From: Sasha Levin Date: Sat, 6 May 2023 11:59:20 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v5.15.111~99 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=95fa2bdb66ac3aaabbab73aa5fa6f635c6305489;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch b/queue-4.19/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..c2e3459c061 --- /dev/null +++ b/queue-4.19/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,45 @@ +From 8fec0db0d424a1692195625f80161a56f03366c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:51 +0530 +Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address +(0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 59527bb1225a9..cb90e7645d08c 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -387,8 +387,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>, +- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>; ++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>, ++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>; + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-4.19/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch b/queue-4.19/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch new file mode 100644 index 00000000000..777815fcace --- /dev/null +++ b/queue-4.19/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch @@ -0,0 +1,128 @@ +From 4d59e512fe465fc97628b2019e3f503e33649f01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 13:01:48 +0530 +Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step + +From: Sumit Garg + +[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ] + +Currently only the first attempt to single-step has any effect. After +that all further stepping remains "stuck" at the same program counter +value. + +Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12, +PSTATE.SS=1 should be set at each step before transferring the PE to the +'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set +since the second single-step. + +After the first single-step, the PE transferes to the 'Inactive' state, +with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to +kernel_active_single_step()=true. Then the PE transferes to the +'Active-pending' state when ERET and returns to the debugger by step +exception. + +Before this patch: +================== +Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> + +[0]kdb> +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger) + is enabled addr at ffffa45c13d09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> + +After this patch: +================= +Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger) + is enabled addr at ffffc02d2dd09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c +[1]kdb> + +Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support") +Co-developed-by: Wei Li +Signed-off-by: Wei Li +Signed-off-by: Sumit Garg +Tested-by: Douglas Anderson +Acked-by: Daniel Thompson +Tested-by: Daniel Thompson +Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/debug-monitors.h | 1 + + arch/arm64/kernel/debug-monitors.c | 5 +++++ + arch/arm64/kernel/kgdb.c | 2 ++ + 3 files changed, 8 insertions(+) + +diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h +index 41b065f1be88c..13630e8078ff4 100644 +--- a/arch/arm64/include/asm/debug-monitors.h ++++ b/arch/arm64/include/asm/debug-monitors.h +@@ -125,6 +125,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs, + void kernel_enable_single_step(struct pt_regs *regs); + void kernel_disable_single_step(void); + int kernel_active_single_step(void); ++void kernel_rewind_single_step(struct pt_regs *regs); + + #ifdef CONFIG_HAVE_HW_BREAKPOINT + int reinstall_suspended_bps(struct pt_regs *regs); +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index 501e835c65007..f5837937cd932 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -437,6 +437,11 @@ int kernel_active_single_step(void) + } + NOKPROBE_SYMBOL(kernel_active_single_step); + ++void kernel_rewind_single_step(struct pt_regs *regs) ++{ ++ set_regs_spsr_ss(regs); ++} ++ + /* ptrace API */ + void user_enable_single_step(struct task_struct *task) + { +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index 8815b5457dd0b..d7847ef10e9d3 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -234,6 +234,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo, + */ + if (!kernel_active_single_step()) + kernel_enable_single_step(linux_regs); ++ else ++ kernel_rewind_single_step(linux_regs); + err = 0; + break; + default: +-- +2.39.2 + diff --git a/queue-4.19/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch b/queue-4.19/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch new file mode 100644 index 00000000000..088640b20c1 --- /dev/null +++ b/queue-4.19/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch @@ -0,0 +1,46 @@ +From 930d09bc28154ab4b16592a2810092d7c37cc89e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 14:21:15 +0100 +Subject: bpftool: Fix bug for long instructions in program CFG dumps + +From: Quentin Monnet + +[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ] + +When dumping the control flow graphs for programs using the 16-byte long +load instruction, we need to skip the second part of this instruction +when looking for the next instruction to process. Otherwise, we end up +printing "BUG_ld_00" from the kernel disassembler in the CFG. + +Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information") +Signed-off-by: Quentin Monnet +Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/xlated_dumper.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c +index 3284759df98ad..7f49347bf5aa4 100644 +--- a/tools/bpf/bpftool/xlated_dumper.c ++++ b/tools/bpf/bpftool/xlated_dumper.c +@@ -336,8 +336,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end, + struct bpf_insn *insn_start = buf_start; + struct bpf_insn *insn_end = buf_end; + struct bpf_insn *cur = insn_start; ++ bool double_insn = false; + + for (; cur <= insn_end; cur++) { ++ if (double_insn) { ++ double_insn = false; ++ continue; ++ } ++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW); ++ + printf("% 4d: ", (int)(cur - insn_start + start_idx)); + print_bpf_insn(&cbs, cur, true); + if (cur != insn_end) +-- +2.39.2 + diff --git a/queue-4.19/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch b/queue-4.19/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch new file mode 100644 index 00000000000..5340b61a660 --- /dev/null +++ b/queue-4.19/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch @@ -0,0 +1,74 @@ +From 21e7b221568642f754e77f66cb24bf4bd818b381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:32:27 +0100 +Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ] + +When returning from of_parse_phandle_with_args(), the np member of the +of_phandle_args structure should be put after usage. Add missing +of_node_put() calls in both __set_clk_parents() and __set_clk_rates(). + +Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree") +Signed-off-by: Clément Léger +Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-conf.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c +index 49819b546134b..5c6760e45a16e 100644 +--- a/drivers/clk/clk-conf.c ++++ b/drivers/clk/clk-conf.c +@@ -36,9 +36,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + pclk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(pclk)) { + if (PTR_ERR(pclk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get parent clock %d for %pOF\n", +@@ -51,10 +54,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + if (rc < 0) + goto err; + if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + rc = 0; + goto err; + } + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get assigned clock %d for %pOF\n", +@@ -96,10 +101,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get clock %d for %pOF\n", +-- +2.39.2 + diff --git a/queue-4.19/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch b/queue-4.19/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch new file mode 100644 index 00000000000..2302ca8fd25 --- /dev/null +++ b/queue-4.19/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch @@ -0,0 +1,68 @@ +From a36e55872d449f1c0fe502630c33bcfa8ece7236 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 15:18:08 +0100 +Subject: crypto: drbg - make drbg_prepare_hrng() handle jent instantiation + errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nicolai Stange + +[ Upstream commit 559edd47cce4cc407d606b4d7f376822816fd4b8 ] + +Now that drbg_prepare_hrng() doesn't do anything but to instantiate a +jitterentropy crypto_rng instance, it looks a little odd to have the +related error handling at its only caller, drbg_instantiate(). + +Move the handling of jitterentropy allocation failures from +drbg_instantiate() close to the allocation itself in drbg_prepare_hrng(). + +There is no change in behaviour. + +Signed-off-by: Nicolai Stange +Reviewed-by: Stephan Müller +Signed-off-by: Herbert Xu +Stable-dep-of: 686cd976b6dd ("crypto: drbg - Only fail when jent is unavailable in FIPS mode") +Signed-off-by: Sasha Levin +--- + crypto/drbg.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/crypto/drbg.c b/crypto/drbg.c +index c8c56763dfded..8b80fd3690ff4 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1512,6 +1512,14 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) + return 0; + + drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); ++ if (IS_ERR(drbg->jent)) { ++ const int err = PTR_ERR(drbg->jent); ++ ++ drbg->jent = NULL; ++ if (fips_enabled || err != -ENOENT) ++ return err; ++ pr_info("DRBG: Continuing without Jitter RNG\n"); ++ } + + return 0; + } +@@ -1567,14 +1575,6 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, + if (ret) + goto free_everything; + +- if (IS_ERR(drbg->jent)) { +- ret = PTR_ERR(drbg->jent); +- drbg->jent = NULL; +- if (fips_enabled || ret != -ENOENT) +- goto free_everything; +- pr_info("DRBG: Continuing without Jitter RNG\n"); +- } +- + reseed = false; + } + +-- +2.39.2 + diff --git a/queue-4.19/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch b/queue-4.19/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch new file mode 100644 index 00000000000..494c35f1e67 --- /dev/null +++ b/queue-4.19/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch @@ -0,0 +1,41 @@ +From 188f197057c27c123b49f32c05a32f1446cfdcdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 11:35:23 +0800 +Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode + +From: Herbert Xu + +[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] + +When jent initialisation fails for any reason other than ENOENT, +the entire drbg fails to initialise, even when we're not in FIPS +mode. This is wrong because we can still use the kernel RNG when +we're not in FIPS mode. + +Change it so that it only fails when we are in FIPS mode. + +Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") +Signed-off-by: Herbert Xu +Reviewed-by: Stephan Mueller +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/drbg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/drbg.c b/crypto/drbg.c +index 8b80fd3690ff4..0df8cc9bb5637 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1516,7 +1516,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) + const int err = PTR_ERR(drbg->jent); + + drbg->jent = NULL; +- if (fips_enabled || err != -ENOENT) ++ if (fips_enabled) + return err; + pr_info("DRBG: Continuing without Jitter RNG\n"); + } +-- +2.39.2 + diff --git a/queue-4.19/debugobject-prevent-init-race-with-static-objects.patch b/queue-4.19/debugobject-prevent-init-race-with-static-objects.patch new file mode 100644 index 00000000000..bf2aab9f36b --- /dev/null +++ b/queue-4.19/debugobject-prevent-init-race-with-static-objects.patch @@ -0,0 +1,283 @@ +From 4e89fd036a8f2994dff7af89610eaab9059b2286 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 09:54:39 +0200 +Subject: debugobject: Prevent init race with static objects + +From: Thomas Gleixner + +[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ] + +Statically initialized objects are usually not initialized via the init() +function of the subsystem. They are special cased and the subsystem +provides a function to validate whether an object which is not yet tracked +by debugobjects is statically initialized. This means the object is started +to be tracked on first use, e.g. activation. + +This works perfectly fine, unless there are two concurrent operations on +that object. Schspa decoded the problem: + +T0 T1 + +debug_object_assert_init(addr) + lock_hash_bucket() + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + - > preemption + lock_subsytem_object(addr); + activate_object(addr) + lock_hash_bucket(); + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + if (is_static_object(addr)) + init_and_track(addr); + lock_hash_bucket(); + obj = lookup_object(addr); + obj->state = ACTIVATED; + unlock_hash_bucket(); + + subsys function modifies content of addr, + so static object detection does + not longer work. + + unlock_subsytem_object(addr); + + if (is_static_object(addr)) <- Fails + + debugobject emits a warning and invokes the fixup function which + reinitializes the already active object in the worst case. + +This race exists forever, but was never observed until mod_timer() got a +debug_object_assert_init() added which is outside of the timer base lock +held section right at the beginning of the function to cover the lockless +early exit points too. + +Rework the code so that the lookup, the static object check and the +tracking object association happens atomically under the hash bucket +lock. This prevents the issue completely as all callers are serialized on +the hash bucket lock and therefore cannot observe inconsistent state. + +Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects") +Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com +Debugged-by: Schspa Shi +Signed-off-by: Thomas Gleixner +Reviewed-by: Stephen Boyd +Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462 +Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com +Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx +Signed-off-by: Sasha Levin +--- + lib/debugobjects.c | 125 ++++++++++++++++++++++++--------------------- + 1 file changed, 66 insertions(+), 59 deletions(-) + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index 6909a6e51de83..2315a75c45c3b 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -196,10 +196,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list) + return obj; + } + +-/* +- * Allocate a new object. If the pool is empty, switch off the debugger. +- * Must be called with interrupts disabled. +- */ + static struct debug_obj * + alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr) + { +@@ -425,11 +421,49 @@ static void debug_object_is_on_stack(void *addr, int onstack) + WARN_ON(1); + } + ++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b, ++ struct debug_obj_descr *descr, ++ bool onstack, bool alloc_ifstatic) ++{ ++ struct debug_obj *obj = lookup_object(addr, b); ++ enum debug_obj_state state = ODEBUG_STATE_NONE; ++ ++ if (likely(obj)) ++ return obj; ++ ++ /* ++ * debug_object_init() unconditionally allocates untracked ++ * objects. It does not matter whether it is a static object or ++ * not. ++ * ++ * debug_object_assert_init() and debug_object_activate() allow ++ * allocation only if the descriptor callback confirms that the ++ * object is static and considered initialized. For non-static ++ * objects the allocation needs to be done from the fixup callback. ++ */ ++ if (unlikely(alloc_ifstatic)) { ++ if (!descr->is_static_object || !descr->is_static_object(addr)) ++ return ERR_PTR(-ENOENT); ++ /* Statically allocated objects are considered initialized */ ++ state = ODEBUG_STATE_INIT; ++ } ++ ++ obj = alloc_object(addr, b, descr); ++ if (likely(obj)) { ++ obj->state = state; ++ debug_object_is_on_stack(addr, onstack); ++ return obj; ++ } ++ ++ /* Out of memory. Do the cleanup outside of the locked region */ ++ debug_objects_enabled = 0; ++ return NULL; ++} ++ + static void + __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + { + enum debug_obj_state state; +- bool check_stack = false; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -440,16 +474,11 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (!obj) { +- obj = alloc_object(addr, db, descr); +- if (!obj) { +- debug_objects_enabled = 0; +- raw_spin_unlock_irqrestore(&db->lock, flags); +- debug_objects_oom(); +- return; +- } +- check_stack = true; ++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false); ++ if (unlikely(!obj)) { ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_objects_oom(); ++ return; + } + + switch (obj->state) { +@@ -475,8 +504,6 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + } + + raw_spin_unlock_irqrestore(&db->lock, flags); +- if (check_stack) +- debug_object_is_on_stack(addr, onstack); + } + + /** +@@ -516,14 +543,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack); + */ + int debug_object_activate(void *addr, struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + enum debug_obj_state state; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; + int ret; +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; + + if (!debug_objects_enabled) + return 0; +@@ -532,8 +557,8 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr) + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (obj) { ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ if (likely(!IS_ERR_OR_NULL(obj))) { + bool print_object = false; + + switch (obj->state) { +@@ -566,24 +591,16 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr) + + raw_spin_unlock_irqrestore(&db->lock, flags); + +- /* +- * We are here when a static object is activated. We +- * let the type specific code confirm whether this is +- * true or not. if true, we just make sure that the +- * static object is tracked in the object tracker. If +- * not, this must be a bug, so we try to fix it up. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* track this static object */ +- debug_object_init(addr, descr); +- debug_object_activate(addr, descr); +- } else { +- debug_print_object(&o, "activate"); +- ret = debug_object_fixup(descr->fixup_activate, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- return ret ? 0 : -EINVAL; ++ /* If NULL the allocation has hit OOM */ ++ if (!obj) { ++ debug_objects_oom(); ++ return 0; + } +- return 0; ++ ++ /* Object is neither static nor tracked. It's not initialized */ ++ debug_print_object(&o, "activate"); ++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE); ++ return ret ? 0 : -EINVAL; + } + EXPORT_SYMBOL_GPL(debug_object_activate); + +@@ -737,6 +754,7 @@ EXPORT_SYMBOL_GPL(debug_object_free); + */ + void debug_object_assert_init(void *addr, struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -747,31 +765,20 @@ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr) + db = get_bucket((unsigned long) addr); + + raw_spin_lock_irqsave(&db->lock, flags); ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (likely(!IS_ERR_OR_NULL(obj))) ++ return; + +- obj = lookup_object(addr, db); ++ /* If NULL the allocation has hit OOM */ + if (!obj) { +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; +- +- raw_spin_unlock_irqrestore(&db->lock, flags); +- /* +- * Maybe the object is static, and we let the type specific +- * code confirm. Track this static object if true, else invoke +- * fixup. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* Track this static object */ +- debug_object_init(addr, descr); +- } else { +- debug_print_object(&o, "assert_init"); +- debug_object_fixup(descr->fixup_assert_init, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- } ++ debug_objects_oom(); + return; + } + +- raw_spin_unlock_irqrestore(&db->lock, flags); ++ /* Object is neither tracked nor static. It's not initialized. */ ++ debug_print_object(&o, "assert_init"); ++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE); + } + EXPORT_SYMBOL_GPL(debug_object_assert_init); + +-- +2.39.2 + diff --git a/queue-4.19/debugobjects-add-percpu-free-pools.patch b/queue-4.19/debugobjects-add-percpu-free-pools.patch new file mode 100644 index 00000000000..d68eb1b6b03 --- /dev/null +++ b/queue-4.19/debugobjects-add-percpu-free-pools.patch @@ -0,0 +1,261 @@ +From a1cc2da0b7dcfc906e931eb03f62a7c4bbff1beb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2019 10:14:46 -0400 +Subject: debugobjects: Add percpu free pools + +From: Waiman Long + +[ Upstream commit d86998b17a01050c0232231fa481e65ef8171ca6 ] + +When a multi-threaded workload does a lot of small memory object +allocations and deallocations, it may cause the allocation and freeing of +many debug objects. This will make the global pool_lock a bottleneck in the +performance of the workload. Since interrupts are disabled when acquiring +the pool_lock, it may even cause hard lockups to happen. + +To reduce contention of the global pool_lock, add a percpu debug object +free pool that can be used to buffer some of the debug object allocation +and freeing requests without acquiring the pool_lock. Each CPU will now +have a percpu free pool that can hold up to a maximum of 64 debug +objects. Allocation and freeing requests will go to the percpu free pool +first. If that fails, the pool_lock will be taken and the global free pool +will be used. + +The presence or absence of obj_cache is used as a marker to see if the +percpu cache should be used. + +Signed-off-by: Waiman Long +Signed-off-by: Thomas Gleixner +Cc: Andrew Morton +Cc: Yang Shi +Cc: "Joel Fernandes (Google)" +Cc: Qian Cai +Cc: Zhong Jiang +Link: https://lkml.kernel.org/r/20190520141450.7575-2-longman@redhat.com +Stable-dep-of: 63a759694eed ("debugobject: Prevent init race with static objects") +Signed-off-by: Sasha Levin +--- + lib/debugobjects.c | 115 +++++++++++++++++++++++++++++++++++---------- + 1 file changed, 91 insertions(+), 24 deletions(-) + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index 14afeeb7d6ef5..6e2baf9e9eb27 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -25,6 +25,7 @@ + + #define ODEBUG_POOL_SIZE 1024 + #define ODEBUG_POOL_MIN_LEVEL 256 ++#define ODEBUG_POOL_PERCPU_SIZE 64 + + #define ODEBUG_CHUNK_SHIFT PAGE_SHIFT + #define ODEBUG_CHUNK_SIZE (1 << ODEBUG_CHUNK_SHIFT) +@@ -35,6 +36,17 @@ struct debug_bucket { + raw_spinlock_t lock; + }; + ++/* ++ * Debug object percpu free list ++ * Access is protected by disabling irq ++ */ ++struct debug_percpu_free { ++ struct hlist_head free_objs; ++ int obj_free; ++}; ++ ++static DEFINE_PER_CPU(struct debug_percpu_free, percpu_obj_pool); ++ + static struct debug_bucket obj_hash[ODEBUG_HASH_SIZE]; + + static struct debug_obj obj_static_pool[ODEBUG_POOL_SIZE] __initdata; +@@ -44,13 +56,19 @@ static DEFINE_RAW_SPINLOCK(pool_lock); + static HLIST_HEAD(obj_pool); + static HLIST_HEAD(obj_to_free); + ++/* ++ * Because of the presence of percpu free pools, obj_pool_free will ++ * under-count those in the percpu free pools. Similarly, obj_pool_used ++ * will over-count those in the percpu free pools. Adjustments will be ++ * made at debug_stats_show(). Both obj_pool_min_free and obj_pool_max_used ++ * can be off. ++ */ + static int obj_pool_min_free = ODEBUG_POOL_SIZE; + static int obj_pool_free = ODEBUG_POOL_SIZE; + static int obj_pool_used; + static int