tup->ier_shadow; +- ier |= UART_IER_RDI; +- tegra_uart_write(tup, ier, UART_IER); + ier &= ~(UART_IER_RDI | UART_IER_RLSI | + UART_IER_RTOIE | TEGRA_UART_IER_EORD); + tup->ier_shadow = ier; + tegra_uart_write(tup, ier, UART_IER); ++ break; ++ } ++ /* Fall through */ ++ case 2: /* Receive */ ++ if (!tup->use_rx_pio) { ++ is_rx_start = tup->rx_in_progress; ++ tup->ier_shadow &= ~UART_IER_RDI; ++ tegra_uart_write(tup, tup->ier_shadow, ++ UART_IER); + } else { + do_handle_rx_pio(tup); + } +@@ -832,7 +856,6 @@ static void tegra_uart_stop_rx(struct uart_port *u) + { + struct tegra_uart_port *tup = to_tegra_uport(u); + struct tty_port *port = &tup->uport.state->port; +- struct dma_tx_state state; + unsigned long ier; + + if (tup->rts_active) +@@ -849,13 +872,11 @@ static void tegra_uart_stop_rx(struct uart_port *u) + tup->ier_shadow = ier; + tegra_uart_write(tup, ier, UART_IER); + tup->rx_in_progress = 0; +- if (tup->rx_dma_chan && !tup->use_rx_pio) { +- dmaengine_terminate_all(tup->rx_dma_chan); +- dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state); +- tegra_uart_rx_buffer_push(tup, state.residue); +- } else { ++ ++ if (!tup->use_rx_pio) ++ tegra_uart_terminate_rx_dma(tup); ++ else + tegra_uart_handle_rx_pio(tup, port); +- } + } + + static void tegra_uart_hw_deinit(struct tegra_uart_port *tup) +@@ -998,12 +1019,6 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + tup->lcr_shadow = TEGRA_UART_DEFAULT_LSR; + tup->fcr_shadow |= UART_FCR_DMA_SELECT; + tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); +- +- ret = tegra_uart_start_rx_dma(tup); +- if (ret < 0) { +- dev_err(tup->uport.dev, "Not able to start Rx DMA\n"); +- return ret; +- } + } else { + tegra_uart_write(tup, tup->fcr_shadow, UART_FCR); + } +@@ -1013,10 +1028,6 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + * Enable IE_RXS for the receive status interrupts like line errros. + * Enable IE_RX_TIMEOUT to get the bytes which cannot be DMA'd. + * +- * If using DMA mode, enable EORD instead of receive interrupt which +- * will interrupt after the UART is done with the receive instead of +- * the interrupt when the FIFO "threshold" is reached. +- * + * EORD is different interrupt than RX_TIMEOUT - RX_TIMEOUT occurs when + * the DATA is sitting in the FIFO and couldn't be transferred to the + * DMA as the DMA size alignment(4 bytes) is not met. EORD will be +@@ -1027,11 +1038,14 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup) + * both the EORD as well as RX_TIMEOUT - SW sees RX_TIMEOUT first + * then the EORD. + */ ++ tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | UART_IER_RDI; ++ ++ /* ++ * If using DMA mode, enable EORD interrupt to notify about RX ++ * completion. ++ */ + if (!tup->use_rx_pio) +- tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | +- TEGRA_UART_IER_EORD; +- else +- tup->ier_shadow = UART_IER_RLSI | UART_IER_RTOIE | UART_IER_RDI; ++ tup->ier_shadow |= TEGRA_UART_IER_EORD; + + tegra_uart_write(tup, tup->ier_shadow, UART_IER); + return 0; +-- +2.35.1 + diff --git a/queue-4.19/udf-avoid-double-brelse-in-udf_rename.patch b/queue-4.19/udf-avoid-double-brelse-in-udf_rename.patch new file mode 100644 index 00000000000..323c75bf200 --- /dev/null +++ b/queue-4.19/udf-avoid-double-brelse-in-udf_rename.patch @@ -0,0 +1,93 @@ +From e35f20185151e5223da4f253deb5f63c60928b91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Oct 2022 18:57:41 +0900 +Subject: udf: Avoid double brelse() in udf_rename() + +From: Shigeru Yoshida + +[ Upstream commit c791730f2554a9ebb8f18df9368dc27d4ebc38c2 ] + +syzbot reported a warning like below [1]: + +VFS: brelse: Trying to free free buffer +WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 +... +Call Trace: + + invalidate_bh_lru+0x99/0x150 + smp_call_function_many_cond+0xe2a/0x10c0 + ? generic_remap_file_range_prep+0x50/0x50 + ? __brelse+0xa0/0xa0 + ? __mutex_lock+0x21c/0x12d0 + ? smp_call_on_cpu+0x250/0x250 + ? rcu_read_lock_sched_held+0xb/0x60 + ? lock_release+0x587/0x810 + ? __brelse+0xa0/0xa0 + ? generic_remap_file_range_prep+0x50/0x50 + on_each_cpu_cond_mask+0x3c/0x80 + blkdev_flush_mapping+0x13a/0x2f0 + blkdev_put_whole+0xd3/0xf0 + blkdev_put+0x222/0x760 + deactivate_locked_super+0x96/0x160 + deactivate_super+0xda/0x100 + cleanup_mnt+0x222/0x3d0 + task_work_run+0x149/0x240 + ? task_work_cancel+0x30/0x30 + do_exit+0xb29/0x2a40 + ? reacquire_held_locks+0x4a0/0x4a0 + ? do_raw_spin_lock+0x12a/0x2b0 + ? mm_update_next_owner+0x7c0/0x7c0 + ? rwlock_bug.part.0+0x90/0x90 + ? zap_other_threads+0x234/0x2d0 + do_group_exit+0xd0/0x2a0 + __x64_sys_exit_group+0x3a/0x50 + do_syscall_64+0x34/0xb0 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The cause of the issue is that brelse() is called on both ofibh.sbh +and ofibh.ebh by udf_find_entry() when it returns NULL. However, +brelse() is called by udf_rename(), too. So, b_count on buffer_head +becomes unbalanced. + +This patch fixes the issue by not calling brelse() by udf_rename() +when udf_find_entry() returns NULL. + +Link: https://syzkaller.appspot.com/bug?id=8297f45698159c6bca8a1f87dc983667c1a1c851 [1] +Reported-by: syzbot+7902cd7684bc35306224@syzkaller.appspotmail.com +Signed-off-by: Shigeru Yoshida +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20221023095741.271430-1-syoshida@redhat.com +Signed-off-by: Sasha Levin +--- + fs/udf/namei.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index d13ded8e2c30..ef251622da13 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -1106,8 +1106,9 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry, + return -EINVAL; + + ofi = udf_find_entry(old_dir, &old_dentry->d_name, &ofibh, &ocfi); +- if (IS_ERR(ofi)) { +- retval = PTR_ERR(ofi); ++ if (!ofi || IS_ERR(ofi)) { ++ if (IS_ERR(ofi)) ++ retval = PTR_ERR(ofi); + goto end_rename; + } + +@@ -1116,8 +1117,7 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry, + + brelse(ofibh.sbh); + tloc = lelb_to_cpu(ocfi.icb.extLocation); +- if (!ofi || udf_get_lb_pblock(old_dir->i_sb, &tloc, 0) +- != old_inode->i_ino) ++ if (udf_get_lb_pblock(old_dir->i_sb, &tloc, 0) != old_inode->i_ino) + goto end_rename; + + nfi = udf_find_entry(new_dir, &new_dentry->d_name, &nfibh, &ncfi); +-- +2.35.1 + diff --git a/queue-4.19/uio-uio_dmem_genirq-fix-deadlock-between-irq-config-.patch b/queue-4.19/uio-uio_dmem_genirq-fix-deadlock-between-irq-config-.patch new file mode 100644 index 00000000000..b318536cc0c --- /dev/null +++ b/queue-4.19/uio-uio_dmem_genirq-fix-deadlock-between-irq-config-.patch @@ -0,0 +1,64 @@ +From 3ee68aea3d494ee573ffe2162689207a9e696e06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Sep 2022 19:40:58 -0300 +Subject: uio: uio_dmem_genirq: Fix deadlock between irq config and handling + +From: Rafael Mendonca + +[ Upstream commit 118b918018175d9fcd8db667f905012e986cc2c9 ] + +This fixes a concurrency issue addressed in commit 34cb27528398 ("UIO: Fix +concurrency issue"): + + "In a SMP case there was a race condition issue between + Uio_pdrv_genirq_irqcontrol() running on one CPU and irq handler on + another CPU. Fix it by spin_locking shared resources access inside irq + handler." + +The implementation of "uio_dmem_genirq" was based on "uio_pdrv_genirq" and +it is used in a similar manner to the "uio_pdrv_genirq" driver with respect +to interrupt configuration and handling. At the time "uio_dmem_genirq" was +merged, both had the same implementation of the 'uio_info' handlers +irqcontrol() and handler(), thus, both had the same concurrency issue +mentioned by the above commit. However, the above patch was only applied to +the "uio_pdrv_genirq" driver. + +Split out from commit 34cb27528398 ("UIO: Fix concurrency issue"). + +Fixes: 0a0c3b5a24bd ("Add new uio device for dynamic memory allocation") +Signed-off-by: Rafael Mendonca +Link: https://lore.kernel.org/r/20220930224100.816175-3-rafaelmendsr@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/uio/uio_dmem_genirq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c +index c25a6bcb2d21..b4b7fa05b29b 100644 +--- a/drivers/uio/uio_dmem_genirq.c ++++ b/drivers/uio/uio_dmem_genirq.c +@@ -113,8 +113,10 @@ static irqreturn_t uio_dmem_genirq_handler(int irq, struct uio_info *dev_info) + * remember the state so we can allow user space to enable it later. + */ + ++ spin_lock(&priv->lock); + if (!test_and_set_bit(0, &priv->flags)) + disable_irq_nosync(irq); ++ spin_unlock(&priv->lock); + + return IRQ_HANDLED; + } +@@ -128,7 +130,8 @@ static int uio_dmem_genirq_irqcontrol(struct uio_info *dev_info, s32 irq_on) + * in the interrupt controller, but keep track of the + * state to prevent per-irq depth damage. + * +- * Serialize this operation to support multiple tasks. ++ * Serialize this operation to support multiple tasks and concurrency ++ * with irq handler on SMP systems. + */ + + spin_lock_irqsave(&priv->lock, flags); +-- +2.35.1 + diff --git a/queue-4.19/uio-uio_dmem_genirq-fix-missing-unlock-in-irq-config.patch b/queue-4.19/uio-uio_dmem_genirq-fix-missing-unlock-in-irq-config.patch new file mode 100644 index 00000000000..f8230941659 --- /dev/null +++ b/queue-4.19/uio-uio_dmem_genirq-fix-missing-unlock-in-irq-config.patch @@ -0,0 +1,127 @@ +From d14f51acecdb6e68cf5211bb71e59b276415dd1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Sep 2022 19:40:57 -0300 +Subject: uio: uio_dmem_genirq: Fix missing unlock in irq configuration + +From: Rafael Mendonca + +[ Upstream commit 9de255c461d1b3f0242b3ad1450c3323a3e00b34 ] + +Commit b74351287d4b ("uio: fix a sleep-in-atomic-context bug in +uio_dmem_genirq_irqcontrol()") started calling disable_irq() without +holding the spinlock because it can sleep. However, that fix introduced +another bug: if interrupt is already disabled and a new disable request +comes in, then the spinlock is not unlocked: + +root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0 +root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0 +root@localhost:~# [ 14.851538] BUG: scheduling while atomic: bash/223/0x00000002 +[ 14.851991] Modules linked in: uio_dmem_genirq uio myfpga(OE) bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper drm snd_pcm ppdev joydev psmouse snd_timer snd e1000fb_sys_fops syscopyarea parport sysfillrect soundcore sysimgblt input_leds pcspkr i2c_piix4 serio_raw floppy evbug qemu_fw_cfg mac_hid pata_acpi ip_tables x_tables autofs4 [last unloaded: parport_pc] +[ 14.854206] CPU: 0 PID: 223 Comm: bash Tainted: G OE 6.0.0-rc7 #21 +[ 14.854786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +[ 14.855664] Call Trace: +[ 14.855861] +[ 14.856025] dump_stack_lvl+0x4d/0x67 +[ 14.856325] dump_stack+0x14/0x1a +[ 14.856583] __schedule_bug.cold+0x4b/0x5c +[ 14.856915] __schedule+0xe81/0x13d0 +[ 14.857199] ? idr_find+0x13/0x20 +[ 14.857456] ? get_work_pool+0x2d/0x50 +[ 14.857756] ? __flush_work+0x233/0x280 +[ 14.858068] ? __schedule+0xa95/0x13d0 +[ 14.858307] ? idr_find+0x13/0x20 +[ 14.858519] ? get_work_pool+0x2d/0x50 +[ 14.858798] schedule+0x6c/0x100 +[ 14.859009] schedule_hrtimeout_range_clock+0xff/0x110 +[ 14.859335] ? tty_write_room+0x1f/0x30 +[ 14.859598] ? n_tty_poll+0x1ec/0x220 +[ 14.859830] ? tty_ldisc_deref+0x1a/0x20 +[ 14.860090] schedule_hrtimeout_range+0x17/0x20 +[ 14.860373] do_select+0x596/0x840 +[ 14.860627] ? __kernel_text_address+0x16/0x50 +[ 14.860954] ? poll_freewait+0xb0/0xb0 +[ 14.861235] ? poll_freewait+0xb0/0xb0 +[ 14.861517] ? rpm_resume+0x49d/0x780 +[ 14.861798] ? common_interrupt+0x59/0xa0 +[ 14.862127] ? asm_common_interrupt+0x2b/0x40 +[ 14.862511] ? __uart_start.isra.0+0x61/0x70 +[ 14.862902] ? __check_object_size+0x61/0x280 +[ 14.863255] core_sys_select+0x1c6/0x400 +[ 14.863575] ? vfs_write+0x1c9/0x3d0 +[ 14.863853] ? vfs_write+0x1c9/0x3d0 +[ 14.864121] ? _copy_from_user+0x45/0x70 +[ 14.864526] do_pselect.constprop.0+0xb3/0xf0 +[ 14.864893] ? do_syscall_64+0x6d/0x90 +[ 14.865228] ? do_syscall_64+0x6d/0x90 +[ 14.865556] __x64_sys_pselect6+0x76/0xa0 +[ 14.865906] do_syscall_64+0x60/0x90 +[ 14.866214] ? syscall_exit_to_user_mode+0x2a/0x50 +[ 14.866640] ? do_syscall_64+0x6d/0x90 +[ 14.866972] ? do_syscall_64+0x6d/0x90 +[ 14.867286] ? do_syscall_64+0x6d/0x90 +[ 14.867626] entry_SYSCALL_64_after_hwframe+0x63/0xcd +[...] stripped +[ 14.872959] + +('myfpga' is a simple 'uio_dmem_genirq' driver I wrote to test this) + +The implementation of "uio_dmem_genirq" was based on "uio_pdrv_genirq" and +it is used in a similar manner to the "uio_pdrv_genirq" driver with respect +to interrupt configuration and handling. At the time "uio_dmem_genirq" was +introduced, both had the same implementation of the 'uio_info' handlers +irqcontrol() and handler(). Then commit 34cb27528398 ("UIO: Fix concurrency +issue"), which was only applied to "uio_pdrv_genirq", ended up making them +a little different. That commit, among other things, changed disable_irq() +to disable_irq_nosync() in the implementation of irqcontrol(). The +motivation there was to avoid a deadlock between irqcontrol() and +handler(), since it added a spinlock in the irq handler, and disable_irq() +waits for the completion of the irq handler. + +By changing disable_irq() to disable_irq_nosync() in irqcontrol(), we also +avoid the sleeping-while-atomic bug that commit b74351287d4b ("uio: fix a +sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()") was trying to +fix. Thus, this fixes the missing unlock in irqcontrol() by importing the +implementation of irqcontrol() handler from the "uio_pdrv_genirq" driver. +In the end, it reverts commit b74351287d4b ("uio: fix a +sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()") and change +disable_irq() to disable_irq_nosync(). + +It is worth noting that this still does not address the concurrency issue +fixed by commit 34cb27528398 ("UIO: Fix concurrency issue"). It will be +addressed separately in the next commits. + +Split out from commit 34cb27528398 ("UIO: Fix concurrency issue"). + +Fixes: b74351287d4b ("uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()") +Signed-off-by: Rafael Mendonca +Link: https://lore.kernel.org/r/20220930224100.816175-2-rafaelmendsr@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/uio/uio_dmem_genirq.