obj_pool_max_used; + /* The number of objs on the global free list */ + static int obj_nr_tofree; +-static struct kmem_cache *obj_cache; + + static int debug_objects_maxchain __read_mostly; + static int __maybe_unused debug_objects_maxchecked __read_mostly; +@@ -63,6 +81,7 @@ static int debug_objects_pool_size __read_mostly + static int debug_objects_pool_min_level __read_mostly + = ODEBUG_POOL_MIN_LEVEL; + static struct debug_obj_descr *descr_test __read_mostly; ++static struct kmem_cache *obj_cache __read_mostly; + + /* + * Track numbers of kmem_cache_alloc()/free() calls done. +@@ -162,6 +181,21 @@ static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b) + return NULL; + } + ++/* ++ * Allocate a new object from the hlist ++ */ ++static struct debug_obj *__alloc_object(struct hlist_head *list) ++{ ++ struct debug_obj *obj = NULL; ++ ++ if (list->first) { ++ obj = hlist_entry(list->first, typeof(*obj), node); ++ hlist_del(&obj->node); ++ } ++ ++ return obj; ++} ++ + /* + * Allocate a new object. If the pool is empty, switch off the debugger. + * Must be called with interrupts disabled. +@@ -169,20 +203,21 @@ static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b) + static struct debug_obj * + alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr) + { +- struct debug_obj *obj = NULL; +- +- raw_spin_lock(&pool_lock); +- if (obj_pool.first) { +- obj = hlist_entry(obj_pool.first, typeof(*obj), node); +- +- obj->object = addr; +- obj->descr = descr; +- obj->state = ODEBUG_STATE_NONE; +- obj->astate = 0; +- hlist_del(&obj->node); ++ struct debug_percpu_free *percpu_pool; ++ struct debug_obj *obj; + +- hlist_add_head(&obj->node, &b->list); ++ if (likely(obj_cache)) { ++ percpu_pool = this_cpu_ptr(&percpu_obj_pool); ++ obj = __alloc_object(&percpu_pool->free_objs); ++ if (obj) { ++ percpu_pool->obj_free--; ++ goto init_obj; ++ } ++ } + ++ raw_spin_lock(&pool_lock); ++ obj = __alloc_object(&obj_pool); ++ if (obj) { + obj_pool_used++; + if (obj_pool_used > obj_pool_max_used) + obj_pool_max_used = obj_pool_used; +@@ -193,6 +228,14 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr) + } + raw_spin_unlock(&pool_lock); + ++init_obj: ++ if (obj) { ++ obj->object = addr; ++ obj->descr = descr; ++ obj->state = ODEBUG_STATE_NONE; ++ obj->astate = 0; ++ hlist_add_head(&obj->node, &b->list); ++ } + return obj; + } + +@@ -247,8 +290,21 @@ static bool __free_object(struct debug_obj *obj) + { + unsigned long flags; + bool work; ++ struct debug_percpu_free *percpu_pool; + +- raw_spin_lock_irqsave(&pool_lock, flags); ++ local_irq_save(flags); ++ /* ++ * Try to free it into the percpu pool first. ++ */ ++ percpu_pool = this_cpu_ptr(&percpu_obj_pool); ++ if (obj_cache && percpu_pool->obj_free < ODEBUG_POOL_PERCPU_SIZE) { ++ hlist_add_head(&obj->node, &percpu_pool->free_objs); ++ percpu_pool->obj_free++; ++ local_irq_restore(flags); ++ return false; ++ } ++ ++ raw_spin_lock(&pool_lock); + work = (obj_pool_free > debug_objects_pool_size) && obj_cache; + obj_pool_used--; + +@@ -259,7 +315,8 @@ static bool __free_object(struct debug_obj *obj) + obj_pool_free++; + hlist_add_head(&obj->node, &obj_pool); + } +- raw_spin_unlock_irqrestore(&pool_lock, flags); ++ raw_spin_unlock(&pool_lock); ++ local_irq_restore(flags); + return work; + } + +@@ -822,13 +879,19 @@ void debug_check_no_obj_freed(const void *address, unsigned long size) + + static int debug_stats_show(struct seq_file *m, void *v) + { ++ int cpu, obj_percpu_free = 0; ++ ++ for_each_possible_cpu(cpu) ++ obj_percpu_free += per_cpu(percpu_obj_pool.obj_free, cpu); ++ + seq_printf(m, "max_chain :%d\n", debug_objects_maxchain); + seq_printf(m, "max_checked :%d\n", debug_objects_maxchecked); + seq_printf(m, "warnings :%d\n", debug_objects_warnings); + seq_printf(m, "fixups :%d\n", debug_objects_fixups); +- seq_printf(m, "pool_free :%d\n", obj_pool_free); ++ seq_printf(m, "pool_free :%d\n", obj_pool_free + obj_percpu_free); ++ seq_printf(m, "pool_pcp_free :%d\n", obj_percpu_free); + seq_printf(m, "pool_min_free :%d\n", obj_pool_min_free); +- seq_printf(m, "pool_used :%d\n", obj_pool_used); ++ seq_printf(m, "pool_used :%d\n", obj_pool_used - obj_percpu_free); + seq_printf(m, "pool_max_used :%d\n", obj_pool_max_used); + seq_printf(m, "on_free_list :%d\n", obj_nr_tofree); + seq_printf(m, "objs_allocated:%d\n", debug_objects_allocated); +@@ -1177,9 +1240,20 @@ static int __init debug_objects_replace_static_objects(void) + */ + void __init debug_objects_mem_init(void) + { ++ int cpu; ++ + if (!debug_objects_enabled) + return; + ++ /* ++ * Initialize the percpu object pools ++ * ++ * Initialization is not strictly necessary, but was done for ++ * completeness. ++ */ ++ for_each_possible_cpu(cpu) ++ INIT_HLIST_HEAD(&per_cpu(percpu_obj_pool.free_objs, cpu)); ++ + obj_cache = kmem_cache_create("debug_objects_cache", + sizeof (struct debug_obj), 0, + SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE, +@@ -1191,11 +1265,4 @@ void __init debug_objects_mem_init(void) + pr_warn("out of memory.\n"); + } else + debug_objects_selftest(); +- +- /* +- * Increase the thresholds for allocating and freeing objects +- * according to the number of possible CPUs available in the system. +- */ +- debug_objects_pool_size += num_possible_cpus() * 32; +- debug_objects_pool_min_level += num_possible_cpus() * 4; + } +-- +2.39.2 + diff --git a/queue-4.19/debugobjects-move-printk-out-of-db-lock-critical-sec.patch b/queue-4.19/debugobjects-move-printk-out-of-db-lock-critical-sec.patch new file mode 100644 index 00000000000..b7ef241b671 --- /dev/null +++ b/queue-4.19/debugobjects-move-printk-out-of-db-lock-critical-sec.patch @@ -0,0 +1,256 @@ +From f4bae042ab9b0690baf79a8257862c656a330b0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2019 10:14:50 -0400 +Subject: debugobjects: Move printk out of db->lock critical sections + +From: Waiman Long + +[ Upstream commit d5f34153e526903abe71869dbbc898bfc0f69373 ] + +The db->lock is a raw spinlock and so the lock hold time is supposed +to be short. This will not be the case when printk() is being involved +in some of the critical sections. In order to avoid the long hold time, +in case some messages need to be printed, the debug_object_is_on_stack() +and debug_print_object() calls are now moved out of those critical +sections. + +Signed-off-by: Waiman Long +Signed-off-by: Thomas Gleixner +Cc: Andrew Morton +Cc: Yang Shi +Cc: "Joel Fernandes (Google)" +Cc: Qian Cai +Cc: Zhong Jiang +Link: https://lkml.kernel.org/r/20190520141450.7575-6-longman@redhat.com +Stable-dep-of: 63a759694eed ("debugobject: Prevent init race with static objects") +Signed-off-by: Sasha Levin +--- + lib/debugobjects.c | 58 +++++++++++++++++++++++++++++++--------------- + 1 file changed, 39 insertions(+), 19 deletions(-) + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index 6e2baf9e9eb27..6909a6e51de83 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -429,6 +429,7 @@ static void + __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + { + enum debug_obj_state state; ++ bool check_stack = false; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -448,7 +449,7 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + debug_objects_oom(); + return; + } +- debug_object_is_on_stack(addr, onstack); ++ check_stack = true; + } + + switch (obj->state) { +@@ -459,20 +460,23 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + break; + + case ODEBUG_STATE_ACTIVE: +- debug_print_object(obj, "init"); + state = obj->state; + raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_print_object(obj, "init"); + debug_object_fixup(descr->fixup_init, addr, state); + return; + + case ODEBUG_STATE_DESTROYED: ++ raw_spin_unlock_irqrestore(&db->lock, flags); + debug_print_object(obj, "init"); +- break; ++ return; + default: + break; + } + + raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (check_stack) ++ debug_object_is_on_stack(addr, onstack); + } + + /** +@@ -530,6 +534,8 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr) + + obj = lookup_object(addr, db); + if (obj) { ++ bool print_object = false; ++ + switch (obj->state) { + case ODEBUG_STATE_INIT: + case ODEBUG_STATE_INACTIVE: +@@ -538,14 +544,14 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr) + break; + + case ODEBUG_STATE_ACTIVE: +- debug_print_object(obj, "activate"); + state = obj->state; + raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_print_object(obj, "activate"); + ret = debug_object_fixup(descr->fixup_activate, addr, state); + return ret ? 0 : -EINVAL; + + case ODEBUG_STATE_DESTROYED: +- debug_print_object(obj, "activate"); ++ print_object = true; + ret = -EINVAL; + break; + default: +@@ -553,10 +559,13 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr) + break; + } + raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (print_object) ++ debug_print_object(obj, "activate"); + return ret; + } + + raw_spin_unlock_irqrestore(&db->lock, flags); ++ + /* + * We are here when a static object is activated. We + * let the type specific code confirm whether this is +@@ -588,6 +597,7 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr) + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; ++ bool print_object = false; + + if (!debug_objects_enabled) + return; +@@ -605,24 +615,27 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr) + if (!obj->astate) + obj->state = ODEBUG_STATE_INACTIVE; + else +- debug_print_object(obj, "deactivate"); ++ print_object = true; + break; + + case ODEBUG_STATE_DESTROYED: +- debug_print_object(obj, "deactivate"); ++ print_object = true; + break; + default: + break; + } +- } else { ++ } ++ ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (!obj) { + struct debug_obj o = { .object = addr, + .state = ODEBUG_STATE_NOTAVAILABLE, + .descr = descr }; + + debug_print_object(&o, "deactivate"); ++ } else if (print_object) { ++ debug_print_object(obj, "deactivate"); + } +- +- raw_spin_unlock_irqrestore(&db->lock, flags); + } + EXPORT_SYMBOL_GPL(debug_object_deactivate); + +@@ -637,6 +650,7 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr) + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; ++ bool print_object = false; + + if (!debug_objects_enabled) + return; +@@ -656,20 +670,22 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr) + obj->state = ODEBUG_STATE_DESTROYED; + break; + case ODEBUG_STATE_ACTIVE: +- debug_print_object(obj, "destroy"); + state = obj->state; + raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_print_object(obj, "destroy"); + debug_object_fixup(descr->fixup_destroy, addr, state); + return; + + case ODEBUG_STATE_DESTROYED: +- debug_print_object(obj, "destroy"); ++ print_object = true; + break; + default: + break; + } + out_unlock: + raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (print_object) ++ debug_print_object(obj, "destroy"); + } + EXPORT_SYMBOL_GPL(debug_object_destroy); + +@@ -698,9 +714,9 @@ void debug_object_free(void *addr, struct debug_obj_descr *descr) + + switch (obj->state) { + case ODEBUG_STATE_ACTIVE: +- debug_print_object(obj, "free"); + state = obj->state; + raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_print_object(obj, "free"); + debug_object_fixup(descr->fixup_free, addr, state); + return; + default: +@@ -773,6 +789,7 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr, + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; ++ bool print_object = false; + + if (!debug_objects_enabled) + return; +@@ -788,22 +805,25 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr, + if (obj->astate == expect) + obj->astate = next; + else +- debug_print_object(obj, "active_state"); ++ print_object = true; + break; + + default: +- debug_print_object(obj, "active_state"); ++ print_object = true; + break; + } +- } else { ++ } ++ ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (!obj) { + struct debug_obj o = { .object = addr, + .state = ODEBUG_STATE_NOTAVAILABLE, + .descr = descr }; + + debug_print_object(&o, "active_state"); ++ } else if (print_object) { ++ debug_print_object(obj, "active_state"); + } +- +- raw_spin_unlock_irqrestore(&db->lock, flags); + } + EXPORT_SYMBOL_GPL(debug_object_active_state); + +@@ -839,10 +859,10 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size) + + switch (obj->state) { + case ODEBUG_STATE_ACTIVE: +- debug_print_object(obj, "free"); + descr = obj->descr; + state = obj->state; + raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_print_object(obj, "free"); + debug_object_fixup(descr->fixup_free, + (void *) oaddr, state); + goto repeat; +-- +2.39.2 + diff --git a/queue-4.19/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch b/queue-4.19/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch new file mode 100644 index 00000000000..4039894f7d4 --- /dev/null +++ b/queue-4.19/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch @@ -0,0 +1,55 @@ +From 9b37d2bcb7f0e12282c1359089e8c31587a058a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 17:18:25 +0200 +Subject: dmaengine: at_xdmac: do not enable all cyclic channels + +From: Claudiu Beznea + +[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ] + +Do not global enable all the cyclic channels in at_xdmac_resume(). Instead +save the global status in at_xdmac_suspend() and re-enable the cyclic +channel only if it was active before suspend. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_xdmac.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index a451ecae16692..33ea7abd8cc97 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -223,6 +223,7 @@ struct at_xdmac { + int irq; + struct clk *clk; + u32 save_gim; ++ u32 save_gs; + struct dma_pool *at_xdmac_desc_pool; + struct at_xdmac_chan chan[0]; + }; +@@ -1878,6 +1879,7 @@ static int atmel_xdmac_suspend(struct device *dev) + } + } + atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM); ++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS); + + at_xdmac_off(atxdmac); + clk_disable_unprepare(atxdmac->clk); +@@ -1914,7 +1916,8 @@ static int atmel_xdmac_resume(struct device *dev) + at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc); + at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim); + wmb(); +- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); ++ if (atxdmac->save_gs & atchan->mask) ++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); + } + } + return 0; +-- +2.39.2 + diff --git a/queue-4.19/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch b/queue-4.19/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch new file mode 100644 index 00000000000..42604a62000 --- /dev/null +++ b/queue-4.19/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch @@ -0,0 +1,62 @@ +From 9ec3eefdba64497e3a54f6a557ac12d74784684e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 11:20:30 -0700 +Subject: drm/msm/adreno: Defer enabling runpm until hw_init() + +From: Rob Clark + +[ Upstream commit 4b18299b33655fa9672b774b6df774dc03d6aee8 ] + +To avoid preventing the display from coming up before the rootfs is +mounted, without resorting to packing fw in the initrd, the GPU has +this limbo state where the device is probed, but we aren't ready to +start sending commands to it. This is particularly problematic for +a6xx, since the GMU (which requires fw to be loaded) is the one that +is controlling the power/clk/icc votes. + +So defer enabling runpm until we are ready to call gpu->hw_init(), +as that is a point where we know we have all the needed fw and are +ready to start sending commands to the coproc's. + +Signed-off-by: Rob Clark +Patchwork: https://patchwork.freedesktop.org/patch/489337/ +Link: https://lore.kernel.org/r/20220613182036.2567963-1-robdclark@gmail.com +Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_device.c | 6 ++++++ + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 - + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c +index 7d3e9a129ac74..0275be7e13b19 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_device.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c +@@ -190,6 +190,12 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev) + if (ret) + return NULL; + ++ /* ++ * Now that we have firmware loaded, and are ready to begin ++ * booting the gpu, go ahead and enable runpm: ++ */ ++ pm_runtime_enable(&pdev->dev); ++ + /* Make sure pm runtime is active and reset any previous errors */ + pm_runtime_set_active(&pdev->dev); + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index c9f831604558f..6da144c394097 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -725,7 +725,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, + pm_runtime_set_autosuspend_delay(&pdev->dev, + adreno_gpu->info->inactive_period); + pm_runtime_use_autosuspend(&pdev->dev); +- pm_runtime_enable(&pdev->dev); + + return msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base, + adreno_gpu->info->name, &adreno_gpu_config); +-- +2.39.2 + diff --git a/queue-4.19/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch b/queue-4.19/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch new file mode 100644 index 00000000000..fb478b87a7c --- /dev/null +++ b/queue-4.19/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch @@ -0,0 +1,42 @@ +From 273491c75db6c63f4eeda321e18b745827a4f619 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 17:48:06 +0100 +Subject: drm/msm/adreno: drop bogus pm_runtime_set_active() + +From: Johan Hovold + +[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ] + +The runtime PM status can only be updated while runtime PM is disabled. + +Drop the bogus pm_runtime_set_active() call that was made after enabling +runtime PM and which (incidentally but correctly) left the runtime PM +status set to 'suspended'. + +Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware") +Signed-off-by: Johan Hovold +Patchwork: https://patchwork.freedesktop.org/patch/524972/ +Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_device.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c +index 0275be7e13b19..7acb53a907e5c 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_device.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c +@@ -196,9 +196,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev) + */ + pm_runtime_enable(&pdev->dev); + +- /* Make sure pm runtime is active and reset any previous errors */ +- pm_runtime_set_active(&pdev->dev); +- + ret = pm_runtime_get_sync(&pdev->dev); + if (ret < 0) { + dev_err(dev->dev, "Couldn't power up the GPU: %d\n", ret); +-- +2.39.2 + diff --git a/queue-4.19/drm-probe-helper-cancel-previous-job-before-starting.patch b/queue-4.19/drm-probe-helper-cancel-previous-job-before-starting.patch new file mode 100644 index 00000000000..124e80d3082 --- /dev/null +++ b/queue-4.19/drm-probe-helper-cancel-previous-job-before-starting.patch @@ -0,0 +1,52 @@ +From b17767637ed63e0f6661633ba48b2e64eca7b109 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 16:40:52 +0100 +Subject: drm/probe-helper: Cancel previous job before starting new one + +From: Dom Cobley + +[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ] + +Currently we schedule a call to output_poll_execute from +drm_kms_helper_poll_enable for 10s in future. Later we try to replace +that in drm_helper_probe_single_connector_modes with a 0s schedule with +delayed_event set. + +But as there is already a job in the queue this fails, and the immediate +job we wanted with delayed_event set doesn't occur until 10s later. + +And that call acts as if connector state has changed, reprobing modes. +This has a side effect of waking up a display that has been blanked. + +Make sure we cancel the old job before submitting the immediate one. + +Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event") +Acked-by: Daniel Vetter +Signed-off-by: Dom Cobley +[Maxime: Switched to mod_delayed_work] +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_probe_helper.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index c0b26135dbd5b..f9e0594ee7024 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -459,8 +459,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector, + */ + dev->mode_config.delayed_event = true; + if (dev->mode_config.poll_enabled) +- schedule_delayed_work(&dev->mode_config.output_poll_work, +- 0); ++ mod_delayed_work(system_wq, ++ &dev->mode_config.output_poll_work, ++ 0); + } + + /* Re-enable polling in case the global poll config changed. */ +-- +2.39.2 + diff --git a/queue-4.19/drm-rockchip-drop-unbalanced-obj-unref.patch b/queue-4.19/drm-rockchip-drop-unbalanced-obj-unref.patch new file mode 100644 index 00000000000..86c1fd4b29a --- /dev/null +++ b/queue-4.19/drm-rockchip-drop-unbalanced-obj-unref.patch @@ -0,0 +1,38 @@ +From 8daf52402ddd58ecf63a46e8fe4b70220360c8db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:17:34 -0800 +Subject: drm/rockchip: Drop unbalanced obj unref + +From: Rob Clark + +[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ] + +In the error path, rockchip_drm_gem_object_mmap() is dropping an obj +reference that it doesn't own. + +Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers") +Signed-off-by: Rob Clark +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +index a8db758d523e9..94242fa9e25d1 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +@@ -270,9 +270,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj, + else + ret = rockchip_drm_gem_object_mmap_dma(obj, vma); + +- if (ret) +- drm_gem_vm_close(vma); +- + return ret; + } + +-- +2.39.2 + diff --git a/queue-4.19/drm-vgem-add-missing-mutex_destroy.patch b/queue-4.19/drm-vgem-add-missing-mutex_destroy.patch new file mode 100644 index 00000000000..265a2d1295c --- /dev/null +++ b/queue-4.19/drm-vgem-add-missing-mutex_destroy.patch @@ -0,0 +1,42 @@ +From f789ddf380070cd408c22019eb88c0cfc0c37c39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 09:55:17 -0300 +Subject: drm/vgem: add missing mutex_destroy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ] + +vgem_fence_open() instantiates a mutex for a particular fence +instance, but never destroys it by calling mutex_destroy() in +vgem_fence_close(). + +So, add the missing mutex_destroy() to guarantee proper resource +destruction. + +Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)") +Signed-off-by: Maíra Canal +Reviewed-by: Stanislaw Gruszka +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vgem/vgem_fence.