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c +index a00b4aee6c79..c25a6bcb2d21 100644 +--- a/drivers/uio/uio_dmem_genirq.c ++++ b/drivers/uio/uio_dmem_genirq.c +@@ -135,13 +135,11 @@ static int uio_dmem_genirq_irqcontrol(struct uio_info *dev_info, s32 irq_on) + if (irq_on) { + if (test_and_clear_bit(0, &priv->flags)) + enable_irq(dev_info->irq); +- spin_unlock_irqrestore(&priv->lock, flags); + } else { +- if (!test_and_set_bit(0, &priv->flags)) { +- spin_unlock_irqrestore(&priv->lock, flags); +- disable_irq(dev_info->irq); +- } ++ if (!test_and_set_bit(0, &priv->flags)) ++ disable_irq_nosync(dev_info->irq); + } ++ spin_unlock_irqrestore(&priv->lock, flags); + + return 0; + } +-- +2.35.1 + diff --git a/queue-4.19/uprobes-x86-allow-to-probe-a-nop-instruction-with-0x.patch b/queue-4.19/uprobes-x86-allow-to-probe-a-nop-instruction-with-0x.patch new file mode 100644 index 00000000000..fbb1f9960d8 --- /dev/null +++ b/queue-4.19/uprobes-x86-allow-to-probe-a-nop-instruction-with-0x.patch @@ -0,0 +1,53 @@ +From 100a877b2e93025e6b871d07b210054f46254502 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Dec 2022 18:39:33 +0100 +Subject: uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix + +From: Oleg Nesterov + +[ Upstream commit cefa72129e45313655d53a065b8055aaeb01a0c9 ] + +Intel ICC -hotpatch inserts 2-byte "0x66 0x90" NOP at the start of each +function to reserve extra space for hot-patching, and currently it is not +possible to probe these functions because branch_setup_xol_ops() wrongly +rejects NOP with REP prefix as it treats them like word-sized branch +instructions. + +Fixes: 250bbd12c2fe ("uprobes/x86: Refuse to attach uprobe to "word-sized" branch insns") +Reported-by: Seiji Nishikawa +Suggested-by: Denys Vlasenko +Signed-off-by: Oleg Nesterov +Signed-off-by: Thomas Gleixner +Acked-by: Masami Hiramatsu (Google) +Link: https://lore.kernel.org/r/20221204173933.GA31544@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/uprobes.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index ae9e806a11de..3b87bca027b4 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -735,8 +735,9 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn) + switch (opc1) { + case 0xeb: /* jmp 8 */ + case 0xe9: /* jmp 32 */ +- case 0x90: /* prefix* + nop; same as jmp with .offs = 0 */ + break; ++ case 0x90: /* prefix* + nop; same as jmp with .offs = 0 */ ++ goto setup; + + case 0xe8: /* call relative */ + branch_clear_offset(auprobe, insn); +@@ -765,6 +766,7 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn) + return -ENOTSUPP; + } + ++setup: + auprobe->branch.opc1 = opc1; + auprobe->branch.ilen = insn->length; + auprobe->branch.offs = insn->immediate.value; +-- +2.35.1 + diff --git a/queue-4.19/usb-fotg210-udc-fix-ages-old-endianness-issues.patch b/queue-4.19/usb-fotg210-udc-fix-ages-old-endianness-issues.patch new file mode 100644 index 00000000000..0c7a2a26d3f --- /dev/null +++ b/queue-4.19/usb-fotg210-udc-fix-ages-old-endianness-issues.patch @@ -0,0 +1,71 @@ +From 4a243ed6dc18d8ad887b471f6b069c63479aca0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Nov 2022 10:03:17 +0100 +Subject: usb: fotg210-udc: Fix ages old endianness issues + +From: Linus Walleij + +[ Upstream commit 46ed6026ca2181c917c8334a82e3eaf40a6234dd ] + +The code in the FOTG210 driver isn't entirely endianness-agnostic +as reported by the kernel robot sparse testing. This came to +the surface while moving the files around. + +The driver is only used on little-endian systems, so this causes +no real-world regression, but it is nice to be strict and have +some compile coverage also on big endian machines, so fix it +up with the right LE accessors. + +Fixes: b84a8dee23fd ("usb: gadget: add Faraday fotg210_udc driver") +Reported-by: kernel test robot +Link: https://lore.kernel.org/linux-usb/202211110910.0dJ7nZCn-lkp@intel.com/ +Signed-off-by: Linus Walleij +Link: https://lore.kernel.org/r/20221111090317.94228-1-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 785822ecc3f1..74c93fa7439c 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -633,10 +633,10 @@ static void fotg210_request_error(struct fotg210_udc *fotg210) + static void fotg210_set_address(struct fotg210_udc *fotg210, + struct usb_ctrlrequest *ctrl) + { +- if (ctrl->wValue >= 0x0100) { ++ if (le16_to_cpu(ctrl->wValue) >= 0x0100) { + fotg210_request_error(fotg210); + } else { +- fotg210_set_dev_addr(fotg210, ctrl->wValue); ++ fotg210_set_dev_addr(fotg210, le16_to_cpu(ctrl->wValue)); + fotg210_set_cxdone(fotg210); + } + } +@@ -717,17 +717,17 @@ static void fotg210_get_status(struct fotg210_udc *fotg210, + + switch (ctrl->bRequestType & USB_RECIP_MASK) { + case USB_RECIP_DEVICE: +- fotg210->ep0_data = 1 << USB_DEVICE_SELF_POWERED; ++ fotg210->ep0_data = cpu_to_le16(1 << USB_DEVICE_SELF_POWERED); + break; + case USB_RECIP_INTERFACE: +- fotg210->ep0_data = 0; ++ fotg210->ep0_data = cpu_to_le16(0); + break; + case USB_RECIP_ENDPOINT: + epnum = ctrl->wIndex & USB_ENDPOINT_NUMBER_MASK; + if (epnum) + fotg210->ep0_data = +- fotg210_is_epnstall(fotg210->ep[epnum]) +- << USB_ENDPOINT_HALT; ++ cpu_to_le16(fotg210_is_epnstall(fotg210->ep[epnum]) ++ << USB_ENDPOINT_HALT); + else + fotg210_request_error(fotg210); + break; +-- +2.35.1 + diff --git a/queue-4.19/usb-gadget-f_hid-fix-f_hidg-lifetime-vs-cdev.patch b/queue-4.19/usb-gadget-f_hid-fix-f_hidg-lifetime-vs-cdev.patch new file mode 100644 index 00000000000..658b22a8fff --- /dev/null +++ b/queue-4.19/usb-gadget-f_hid-fix-f_hidg-lifetime-vs-cdev.patch @@ -0,0 +1,164 @@ +From 2a42d587f178f381ba6efbc81868e63a00e6e52a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 12:35:21 +0000 +Subject: usb: gadget: f_hid: fix f_hidg lifetime vs cdev + +From: John Keeping + +[ Upstream commit 89ff3dfac604614287ad5aad9370c3f984ea3f4b ] + +The embedded struct cdev does not have its lifetime correctly tied to +the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN +is held open while the gadget is deleted. + +This can readily be replicated with libusbgx's example programs (for +conciseness - operating directly via configfs is equivalent): + + gadget-hid + exec 3<> /dev/hidg0 + gadget-vid-pid-remove + exec 3<&- + +Pull the existing device up in to struct f_hidg and make use of the +cdev_device_{add,del}() helpers. This changes the lifetime of the +device object to match struct f_hidg, but note that it is still added +and deleted at the same time. + +Fixes: 71adf1189469 ("USB: gadget: add HID gadget driver") +Tested-by: Lee Jones +Reviewed-by: Andrzej Pietrasiewicz +Reviewed-by: Lee Jones +Signed-off-by: John Keeping +Link: https://lore.kernel.org/r/20221122123523.3068034-2-john@metanate.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_hid.c | 52 ++++++++++++++++------------- + 1 file changed, 28 insertions(+), 24 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index 0c200f152036..2aaa3ea74e5a 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -71,7 +71,7 @@ struct f_hidg { + wait_queue_head_t write_queue; + struct usb_request *req; + +- int minor; ++ struct device dev; + struct cdev cdev; + struct usb_function func; + +@@ -84,6 +84,14 @@ static inline struct f_hidg *func_to_hidg(struct usb_function *f) + return container_of(f, struct f_hidg, func); + } + ++static void hidg_release(struct device *dev) ++{ ++ struct f_hidg *hidg = container_of(dev, struct f_hidg, dev); ++ ++ kfree(hidg->set_report_buf); ++ kfree(hidg); ++} ++ + /*-------------------------------------------------------------------------*/ + /* Static descriptors */ + +@@ -910,9 +918,7 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) + struct usb_ep *ep; + struct f_hidg *hidg = func_to_hidg(f); + struct usb_string *us; +- struct device *device; + int status; +- dev_t dev; + + /* maybe allocate device-global string IDs, and patch descriptors */ + us = usb_gstrings_attach(c->cdev, ct_func_strings, +@@ -1005,21 +1011,11 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) + + /* create char device */ + cdev_init(&hidg->cdev, &f_hidg_fops); +- dev = MKDEV(major, hidg->minor); +- status = cdev_add(&hidg->cdev, dev, 1); ++ status = cdev_device_add(&hidg->cdev, &hidg->dev); + if (status) + goto fail_free_descs; + +- device = device_create(hidg_class, NULL, dev, NULL, +- "%s%d", "hidg", hidg->minor); +- if (IS_ERR(device)) { +- status = PTR_ERR(device); +- goto del; +- } +- + return 0; +-del: +- cdev_del(&hidg->cdev); + fail_free_descs: + usb_free_all_descriptors(f); + fail: +@@ -1250,9 +1246,7 @@ static void hidg_free(struct usb_function *f) + + hidg = func_to_hidg(f); + opts = container_of(f->fi, struct f_hid_opts, func_inst); +- kfree(hidg->report_desc); +- kfree(hidg->set_report_buf); +- kfree(hidg); ++ put_device(&hidg->dev); + mutex_lock(&opts->lock); + --opts->refcnt; + mutex_unlock(&opts->lock); +@@ -1262,8 +1256,7 @@ static void hidg_unbind(struct usb_configuration *c, struct usb_function *f) + { + struct f_hidg *hidg = func_to_hidg(f); + +- device_destroy(hidg_class, MKDEV(major, hidg->minor)); +- cdev_del(&hidg->cdev); ++ cdev_device_del(&hidg->cdev, &hidg->dev); + + usb_free_all_descriptors(f); + } +@@ -1272,6 +1265,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) + { + struct f_hidg *hidg; + struct f_hid_opts *opts; ++ int ret; + + /* allocate and initialize one new instance */ + hidg = kzalloc(sizeof(*hidg), GFP_KERNEL); +@@ -1283,17 +1277,27 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) + mutex_lock(&opts->lock); + ++opts->refcnt; + +- hidg->minor = opts->minor; ++ device_initialize(&hidg->dev); ++ hidg->dev.release = hidg_release; ++ hidg->dev.class = hidg_class; ++ hidg->dev.devt = MKDEV(major, opts->minor); ++ ret = dev_set_name(&hidg->dev, "hidg%d", opts->minor); ++ if (ret) { ++ --opts->refcnt; ++ mutex_unlock(&opts->lock); ++ return ERR_PTR(ret); ++ } ++ + hidg->bInterfaceSubClass = opts->subclass; + hidg->bInterfaceProtocol = opts->protocol; + hidg->report_length = opts->report_length; + hidg->report_desc_length = opts->report_desc_length; + if (opts->report_desc) { +- hidg->report_desc = kmemdup(opts->report_desc, +- opts->report_desc_length, +- GFP_KERNEL); ++ hidg->report_desc = devm_kmemdup(&hidg->dev, opts->report_desc, ++ opts->report_desc_length, ++ GFP_KERNEL); + if (!hidg->report_desc) { +- kfree(hidg); ++ put_device(&hidg->dev); + mutex_unlock(&opts->lock); + return ERR_PTR(-ENOMEM); + } +-- +2.35.1 + diff --git a/queue-4.19/usb-gadget-f_hid-fix-refcount-leak-on-error-path.patch b/queue-4.19/usb-gadget-f_hid-fix-refcount-leak-on-error-path.patch new file mode 100644 index 00000000000..eb8e151ce52 --- /dev/null +++ b/queue-4.19/usb-gadget-f_hid-fix-refcount-leak-on-error-path.patch @@ -0,0 +1,40 @@ +From d8640720a46a840a67ce2b1a8bbe22b1209e3ff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Nov 2022 12:35:22 +0000 +Subject: usb: gadget: f_hid: fix refcount leak on error path + +From: John Keeping + +[ Upstream commit 70a3288a7586526315105c699b687d78cd32559a ] + +When failing to allocate report_desc, opts->refcnt has already been +incremented so it needs to be decremented to avoid leaving the options +structure permanently locked. + +Fixes: 21a9476a7ba8 ("usb: gadget: hid: add configfs support") +Tested-by: Lee Jones +Reviewed-by: Andrzej Pietrasiewicz +Reviewed-by: Lee Jones +Signed-off-by: John Keeping +Link: https://lore.kernel.org/r/20221122123523.3068034-3-john@metanate.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_hid.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index 2aaa3ea74e5a..ea877cba0763 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -1298,6 +1298,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) + GFP_KERNEL); + if (!hidg->report_desc) { + put_device(&hidg->dev); ++ --opts->refcnt; + mutex_unlock(&opts->lock); + return ERR_PTR(-ENOMEM); + } +-- +2.35.1 + diff --git a/queue-4.19/usb-gadget-f_hid-optional-setup-set_report-mode.patch b/queue-4.19/usb-gadget-f_hid-optional-setup-set_report-mode.patch new file mode 100644 index 00000000000..5ed3895cef5 --- /dev/null +++ b/queue-4.19/usb-gadget-f_hid-optional-setup-set_report-mode.patch @@ -0,0 +1,508 @@ +From 616daaa2d56582da23154b2cbc2f543d5860e34f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 16:40:04 +0300 +Subject: usb: gadget: f_hid: optional SETUP/SET_REPORT mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxim Devaev + +[ Upstream commit d7428bc26fc767942c38d74b80299bcd4f01e7cb ] + +f_hid provides the OUT Endpoint as only way for receiving reports +from the host. SETUP/SET_REPORT method is not supported, and this causes +a number of compatibility problems with various host drivers, especially +in the case of keyboard emulation using f_hid. + + - Some hosts do not support the OUT Endpoint and ignore it, + so it becomes impossible for the gadget to receive a report + from the host. In the case of a keyboard, the gadget loses + the ability to receive the status of the LEDs. + + - Some BIOSes/UEFIs can't work with HID devices with the OUT Endpoint + at all. This may be due to their bugs or incomplete implementation + of the HID standard. + For example, absolutely all Apple UEFIs can't handle the OUT Endpoint + if it goes after IN Endpoint in the descriptor and require the reverse + order (OUT, IN) which is a violation of the standard. + Other hosts either do not initialize gadgets with a descriptor + containing the OUT Endpoint completely (like some HP and DELL BIOSes + and embedded firmwares like on KVM switches), or initialize them, + but will not poll the IN Endpoint. + +This patch adds configfs option no_out_endpoint=1 to disable +the OUT Endpoint and allows f_hid to receive reports from the host +via SETUP/SET_REPORT. + +Previously, there was such a feature in f_hid, but it was replaced +by the OUT Endpoint [1] in the commit 99c515005857 ("usb: gadget: hidg: +register OUT INT endpoint for SET_REPORT"). So this patch actually +returns the removed functionality while making it optional. +For backward compatibility reasons, the OUT Endpoint mode remains +the default behaviour. + + - The OUT Endpoint mode provides the report queue and reduces + USB overhead (eliminating SETUP routine) on transmitting a report + from the host. + + - If the SETUP/SET_REPORT mode is used, there is no report queue, + so the userspace will only read last report. For classic HID devices + like keyboards this is not a problem, since it's intended to transmit + the status of the LEDs and only the last report is important. + This mode provides better compatibility with strange and buggy + host drivers. + +Both modes passed USBCV tests. Checking with the USB protocol analyzer +also confirmed that everything is working as it should and the new mode +ensures operability in all of the described cases. + +Link: https://www.spinics.net/lists/linux-usb/msg65494.html [1] +Reviewed-by: Maciej Żenczykowski +Acked-by: Felipe Balbi +Signed-off-by: Maxim Devaev +Link: https://lore.kernel.org/r/20210821134004.363217-1-mdevaev@gmail.com +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 89ff3dfac604 ("usb: gadget: f_hid: fix f_hidg lifetime vs cdev") +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_hid.c | 220 +++++++++++++++++++++++----- + drivers/usb/gadget/function/u_hid.h | 1 + + 2 files changed, 188 insertions(+), 33 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index 1d10d29c115b..0c200f152036 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -45,12 +45,25 @@ struct f_hidg { + unsigned short report_desc_length; + char *report_desc; + unsigned short report_length; ++ /* ++ * use_out_ep - if true, the OUT Endpoint (interrupt out method) ++ * will be used to receive reports from the host ++ * using functions with the "intout" suffix. ++ * Otherwise, the OUT Endpoint will not be configured ++ * and the SETUP/SET_REPORT method ("ssreport" suffix) ++ * will be used to receive reports. ++ */ ++ bool use_out_ep; + + /* recv report */ +- struct list_head completed_out_req; + spinlock_t read_spinlock; + wait_queue_head_t read_queue; ++ /* recv report - interrupt out only (use_out_ep == 1) */ ++ struct list_head completed_out_req; + unsigned int qlen; ++ /* recv report - setup set_report only (use_out_ep == 0) */ ++ char *set_report_buf; ++ unsigned int set_report_length; + + /* send report */ + spinlock_t write_spinlock; +@@ -79,7 +92,7 @@ static struct usb_interface_descriptor hidg_interface_desc = { + .bDescriptorType = USB_DT_INTERFACE, + /* .bInterfaceNumber = DYNAMIC */ + .bAlternateSetting = 0, +- .bNumEndpoints = 2, ++ /* .bNumEndpoints = DYNAMIC (depends on use_out_ep) */ + .bInterfaceClass = USB_CLASS_HID, + /* .bInterfaceSubClass = DYNAMIC */ + /* .bInterfaceProtocol = DYNAMIC */ +@@ -140,7 +153,7 @@ static struct usb_ss_ep_comp_descriptor hidg_ss_out_comp_desc = { + /* .wBytesPerInterval = DYNAMIC */ + }; + +-static struct usb_descriptor_header *hidg_ss_descriptors[] = { ++static struct usb_descriptor_header *hidg_ss_descriptors_intout[] = { + (struct usb_descriptor_header *)&hidg_interface_desc, + (struct usb_descriptor_header *)&hidg_desc, + (struct usb_descriptor_header *)&hidg_ss_in_ep_desc, +@@ -150,6 +163,14 @@ static struct usb_descriptor_header *hidg_ss_descriptors[] = { + NULL, + }; + ++static struct usb_descriptor_header *hidg_ss_descriptors_ssreport[] = { ++ (struct usb_descriptor_header *)&hidg_interface_desc, ++ (struct usb_descriptor_header *)&hidg_desc, ++ (struct usb_descriptor_header *)&hidg_ss_in_ep_desc, ++ (struct usb_descriptor_header *)&hidg_ss_in_comp_desc, ++ NULL, ++}; ++ + /* High-Speed Support */ + + static struct usb_endpoint_descriptor hidg_hs_in_ep_desc = { +@@ -176,7 +197,7 @@ static struct usb_endpoint_descriptor hidg_hs_out_ep_desc = { + */ + }; + +-static struct usb_descriptor_header *hidg_hs_descriptors[] = { ++static struct usb_descriptor_header *hidg_hs_descriptors_intout[] = { + (struct usb_descriptor_header *)&hidg_interface_desc, + (struct usb_descriptor_header *)&hidg_desc, + (struct usb_descriptor_header *)&hidg_hs_in_ep_desc, +@@ -184,6 +205,13 @@ static struct usb_descriptor_header *hidg_hs_descriptors[] = { + NULL, + }; + ++static struct usb_descriptor_header *hidg_hs_descriptors_ssreport[] = { ++ (struct usb_descriptor_header *)&hidg_interface_desc, ++ (struct usb_descriptor_header *)&hidg_desc, ++ (struct usb_descriptor_header *)&hidg_hs_in_ep_desc, ++ NULL, ++}; ++ + /* Full-Speed Support */ + + static struct usb_endpoint_descriptor hidg_fs_in_ep_desc = { +@@ -210,7 +238,7 @@ static struct usb_endpoint_descriptor hidg_fs_out_ep_desc = { + */ + }; + +-static struct usb_descriptor_header *hidg_fs_descriptors[] = { ++static struct usb_descriptor_header *hidg_fs_descriptors_intout[] = { + (struct usb_descriptor_header *)&hidg_interface_desc, + (struct usb_descriptor_header *)&hidg_desc, + (struct usb_descriptor_header *)&hidg_fs_in_ep_desc, +@@ -218,6 +246,13 @@ static struct usb_descriptor_header *hidg_fs_descriptors[] = { + NULL, + }; + ++static struct usb_descriptor_header *hidg_fs_descriptors_ssreport[] = { ++ (struct usb_descriptor_header *)&hidg_interface_desc, ++ (struct usb_descriptor_header *)&hidg_desc, ++ (struct usb_descriptor_header *)&hidg_fs_in_ep_desc, ++ NULL, ++}; ++ + /*-------------------------------------------------------------------------*/ + /* Strings */ + +@@ -241,8 +276,8 @@ static struct usb_gadget_strings *ct_func_strings[] = { + /*-------------------------------------------------------------------------*/ + /* Char Device */ + +-static ssize_t f_hidg_read(struct file *file, char __user *buffer, +- size_t count, loff_t *ptr) ++static ssize_t f_hidg_intout_read(struct file *file, char __user *buffer, ++ size_t count, loff_t *ptr) + { + struct f_hidg *hidg = file->private_data; + struct f_hidg_req_list *list; +@@ -258,15 +293,15 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, + + spin_lock_irqsave(&hidg->read_spinlock, flags); + +-#define READ_COND (!list_empty(&hidg->completed_out_req)) ++#define READ_COND_INTOUT (!list_empty(&hidg->completed_out_req)) + + /* wait for at least one buffer to complete */ +- while (!READ_COND) { ++ while (!READ_COND_INTOUT) { + spin_unlock_irqrestore(&hidg->read_spinlock, flags); + if (file->f_flags & O_NONBLOCK) + return -EAGAIN; + +- if (wait_event_interruptible(hidg->read_queue, READ_COND)) ++ if (wait_event_interruptible(hidg->read_queue, READ_COND_INTOUT)) + return -ERESTARTSYS; + + spin_lock_irqsave(&hidg->read_spinlock, flags); +@@ -316,6 +351,60 @@ static ssize_t f_hidg_read(struct file *file, char __user *buffer, + return count; + } + ++#define READ_COND_SSREPORT (hidg->set_report_buf != NULL) ++ ++static ssize_t f_hidg_ssreport_read(struct file *file, char __user *buffer, ++ size_t count, loff_t *ptr) ++{ ++ struct f_hidg *hidg = file->private_data; ++ char *tmp_buf = NULL; ++ unsigned long flags; ++ ++ if (!count) ++ return 0; ++ ++ spin_lock_irqsave(&hidg->read_spinlock, flags); ++ ++ while (!READ_COND_SSREPORT) { ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); ++ if (file->f_flags & O_NONBLOCK) ++ return -EAGAIN; ++ ++ if (wait_event_interruptible(hidg->read_queue, READ_COND_SSREPORT)) ++ return -ERESTARTSYS; ++ ++ spin_lock_irqsave(&hidg->read_spinlock, flags); ++ } ++ ++ count = min_t(unsigned int, count, hidg->set_report_length); ++ tmp_buf = hidg->set_report_buf; ++ hidg->set_report_buf = NULL; ++ ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); ++ ++ if (tmp_buf != NULL) { ++ count -= copy_to_user(buffer, tmp_buf, count); ++ kfree(tmp_buf); ++ } else { ++ count = -ENOMEM; ++ } ++ ++ wake_up(&hidg->read_queue); ++ ++ return count; ++} ++ ++static ssize_t f_hidg_read(struct file *file, char __user *buffer, ++ size_t count, loff_t *ptr) ++{ ++ struct f_hidg *hidg = file->private_data; ++ ++ if (hidg->use_out_ep) ++ return f_hidg_intout_read(file, buffer, count, ptr); ++ else ++ return f_hidg_ssreport_read(file, buffer, count, ptr); ++} ++ + static void f_hidg_req_complete(struct usb_ep *ep, struct usb_request *req) + { + struct f_hidg *hidg = (struct f_hidg *)ep->driver_data; +@@ -439,14 +528,20 @@ static __poll_t f_hidg_poll(struct file *file, poll_table *wait) + if (WRITE_COND) + ret |= EPOLLOUT | EPOLLWRNORM; + +- if (READ_COND) +- ret |= EPOLLIN | EPOLLRDNORM; ++ if (hidg->use_out_ep) { ++ if (READ_COND_INTOUT) ++ ret |= EPOLLIN | EPOLLRDNORM; ++ } else { ++ if (READ_COND_SSREPORT) ++ ret |= EPOLLIN | EPOLLRDNORM; ++ } + + return ret; + } + + #undef WRITE_COND +-#undef READ_COND ++#undef READ_COND_SSREPORT ++#undef READ_COND_INTOUT + + static int f_hidg_release(struct inode *inode, struct file *fd) + { +@@ -473,7 +568,7 @@ static inline struct usb_request *hidg_alloc_ep_req(struct usb_ep *ep, + return alloc_ep_req(ep, length); + } + +-static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req) ++static void hidg_intout_complete(struct usb_ep *ep, struct usb_request *req) + { + struct f_hidg *hidg = (struct f_hidg *) req->context; + struct usb_composite_dev *cdev = hidg->func.config->cdev; +@@ -508,6 +603,37 @@ static void hidg_set_report_complete(struct usb_ep *ep, struct usb_request *req) + } + } + ++static void hidg_ssreport_complete(struct usb_ep *ep, struct usb_request *req) ++{ ++ struct f_hidg *hidg = (struct f_hidg *)req->context; ++ struct usb_composite_dev *cdev = hidg->func.config->cdev; ++ char *new_buf = NULL; ++ unsigned long flags; ++ ++ if (req->status != 0 || req->buf == NULL || req->actual == 0) { ++ ERROR(cdev, ++ "%s FAILED: status=%d, buf=%p, actual=%d\n", ++ __func__, req->status, req->buf, req->actual); ++ return; ++ } ++ ++ spin_lock_irqsave(&hidg->read_spinlock, flags); ++ ++ new_buf = krealloc(hidg->set_report_buf, req->actual, GFP_ATOMIC); ++ if (new_buf == NULL) { ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); ++ return; ++ } ++ hidg->set_report_buf = new_buf; ++ ++ hidg->set_report_length = req->actual; ++ memcpy(hidg->set_report_buf, req->buf, req->actual); ++ ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); ++ ++ wake_up(&hidg->read_queue); ++} ++ + static int hidg_setup(struct usb_function *f, + const struct usb_ctrlrequest *ctrl) + { +@@ -555,7 +681,11 @@ static int hidg_setup(struct usb_function *f, + case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 + | HID_REQ_SET_REPORT): + VDBG(cdev, "set_report | wLength=%d\n", ctrl->wLength); +- goto stall; ++ if (hidg->use_out_ep) ++ goto stall; ++ req->complete = hidg_ssreport_complete; ++ req->context = hidg; ++ goto respond; + break; + + case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE) << 8 +@@ -643,15 +773,18 @@ static void hidg_disable(struct usb_function *f) + unsigned long flags; + + usb_ep_disable(hidg->in_ep); +- usb_ep_disable(hidg->out_ep); + +- spin_lock_irqsave(&hidg->read_spinlock, flags); +- list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) { +- free_ep_req(hidg->out_ep, list->req); +- list_del(&list->list); +- kfree(list); ++ if (hidg->out_ep) { ++ usb_ep_disable(hidg->out_ep); ++ ++ spin_lock_irqsave(&hidg->read_spinlock, flags); ++ list_for_each_entry_safe(list, next, &hidg->completed_out_req, list) { ++ free_ep_req(hidg->out_ep, list->req); ++ list_del(&list->list); ++ kfree(list); ++ } ++ spin_unlock_irqrestore(&hidg->read_spinlock, flags); + } +- spin_unlock_irqrestore(&hidg->read_spinlock, flags); + + spin_lock_irqsave(&hidg->write_spinlock, flags); + if (!hidg->write_pending) { +@@ -697,8 +830,7 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) + } + } + +- +- if (hidg->out_ep != NULL) { ++ if (hidg->use_out_ep && hidg->out_ep != NULL) { + /* restart endpoint */ + usb_ep_disable(hidg->out_ep); + +@@ -723,7 +855,7 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) + hidg_alloc_ep_req(hidg->out_ep, + hidg->report_length); + if (req) { +- req->complete = hidg_set_report_complete; ++ req->complete = hidg_intout_complete; + req->context = hidg; + status = usb_ep_queue(hidg->out_ep, req, + GFP_ATOMIC); +@@ -749,7 +881,8 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) + } + return 0; + disable_out_ep: +- usb_ep_disable(hidg->out_ep); ++ if (hidg->out_ep) ++ usb_ep_disable(hidg->out_ep); + free_req_in: + if (req_in) + free_ep_req(hidg->in_ep, req_in); +@@ -801,14 +934,21 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) + goto fail; + hidg->in_ep = ep; + +- ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_out_ep_desc); +- if (!ep) +- goto fail; +- hidg->out_ep = ep; ++ hidg->out_ep = NULL; ++ if (hidg->use_out_ep) { ++ ep = usb_ep_autoconfig(c->cdev->gadget, &hidg_fs_out_ep_desc); ++ if (!ep) ++ goto fail; ++ hidg->out_ep = ep; ++ } ++ ++ /* used only if use_out_ep == 1 */ ++ hidg->set_report_buf = NULL; + + /* set descriptor dynamic values */ + hidg_interface_desc.bInterfaceSubClass = hidg->bInterfaceSubClass; + hidg_interface_desc.bInterfaceProtocol = hidg->bInterfaceProtocol; ++ hidg_interface_desc.bNumEndpoints = hidg->use_out_ep ? 