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c +index b28876c222b46..04527d8f36236 100644 +--- a/drivers/gpu/drm/vgem/vgem_fence.c ++++ b/drivers/gpu/drm/vgem/vgem_fence.c +@@ -280,4 +280,5 @@ void vgem_fence_close(struct vgem_file *vfile) + { + idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile); + idr_destroy(&vfile->fence_idr); ++ mutex_destroy(&vfile->fence_mutex); + } +-- +2.39.2 + diff --git a/queue-4.19/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch b/queue-4.19/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch new file mode 100644 index 00000000000..c7dec15b4af --- /dev/null +++ b/queue-4.19/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch @@ -0,0 +1,53 @@ +From 5dc44ecd534a6aeae9c2d1c374acd13171246609 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 09:17:28 +0800 +Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays + +From: Qiuxu Zhuo + +[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ] + +The current DRAM row address mapping arrays skx_{open,close}_row[] +only support ranks with sizes up to 16G. Decoding a rank address +to a DRAM row address for a 32G rank by using either one of the +above arrays by the skx_edac driver, will result in an overflow on +the array. + +For a 32G rank, the most significant DRAM row address bit (the +bit17) is mapped from the bit34 of the rank address. Add this new +mapping item to both arrays to fix the overflow issue. + +Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake") +Reported-by: Feng Xu +Tested-by: Feng Xu +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/skx_edac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c +index b97803580d70f..38a82a3f45167 100644 +--- a/drivers/edac/skx_edac.c ++++ b/drivers/edac/skx_edac.c +@@ -825,13 +825,13 @@ static bool skx_rir_decode(struct decoded_addr *res) + } + + static u8 skx_close_row[] = { +- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33 ++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34 + }; + static u8 skx_close_column[] = { + 3, 4, 5, 14, 19, 23, 24, 25, 26, 27 + }; + static u8 skx_open_row[] = { +- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33 ++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34 + }; + static u8 skx_open_column[] = { + 3, 4, 5, 6, 7, 8, 9, 10, 11, 12 +-- +2.39.2 + diff --git a/queue-4.19/edac-skx-move-debugfs-node-under-edac-s-hierarchy.patch b/queue-4.19/edac-skx-move-debugfs-node-under-edac-s-hierarchy.patch new file mode 100644 index 00000000000..dba41c73b76 --- /dev/null +++ b/queue-4.19/edac-skx-move-debugfs-node-under-edac-s-hierarchy.patch @@ -0,0 +1,78 @@ +From eb10369c6dc92dce4bc80aa3b11b161475e0441c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 15:34:44 +0800 +Subject: EDAC, skx: Move debugfs node under EDAC's hierarchy + +From: Qiuxu Zhuo + +[ Upstream commit 85b9c8bfee67ed151c44861c71adc816fc1b46a9 ] + +The debugfs node is /sys/kernel/debug/skx_edac_test. Rename it and move +under EDAC debugfs root directory. Remove the unused 'skx_fake_addr' and +remove the 'skx_test' on error. + +Co-developed-by: Tony Luck +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Borislav Petkov +CC: Mauro Carvalho Chehab +CC: arozansk@redhat.com +CC: linux-edac +Link: http://lkml.kernel.org/r/1542353684-13496-1-git-send-email-qiuxu.zhuo@intel.com +Stable-dep-of: 71b1e3ba3fed ("EDAC/skx: Fix overflows on the DRAM row address mapping arrays") +Signed-off-by: Sasha Levin +--- + drivers/edac/skx_edac.c | 25 ++++++++++++------------- + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c +index dd209e0dd9abb..b97803580d70f 100644 +--- a/drivers/edac/skx_edac.c ++++ b/drivers/edac/skx_edac.c +@@ -896,12 +896,11 @@ static bool skx_decode(struct decoded_addr *res) + + #ifdef CONFIG_EDAC_DEBUG + /* +- * Debug feature. Make /sys/kernel/debug/skx_edac_test/addr. +- * Write an address to this file to exercise the address decode +- * logic in this driver. ++ * Debug feature. ++ * Exercise the address decode logic by writing an address to ++ * /sys/kernel/debug/edac/skx_test/addr. + */ + static struct dentry *skx_test; +-static u64 skx_fake_addr; + + static int debugfs_u64_set(void *data, u64 val) + { +@@ -912,19 +911,19 @@ static int debugfs_u64_set(void *data, u64 val) + + return 0; + } +- + DEFINE_SIMPLE_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n"); + +-static struct dentry *mydebugfs_create(const char *name, umode_t mode, +- struct dentry *parent, u64 *value) +-{ +- return debugfs_create_file(name, mode, parent, value, &fops_u64_wo); +-} +- + static void setup_skx_debug(void) + { +- skx_test = debugfs_create_dir("skx_edac_test", NULL); +- mydebugfs_create("addr", S_IWUSR, skx_test, &skx_fake_addr); ++ skx_test = edac_debugfs_create_dir("skx_test"); ++ if (!skx_test) ++ return; ++ ++ if (!edac_debugfs_create_file("addr", 0200, skx_test, ++ NULL, &fops_u64_wo)) { ++ debugfs_remove(skx_test); ++ skx_test = NULL; ++ } + } + + static void teardown_skx_debug(void) +-- +2.39.2 + diff --git a/queue-4.19/firmware-qcom_scm-clear-download-bit-during-reboot.patch b/queue-4.19/firmware-qcom_scm-clear-download-bit-during-reboot.patch new file mode 100644 index 00000000000..d40164f1525 --- /dev/null +++ b/queue-4.19/firmware-qcom_scm-clear-download-bit-during-reboot.patch @@ -0,0 +1,39 @@ +From 12d8a56f405c94b29046d851c81cd9441ac63af8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 20:44:26 +0530 +Subject: firmware: qcom_scm: Clear download bit during reboot + +From: Mukesh Ojha + +[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ] + +During normal restart of a system download bit should +be cleared irrespective of whether download mode is +set or not. + +Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control") +Signed-off-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index 513908a0c2622..e795bd9c8038e 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -586,8 +586,7 @@ static int qcom_scm_probe(struct platform_device *pdev) + static void qcom_scm_shutdown(struct platform_device *pdev) + { + /* Clean shutdown, disable download mode to allow normal restart */ +- if (download_mode) +- qcom_scm_set_download_mode(false); ++ qcom_scm_set_download_mode(false); + } + + static const struct of_device_id qcom_scm_dt_match[] = { +-- +2.39.2 + diff --git a/queue-4.19/fpga-bridge-fix-kernel-doc-parameter-description.patch b/queue-4.19/fpga-bridge-fix-kernel-doc-parameter-description.patch new file mode 100644 index 00000000000..6941efb742f --- /dev/null +++ b/queue-4.19/fpga-bridge-fix-kernel-doc-parameter-description.patch @@ -0,0 +1,39 @@ +From d8657bc081b6643a1326c2d7708462434327ab99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 15:03:08 +0100 +Subject: fpga: bridge: fix kernel-doc parameter description + +From: Marco Pagani + +[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ] + +Fix the kernel-doc description for the "struct fpga_image_info *info" +parameter of the fpga_bridge_get() function. + +Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes") +Signed-off-by: Marco Pagani +Reviewed-by: Tom Rix +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fpga/fpga-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c +index c983dac97501b..c7db12192facd 100644 +--- a/drivers/fpga/fpga-bridge.c ++++ b/drivers/fpga/fpga-bridge.c +@@ -121,7 +121,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data) + /** + * fpga_bridge_get - get an exclusive reference to a fpga bridge + * @dev: parent device that fpga bridge was registered with +- * @info: fpga manager info ++ * @info: fpga image specific information + * + * Given a device, get an exclusive reference to a fpga bridge. + * +-- +2.39.2 + diff --git a/queue-4.19/ia64-mm-contig-fix-section-mismatch-warning-error.patch b/queue-4.19/ia64-mm-contig-fix-section-mismatch-warning-error.patch new file mode 100644 index 00000000000..c2a7c52ba56 --- /dev/null +++ b/queue-4.19/ia64-mm-contig-fix-section-mismatch-warning-error.patch @@ -0,0 +1,41 @@ +From 762680d5f0d800ffdb8b9ae52b20a4552c109170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:42:58 -0800 +Subject: ia64: mm/contig: fix section mismatch warning/error + +From: Randy Dunlap + +[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ] + +alloc_per_cpu_data() is called by find_memory(), which is marked as +__init. Therefore alloc_per_cpu_data() can also be marked as __init to +remedy this modpost problem. + +WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text) + +Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org +Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/mm/contig.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c +index e2e40bbd391c6..18a2b105f7f30 100644 +--- a/arch/ia64/mm/contig.c ++++ b/arch/ia64/mm/contig.c +@@ -82,7 +82,7 @@ void *per_cpu_init(void) + return __per_cpu_start + __per_cpu_offset[smp_processor_id()]; + } + +-static inline void ++static inline __init void + alloc_per_cpu_data(void) + { + cpu_data = __alloc_bootmem(PERCPU_PAGE_SIZE * num_possible_cpus(), +-- +2.39.2 + diff --git a/queue-4.19/ia64-salinfo-placate-defined-but-not-used-warning.patch b/queue-4.19/ia64-salinfo-placate-defined-but-not-used-warning.patch new file mode 100644 index 00000000000..980e4629f30 --- /dev/null +++ b/queue-4.19/ia64-salinfo-placate-defined-but-not-used-warning.patch @@ -0,0 +1,42 @@ +From 8c349306e2f2ae6686c1f57065cf9810a32c4c8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:43:09 -0800 +Subject: ia64: salinfo: placate defined-but-not-used warning + +From: Randy Dunlap + +[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ] + +When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used. Mark the +function as __maybe_unused to quieten the warning message. + +../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function] + 584 | static int proc_salinfo_show(struct seq_file *m, void *v) + | ^~~~~~~~~~~~~~~~~ + +Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org +Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/salinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c +index aba1f463a8dd4..b889db4492c8d 100644 +--- a/arch/ia64/kernel/salinfo.c ++++ b/arch/ia64/kernel/salinfo.c +@@ -580,7 +580,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu) + * 'data' contains an integer that corresponds to the feature we're + * testing + */ +-static int proc_salinfo_show(struct seq_file *m, void *v) ++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v) + { + unsigned long data = (unsigned long)v; + seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n"); +-- +2.39.2 + diff --git a/queue-4.19/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch b/queue-4.19/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch new file mode 100644 index 00000000000..27c7cddcf58 --- /dev/null +++ b/queue-4.19/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch @@ -0,0 +1,93 @@ +From aeac55e4b23af5e64ec2d508c0b97e6250f06464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 12:52:39 -0400 +Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order + +From: Patrick Kelsey + +[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ] + +hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in +mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node. + +As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly +least-recently used nodes. + +This could be a performance issue for an application when that +application: +- Uses some long-lived buffers frequently. +- Uses a large number of buffers once. +- Hits the mmu_rb_handler cache size or pinned-page limits, forcing + mmu_rb_handler cache entries to be evicted. + +In this case, the one-time use buffers cause the long-lived buffer +entries to eventually filter to the end of the LRU list where +hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived +entry instead of evicting one of the one-time use entries. + +Fix this by inserting new mmu_rb_node at the tail of +mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of +mmu_rb_handler->lru_list when the mmu_rb_node is a hit in +hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict +from the head of mmu_rb_handler->lru_list instead of the tail. + +Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index e1c7996c018ef..513a297b4ff0e 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -175,7 +175,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +- list_add(&mnode->list, &handler->lru_list); ++ list_add_tail(&mnode->list, &handler->lru_list); + + ret = handler->ops->insert(handler->ops_arg, mnode); + if (ret) { +@@ -222,8 +222,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, addr, len); + if (node) { +- if (node->addr == addr && node->len == len) ++ if (node->addr == addr && node->len == len) { ++ list_move_tail(&node->list, &handler->lru_list); + goto unlock; ++ } + __mmu_int_rb_remove(node, &handler->root); + list_del(&node->list); /* remove from LRU list */ + ret = true; +@@ -244,8 +246,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + INIT_LIST_HEAD(&del_list); + + spin_lock_irqsave(&handler->lock, flags); +- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list, +- list) { ++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) { + if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg, + &stop)) { + __mmu_int_rb_remove(rbnode, &handler->root); +@@ -257,9 +258,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + spin_unlock_irqrestore(&handler->lock, flags); + +- while (!list_empty(&del_list)) { +- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list); +- list_del(&rbnode->list); ++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) { + handler->ops->remove(handler->ops_arg, rbnode); + } + } +-- +2.39.2 + diff --git a/queue-4.19/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch b/queue-4.19/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch new file mode 100644 index 00000000000..da39c6a0eb2 --- /dev/null +++ b/queue-4.19/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch @@ -0,0 +1,56 @@ +From 0ac8ceb68dea9c2474c74c13432d8b55af6e0757 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 20:40:35 +0800 +Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb() + +From: Ziyang Xuan + +[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ] + +Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in +__ip6_make_skb()"). icmphdr does not in skb linear region under the +scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will +trigger the uninit variable access bug. + +Use a local variable icmp_type to carry the correct value in different +scenarios. + +Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)") +Reviewed-by: Willem de Bruijn +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_output.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 06a981676356c..92fa11e75a4d0 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1443,9 +1443,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk, + cork->dst = NULL; + skb_dst_set(skb, &rt->dst); + +- if (iph->protocol == IPPROTO_ICMP) +- icmp_out_count(net, ((struct icmphdr *) +- skb_transport_header(skb))->type); ++ if (iph->protocol == IPPROTO_ICMP) { ++ u8 icmp_type; ++ ++ /* For such sockets, transhdrlen is zero when do ip_append_data(), ++ * so icmphdr does not in skb linear region and can not get icmp_type ++ * by icmp_hdr(skb)->type. ++ */ ++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) ++ icmp_type = fl4->fl4_icmp_type; ++ else ++ icmp_type = icmp_hdr(skb)->type; ++ icmp_out_count(net, icmp_type); ++ } + + ip_cork_release(cork); + out: +-- +2.39.2 + diff --git a/queue-4.19/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch b/queue-4.19/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch new file mode 100644 index 00000000000..aa2818f6771 --- /dev/null +++ b/queue-4.19/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch @@ -0,0 +1,68 @@ +From e25cd71e645e4264287b1ad75513db3feba414d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:22 +0000 +Subject: ixgbe: Allow flow hash to be set via ethtool + +From: Joe Damato + +[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ] + +ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool +because the ethtool code in the kernel passes a non-zero value for hfunc +that ixgbe should allow. + +When ethtool is called with `ETHTOOL_SRXFHINDIR`, +`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function +with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted. + +When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will +call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be +hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should +also be accepted. + +Before this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 + 24: 4 5 6 7 8 9 0 1 + ... + +Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index 8829bd95d0d36..a852f9c920742 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -3005,8 +3005,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir, + int i; + u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter); + +- if (hfunc) +- return -EINVAL; ++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) ++ return -EOPNOTSUPP; + + /* Fill out the redirection table */ + if (indir) { +-- +2.39.2 + diff --git a/queue-4.19/ixgbe-enable-setting-rss-table-to-default-values.patch b/queue-4.19/ixgbe-enable-setting-rss-table-to-default-values.patch new file mode 100644 index 00000000000..f48f7670572 --- /dev/null +++ b/queue-4.19/ixgbe-enable-setting-rss-table-to-default-values.patch @@ -0,0 +1,147 @@ +From 484d9c63c80204cdcc8ef9626f05ec3cba0076f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:23 +0000 +Subject: ixgbe: Enable setting RSS table to default values + +From: Joe Damato + +[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ] + +ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported +by RSS. The driver should return the smaller of either: + - The maximum number of RSS queues the device supports, OR + - The number of RX queues configured + +Prior to this change, running `ethtool -X $iface default` fails if the +number of queues configured is larger than the number supported by RSS, +even though changing the queue count correctly resets the flowhash to +use all supported queues. + +Other drivers (for example, i40e) will succeed but the flow hash will +reset to support the maximum number of queues supported by RSS, even if +that amount is smaller than the configured amount. + +Prior to this change: + +$ sudo ethtool -L eth1 combined 20 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 20 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 + 24: 8 9 10 11 12 13 14 15 + 32: 0 1 2 3 4 5 6 7 +... + +You can see that the flowhash was correctly set to use the maximum +number of queues supported by the driver (16). + +However, asking the NIC to reset to "default" fails: + +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this change, the flowhash can be reset to default which will use +all of the available RSS queues (16) or the configured queue count, +whichever is smaller. + +Starting with eth1 which has 10 queues and a flowhash distributing to +all 10 queues: + +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 +... + +Increasing the queue count to 48 resets the flowhash to distribute to 16 +queues, as it did before this patch: + +$ sudo ethtool -L eth1 combined 48 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Due to the other bugfix in this series, the flowhash can be set to use +queues 0-5: + +$ sudo ethtool -X eth1 equal 5 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 0 1 2 + 8: 3 4 0 1 2 3 4 0 + 16: 1 2 3 4 0 1 2 3 +... + +Due to this bugfix, the flowhash can be reset to default and use 16 +queues: + +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index a852f9c920742..3d361557a63a3 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -2539,6 +2539,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter, + return 0; + } + ++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) ++{ ++ if (adapter->hw.mac.type < ixgbe_mac_X550) ++ return 16; ++ else ++ return 64; ++} ++ + static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + u32 *rule_locs) + { +@@ -2547,7 +2555,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + + switch (cmd->cmd) { + case ETHTOOL_GRXRINGS: +- cmd->data = adapter->num_rx_queues; ++ cmd->data = min_t(int, adapter->num_rx_queues, ++ ixgbe_rss_indir_tbl_max(adapter)); + ret = 0; + break; + case ETHTOOL_GRXCLSRLCNT: +@@ -2949,14 +2958,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd) + return ret; + } + +-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) +-{ +- if (adapter->hw.mac.type < ixgbe_mac_X550) +- return 16; +- else +- return 64; +-} +- + static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev) + { + return IXGBE_RSS_KEY_SIZE; +-- +2.39.2 + diff --git a/queue-4.19/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch b/queue-4.19/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch new file mode 100644 index 00000000000..69edba20afa --- /dev/null +++ b/queue-4.19/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch @@ -0,0 +1,58 @@ +From 0dd18d13eea147380a382c7c54b1cfe87791d32e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 19:15:29 -0700 +Subject: linux/vt_buffer.h: allow either builtin or modular for macros + +From: Randy Dunlap + +[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ] + +Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m. +This allows the ARCH macros to be the only ones defined. + +In file included from ../drivers/video/console/mdacon.c:37: +../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~ +../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew' + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^~~~ +../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^ +../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~~~ +../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile' + 25 | static inline u16 scr_readw(volatile const u16 *addr) + | ^~~~~~~~ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: dri-devel@lists.freedesktop.org +Cc: linux-fbdev@vger.kernel.org +Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/vt_buffer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h +index 848db1b1569ff..919d999a8c1db 100644 +--- a/include/linux/vt_buffer.h ++++ b/include/linux/vt_buffer.h +@@ -16,7 +16,7 @@ + + #include + +-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE) ++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE) + #include + #endif + +-- +2.39.2 + diff --git a/queue-4.19/macintosh-via-pmu-led-requires-ata-to-be-set.patch b/queue-4.19/macintosh-via-pmu-led-requires-ata-to-be-set.patch new file mode 100644 index 00000000000..e2a006e18fc --- /dev/null +++ b/queue-4.19/macintosh-via-pmu-led-requires-ata-to-be-set.patch @@ -0,0 +1,45 @@ +From 411b86b74a994cb4b2e8e8381b79f1e6b81f2c91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 17:42:41 -0800 +Subject: macintosh: via-pmu-led: requires ATA to be set + +From: Randy Dunlap + +[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ] + +LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK +when ATA is not set/enabled causes a Kconfig warning: + +WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK + Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n] + Selected by [y]: + - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y] + +Fix this by making ADB_PMU_LED_DISK depend on ATA. + +Seen on both PPC32 and PPC64. + +Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/macintosh/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig +index a316624742f68..c3d421c7b0cf1 100644 +--- a/drivers/macintosh/Kconfig ++++ b/drivers/macintosh/Kconfig +@@ -83,6 +83,7 @@ config ADB_PMU_LED + + config ADB_PMU_LED_DISK + bool "Use front LED as DISK LED by default" ++ depends on ATA + depends on ADB_PMU_LED + depends on LEDS_CLASS + select LEDS_TRIGGERS +-- +2.39.2 + diff --git a/queue-4.19/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch b/queue-4.19/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch new file mode 100644 index 00000000000..2e9537574c2 --- /dev/null +++ b/queue-4.19/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch @@ -0,0 +1,36 @@ +From f2a500bfe2f4c61a1e4d79eb2273ffe2e9f6606c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 