2 : 1; + hidg->protocol = HID_REPORT_PROTOCOL; + hidg->idle = 1; + hidg_ss_in_ep_desc.wMaxPacketSize = cpu_to_le16(hidg->report_length); +@@ -839,9 +979,19 @@ static int hidg_bind(struct usb_configuration *c, struct usb_function *f) + hidg_ss_out_ep_desc.bEndpointAddress = + hidg_fs_out_ep_desc.bEndpointAddress; + +- status = usb_assign_descriptors(f, hidg_fs_descriptors, +- hidg_hs_descriptors, hidg_ss_descriptors, +- hidg_ss_descriptors); ++ if (hidg->use_out_ep) ++ status = usb_assign_descriptors(f, ++ hidg_fs_descriptors_intout, ++ hidg_hs_descriptors_intout, ++ hidg_ss_descriptors_intout, ++ hidg_ss_descriptors_intout); ++ else ++ status = usb_assign_descriptors(f, ++ hidg_fs_descriptors_ssreport, ++ hidg_hs_descriptors_ssreport, ++ hidg_ss_descriptors_ssreport, ++ hidg_ss_descriptors_ssreport); ++ + if (status) + goto fail; + +@@ -956,6 +1106,7 @@ CONFIGFS_ATTR(f_hid_opts_, name) + + F_HID_OPT(subclass, 8, 255); + F_HID_OPT(protocol, 8, 255); ++F_HID_OPT(no_out_endpoint, 8, 1); + F_HID_OPT(report_length, 16, 65535); + + static ssize_t f_hid_opts_report_desc_show(struct config_item *item, char *page) +@@ -1015,6 +1166,7 @@ CONFIGFS_ATTR_RO(f_hid_opts_, dev); + static struct configfs_attribute *hid_attrs[] = { + &f_hid_opts_attr_subclass, + &f_hid_opts_attr_protocol, ++ &f_hid_opts_attr_no_out_endpoint, + &f_hid_opts_attr_report_length, + &f_hid_opts_attr_report_desc, + &f_hid_opts_attr_dev, +@@ -1099,6 +1251,7 @@ static void hidg_free(struct usb_function *f) + hidg = func_to_hidg(f); + opts = container_of(f->fi, struct f_hid_opts, func_inst); + kfree(hidg->report_desc); ++ kfree(hidg->set_report_buf); + kfree(hidg); + mutex_lock(&opts->lock); + --opts->refcnt; +@@ -1145,6 +1298,7 @@ static struct usb_function *hidg_alloc(struct usb_function_instance *fi) + return ERR_PTR(-ENOMEM); + } + } ++ hidg->use_out_ep = !opts->no_out_endpoint; + + mutex_unlock(&opts->lock); + +diff --git a/drivers/usb/gadget/function/u_hid.h b/drivers/usb/gadget/function/u_hid.h +index 2f5ca4bfa7ff..c090eb6c9759 100644 +--- a/drivers/usb/gadget/function/u_hid.h ++++ b/drivers/usb/gadget/function/u_hid.h +@@ -20,6 +20,7 @@ struct f_hid_opts { + int minor; + unsigned char subclass; + unsigned char protocol; ++ unsigned char no_out_endpoint; + unsigned short report_length; + unsigned short report_desc_length; + unsigned char *report_desc; +-- +2.35.1 + diff --git a/queue-4.19/usb-musb-remove-extra-check-in-musb_gadget_vbus_draw.patch b/queue-4.19/usb-musb-remove-extra-check-in-musb_gadget_vbus_draw.patch new file mode 100644 index 00000000000..4f968301898 --- /dev/null +++ b/queue-4.19/usb-musb-remove-extra-check-in-musb_gadget_vbus_draw.patch @@ -0,0 +1,47 @@ +From a5fd10517f7223f3062606437de5e47cd0ee902b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 20:21:15 +0200 +Subject: usb: musb: remove extra check in musb_gadget_vbus_draw + +From: Ivaylo Dimitrov + +[ Upstream commit ecec4b20d29c3d6922dafe7d2555254a454272d2 ] + +The checks for musb->xceiv and musb->xceiv->set_power duplicate those in +usb_phy_set_power(), so there is no need of them. Moreover, not calling +usb_phy_set_power() results in usb_phy_set_charger_current() not being +called, so current USB config max current is not propagated through USB +charger framework and charger drivers may try to draw more current than +allowed or possible. + +Fix that by removing those extra checks and calling usb_phy_set_power() +directly. + +Tested on Motorola Droid4 and Nokia N900 + +Fixes: a9081a008f84 ("usb: phy: Add USB charger support") +Cc: stable +Signed-off-by: Ivaylo Dimitrov +Link: https://lore.kernel.org/r/1669400475-4762-1-git-send-email-ivo.g.dimitrov.75@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/musb_gadget.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c +index 8e83995fc3bd..b8fc818c154a 100644 +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -1629,8 +1629,6 @@ static int musb_gadget_vbus_draw(struct usb_gadget *gadget, unsigned mA) + { + struct musb *musb = gadget_to_musb(gadget); + +- if (!musb->xceiv->set_power) +- return -EOPNOTSUPP; + return usb_phy_set_power(musb->xceiv, mA); + } + +-- +2.35.1 + diff --git a/queue-4.19/usb-storage-add-check-for-kcalloc.patch b/queue-4.19/usb-storage-add-check-for-kcalloc.patch new file mode 100644 index 00000000000..d62ea8d1e3e --- /dev/null +++ b/queue-4.19/usb-storage-add-check-for-kcalloc.patch @@ -0,0 +1,39 @@ +From 84cd65318e00b3d97ace94451fb17103a859a782 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Dec 2022 19:00:58 +0800 +Subject: usb: storage: Add check for kcalloc + +From: Jiasheng Jiang + +[ Upstream commit c35ca10f53c51eeb610d3f8fbc6dd6d511b58a58 ] + +As kcalloc may return NULL pointer, the return value should +be checked and return error if fails as same as the ones in +alauda_read_map. + +Fixes: e80b0fade09e ("[PATCH] USB Storage: add alauda support") +Acked-by: Alan Stern +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20221208110058.12983-1-jiasheng@iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/alauda.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/storage/alauda.c b/drivers/usb/storage/alauda.c +index 6b8edf6178df..6fcf5fd2ff98 100644 +--- a/drivers/usb/storage/alauda.c ++++ b/drivers/usb/storage/alauda.c +@@ -437,6 +437,8 @@ static int alauda_init_media(struct us_data *us) + + MEDIA_INFO(us).blockshift + MEDIA_INFO(us).pageshift); + MEDIA_INFO(us).pba_to_lba = kcalloc(num_zones, sizeof(u16*), GFP_NOIO); + MEDIA_INFO(us).lba_to_pba = kcalloc(num_zones, sizeof(u16*), GFP_NOIO); ++ if (MEDIA_INFO(us).pba_to_lba == NULL || MEDIA_INFO(us).lba_to_pba == NULL) ++ return USB_STOR_TRANSPORT_ERROR; + + if (alauda_reset_media(us) != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; +-- +2.35.1 + diff --git a/queue-4.19/usb-typec-check-for-ops-exit-instead-of-ops-enter-in.patch b/queue-4.19/usb-typec-check-for-ops-exit-instead-of-ops-enter-in.patch new file mode 100644 index 00000000000..9a7ac0a302f --- /dev/null +++ b/queue-4.19/usb-typec-check-for-ops-exit-instead-of-ops-enter-in.patch @@ -0,0 +1,39 @@ +From 347ef3171af98d554ea459201a658955fc262488 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 17:59:24 +0100 +Subject: usb: typec: Check for ops->exit instead of ops->enter in altmode_exit + +From: Sven Peter + +[ Upstream commit b6ddd180e3d9f92c1e482b3cdeec7dda086b1341 ] + +typec_altmode_exit checks if ops->enter is not NULL but then calls +ops->exit a few lines below. Fix that and check for the function +pointer it's about to call instead. + +Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes") +Signed-off-by: Sven Peter +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20221114165924.33487-1-sven@svenpeter.dev +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/bus.c b/drivers/usb/typec/bus.c +index 76299b6ff06d..7605963f71ed 100644 +--- a/drivers/usb/typec/bus.c ++++ b/drivers/usb/typec/bus.c +@@ -126,7 +126,7 @@ int typec_altmode_exit(struct typec_altmode *adev) + if (!adev || !adev->active) + return 0; + +- if (!pdev->ops || !pdev->ops->enter) ++ if (!pdev->ops || !pdev->ops->exit) + return -EOPNOTSUPP; + + /* Moving to USB Safe State */ +-- +2.35.1 + diff --git a/queue-4.19/usb-typec-group-all-tcpci-tcpm-code-together.patch b/queue-4.19/usb-typec-group-all-tcpci-tcpm-code-together.patch new file mode 100644 index 00000000000..732c78b11e1 --- /dev/null +++ b/queue-4.19/usb-typec-group-all-tcpci-tcpm-code-together.patch @@ -0,0 +1,259 @@ +From 29c281b0c3ac3ab2bcefdf4e2bec2578cf0cf112 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 14:23:47 +0300 +Subject: usb: typec: Group all TCPCI/TCPM code together + +From: Heikki Krogerus + +[ Upstream commit ae8a2ca8a2215c7e31e6d874f7303801bb15fbbc ] + +Moving all the drivers that depend on the Port Controller +Manager under a new directory drivers/usb/typec/tcpm/ and +making Guenter Roeck the designated reviewer of that code. + +Acked-by: Guenter Roeck +Signed-off-by: Heikki Krogerus +Signed-off-by: Greg Kroah-Hartman +Stable-dep-of: 0384e87e3fec ("usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()") +Signed-off-by: Sasha Levin +--- + MAINTAINERS | 6 +++ + drivers/usb/typec/Kconfig | 45 +--------------- + drivers/usb/typec/Makefile | 6 +-- + drivers/usb/typec/fusb302/Kconfig | 7 --- + drivers/usb/typec/fusb302/Makefile | 2 - + drivers/usb/typec/tcpm/Kconfig | 52 +++++++++++++++++++ + drivers/usb/typec/tcpm/Makefile | 7 +++ + drivers/usb/typec/{fusb302 => tcpm}/fusb302.c | 0 + .../usb/typec/{fusb302 => tcpm}/fusb302_reg.h | 0 + drivers/usb/typec/{ => tcpm}/tcpci.c | 0 + drivers/usb/typec/{ => tcpm}/tcpci.h | 0 + drivers/usb/typec/{ => tcpm}/tcpci_rt1711h.c | 0 + drivers/usb/typec/{ => tcpm}/tcpm.c | 0 + .../usb/typec/{typec_wcove.c => tcpm/wcove.c} | 0 + 14 files changed, 67 insertions(+), 58 deletions(-) + delete mode 100644 drivers/usb/typec/fusb302/Kconfig + delete mode 100644 drivers/usb/typec/fusb302/Makefile + create mode 100644 drivers/usb/typec/tcpm/Kconfig + create mode 100644 drivers/usb/typec/tcpm/Makefile + rename drivers/usb/typec/{fusb302 => tcpm}/fusb302.c (100%) + rename drivers/usb/typec/{fusb302 => tcpm}/fusb302_reg.h (100%) + rename drivers/usb/typec/{ => tcpm}/tcpci.c (100%) + rename drivers/usb/typec/{ => tcpm}/tcpci.h (100%) + rename drivers/usb/typec/{ => tcpm}/tcpci_rt1711h.c (100%) + rename drivers/usb/typec/{ => tcpm}/tcpm.c (100%) + rename drivers/usb/typec/{typec_wcove.c => tcpm/wcove.c} (100%) + +diff --git a/MAINTAINERS b/MAINTAINERS +index af0f322cf2f7..4a2f805dee95 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -15314,6 +15314,12 @@ F: Documentation/driver-api/usb/typec_bus.rst + F: drivers/usb/typec/altmodes/ + F: include/linux/usb/typec_altmode.h + ++USB TYPEC PORT CONTROLLER DRIVERS ++M: Guenter Roeck ++L: linux-usb@vger.kernel.org ++S: Maintained ++F: drivers/usb/typec/tcpm/ ++ + USB UHCI DRIVER + M: Alan Stern + L: linux-usb@vger.kernel.org +diff --git a/drivers/usb/typec/Kconfig b/drivers/usb/typec/Kconfig +index 8445890accdf..e078f23e3f8d 100644 +--- a/drivers/usb/typec/Kconfig ++++ b/drivers/usb/typec/Kconfig +@@ -45,50 +45,7 @@ menuconfig TYPEC + + if TYPEC + +-config TYPEC_TCPM +- tristate "USB Type-C Port Controller Manager" +- depends on USB +- select USB_ROLE_SWITCH +- select POWER_SUPPLY +- help +- The Type-C Port Controller Manager provides a USB PD and USB Type-C +- state machine for use with Type-C Port Controllers. +- +-if TYPEC_TCPM +- +-config TYPEC_TCPCI +- tristate "Type-C Port Controller Interface driver" +- depends on I2C +- select REGMAP_I2C +- help +- Type-C Port Controller driver for TCPCI-compliant controller. +- +-config TYPEC_RT1711H +- tristate "Richtek RT1711H Type-C chip driver" +- depends on I2C +- select TYPEC_TCPCI +- help +- Richtek RT1711H Type-C chip driver that works with +- Type-C Port Controller Manager to provide USB PD and USB +- Type-C functionalities. +- +-source "drivers/usb/typec/fusb302/Kconfig" +- +-config TYPEC_WCOVE +- tristate "Intel WhiskeyCove PMIC USB Type-C PHY driver" +- depends on ACPI +- depends on INTEL_SOC_PMIC +- depends on INTEL_PMC_IPC +- depends on BXT_WC_PMIC_OPREGION +- help +- This driver adds support for USB Type-C detection on Intel Broxton +- platforms that have Intel Whiskey Cove PMIC. The driver can detect the +- role and cable orientation. +- +- To compile this driver as module, choose M here: the module will be +- called typec_wcove +- +-endif # TYPEC_TCPM ++source "drivers/usb/typec/tcpm/Kconfig" + + source "drivers/usb/typec/ucsi/Kconfig" + +diff --git a/drivers/usb/typec/Makefile b/drivers/usb/typec/Makefile +index 45b0aef428a8..6696b7263d61 100644 +--- a/drivers/usb/typec/Makefile ++++ b/drivers/usb/typec/Makefile +@@ -2,11 +2,7 @@ + obj-$(CONFIG_TYPEC) += typec.o + typec-y := class.o mux.o bus.o + obj-$(CONFIG_TYPEC) += altmodes/ +-obj-$(CONFIG_TYPEC_TCPM) += tcpm.o +-obj-y += fusb302/ +-obj-$(CONFIG_TYPEC_WCOVE) += typec_wcove.o ++obj-$(CONFIG_TYPEC_TCPM) += tcpm/ + obj-$(CONFIG_TYPEC_UCSI) += ucsi/ + obj-$(CONFIG_TYPEC_TPS6598X) += tps6598x.o + obj-$(CONFIG_TYPEC) += mux/ +-obj-$(CONFIG_TYPEC_TCPCI) += tcpci.o +-obj-$(CONFIG_TYPEC_RT1711H) += tcpci_rt1711h.o +diff --git a/drivers/usb/typec/fusb302/Kconfig b/drivers/usb/typec/fusb302/Kconfig +deleted file mode 100644 +index fce099ff39fe..000000000000 +--- a/drivers/usb/typec/fusb302/Kconfig ++++ /dev/null +@@ -1,7 +0,0 @@ +-config TYPEC_FUSB302 +- tristate "Fairchild FUSB302 Type-C chip driver" +- depends on I2C +- help +- The Fairchild FUSB302 Type-C chip driver that works with +- Type-C Port Controller Manager to provide USB PD and USB +- Type-C functionalities. +diff --git a/drivers/usb/typec/fusb302/Makefile b/drivers/usb/typec/fusb302/Makefile +deleted file mode 100644 +index 3b51b33631a0..000000000000 +--- a/drivers/usb/typec/fusb302/Makefile ++++ /dev/null +@@ -1,2 +0,0 @@ +-# SPDX-License-Identifier: GPL-2.0 +-obj-$(CONFIG_TYPEC_FUSB302) += fusb302.o +diff --git a/drivers/usb/typec/tcpm/Kconfig b/drivers/usb/typec/tcpm/Kconfig +new file mode 100644 +index 000000000000..f03ea8a61768 +--- /dev/null ++++ b/drivers/usb/typec/tcpm/Kconfig +@@ -0,0 +1,52 @@ ++config TYPEC_TCPM ++ tristate "USB Type-C Port Controller Manager" ++ depends on USB ++ select USB_ROLE_SWITCH ++ select POWER_SUPPLY ++ help ++ The Type-C Port Controller Manager provides a USB PD and USB Type-C ++ state machine for use with Type-C Port Controllers. ++ ++if TYPEC_TCPM ++ ++config TYPEC_TCPCI ++ tristate "Type-C Port Controller Interface driver" ++ depends on I2C ++ select REGMAP_I2C ++ help ++ Type-C Port Controller driver for TCPCI-compliant controller. ++ ++if TYPEC_TCPCI ++ ++config TYPEC_RT1711H ++ tristate "Richtek RT1711H Type-C chip driver" ++ help ++ Richtek RT1711H Type-C chip driver that works with ++ Type-C Port Controller Manager to provide USB PD and USB ++ Type-C functionalities. ++ ++endif # TYPEC_TCPCI ++ ++config TYPEC_FUSB302 ++ tristate "Fairchild FUSB302 Type-C chip driver" ++ depends on I2C ++ help ++ The Fairchild FUSB302 Type-C chip driver that works with ++ Type-C Port Controller Manager to provide USB PD and USB ++ Type-C functionalities. ++ ++config TYPEC_WCOVE ++ tristate "Intel WhiskeyCove PMIC USB Type-C PHY driver" ++ depends on ACPI ++ depends on INTEL_SOC_PMIC ++ depends on INTEL_PMC_IPC ++ depends on BXT_WC_PMIC_OPREGION ++ help ++ This driver adds support for USB Type-C on Intel Broxton platforms ++ that have Intel Whiskey Cove PMIC. The driver works with USB Type-C ++ Port Controller Manager to provide USB PD and Type-C functionalities. ++ ++ To compile this driver as module, choose M here: the module will be ++ called typec_wcove.ko ++ ++endif # TYPEC_TCPM +diff --git a/drivers/usb/typec/tcpm/Makefile b/drivers/usb/typec/tcpm/Makefile +new file mode 100644 +index 000000000000..a5ff6c8eb892 +--- /dev/null ++++ b/drivers/usb/typec/tcpm/Makefile +@@ -0,0 +1,7 @@ ++# SPDX-License-Identifier: GPL-2.0 ++obj-$(CONFIG_TYPEC_TCPM) += tcpm.o ++obj-$(CONFIG_TYPEC_FUSB302) += fusb302.o ++obj-$(CONFIG_TYPEC_WCOVE) += typec_wcove.o ++typec_wcove-y := wcove.o ++obj-$(CONFIG_TYPEC_TCPCI) += tcpci.o ++obj-$(CONFIG_TYPEC_RT1711H) += tcpci_rt1711h.o +diff --git a/drivers/usb/typec/fusb302/fusb302.c b/drivers/usb/typec/tcpm/fusb302.c +similarity index 100% +rename from drivers/usb/typec/fusb302/fusb302.c +rename to drivers/usb/typec/tcpm/fusb302.c +diff --git a/drivers/usb/typec/fusb302/fusb302_reg.h b/drivers/usb/typec/tcpm/fusb302_reg.h +similarity index 100% +rename from drivers/usb/typec/fusb302/fusb302_reg.h +rename to drivers/usb/typec/tcpm/fusb302_reg.h +diff --git a/drivers/usb/typec/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c +similarity index 100% +rename from drivers/usb/typec/tcpci.c +rename to drivers/usb/typec/tcpm/tcpci.c +diff --git a/drivers/usb/typec/tcpci.h b/drivers/usb/typec/tcpm/tcpci.h +similarity index 100% +rename from drivers/usb/typec/tcpci.h +rename to drivers/usb/typec/tcpm/tcpci.h +diff --git a/drivers/usb/typec/tcpci_rt1711h.c b/drivers/usb/typec/tcpm/tcpci_rt1711h.c +similarity index 100% +rename from drivers/usb/typec/tcpci_rt1711h.c +rename to drivers/usb/typec/tcpm/tcpci_rt1711h.c +diff --git a/drivers/usb/typec/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c +similarity index 100% +rename from drivers/usb/typec/tcpm.c +rename to drivers/usb/typec/tcpm/tcpm.c +diff --git a/drivers/usb/typec/typec_wcove.c b/drivers/usb/typec/tcpm/wcove.c +similarity index 100% +rename from drivers/usb/typec/typec_wcove.c +rename to drivers/usb/typec/tcpm/wcove.c +-- +2.35.1 + diff --git a/queue-4.19/usb-typec-tcpci-fix-of-node-refcount-leak-in-tcpci_r.patch b/queue-4.19/usb-typec-tcpci-fix-of-node-refcount-leak-in-tcpci_r.patch new file mode 100644 index 00000000000..bf82f23bb79 --- /dev/null +++ b/queue-4.19/usb-typec-tcpci-fix-of-node-refcount-leak-in-tcpci_r.patch @@ -0,0 +1,60 @@ +From c60d7eadc9e21ad23adf30f3739835655bc97a93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Nov 2022 14:24:16 +0800 +Subject: usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() + +From: Yang Yingliang + +[ Upstream commit 0384e87e3fec735e47f1c133c796f32ef7a72a9b ] + +I got the following report while doing device(mt6370-tcpc) load +test with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled: + + OF: ERROR: memory leak, expected refcount 1 instead of 2, + of_node_get()/of_node_put() unbalanced - destroy cset entry: + attach overlay node /i2c/pmic@34/tcpc/connector + +The 'fwnode' set in tcpci_parse_config() which is called +in tcpci_register_port(), its node refcount is increased +in device_get_named_child_node(). It needs be put while +exiting, so call fwnode_handle_put() in the error path of +tcpci_register_port() and in tcpci_unregister_port() to +avoid leak. + +Fixes: 5e85a04c8c0d ("usb: typec: add fwnode to tcpc") +Signed-off-by: Yang Yingliang +Acked-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20221121062416.1026192-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tcpm/tcpci.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c +index 9f98376d9bef..e5dbd14f0881 100644 +--- a/drivers/usb/typec/tcpm/tcpci.c ++++ b/drivers/usb/typec/tcpm/tcpci.c +@@ -541,8 +541,10 @@ struct tcpci *tcpci_register_port(struct device *dev, struct tcpci_data *data) + return ERR_PTR(err); + + tcpci->port = tcpm_register_port(tcpci->dev, &tcpci->tcpc); +- if (IS_ERR(tcpci->port)) ++ if (IS_ERR(tcpci->port)) { ++ fwnode_handle_put(tcpci->tcpc.fwnode); + return ERR_CAST(tcpci->port); ++ } + + return tcpci; + } +@@ -551,6 +553,7 @@ EXPORT_SYMBOL_GPL(tcpci_register_port); + void tcpci_unregister_port(struct tcpci *tcpci) + { + tcpm_unregister_port(tcpci->port); ++ fwnode_handle_put(tcpci->tcpc.fwnode); + } + EXPORT_SYMBOL_GPL(tcpci_unregister_port); + +-- +2.35.1 + diff --git a/queue-4.19/vfio-platform-do-not-pass-return-buffer-to-acpi-_rst.patch b/queue-4.19/vfio-platform-do-not-pass-return-buffer-to-acpi-_rst.patch new file mode 100644 index 00000000000..fc4d986b1a7 --- /dev/null +++ b/queue-4.19/vfio-platform-do-not-pass-return-buffer-to-acpi-_rst.patch @@ -0,0 +1,43 @@ +From 48a7272a32af23b2b931f7dba1c9f08716242368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 12:28:25 -0300 +Subject: vfio: platform: Do not pass return buffer to ACPI _RST method + +From: Rafael Mendonca + +[ Upstream commit e67e070632a665c932d534b8b800477bb3111449 ] + +The ACPI _RST method has no return value, there's no need to pass a return +buffer to acpi_evaluate_object(). + +Fixes: d30daa33ec1d ("vfio: platform: call _RST method when using ACPI") +Signed-off-by: Rafael Mendonca +Reviewed-by: Eric Auger +Link: https://lore.kernel.org/r/20221018152825.891032-1-rafaelmendsr@gmail.com +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/platform/vfio_platform_common.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c +index c29fc6844f84..d8bb6537c688 100644 +--- a/drivers/vfio/platform/vfio_platform_common.c ++++ b/drivers/vfio/platform/vfio_platform_common.c +@@ -78,12 +78,11 @@ static int vfio_platform_acpi_call_reset(struct vfio_platform_device *vdev, + const char **extra_dbg) + { + #ifdef CONFIG_ACPI +- struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; + struct device *dev = vdev->device; + acpi_handle handle = ACPI_HANDLE(dev); + acpi_status acpi_ret; + +- acpi_ret = acpi_evaluate_object(handle, "_RST", NULL, &buffer); ++ acpi_ret = acpi_evaluate_object(handle, "_RST", NULL, NULL); + if (ACPI_FAILURE(acpi_ret)) { + if (extra_dbg) + *extra_dbg = acpi_format_exception(acpi_ret); +-- +2.35.1 + diff --git a/queue-4.19/vme-fix-error-not-catched-in-fake_init.patch b/queue-4.19/vme-fix-error-not-catched-in-fake_init.patch new file mode 100644 index 00000000000..6d8805fdb4d --- /dev/null +++ b/queue-4.19/vme-fix-error-not-catched-in-fake_init.patch @@ -0,0 +1,49 @@ +From 156a144fd93877bfceadc4e27904ccc802a4d5fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 16:48:05 +0800 +Subject: vme: Fix error not catched in fake_init() + +From: Chen Zhongjin + +[ Upstream commit 7bef797d707f1744f71156b21d41e3b8c946631f ] + +In fake_init(), __root_device_register() is possible to fail but it's +ignored, which can cause unregistering vme_root fail when exit. + + general protection fault, + probably for non-canonical address 0xdffffc000000008c + KASAN: null-ptr-deref in range [0x0000000000000460-0x0000000000000467] + RIP: 0010:root_device_unregister+0x26/0x60 + Call Trace: + + __x64_sys_delete_module+0x34f/0x540 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Return error when __root_device_register() fails. + +Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221205084805.147436-1-chenzhongjin@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/vme/bridges/vme_fake.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/vme/bridges/vme_fake.c b/drivers/vme/bridges/vme_fake.c +index 685a43bdc2a1..06bfc7f0e0b6 100644 +--- a/drivers/vme/bridges/vme_fake.c ++++ b/drivers/vme/bridges/vme_fake.c +@@ -1077,6 +1077,8 @@ static int __init fake_init(void) + + /* We need a fake parent device */ + vme_root = __root_device_register("vme", THIS_MODULE); ++ if (IS_ERR(vme_root)) ++ return PTR_ERR(vme_root); + + /* If we want to support more than one bridge at some point, we need to + * dynamically allocate this so we get one per device. +-- +2.35.1 + diff --git a/queue-4.19/wifi-ar5523-fix-use-after-free-on-ar5523_cmd-timed-o.patch b/queue-4.19/wifi-ar5523-fix-use-after-free-on-ar5523_cmd-timed-o.patch new file mode 100644 index 00000000000..3d6a9ffff27 --- /dev/null +++ b/queue-4.19/wifi-ar5523-fix-use-after-free-on-ar5523_cmd-timed-o.patch @@ -0,0 +1,110 @@ +From 152f19fcf12eb6434f0244adcd9baf988bfdebd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 03:32:23 +0900 +Subject: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out + +From: Shigeru Yoshida + +[ Upstream commit b6702a942a069c2a975478d719e98d83cdae1797 ] + +syzkaller reported use-after-free with the stack trace like below [1]: + +[ 38.960489][ C3] ================================================================== +[ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240 +[ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0 +[ 38.966363][ C3] +[ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18 +[ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 +[ 38.969959][ C3] Call Trace: +[ 38.970841][ C3] +[ 38.971663][ C3] dump_stack_lvl+0xfc/0x174 +[ 38.972620][ C3] print_report.cold+0x2c3/0x752 +[ 38.973626][ C3] ? ar5523_cmd_tx_cb+0x220/0x240 +[ 38.974644][ C3] kasan_report+0xb1/0x1d0 +[ 38.975720][ C3] ? ar5523_cmd_tx_cb+0x220/0x240 +[ 38.976831][ C3] ar5523_cmd_tx_cb+0x220/0x240 +[ 38.978412][ C3] __usb_hcd_giveback_urb+0x353/0x5b0 +[ 38.979755][ C3] usb_hcd_giveback_urb+0x385/0x430 +[ 38.981266][ C3] dummy_timer+0x140c/0x34e0 +[ 38.982925][ C3] ? notifier_call_chain+0xb5/0x1e0 +[ 38.984761][ C3] ? rcu_read_lock_sched_held+0xb/0x60 +[ 38.986242][ C3] ? lock_release+0x51c/0x790 +[ 38.987323][ C3] ? _raw_read_unlock_irqrestore+0x37/0x70 +[ 38.988483][ C3] ? __wake_up_common_lock+0xde/0x130 +[ 38.989621][ C3] ? reacquire_held_locks+0x4a0/0x4a0 +[ 38.990777][ C3] ? lock_acquire+0x472/0x550 +[ 38.991919][ C3] ? rcu_read_lock_sched_held+0xb/0x60 +[ 38.993138][ C3] ? lock_acquire+0x472/0x550 +[ 38.994890][ C3] ? dummy_urb_enqueue+0x860/0x860 +[ 38.996266][ C3] ? do_raw_spin_unlock+0x16f/0x230 +[ 38.997670][ C3] ? dummy_urb_enqueue+0x860/0x860 +[ 38.999116][ C3] call_timer_fn+0x1a0/0x6a0 +[ 39.000668][ C3] ? add_timer_on+0x4a0/0x4a0 +[ 39.002137][ C3] ? reacquire_held_locks+0x4a0/0x4a0 +[ 39.003809][ C3] ? __next_timer_interrupt+0x226/0x2a0 +[ 39.005509][ C3] __run_timers.part.0+0x69a/0xac0 +[ 39.007025][ C3] ? dummy_urb_enqueue+0x860/0x860 +[ 39.008716][ C3] ? call_timer_fn+0x6a0/0x6a0 +[ 39.010254][ C3] ? cpuacct_percpu_seq_show+0x10/0x10 +[ 39.011795][ C3] ? kvm_sched_clock_read+0x14/0x40 +[ 39.013277][ C3] ? sched_clock_cpu+0x69/0x2b0 +[ 39.014724][ C3] run_timer_softirq+0xb6/0x1d0 +[ 39.016196][ C3] __do_softirq+0x1d2/0x9be +[ 39.017616][ C3] __irq_exit_rcu+0xeb/0x190 +[ 39.019004][ C3] irq_exit_rcu+0x5/0x20 +[ 39.020361][ C3] sysvec_apic_timer_interrupt+0x8f/0xb0 +[ 39.021965][ C3] +[ 39.023237][ C3] + +In ar5523_probe(), ar5523_host_available() calls ar5523_cmd() as below +(there are other functions which finally call ar5523_cmd()): + +ar5523_probe() +-> ar5523_host_available() + -> ar5523_cmd_read() + -> ar5523_cmd() + +If ar5523_cmd() timed out, then ar5523_host_available() failed and +ar5523_probe() freed the device structure. So, ar5523_cmd_tx_cb() +might touch the freed structure. + +This patch fixes this issue by canceling in-flight tx cmd if submitted +urb timed out. + +Link: https://syzkaller.appspot.com/bug?id=9e12b2d54300842b71bdd18b54971385ff0d0d3a [1] +Reported-by: syzbot+95001b1fd6dfcc716c29@syzkaller.appspotmail.com +Signed-off-by: Shigeru Yoshida +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221009183223.420015-1-syoshida@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ar5523/ar5523.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index 58e189ec672f..5d3cf354f6cb 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -241,6 +241,11 @@ static void ar5523_cmd_tx_cb(struct urb *urb) + } + } + ++static void ar5523_cancel_tx_cmd(struct ar5523 *ar) ++{ ++ usb_kill_urb(ar->tx_cmd.urb_tx); ++} ++ + static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata, + int ilen, void *odata, int olen, int flags) + { +@@ -280,6 +285,7 @@ static int ar5523_cmd(struct ar5523 *ar, u32 code, const void *idata, + } + + if (!wait_for_completion_timeout(&cmd->done, 2 * HZ)) { ++ ar5523_cancel_tx_cmd(ar); + cmd->odata = NULL; + ar5523_err(ar, "timeout waiting for command %02x reply\n", + code); +-- +2.35.1 + diff --git a/queue-4.19/wifi-ath10k-fix-return-value-in-ath10k_pci_init.patch b/queue-4.19/wifi-ath10k-fix-return-value-in-ath10k_pci_init.patch new file mode 100644 index 00000000000..d55ae8ed0fa --- /dev/null +++ b/queue-4.19/wifi-ath10k-fix-return-value-in-ath10k_pci_init.patch @@ -0,0 +1,63 @@ +From b0244a75f87d6373368a47d8a46b77572d4f95d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Nov 2022 14:19:26 +0800 +Subject: wifi: ath10k: Fix return value in ath10k_pci_init() + +From: Xiu Jianfeng + +[ Upstream commit 2af7749047d8d6ad43feff69f555a13a6a6c2831 ] + +This driver is attempting to register to support two different buses. +if either of these is successful then ath10k_pci_init() should return 0 +so that hardware attached to the successful bus can be probed and +supported. only if both of these are unsuccessful should ath10k_pci_init() +return an errno. + +Fixes: 0b523ced9a3c ("ath10k: add basic skeleton to support ahb") +Signed-off-by: Xiu Jianfeng +Reviewed-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221110061926.18163-1-xiujianfeng@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/pci.