11:35:58 +0800 +Subject: macintosh/windfarm_smu_sat: Add missing of_node_put() + +From: Liang He + +[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ] + +We call of_node_get() in wf_sat_probe() after sat is created, +so we need the of_node_put() before *kfree(sat)*. + +Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s") +Signed-off-by: Liang He +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/macintosh/windfarm_smu_sat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c +index 51ef77de41744..3d4b8c33640a8 100644 +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -172,6 +172,7 @@ static void wf_sat_release(struct kref *ref) + + if (sat->nr >= 0) + sats[sat->nr] = NULL; ++ of_node_put(sat->node); + kfree(sat); + } + +-- +2.39.2 + diff --git a/queue-4.19/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch b/queue-4.19/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch new file mode 100644 index 00000000000..39fb2e1a2e9 --- /dev/null +++ b/queue-4.19/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch @@ -0,0 +1,73 @@ +From 8806a45a2956412e20bae29ee8b3afbbbfeafd16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:53 +0800 +Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery + +From: Yu Kuai + +[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ] + +raid10_sync_request() will add 'r10bio->remaining' for both rdev and +replacement rdev. However, if the read io fails, recovery_request_write() +returns without issuing the write io, in this case, end_sync_request() +is only called once and 'remaining' is leaked, cause an io hang. + +Fix the problem by decreasing 'remaining' according to if 'bio' and +'repl_bio' is valid. + +Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 9f9cd2fadc1e7..8181d9a375f0b 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2266,11 +2266,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + { + struct r10conf *conf = mddev->private; + int d; +- struct bio *wbio, *wbio2; ++ struct bio *wbio = r10_bio->devs[1].bio; ++ struct bio *wbio2 = r10_bio->devs[1].repl_bio; ++ ++ /* Need to test wbio2->bi_end_io before we call ++ * generic_make_request as if the former is NULL, ++ * the latter is free to free wbio2. ++ */ ++ if (wbio2 && !wbio2->bi_end_io) ++ wbio2 = NULL; + + if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) { + fix_recovery_read_error(r10_bio); +- end_sync_request(r10_bio); ++ if (wbio->bi_end_io) ++ end_sync_request(r10_bio); ++ if (wbio2) ++ end_sync_request(r10_bio); + return; + } + +@@ -2279,14 +2290,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + * and submit the write request + */ + d = r10_bio->devs[1].devnum; +- wbio = r10_bio->devs[1].bio; +- wbio2 = r10_bio->devs[1].repl_bio; +- /* Need to test wbio2->bi_end_io before we call +- * generic_make_request as if the former is NULL, +- * the latter is free to free wbio2. +- */ +- if (wbio2 && !wbio2->bi_end_io) +- wbio2 = NULL; + if (wbio->bi_end_io) { + atomic_inc(&conf->mirrors[d].rdev->nr_pending); + md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio)); +-- +2.39.2 + diff --git a/queue-4.19/md-raid10-fix-memleak-for-conf-bio_split.patch b/queue-4.19/md-raid10-fix-memleak-for-conf-bio_split.patch new file mode 100644 index 00000000000..5be2a3ae7be --- /dev/null +++ b/queue-4.19/md-raid10-fix-memleak-for-conf-bio_split.patch @@ -0,0 +1,96 @@ +From 5f6ca1a572625b4804315967561bee3dc865d3ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:54 +0800 +Subject: md/raid10: fix memleak for 'conf->bio_split' + +From: Yu Kuai + +[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ] + +In the error path of raid10_run(), 'conf' need be freed, however, +'conf->bio_split' is missed and memory will be leaked. + +Since there are 3 places to free 'conf', factor out a helper to fix the +problem. + +Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 37 +++++++++++++++++-------------------- + 1 file changed, 17 insertions(+), 20 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 8181d9a375f0b..fca95eb3cb1f3 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3671,6 +3671,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new) + return nc*fc; + } + ++static void raid10_free_conf(struct r10conf *conf) ++{ ++ if (!conf) ++ return; ++ ++ mempool_exit(&conf->r10bio_pool); ++ kfree(conf->mirrors); ++ kfree(conf->mirrors_old); ++ kfree(conf->mirrors_new); ++ safe_put_page(conf->tmppage); ++ bioset_exit(&conf->bio_split); ++ kfree(conf); ++} ++ + static struct r10conf *setup_conf(struct mddev *mddev) + { + struct r10conf *conf = NULL; +@@ -3753,13 +3767,7 @@ static struct r10conf *setup_conf(struct mddev *mddev) + return conf; + + out: +- if (conf) { +- mempool_exit(&conf->r10bio_pool); +- kfree(conf->mirrors); +- safe_put_page(conf->tmppage); +- bioset_exit(&conf->bio_split); +- kfree(conf); +- } ++ raid10_free_conf(conf); + return ERR_PTR(err); + } + +@@ -3973,10 +3981,7 @@ static int raid10_run(struct mddev *mddev) + + out_free_conf: + md_unregister_thread(&mddev->thread); +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf); ++ raid10_free_conf(conf); + mddev->private = NULL; + out: + return -EIO; +@@ -3984,15 +3989,7 @@ static int raid10_run(struct mddev *mddev) + + static void raid10_free(struct mddev *mddev, void *priv) + { +- struct r10conf *conf = priv; +- +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf->mirrors_old); +- kfree(conf->mirrors_new); +- bioset_exit(&conf->bio_split); +- kfree(conf); ++ raid10_free_conf(priv); + } + + static void raid10_quiesce(struct mddev *mddev, int quiesce) +-- +2.39.2 + diff --git a/queue-4.19/md-raid10-fix-memleak-of-md-thread.patch b/queue-4.19/md-raid10-fix-memleak-of-md-thread.patch new file mode 100644 index 00000000000..7860f8dff56 --- /dev/null +++ b/queue-4.19/md-raid10-fix-memleak-of-md-thread.patch @@ -0,0 +1,51 @@ +From 0255e0d7eb95d0695af9119368f9888e11bcb3d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:55 +0800 +Subject: md/raid10: fix memleak of md thread + +From: Yu Kuai + +[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ] + +In raid10_run(), if setup_conf() succeed and raid10_run() failed before +setting 'mddev->thread', then in the error path 'conf->thread' is not +freed. + +Fix the problem by setting 'mddev->thread' right after setup_conf(). + +Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 2a7f9df5b82c6..dc625f9cfa9d1 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3805,6 +3805,9 @@ static int raid10_run(struct mddev *mddev) + if (!conf) + goto out; + ++ mddev->thread = conf->thread; ++ conf->thread = NULL; ++ + if (mddev_is_clustered(conf->mddev)) { + int fc, fo; + +@@ -3817,9 +3820,6 @@ static int raid10_run(struct mddev *mddev) + } + } + +- mddev->thread = conf->thread; +- conf->thread = NULL; +- + if (mddev->queue) { + blk_queue_max_discard_sectors(mddev->queue, + mddev->chunk_sectors); +-- +2.39.2 + diff --git a/queue-4.19/md-update-the-optimal-i-o-size-on-reshape.patch b/queue-4.19/md-update-the-optimal-i-o-size-on-reshape.patch new file mode 100644 index 00000000000..8fd653ede95 --- /dev/null +++ b/queue-4.19/md-update-the-optimal-i-o-size-on-reshape.patch @@ -0,0 +1,119 @@ +From 2ccd8dc6f1250f049a71700d30fffb414720e997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 08:51:33 +0200 +Subject: md: update the optimal I/O size on reshape + +From: Christoph Hellwig + +[ Upstream commit 16ef510139315a2147ee7525796f8dbd4e4b7864 ] + +The raid5 and raid10 drivers currently update the read-ahead size, +but not the optimal I/O size on reshape. To prepare for deriving the +read-ahead size from the optimal I/O size make sure it is updated +as well. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Reviewed-by: Martin K. Petersen +Acked-by: Song Liu +Signed-off-by: Jens Axboe +Stable-dep-of: f0ddb83da3cb ("md/raid10: fix memleak of md thread") +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 22 ++++++++++++++-------- + drivers/md/raid5.c | 10 ++++++++-- + 2 files changed, 22 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index fca95eb3cb1f3..2a7f9df5b82c6 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3771,10 +3771,20 @@ static struct r10conf *setup_conf(struct mddev *mddev) + return ERR_PTR(err); + } + ++static void raid10_set_io_opt(struct r10conf *conf) ++{ ++ int raid_disks = conf->geo.raid_disks; ++ ++ if (!(conf->geo.raid_disks % conf->geo.near_copies)) ++ raid_disks /= conf->geo.near_copies; ++ blk_queue_io_opt(conf->mddev->queue, (conf->mddev->chunk_sectors << 9) * ++ raid_disks); ++} ++ + static int raid10_run(struct mddev *mddev) + { + struct r10conf *conf; +- int i, disk_idx, chunk_size; ++ int i, disk_idx; + struct raid10_info *disk; + struct md_rdev *rdev; + sector_t size; +@@ -3810,18 +3820,13 @@ static int raid10_run(struct mddev *mddev) + mddev->thread = conf->thread; + conf->thread = NULL; + +- chunk_size = mddev->chunk_sectors << 9; + if (mddev->queue) { + blk_queue_max_discard_sectors(mddev->queue, + mddev->chunk_sectors); + blk_queue_max_write_same_sectors(mddev->queue, 0); + blk_queue_max_write_zeroes_sectors(mddev->queue, 0); +- blk_queue_io_min(mddev->queue, chunk_size); +- if (conf->geo.raid_disks % conf->geo.near_copies) +- blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks); +- else +- blk_queue_io_opt(mddev->queue, chunk_size * +- (conf->geo.raid_disks / conf->geo.near_copies)); ++ blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9); ++ raid10_set_io_opt(conf); + } + + rdev_for_each(rdev, mddev) { +@@ -4724,6 +4729,7 @@ static void end_reshape(struct r10conf *conf) + stripe /= conf->geo.near_copies; + if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe) + conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe; ++ raid10_set_io_opt(conf); + } + conf->fullsync = 0; + } +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 7fe0619c487ae..7eeae0301ccc6 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -7153,6 +7153,12 @@ static int only_parity(int raid_disk, int algo, int raid_disks, int max_degraded + return 0; + } + ++static void raid5_set_io_opt(struct r5conf *conf) ++{ ++ blk_queue_io_opt(conf->mddev->queue, (conf->chunk_sectors << 9) * ++ (conf->raid_disks - conf->max_degraded)); ++} ++ + static int raid5_run(struct mddev *mddev) + { + struct r5conf *conf; +@@ -7442,8 +7448,7 @@ static int raid5_run(struct mddev *mddev) + + chunk_size = mddev->chunk_sectors << 9; + blk_queue_io_min(mddev->queue, chunk_size); +- blk_queue_io_opt(mddev->queue, chunk_size * +- (conf->raid_disks - conf->max_degraded)); ++ raid5_set_io_opt(conf); + mddev->queue->limits.raid_partial_stripes_expensive = 1; + /* + * We can only discard a whole stripe. It doesn't make sense to +@@ -8037,6 +8042,7 @@ static void end_reshape(struct r5conf *conf) + / PAGE_SIZE); + if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe) + conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe; ++ raid5_set_io_opt(conf); + } + } + } +-- +2.39.2 + diff --git a/queue-4.19/media-av7110-prevent-underflow-in-write_ts_to_decode.patch b/queue-4.19/media-av7110-prevent-underflow-in-write_ts_to_decode.patch new file mode 100644 index 00000000000..4bd11d673fd --- /dev/null +++ b/queue-4.19/media-av7110-prevent-underflow-in-write_ts_to_decode.patch @@ -0,0 +1,47 @@ +From 165fc1f6d90e765cb6ea766ab2883f31f67cb192 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:00:23 +0100 +Subject: media: av7110: prevent underflow in write_ts_to_decoder() + +From: Dan Carpenter + +[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ] + +The buf[4] value comes from the user via ts_play(). It is a value in +the u8 range. The final length we pass to av7110_ipack_instant_repack() +is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is +not negative. It's not clear that passing a negative len value does +anything bad necessarily, but it's not best practice. + +With the new bounds checking the "if (!len)" condition is no longer +possible or required so remove that. + +Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ttpci/av7110_av.