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index caece8339a50..92757495c73b 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -3739,18 +3739,22 @@ static struct pci_driver ath10k_pci_driver = { + + static int __init ath10k_pci_init(void) + { +- int ret; ++ int ret1, ret2; + +- ret = pci_register_driver(&ath10k_pci_driver); +- if (ret) ++ ret1 = pci_register_driver(&ath10k_pci_driver); ++ if (ret1) + printk(KERN_ERR "failed to register ath10k pci driver: %d\n", +- ret); ++ ret1); + +- ret = ath10k_ahb_init(); +- if (ret) +- printk(KERN_ERR "ahb init failed: %d\n", ret); ++ ret2 = ath10k_ahb_init(); ++ if (ret2) ++ printk(KERN_ERR "ahb init failed: %d\n", ret2); + +- return ret; ++ if (ret1 && ret2) ++ return ret1; ++ ++ /* registered to at least one bus */ ++ return 0; + } + module_init(ath10k_pci_init); + +-- +2.35.1 + diff --git a/queue-4.19/wifi-ath9k-hif_usb-fix-memory-leak-of-urbs-in-ath9k_.patch b/queue-4.19/wifi-ath9k-hif_usb-fix-memory-leak-of-urbs-in-ath9k_.patch new file mode 100644 index 00000000000..c593222849a --- /dev/null +++ b/queue-4.19/wifi-ath9k-hif_usb-fix-memory-leak-of-urbs-in-ath9k_.patch @@ -0,0 +1,61 @@ +From f04f2ace97c2b71d45fc001f116936348ece20de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Jul 2022 18:13:59 +0300 +Subject: wifi: ath9k: hif_usb: fix memory leak of urbs in + ath9k_hif_usb_dealloc_tx_urbs() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit c2a94de38c74e86f49124ac14f093d6a5c377a90 ] + +Syzkaller reports a long-known leak of urbs in +ath9k_hif_usb_dealloc_tx_urbs(). + +The cause of the leak is that usb_get_urb() is called but usb_free_urb() +(or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or +urb->ep fields have not been initialized and usb_kill_urb() returns +immediately. + +The patch removes trying to kill urbs located in hif_dev->tx.tx_buf +because hif_dev->tx.tx_buf is not supposed to contain urbs which are in +pending state (the pending urbs are stored in hif_dev->tx.tx_pending). +The tx.tx_lock is acquired so there should not be any changes in the list. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 03fb92a432ea ("ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220725151359.283704-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index c8c7afe0e343..4290753a2002 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -781,14 +781,10 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev) + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + list_for_each_entry_safe(tx_buf, tx_buf_tmp, + &hif_dev->tx.tx_buf, list) { +- usb_get_urb(tx_buf->urb); +- spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); +- usb_kill_urb(tx_buf->urb); + list_del(&tx_buf->list); + usb_free_urb(tx_buf->urb); + kfree(tx_buf->buf); + kfree(tx_buf); +- spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + } + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + +-- +2.35.1 + diff --git a/queue-4.19/wifi-ath9k-hif_usb-fix-use-after-free-in-ath9k_hif_u.patch b/queue-4.19/wifi-ath9k-hif_usb-fix-use-after-free-in-ath9k_hif_u.patch new file mode 100644 index 00000000000..cfee70ba0f4 --- /dev/null +++ b/queue-4.19/wifi-ath9k-hif_usb-fix-use-after-free-in-ath9k_hif_u.patch @@ -0,0 +1,118 @@ +From ce43b16547a74ede37a906fcda2dde987870b00c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Oct 2022 14:49:17 +0300 +Subject: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit dd95f2239fc846795fc926787c3ae0ca701c9840 ] + +It is possible that skb is freed in ath9k_htc_rx_msg(), then +usb_submit_urb() fails and we try to free skb again. It causes +use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes +NULL but rx_buf is not freed and there can be a memory leak. + +The patch removes unnecessary nskb and makes skb processing more clear: it +is supposed that ath9k_htc_rx_msg() either frees old skb or passes its +managing to another callback function. + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: 3deff76095c4 ("ath9k_htc: Increase URB count for REG_IN pipe") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221008114917.21404-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 28 +++++++++++++----------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index 4290753a2002..d872459c51cc 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -709,14 +709,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + struct rx_buf *rx_buf = (struct rx_buf *)urb->context; + struct hif_device_usb *hif_dev = rx_buf->hif_dev; + struct sk_buff *skb = rx_buf->skb; +- struct sk_buff *nskb; + int ret; + + if (!skb) + return; + + if (!hif_dev) +- goto free; ++ goto free_skb; + + switch (urb->status) { + case 0: +@@ -725,7 +724,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + case -ECONNRESET: + case -ENODEV: + case -ESHUTDOWN: +- goto free; ++ goto free_skb; + default: + skb_reset_tail_pointer(skb); + skb_trim(skb, 0); +@@ -736,25 +735,27 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + if (likely(urb->actual_length != 0)) { + skb_put(skb, urb->actual_length); + +- /* Process the command first */ ++ /* ++ * Process the command first. ++ * skb is either freed here or passed to be ++ * managed to another callback function. ++ */ + ath9k_htc_rx_msg(hif_dev->htc_handle, skb, + skb->len, USB_REG_IN_PIPE); + +- +- nskb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC); +- if (!nskb) { ++ skb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC); ++ if (!skb) { + dev_err(&hif_dev->udev->dev, + "ath9k_htc: REG_IN memory allocation failure\n"); +- urb->context = NULL; +- return; ++ goto free_rx_buf; + } + +- rx_buf->skb = nskb; ++ rx_buf->skb = skb; + + usb_fill_int_urb(urb, hif_dev->udev, + usb_rcvintpipe(hif_dev->udev, + USB_REG_IN_PIPE), +- nskb->data, MAX_REG_IN_BUF_SIZE, ++ skb->data, MAX_REG_IN_BUF_SIZE, + ath9k_hif_usb_reg_in_cb, rx_buf, 1); + } + +@@ -763,12 +764,13 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) + ret = usb_submit_urb(urb, GFP_ATOMIC); + if (ret) { + usb_unanchor_urb(urb); +- goto free; ++ goto free_skb; + } + + return; +-free: ++free_skb: + kfree_skb(skb); ++free_rx_buf: + kfree(rx_buf); + urb->context = NULL; + } +-- +2.35.1 + diff --git a/queue-4.19/wifi-ath9k-verify-the-expected-usb_endpoints-are-pre.patch b/queue-4.19/wifi-ath9k-verify-the-expected-usb_endpoints-are-pre.patch new file mode 100644 index 00000000000..ea4ad8fc3d2 --- /dev/null +++ b/queue-4.19/wifi-ath9k-verify-the-expected-usb_endpoints-are-pre.patch @@ -0,0 +1,80 @@ +From 5f2424ec3e4fb72204655076052a0338973a9218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Oct 2022 00:15:32 +0300 +Subject: wifi: ath9k: verify the expected usb_endpoints are present +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 16ef02bad239f11f322df8425d302be62f0443ce ] + +The bug arises when a USB device claims to be an ATH9K but doesn't +have the expected endpoints. (In this case there was an interrupt +endpoint where the driver expected a bulk endpoint.) The kernel +needs to be able to handle such devices without getting an internal error. + +usb 1-1: BOGUS urb xfer, pipe 3 != type 1 +WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 +Modules linked in: +CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 +Workqueue: events request_firmware_work_func +RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 +Call Trace: + ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline] + ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019 + ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline] + ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242 + request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097 + process_one_work+0x9af/0x1600 kernel/workqueue.c:2279 + worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425 + kthread+0x3b4/0x4a0 kernel/kthread.c:313 + ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299 + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Suggested-by: Alan Stern +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221008211532.74583-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index d872459c51cc..8a18a33b5b59 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -1328,10 +1328,24 @@ static int send_eject_command(struct usb_interface *interface) + static int ath9k_hif_usb_probe(struct usb_interface *interface, + const struct usb_device_id *id) + { ++ struct usb_endpoint_descriptor *bulk_in, *bulk_out, *int_in, *int_out; + struct usb_device *udev = interface_to_usbdev(interface); ++ struct usb_host_interface *alt; + struct hif_device_usb *hif_dev; + int ret = 0; + ++ /* Verify the expected endpoints are present */ ++ alt = interface->cur_altsetting; ++ if (usb_find_common_endpoints(alt, &bulk_in, &bulk_out, &int_in, &int_out) < 0 || ++ usb_endpoint_num(bulk_in) != USB_WLAN_RX_PIPE || ++ usb_endpoint_num(bulk_out) != USB_WLAN_TX_PIPE || ++ usb_endpoint_num(int_in) != USB_REG_IN_PIPE || ++ usb_endpoint_num(int_out) != USB_REG_OUT_PIPE) { ++ dev_err(&udev->dev, ++ "ath9k_htc: Device endpoint numbers are not the expected ones\n"); ++ return -ENODEV; ++ } ++ + if (id->driver_info == STORAGE_DEVICE) + return send_eject_command(interface); + +-- +2.35.1 + diff --git a/queue-4.19/wifi-brcmfmac-fix-error-return-code-in-brcmf_sdio_do.patch b/queue-4.19/wifi-brcmfmac-fix-error-return-code-in-brcmf_sdio_do.patch new file mode 100644 index 00000000000..ec3ef1b20ea --- /dev/null +++ b/queue-4.19/wifi-brcmfmac-fix-error-return-code-in-brcmf_sdio_do.patch @@ -0,0 +1,53 @@ +From 2dacd66fd46d7192f9661385b5f4ae20630a4895 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 13:35:42 +0800 +Subject: wifi: brcmfmac: Fix error return code in + brcmf_sdio_download_firmware() + +From: Wang Yufen + +[ Upstream commit c2f2924bc7f9ea75ef8d95863e710168f8196256 ] + +Fix to return a negative error code instead of 0 when +brcmf_chip_set_active() fails. In addition, change the return +value for brcmf_pcie_exit_download_state() to keep consistent. + +Fixes: d380ebc9b6fb ("brcmfmac: rename chip download functions") +Signed-off-by: Wang Yufen +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1669959342-27144-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index a21529d2ccab..6ee04af85e9d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -612,7 +612,7 @@ static int brcmf_pcie_exit_download_state(struct brcmf_pciedev_info *devinfo, + } + + if (!brcmf_chip_set_active(devinfo->ci, resetintr)) +- return -EINVAL; ++ return -EIO; + return 0; + } + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index 0a96c1071e5b..6eb1daf51301 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -3337,6 +3337,7 @@ static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus, + /* Take arm out of reset */ + if (!brcmf_chip_set_active(bus->ci, rstvec)) { + brcmf_err("error getting out of ARM core reset\n"); ++ bcmerror = -EIO; + goto err; + } + +-- +2.35.1 + diff --git a/queue-4.19/wifi-brcmfmac-fix-potential-shift-out-of-bounds-in-b.patch b/queue-4.19/wifi-brcmfmac-fix-potential-shift-out-of-bounds-in-b.patch new file mode 100644 index 00000000000..a556e9d5626 --- /dev/null +++ b/queue-4.19/wifi-brcmfmac-fix-potential-shift-out-of-bounds-in-b.patch @@ -0,0 +1,149 @@ +From 605e20286e4263c4d5a04e916a45f8590a02bb06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Oct 2022 16:13:29 +0900 +Subject: wifi: brcmfmac: Fix potential shift-out-of-bounds in + brcmf_fw_alloc_request() + +From: Minsuk Kang + +[ Upstream commit 81d17f6f3331f03c8eafdacea68ab773426c1e3c ] + +This patch fixes a shift-out-of-bounds in brcmfmac that occurs in +BIT(chiprev) when a 'chiprev' provided by the device is too large. +It should also not be equal to or greater than BITS_PER_TYPE(u32) +as we do bitwise AND with a u32 variable and BIT(chiprev). The patch +adds a check that makes the function return NULL if that is the case. +Note that the NULL case is later handled by the bus-specific caller, +brcmf_usb_probe_cb() or brcmf_usb_reset_resume(), for example. + +Found by a modified version of syzkaller. + +UBSAN: shift-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +shift exponent 151055786 is too large for 64-bit type 'long unsigned int' +CPU: 0 PID: 1885 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 +Workqueue: usb_hub_wq hub_event +Call Trace: + dump_stack_lvl+0x57/0x7d + ubsan_epilogue+0x5/0x40 + __ubsan_handle_shift_out_of_bounds.cold+0x53/0xdb + ? lock_chain_count+0x20/0x20 + brcmf_fw_alloc_request.cold+0x19/0x3ea + ? brcmf_fw_get_firmwares+0x250/0x250 + ? brcmf_usb_ioctl_resp_wait+0x1a7/0x1f0 + brcmf_usb_get_fwname+0x114/0x1a0 + ? brcmf_usb_reset_resume+0x120/0x120 + ? number+0x6c4/0x9a0 + brcmf_c_process_clm_blob+0x168/0x590 + ? put_dec+0x90/0x90 + ? enable_ptr_key_workfn+0x20/0x20 + ? brcmf_common_pd_remove+0x50/0x50 + ? rcu_read_lock_sched_held+0xa1/0xd0 + brcmf_c_preinit_dcmds+0x673/0xc40 + ? brcmf_c_set_joinpref_default+0x100/0x100 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? rcu_read_lock_bh_held+0xb0/0xb0 + ? lock_acquire+0x19d/0x4e0 + ? find_held_lock+0x2d/0x110 + ? brcmf_usb_deq+0x1cc/0x260 + ? mark_held_locks+0x9f/0xe0 + ? lockdep_hardirqs_on_prepare+0x273/0x3e0 + ? _raw_spin_unlock_irqrestore+0x47/0x50 + ? trace_hardirqs_on+0x1c/0x120 + ? brcmf_usb_deq+0x1a7/0x260 + ? brcmf_usb_rx_fill_all+0x5a/0xf0 + brcmf_attach+0x246/0xd40 + ? wiphy_new_nm+0x1476/0x1d50 + ? kmemdup+0x30/0x40 + brcmf_usb_probe+0x12de/0x1690 + ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 + usb_probe_interface+0x25f/0x710 + really_probe+0x1be/0xa90 + __driver_probe_device+0x2ab/0x460 + ? usb_match_id.part.0+0x88/0xc0 + driver_probe_device+0x49/0x120 + __device_attach_driver+0x18a/0x250 + ? driver_allows_async_probing+0x120/0x120 + bus_for_each_drv+0x123/0x1a0 + ? bus_rescan_devices+0x20/0x20 + ? lockdep_hardirqs_on_prepare+0x273/0x3e0 + ? trace_hardirqs_on+0x1c/0x120 + __device_attach+0x207/0x330 + ? device_bind_driver+0xb0/0xb0 + ? kobject_uevent_env+0x230/0x12c0 + bus_probe_device+0x1a2/0x260 + device_add+0xa61/0x1ce0 + ? __mutex_unlock_slowpath+0xe7/0x660 + ? __fw_devlink_link_to_suppliers+0x550/0x550 + usb_set_configuration+0x984/0x1770 + ? kernfs_create_link+0x175/0x230 + usb_generic_driver_probe+0x69/0x90 + usb_probe_device+0x9c/0x220 + really_probe+0x1be/0xa90 + __driver_probe_device+0x2ab/0x460 + driver_probe_device+0x49/0x120 + __device_attach_driver+0x18a/0x250 + ? driver_allows_async_probing+0x120/0x120 + bus_for_each_drv+0x123/0x1a0 + ? bus_rescan_devices+0x20/0x20 + ? lockdep_hardirqs_on_prepare+0x273/0x3e0 + ? trace_hardirqs_on+0x1c/0x120 + __device_attach+0x207/0x330 + ? device_bind_driver+0xb0/0xb0 + ? kobject_uevent_env+0x230/0x12c0 + bus_probe_device+0x1a2/0x260 + device_add+0xa61/0x1ce0 + ? __fw_devlink_link_to_suppliers+0x550/0x550 + usb_new_device.cold+0x463/0xf66 + ? hub_disconnect+0x400/0x400 + ? _raw_spin_unlock_irq+0x24/0x30 + hub_event+0x10d5/0x3330 + ? hub_port_debounce+0x280/0x280 + ? __lock_acquire+0x1671/0x5790 + ? wq_calc_node_cpumask+0x170/0x2a0 + ? lock_release+0x640/0x640 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? rcu_read_lock_bh_held+0xb0/0xb0 + ? lockdep_hardirqs_on_prepare+0x273/0x3e0 + process_one_work+0x873/0x13e0 + ? lock_release+0x640/0x640 + ? pwq_dec_nr_in_flight+0x320/0x320 + ? rwlock_bug.part.0+0x90/0x90 + worker_thread+0x8b/0xd10 + ? __kthread_parkme+0xd9/0x1d0 + ? process_one_work+0x13e0/0x13e0 + kthread+0x379/0x450 + ? _raw_spin_unlock_irq+0x24/0x30 + ? set_kthread_struct+0x100/0x100 + ret_from_fork+0x1f/0x30 + +Reported-by: Dokyung Song +Reported-by: Jisoo Jang +Reported-by: Minsuk Kang +Signed-off-by: Minsuk Kang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221024071329.504277-1-linuxlovemin@yonsei.ac.kr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +index 4e5a6c311d1a..d8460835ff00 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +@@ -648,6 +648,11 @@ brcmf_fw_alloc_request(u32 chip, u32 chiprev, + char end = '\0'; + size_t reqsz; + ++ if (chiprev >= BITS_PER_TYPE(u32)) { ++ brcmf_err("Invalid chip revision %u\n", chiprev); ++ return NULL; ++ } ++ + for (i = 0; i < table_size; i++) { + if (mapping_table[i].chipid == chip && + mapping_table[i].revmask & BIT(chiprev)) +-- +2.35.1 + diff --git a/queue-4.19/wifi-cfg80211-fix-not-unregister-reg_pdev-when-load_.patch b/queue-4.19/wifi-cfg80211-fix-not-unregister-reg_pdev-when-load_.patch new file mode 100644 index 00000000000..9f10485e054 --- /dev/null +++ b/queue-4.19/wifi-cfg80211-fix-not-unregister-reg_pdev-when-load_.patch @@ -0,0 +1,57 @@ +From 7abf6041321f612364494e4964b5f94b8d24f017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Nov 2022 17:02:37 +0800 +Subject: wifi: cfg80211: Fix not unregister reg_pdev when + load_builtin_regdb_keys() fails + +From: Chen Zhongjin + +[ Upstream commit 833a9fd28c9b7ccb39a334721379e992dc1c0c89 ] + +In regulatory_init_db(), when it's going to return a error, reg_pdev +should be unregistered. When load_builtin_regdb_keys() fails it doesn't +do it and makes cfg80211 can't be reload with report: + +sysfs: cannot create duplicate filename '/devices/platform/regulatory.0' + ... + + dump_stack_lvl+0x79/0x9b + sysfs_warn_dup.cold+0x1c/0x29 + sysfs_create_dir_ns+0x22d/0x290 + kobject_add_internal+0x247/0x800 + kobject_add+0x135/0x1b0 + device_add+0x389/0x1be0 + platform_device_add+0x28f/0x790 + platform_device_register_full+0x376/0x4b0 + regulatory_init+0x9a/0x4b2 [cfg80211] + cfg80211_init+0x84/0x113 [cfg80211] + ... + +Fixes: 90a53e4432b1 ("cfg80211: implement regdb signature checking") +Signed-off-by: Chen Zhongjin +Link: https://lore.kernel.org/r/20221109090237.214127-1-chenzhongjin@huawei.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/reg.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 07d053603e3a..beba41f8a178 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -3918,8 +3918,10 @@ static int __init regulatory_init_db(void) + return -EINVAL; + + err = load_builtin_regdb_keys(); +- if (err) ++ if (err) { ++ platform_device_unregister(reg_pdev); + return err; ++ } + + /* We always try to get an update for the static regdomain */ + err = regulatory_hint_core(cfg80211_world_regdom->alpha2); +-- +2.35.1 + diff --git a/queue-4.19/wifi-mac80211-fix-memory-leak-in-ieee80211_if_add.patch b/queue-4.19/wifi-mac80211-fix-memory-leak-in-ieee80211_if_add.patch new file mode 100644 index 00000000000..e1b86964f5b --- /dev/null +++ b/queue-4.19/wifi-mac80211-fix-memory-leak-in-ieee80211_if_add.patch @@ -0,0 +1,36 @@ +From 27e908352316cb12a174037ca597285139867b00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Nov 2022 14:45:00 +0800 +Subject: wifi: mac80211: fix memory leak in ieee80211_if_add() + +From: Zhengchao Shao + +[ Upstream commit 13e5afd3d773c6fc6ca2b89027befaaaa1ea7293 ] + +When register_netdevice() failed in ieee80211_if_add(), ndev->tstats +isn't released. Fix it. + +Fixes: 5a490510ba5f ("mac80211: use per-CPU TX/RX statistics") +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20221117064500.319983-1-shaozhengchao@huawei.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/iface.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index 358028a09ce4..5d252d144cb9 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1888,6 +1888,7 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name, + + ret = register_netdevice(ndev); + if (ret) { ++ ieee80211_if_free(ndev); + free_netdev(ndev); + return ret; + } +-- +2.35.1 + diff --git a/queue-4.19/wifi-rsi-fix-handling-of-802.3-eapol-frames-sent-via.patch b/queue-4.19/wifi-rsi-fix-handling-of-802.3-eapol-frames-sent-via.patch new file mode 100644 index 00000000000..a63c7788819 --- /dev/null +++ b/queue-4.19/wifi-rsi-fix-handling-of-802.3-eapol-frames-sent-via.patch @@ -0,0 +1,92 @@ +From 7e5e13109cde2ab1516af05527cb34c1f893b023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Nov 2022 17:33:39 +0100 +Subject: wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port + +From: Marek Vasut + +[ Upstream commit b8f6efccbb9dc0ff5dee7e20d69a4747298ee603 ] + +When using wpa_supplicant v2.10, this driver is no longer able to +associate with any AP and fails in the EAPOL 4-way handshake while +sending the 2/4 message to the AP. The problem is not present in +wpa_supplicant v2.9 or older. The problem stems from HostAP commit +144314eaa ("wpa_supplicant: Send EAPOL frames over nl80211 where available") +which changes the way EAPOL frames are sent, from them being send +at L2 frames to them being sent via nl80211 control port. + +An EAPOL frame sent as L2 frame is passed to the WiFi driver with +skb->protocol ETH_P_PAE, while EAPOL frame sent via nl80211 control +port has skb->protocol set to ETH_P_802_3 . The later happens in +ieee80211_tx_control_port(), where the EAPOL frame is encapsulated +into 802.3 frame. + +The rsi_91x driver handles ETH_P_PAE EAPOL frames as high-priority +frames and sends them via highest-priority transmit queue, while +the ETH_P_802_3 frames are sent as regular frames. The EAPOL 4-way +handshake frames must be sent as highest-priority, otherwise the +4-way handshake times out. + +Therefore, to fix this problem, inspect the skb control flags and +if flag IEEE80211_TX_CTRL_PORT_CTRL_PROTO is set, assume this is +an EAPOL frame and transmit the frame via high-priority queue just +like other ETH_P_PAE frames. + +Fixes: 0eb42586cf87 ("rsi: data packet descriptor enhancements") +Signed-off-by: Marek Vasut +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20221104163339.227432-1-marex@denx.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_core.c | 4 +++- + drivers/net/wireless/rsi/rsi_91x_hal.c | 6 +++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_core.c b/drivers/net/wireless/rsi/rsi_91x_core.c +index c6c29034b2ea..a939b552a8e4 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_core.c ++++ b/drivers/net/wireless/rsi/rsi_91x_core.c +@@ -466,7 +466,9 @@ void rsi_core_xmit(struct rsi_common *common, struct sk_buff *skb) + tid, 0); + } + } +- if (skb->protocol == cpu_to_be16(ETH_P_PAE)) { ++ ++ if (IEEE80211_SKB_CB(skb)->control.flags & ++ IEEE80211_TX_CTRL_PORT_CTRL_PROTO) { + q_num = MGMT_SOFT_Q; + skb->priority = q_num; + } +diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c +index 2cb7cca4ec2d..b445a52fbfbd 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -152,12 +152,16 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb) + u8 header_size; + u8 vap_id = 0; + u8 dword_align_bytes; ++ bool tx_eapol; + u16 seq_num; + + info = IEEE80211_SKB_CB(skb); + vif = info->control.vif; + tx_params = (struct skb_info *)info->driver_data; + ++ tx_eapol = IEEE80211_SKB_CB(skb)->control.flags & ++ IEEE80211_TX_CTRL_PORT_CTRL_PROTO; ++ + header_size = FRAME_DESC_SZ + sizeof(struct rsi_xtended_desc); + if (header_size > skb_headroom(skb)) { + rsi_dbg(ERR_ZONE, "%s: Unable to send pkt\n", __func__); +@@ -221,7 +225,7 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb) + } + } + +- if (skb->protocol == cpu_to_be16(ETH_P_PAE)) { ++ if (tx_eapol) { + rsi_dbg(INFO_ZONE, "*** Tx EAPOL ***\n"); + + data_desc->frame_info = cpu_to_le16(RATE_INFO_ENABLE); +-- +2.35.1 + diff --git a/queue-4.19/wifi-rtl8xxxu-add-__packed-to-struct-rtl8723bu_c2h.patch b/queue-4.19/wifi-rtl8xxxu-add-__packed-to-struct-rtl8723bu_c2h.patch new file mode 100644 index 00000000000..297eb763095 --- /dev/null +++ b/queue-4.19/wifi-rtl8xxxu-add-__packed-to-struct-rtl8723bu_c2h.patch @@ -0,0 +1,41 @@ +From d5cd5019b563dba5b8213fdf8c0137cea643f301 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Dec 2022 16:13:57 +0200 +Subject: wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h + +From: Bitterblue Smith + +[ Upstream commit dd469a754afdb782ba3033cee102147493dc39f4 ] + +This struct is used to access a sequence of bytes received from the +wifi chip. It must not have any padding bytes between the members. + +This doesn't change anything on my system, possibly because currently +none of the members need more than byte alignment. + +Fixes: b2b43b7837ba ("rtl8xxxu: Initial functionality to handle C2H events for 8723bu") +Signed-off-by: Bitterblue Smith +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1a270918-da22-ff5f-29fc-7855f740c5ba@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +index bd28deff9b8c..7eef3f7c36ad 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +@@ -1186,7 +1186,7 @@ struct rtl8723bu_c2h { + u8 dummy3_0; + } __packed ra_report; + }; +-}; ++} __packed; + + struct rtl8xxxu_fileops; + +-- +2.35.1 + diff --git a/queue-4.19/wifi-rtl8xxxu-fix-reading-the-vendor-of-combo-chips.patch b/queue-4.19/wifi-rtl8xxxu-fix-reading-the-vendor-of-combo-chips.patch new file mode 100644 index 00000000000..50b1cf6c95c --- /dev/null +++ b/queue-4.19/wifi-rtl8xxxu-fix-reading-the-vendor-of-combo-chips.patch @@ -0,0 +1,83 @@ +From 475d412da5171ee4f5ae01fc2f6054a6321f1dc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Oct 2022 13:56:09 +0300 +Subject: wifi: rtl8xxxu: Fix reading the vendor of combo chips + +From: Bitterblue Smith + +[ Upstream commit 6f103aeb5e985ac08f3a4a049a2c17294f40cff9 ] + +The wifi + bluetooth combo chips (RTL8723AU and RTL8723BU) read the +chip vendor from the wrong register because the val32 variable gets +overwritten. Add one more variable to avoid this. + +This had no real effect on RTL8723BU. It may have had an effect on +RTL8723AU. + +Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") +Signed-off-by: Bitterblue Smith +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/24af8024-2f07-552b-93d8-38823d8e3cb0@gmail.com +Signed-off-by: Sasha Levin +--- + .../wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 38f06ee98b35..fb8545f79fa6 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -1614,18 +1614,18 @@ static void rtl8xxxu_print_chipinfo(struct rtl8xxxu_priv *priv) + static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv) + { + struct device *dev = &priv->udev->dev; +- u32 val32, bonding; ++ u32 val32, bonding, sys_cfg; + u16 val16; + +- val32 = rtl8xxxu_read32(priv, REG_SYS_CFG); +- priv->chip_cut = (val32 & SYS_CFG_CHIP_VERSION_MASK) >> ++ sys_cfg = rtl8xxxu_read32(priv, REG_SYS_CFG); ++ priv->chip_cut = (sys_cfg & SYS_CFG_CHIP_VERSION_MASK) >> + SYS_CFG_CHIP_VERSION_SHIFT; +- if (val32 & SYS_CFG_TRP_VAUX_EN) { ++ if (sys_cfg & SYS_CFG_TRP_VAUX_EN) { + dev_info(dev, "Unsupported test chip\n"); + return -ENOTSUPP; + } + +- if (val32 & SYS_CFG_BT_FUNC) { ++ if (sys_cfg & SYS_CFG_BT_FUNC) { + if (priv->chip_cut >= 3) { + sprintf(priv->chip_name, "8723BU"); + priv->rtl_chip = RTL8723B; +@@ -1647,7 +1647,7 @@ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv) + if (val32 & MULTI_GPS_FUNC_EN) + priv->has_gps = 1; + priv->is_multi_func = 1; +- } else if (val32 & SYS_CFG_TYPE_ID) { ++ } else if (sys_cfg & SYS_CFG_TYPE_ID) { + bonding = rtl8xxxu_read32(priv, REG_HPON_FSM); + bonding &= HPON_FSM_BONDING_MASK; + if (priv->fops->tx_desc_size == +@@ -1695,7 +1695,7 @@ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv) + case RTL8188E: + case RTL8192E: + case RTL8723B: +- switch (val32 & SYS_CFG_VENDOR_EXT_MASK) { ++ switch (sys_cfg & SYS_CFG_VENDOR_EXT_MASK) { + case SYS_CFG_VENDOR_ID_TSMC: + sprintf(priv->chip_vendor, "TSMC"); + break; +@@ -1712,7 +1712,7 @@ static int rtl8xxxu_identify_chip(struct rtl8xxxu_priv *priv) + } + break; + default: +- if (val32 & SYS_CFG_VENDOR_ID) { ++ if (sys_cfg & SYS_CFG_VENDOR_ID) { + sprintf(priv->chip_vendor, "UMC"); + priv->vendor_umc = 1; + } else { +-- +2.35.1 + diff --git a/queue-4.19/x86-xen-fix-memory-leak-in-xen_init_lock_cpu.patch b/queue-4.19/x86-xen-fix-memory-leak-in-xen_init_lock_cpu.patch new file mode 100644 index 00000000000..0cc4d1ab35a --- /dev/null +++ b/queue-4.19/x86-xen-fix-memory-leak-in-xen_init_lock_cpu.patch @@ -0,0 +1,64 @@ +From 1010302ffd06561db1466795f4b59364c53a4feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 23:58:58 +0800 +Subject: x86/xen: Fix memory leak in xen_init_lock_cpu() + +From: Xiu Jianfeng + +[ Upstream commit ca84ce153d887b1dc8b118029976cc9faf2a9b40 ] + +In xen_init_lock_cpu(), the @name has allocated new string by kasprintf(), +if bind_ipi_to_irqhandler() fails, it should be freed, otherwise may lead +to a memory leak issue, fix it. + +Fixes: 2d9e1e2f58b5 ("xen: implement Xen-specific spinlocks") +Signed-off-by: Xiu Jianfeng +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20221123155858.11382-3-xiujianfeng@huawei.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/spinlock.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c +index 6fffb86a32ad..e6cf1b430fd0 100644 +--- a/arch/x86/xen/spinlock.c ++++ b/arch/x86/xen/spinlock.c +@@ -83,6 +83,7 @@ void xen_init_lock_cpu(int cpu) + cpu, per_cpu(lock_kicker_irq, cpu)); + + name = kasprintf(GFP_KERNEL, "spinlock%d", cpu); ++ per_cpu(irq_name, cpu) = name; + irq = bind_ipi_to_irqhandler(XEN_SPIN_UNLOCK_VECTOR, + cpu, + dummy_handler, +@@ -93,7 +94,6 @@ void xen_init_lock_cpu(int cpu) + if (irq >= 0) { + disable_irq(irq); /* make sure it's never delivered */ + per_cpu(lock_kicker_irq, cpu) = irq; +- per_cpu(irq_name, cpu) = name; + } + + printk("cpu %d spinlock event irq %d\n", cpu, irq); +@@ -106,6 +106,8 @@ void xen_uninit_lock_cpu(int cpu) + if (!xen_pvspin) + return; + ++ kfree(per_cpu(irq_name, cpu)); ++ per_cpu(irq_name, cpu) = NULL; + /* + * When booting the kernel with 'mitigations=auto,nosmt', the secondary + * CPUs are not activated, and lock_kicker_irq is not initialized. +@@ -116,8 +118,6 @@ void xen_uninit_lock_cpu(int cpu) + + unbind_from_irqhandler(irq, NULL); + per_cpu(lock_kicker_irq, cpu) = -1; +- kfree(per_cpu(irq_name, cpu)); +- per_cpu(irq_name, cpu) = NULL; + } + + PV_CALLEE_SAVE_REGS_THUNK(xen_vcpu_stolen); +-- +2.35.1 + diff --git a/queue-4.19/x86-xen-fix-memory-leak-in-xen_smp_intr_init-_pv.patch b/queue-4.19/x86-xen-fix-memory-leak-in-xen_smp_intr_init-_pv.patch new file mode 100644 index 00000000000..2fd7f6240f2 --- /dev/null +++ b/queue-4.19/x86-xen-fix-memory-leak-in-xen_smp_intr_init-_pv.patch @@ -0,0 +1,178 @@ +From c0101dad61935cb1648fb67c611d67bbe6fb94f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Nov 2022 23:58:57 +0800 +Subject: x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() + +From: Xiu Jianfeng + +[ Upstream commit 69143f60868b3939ddc89289b29db593b647295e ] + +These local variables @{resched|pmu|callfunc...}_name saves the new +string allocated by kasprintf(), and when bind_{v}ipi_to_irqhandler() +fails, it goes to the @fail tag, and calls xen_smp_intr_free{_pv}() to +free resource, however the new string is not saved, which cause a memory +leak issue. fix it. + +Fixes: 9702785a747a ("i386: move xen") +Signed-off-by: Xiu Jianfeng +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20221123155858.11382-2-xiujianfeng@huawei.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/smp.c | 24 ++++++++++++------------ + arch/x86/xen/smp_pv.c | 12 ++++++------ + 2 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index 63a3605b2225..a1cc855c539c 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -32,30 +32,30 @@ static irqreturn_t xen_reschedule_interrupt(int irq, void *dev_id) + + void xen_smp_intr_free(unsigned int cpu) + { ++ kfree(per_cpu(xen_resched_irq, cpu).name); ++ per_cpu(xen_resched_irq, cpu).name = NULL; + if (per_cpu(xen_resched_irq, cpu).irq >= 0) { + unbind_from_irqhandler(per_cpu(xen_resched_irq, cpu).irq, NULL); + per_cpu(xen_resched_irq, cpu).irq = -1; +- kfree(per_cpu(xen_resched_irq, cpu).name); +- per_cpu(xen_resched_irq, cpu).name = NULL; + } ++ kfree(per_cpu(xen_callfunc_irq, cpu).name); ++ per_cpu(xen_callfunc_irq, cpu).name = NULL; + if (per_cpu(xen_callfunc_irq, cpu).irq >= 0) { + unbind_from_irqhandler(per_cpu(xen_callfunc_irq, cpu).irq, NULL); + per_cpu(xen_callfunc_irq, cpu).irq = -1; +- kfree(per_cpu(xen_callfunc_irq, cpu).name); +- per_cpu(xen_callfunc_irq, cpu).name = NULL; + } ++ kfree(per_cpu(xen_debug_irq, cpu).name); ++ per_cpu(xen_debug_irq, cpu).name = NULL; + if (per_cpu(xen_debug_irq, cpu).irq >= 0) { + unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu).irq, NULL); + per_cpu(xen_debug_irq, cpu).irq = -1; +- kfree(per_cpu(xen_debug_irq, cpu).name); +- per_cpu(xen_debug_irq, cpu).name = NULL; + } ++ kfree(per_cpu(xen_callfuncsingle_irq, cpu).name); ++ per_cpu(xen_callfuncsingle_irq, cpu).name = NULL; + if (per_cpu(xen_callfuncsingle_irq, cpu).irq >= 0) { + unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu).irq, + NULL); + per_cpu(xen_callfuncsingle_irq, cpu).irq = -1; +- kfree(per_cpu(xen_callfuncsingle_irq, cpu).name); +- per_cpu(xen_callfuncsingle_irq, cpu).name = NULL; + } + } + +@@ -65,6 +65,7 @@ int xen_smp_intr_init(unsigned int cpu) + char *resched_name, *callfunc_name, *debug_name; + + resched_name = kasprintf(GFP_KERNEL, "resched%d", cpu); ++ per_cpu(xen_resched_irq, cpu).name = resched_name; + rc = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, + cpu, + xen_reschedule_interrupt, +@@ -74,9 +75,9 @@ int xen_smp_intr_init(unsigned int cpu) + if (rc < 0) + goto fail; + per_cpu(xen_resched_irq, cpu).irq = rc; +- per_cpu(xen_resched_irq, cpu).name = resched_name; + + callfunc_name = kasprintf(GFP_KERNEL, "callfunc%d", cpu); ++ per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_VECTOR, + cpu, + xen_call_function_interrupt, +@@ -86,10 +87,10 @@ int xen_smp_intr_init(unsigned int cpu) + if (rc < 0) + goto fail; + per_cpu(xen_callfunc_irq, cpu).irq = rc; +- per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; + + if (!xen_fifo_events) { + debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); ++ per_cpu(xen_debug_irq, cpu).name = debug_name; + rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, + xen_debug_interrupt, + IRQF_PERCPU | IRQF_NOBALANCING, +@@ -97,10 +98,10 @@ int xen_smp_intr_init(unsigned int cpu) + if (rc < 0) + goto fail; + per_cpu(xen_debug_irq, cpu).irq = rc; +- per_cpu(xen_debug_irq, cpu).name = debug_name; + } + + callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); ++ per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, + cpu, + xen_call_function_single_interrupt, +@@ -110,7 +111,6 @@ int xen_smp_intr_init(unsigned int cpu) + if (rc < 0) + goto fail; + per_cpu(xen_callfuncsingle_irq, cpu).irq = rc; +- per_cpu(xen_callfuncsingle_irq, cpu).name = callfunc_name; + + return 0; + +diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c +index e8248e8a04ca..75807c2a1e17 100644 +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -94,18 +94,18 @@ asmlinkage __visible void cpu_bringup_and_idle(void) + + void xen_smp_intr_free_pv(unsigned int cpu) + { ++ kfree(per_cpu(xen_irq_work, cpu).name); ++ per_cpu(xen_irq_work, cpu).name = NULL; + if (per_cpu(xen_irq_work, cpu).irq >= 0) { + unbind_from_irqhandler(per_cpu(xen_irq_work, cpu).irq, NULL); + per_cpu(xen_irq_work, cpu).irq = -1; +- kfree(per_cpu(xen_irq_work, cpu).name); +- per_cpu(xen_irq_work, cpu).name = NULL; + } + ++ kfree(per_cpu(xen_pmu_irq, cpu).name); ++ per_cpu(xen_pmu_irq, cpu).name = NULL; + if (per_cpu(xen_pmu_irq, cpu).irq >= 0) { + unbind_from_irqhandler(per_cpu(xen_pmu_irq, cpu).irq, NULL); + per_cpu(xen_pmu_irq, cpu).irq = -1; +- kfree(per_cpu(xen_pmu_irq, cpu).name); +- per_cpu(xen_pmu_irq, cpu).name = NULL; + } + } + +@@ -115,6 +115,7 @@ int xen_smp_intr_init_pv(unsigned int cpu) + char *callfunc_name, *pmu_name; + + callfunc_name = kasprintf(GFP_KERNEL, "irqwork%d", cpu); ++ per_cpu(xen_irq_work, cpu).name = callfunc_name; + rc = bind_ipi_to_irqhandler(XEN_IRQ_WORK_VECTOR, + cpu, + xen_irq_work_interrupt, +@@ -124,10 +125,10 @@ int xen_smp_intr_init_pv(unsigned int cpu) + if (rc < 0) + goto fail; + per_cpu(xen_irq_work, cpu).irq = rc; +- per_cpu(xen_irq_work, cpu).name = callfunc_name; + + if (is_xen_pmu) { + pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu); ++ per_cpu(xen_pmu_irq, cpu).name = pmu_name; + rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu, + xen_pmu_irq_handler, + IRQF_PERCPU|IRQF_NOBALANCING, +@@ -135,7 +136,6 @@ int xen_smp_intr_init_pv(unsigned int cpu) + if (rc < 0) + goto fail; + per_cpu(xen_pmu_irq, cpu).irq = rc; +- per_cpu(xen_pmu_irq, cpu).name = pmu_name; + } + + return 0; +-- +2.35.1 + diff --git a/queue-4.19/xen-events-only-register-debug-interrupt-for-2-level.patch b/queue-4.19/xen-events-only-register-debug-interrupt-for-2-level.patch new file mode 100644 index 00000000000..9519736b967 --- /dev/null +++ b/queue-4.19/xen-events-only-register-debug-interrupt-for-2-level.patch @@ -0,0 +1,100 @@ +From 2cff847fc33f25e002c144dc1af0230fc70fcea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 11:49:05 +0200 +Subject: xen/events: only register debug interrupt for 2-level events + +From: Juergen Gross + +[ Upstream commit d04b1ae5a9b0c868dda8b4b34175ef08f3cb9e93 ] + +xen_debug_interrupt() is specific to 2-level event handling. So don't +register it with fifo event handling being active. + +Signed-off-by: Juergen Gross +Reviewed-by: Jan Beulich +Link: https://lore.kernel.org/r/20201022094907.28560-4-jgross@suse.com +Signed-off-by: Boris Ostrovsky +Stable-dep-of: 69143f60868b ("x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()") +Signed-off-by: Sasha Levin +--- + arch/x86/xen/smp.c | 19 +++++++++++-------- + arch/x86/xen/xen-ops.h | 2 ++ + drivers/xen/events/events_base.c | 10 ++++++---- + 3 files changed, 19 insertions(+), 12 deletions(-) + +diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c +index 7a43b2ae19f1..63a3605b2225 100644 +--- a/arch/x86/xen/smp.c ++++ b/arch/x86/xen/smp.c +@@ -88,14 +88,17 @@ int xen_smp_intr_init(unsigned int cpu) + per_cpu(xen_callfunc_irq, cpu).irq = rc; + per_cpu(xen_callfunc_irq, cpu).name = callfunc_name; + +- debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); +- rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, xen_debug_interrupt, +- IRQF_PERCPU | IRQF_NOBALANCING, +- debug_name, NULL); +- if (rc < 0) +- goto fail; +- per_cpu(xen_debug_irq, cpu).irq = rc; +- per_cpu(xen_debug_irq, cpu).name = debug_name; ++ if (!xen_fifo_events) { ++ debug_name = kasprintf(GFP_KERNEL, "debug%d", cpu); ++ rc = bind_virq_to_irqhandler(VIRQ_DEBUG, cpu, ++ xen_debug_interrupt, ++ IRQF_PERCPU | IRQF_NOBALANCING, ++ debug_name, NULL); ++ if (rc < 0) ++ goto fail; ++ per_cpu(xen_debug_irq, cpu).irq = rc; ++ per_cpu(xen_debug_irq, cpu).name = debug_name; ++ } + + callfunc_name = kasprintf(GFP_KERNEL, "callfuncsingle%d", cpu); + rc = bind_ipi_to_irqhandler(XEN_CALL_FUNCTION_SINGLE_VECTOR, +diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h +index 2f111f47ba98..9faec8543237 100644 +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -30,6 +30,8 @@ extern struct start_info *xen_start_info; + extern struct shared_info xen_dummy_shared_info; + extern struct shared_info *HYPERVISOR_shared_info; + ++extern bool xen_fifo_events; ++ + void xen_setup_mfn_list_list(void); + void xen_build_mfn_list_list(void); + void xen_setup_machphys_mapping(void); +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index d138027034fd..b6b3131cb079 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -2100,8 +2100,8 @@ void xen_callback_vector(void) + void xen_callback_vector(void) {} + #endif + +-static bool fifo_events = true; +-module_param(fifo_events, bool, 0); ++bool xen_fifo_events = true; ++module_param_named(fifo_events, xen_fifo_events, bool, 0); + + static int xen_evtchn_cpu_prepare(unsigned int cpu) + { +@@ -2130,10 +2130,12 @@ void __init xen_init_IRQ(void) + int ret = -EINVAL; + unsigned int evtchn; + +- if (fifo_events) ++ if (xen_fifo_events) + ret = xen_evtchn_fifo_init(); +- if (ret < 0) ++ if (ret < 0) { + xen_evtchn_2l_init(); ++ xen_fifo_events = false; ++ } + + xen_cpu_init_eoi(smp_processor_id()); + +-- +2.35.1 + diff --git a/queue-4.19/xen-privcmd-fix-a-possible-warning-in-privcmd_ioctl_.patch b/queue-4.19/xen-privcmd-fix-a-possible-warning-in-privcmd_ioctl_.patch new file mode 100644 index 00000000000..f8b2de2eb24 --- /dev/null +++ b/queue-4.19/xen-privcmd-fix-a-possible-warning-in-privcmd_ioctl_.patch @@ -0,0 +1,46 @@ +From a6eda47540469c9512dc4407938cca1805f5108a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Nov 2022 21:07:45 -0800 +Subject: xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource() + +From: Harshit Mogalapalli + +[ Upstream commit 8b997b2bb2c53b76a6db6c195930e9ab8e4b0c79 ] + +As 'kdata.num' is user-controlled data, if user tries to allocate +memory larger than(>=) MAX_ORDER, then kcalloc() will fail, it +creates a stack trace and messes up dmesg with a warning. + +Call trace: +-> privcmd_ioctl +--> privcmd_ioctl_mmap_resource + +Add __GFP_NOWARN in order to avoid too large allocation warning. +This is detected by static analysis using smatch. + +Fixes: 3ad0876554ca ("xen/privcmd: add IOCTL_PRIVCMD_MMAP_RESOURCE") +Signed-off-by: Harshit Mogalapalli +Reviewed-by: Juergen Gross +Link: https://lore.kernel.org/r/20221126050745.778967-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/privcmd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c +index 74ff28fda64d..15ece1041d17 100644 +--- a/drivers/xen/privcmd.c ++++ b/drivers/xen/privcmd.c +@@ -785,7 +785,7 @@ static long privcmd_ioctl_mmap_resource(struct file *file, + goto out; + } + +- pfns = kcalloc(kdata.num, sizeof(*pfns), GFP_KERNEL); ++ pfns = kcalloc(kdata.num, sizeof(*pfns), GFP_KERNEL | __GFP_NOWARN); + if (!pfns) { + rc = -ENOMEM; + goto out; +-- +2.35.1 +