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c +index ef1bc17cdc4d3..03d1d1fba8bc8 100644 +--- a/drivers/media/pci/ttpci/av7110_av.c ++++ b/drivers/media/pci/ttpci/av7110_av.c +@@ -836,10 +836,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s + av7110_ipack_flush(ipack); + + if (buf[3] & ADAPT_FIELD) { ++ if (buf[4] > len - 1 - 4) ++ return 0; + len -= buf[4] + 1; + buf += buf[4] + 1; +- if (!len) +- return 0; + } + + av7110_ipack_instant_repack(buf + 4, len - 4, ipack); +-- +2.39.2 + diff --git a/queue-4.19/media-bdisp-add-missing-check-for-create_workqueue.patch b/queue-4.19/media-bdisp-add-missing-check-for-create_workqueue.patch new file mode 100644 index 00000000000..9d4ea51786f --- /dev/null +++ b/queue-4.19/media-bdisp-add-missing-check-for-create_workqueue.patch @@ -0,0 +1,37 @@ +From 1c55148fc145e5752e59b5c4d2e369a3ac44c8ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 08:14:42 +0100 +Subject: media: bdisp: Add missing check for create_workqueue + +From: Jiasheng Jiang + +[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ] + +Add the check for the return value of the create_workqueue +in order to avoid NULL pointer dereference. + +Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index 00f6e3f06dac5..7a7271f9d875a 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -1312,6 +1312,8 @@ static int bdisp_probe(struct platform_device *pdev) + init_waitqueue_head(&bdisp->irq_queue); + INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout); + bdisp->work_queue = create_workqueue(BDISP_NAME); ++ if (!bdisp->work_queue) ++ return -ENOMEM; + + spin_lock_init(&bdisp->slock); + mutex_init(&bdisp->lock); +-- +2.39.2 + diff --git a/queue-4.19/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch b/queue-4.19/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch new file mode 100644 index 00000000000..61775d886b1 --- /dev/null +++ b/queue-4.19/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch @@ -0,0 +1,56 @@ +From 32f61a4583678681db6ffdb0ee6ff02f8c0f9040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:15:06 +0800 +Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race + condition + +From: Zheng Wang + +[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ] + +In dm1105_probe, it called dm1105_ir_init and bound +&dm1105->ir.work with dm1105_emit_key. +When it handles IRQ request with dm1105_irq, +it may call schedule_work to start the work. + +When we call dm1105_remove to remove the driver, there +may be a sequence as follows: + +Fix it by finishing the work before cleanup in dm1105_remove + +CPU0 CPU1 + + |dm1105_emit_key +dm1105_remove | + dm1105_ir_exit | + rc_unregister_device | + rc_free_device | + rc_dev_release | + kfree(dev); | + | + | rc_keydown + | //use + +Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/dm1105/dm1105.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c +index 1ddb0576fb7b1..dc3fc69e44806 100644 +--- a/drivers/media/pci/dm1105/dm1105.c ++++ b/drivers/media/pci/dm1105/dm1105.c +@@ -1188,6 +1188,7 @@ static void dm1105_remove(struct pci_dev *pdev) + struct dvb_demux *dvbdemux = &dev->demux; + struct dmx_demux *dmx = &dvbdemux->dmx; + ++ cancel_work_sync(&dev->ir.work); + dm1105_ir_exit(dev); + dmx->close(dmx); + dvb_net_release(&dev->dvbnet); +-- +2.39.2 + diff --git a/queue-4.19/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch b/queue-4.19/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch new file mode 100644 index 00000000000..fb0ae90cebd --- /dev/null +++ b/queue-4.19/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch @@ -0,0 +1,43 @@ +From 79df403a247df7ffac71bd1f3084452bbc9eb2d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 13:38:33 -0700 +Subject: media: rc: gpio-ir-recv: Fix support for wake-up + +From: Florian Fainelli + +[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ] + +The driver was intended from the start to be a wake-up source for the +system, however due to the absence of a suitable call to +device_set_wakeup_capable(), the device_may_wakeup() call used to decide +whether to enable the GPIO interrupt as a wake-up source would never +happen. Lookup the DT standard "wakeup-source" property and call +device_init_wakeup() to ensure the device is flagged as being wakeup +capable. + +Reported-by: Matthew Lear +Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver") +Signed-off-by: Florian Fainelli +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/rc/gpio-ir-recv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c +index 3d99b51384ac9..ed5cfde4d9e79 100644 +--- a/drivers/media/rc/gpio-ir-recv.c ++++ b/drivers/media/rc/gpio-ir-recv.c +@@ -91,6 +91,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev) + rcdev->map_name = RC_MAP_EMPTY; + + gpio_dev->rcdev = rcdev; ++ if (of_property_read_bool(np, "wakeup-source")) ++ device_init_wakeup(dev, true); + + rc = devm_rc_register_device(dev, rcdev); + if (rc < 0) { +-- +2.39.2 + diff --git a/queue-4.19/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch b/queue-4.19/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch new file mode 100644 index 00000000000..1f05a836185 --- /dev/null +++ b/queue-4.19/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch @@ -0,0 +1,70 @@ +From 055352585937f78e98d9e2c327e7606b8d001b92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 11:58:09 +0400 +Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function + +From: Miaoqian Lin + +[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ] + +rcar_fcp_get() take reference, which should be balanced with +rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and +the error paths of fdp1_probe() to fix this. + +Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver") +Signed-off-by: Miaoqian Lin +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +[hverkuil: resolve merge conflict, remove() is now void] +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index e1c8701d44ade..605d8188ac8c1 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2313,8 +2313,10 @@ static int fdp1_probe(struct platform_device *pdev) + + /* Determine our clock rate */ + clk = clk_get(&pdev->dev, NULL); +- if (IS_ERR(clk)) +- return PTR_ERR(clk); ++ if (IS_ERR(clk)) { ++ ret = PTR_ERR(clk); ++ goto put_dev; ++ } + + fdp1->clk_rate = clk_get_rate(clk); + clk_put(clk); +@@ -2323,7 +2325,7 @@ static int fdp1_probe(struct platform_device *pdev) + ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev); + if (ret) { + v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n"); +- return ret; ++ goto put_dev; + } + + /* M2M registration */ +@@ -2388,6 +2390,8 @@ static int fdp1_probe(struct platform_device *pdev) + unreg_dev: + v4l2_device_unregister(&fdp1->v4l2_dev); + ++put_dev: ++ rcar_fcp_put(fdp1->fcp); + return ret; + } + +@@ -2399,6 +2403,7 @@ static int fdp1_remove(struct platform_device *pdev) + video_unregister_device(&fdp1->vfd); + v4l2_device_unregister(&fdp1->v4l2_dev); + pm_runtime_disable(&pdev->dev); ++ rcar_fcp_put(fdp1->fcp); + + return 0; + } +-- +2.39.2 + diff --git a/queue-4.19/media-rcar_fdp1-fix-the-correct-variable-assignments.patch b/queue-4.19/media-rcar_fdp1-fix-the-correct-variable-assignments.patch new file mode 100644 index 00000000000..56613d3637a --- /dev/null +++ b/queue-4.19/media-rcar_fdp1-fix-the-correct-variable-assignments.patch @@ -0,0 +1,48 @@ +From 990a5a9c88f16662fe3ce52f5d626b488c49832f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 05:09:38 +0200 +Subject: media: rcar_fdp1: Fix the correct variable assignments + +From: Tang Bin + +[ Upstream commit af88c2adbb72a09ab1bb5c37ba388c98fecca69b ] + +In the function fdp1_probe(), when get irq failed, the +function platform_get_irq() log an error message, so +remove redundant message here. And the variable type +of "ret" is int, the "fdp1->irq" is unsigned int, when +irq failed, this place maybe wrong, thus fix it. + +Signed-off-by: Tang Bin +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 2bd5898a62044..e1c8701d44ade 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2287,11 +2287,10 @@ static int fdp1_probe(struct platform_device *pdev) + return PTR_ERR(fdp1->regs); + + /* Interrupt service routine registration */ +- fdp1->irq = ret = platform_get_irq(pdev, 0); +- if (ret < 0) { +- dev_err(&pdev->dev, "cannot find IRQ\n"); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) + return ret; +- } ++ fdp1->irq = ret; + + ret = devm_request_irq(&pdev->dev, fdp1->irq, fdp1_irq_handler, 0, + dev_name(&pdev->dev), fdp1); +-- +2.39.2 + diff --git a/queue-4.19/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch b/queue-4.19/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch new file mode 100644 index 00000000000..4b49056dfe3 --- /dev/null +++ b/queue-4.19/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch @@ -0,0 +1,86 @@ +From 09bc50334efde975a9af9da5c759b6d64fc90f2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:50:23 +0800 +Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race + condition + +From: Zheng Wang + +[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ] + +In saa7134_initdev, it will call saa7134_hwinit1. There are three +function invoking here: saa7134_video_init1, saa7134_ts_init1 +and saa7134_vbi_init1. + +All of them will init a timer with same function. Take +saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout +with saa7134_buffer_timeout. + +In buffer_activate, the timer funtcion is started. + +If we remove the module or device which will call saa7134_finidev +to make cleanup, there may be a unfinished work. The +possible sequence is as follows, which will cause a +typical UAF bug. + +Fix it by canceling the timer works accordingly before cleanup in +saa7134_finidev. + +CPU0 CPU1 + + |saa7134_buffer_timeout +saa7134_finidev | + kfree(dev); | + | + | saa7134_buffer_next + | //use dev + +Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-ts.c | 1 + + drivers/media/pci/saa7134/saa7134-vbi.c | 1 + + drivers/media/pci/saa7134/saa7134-video.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c +index 2be703617e294..e7adcd4f99623 100644 +--- a/drivers/media/pci/saa7134/saa7134-ts.c ++++ b/drivers/media/pci/saa7134/saa7134-ts.c +@@ -309,6 +309,7 @@ int saa7134_ts_start(struct saa7134_dev *dev) + + int saa7134_ts_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->ts_q.timeout); + saa7134_pgtable_free(dev->pci, &dev->ts_q.pt); + return 0; + } +diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c +index 57bea543c39ba..559db500b19ce 100644 +--- a/drivers/media/pci/saa7134/saa7134-vbi.c ++++ b/drivers/media/pci/saa7134/saa7134-vbi.c +@@ -194,6 +194,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev) + int saa7134_vbi_fini(struct saa7134_dev *dev) + { + /* nothing */ ++ del_timer_sync(&dev->vbi_q.timeout); + return 0; + } + +diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c +index 079219288af7b..90255ecb08ca4 100644 +--- a/drivers/media/pci/saa7134/saa7134-video.c ++++ b/drivers/media/pci/saa7134/saa7134-video.c +@@ -2213,6 +2213,7 @@ int saa7134_video_init1(struct saa7134_dev *dev) + + void saa7134_video_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->video_q.timeout); + /* free stuff */ + vb2_queue_release(&dev->video_vbq); + saa7134_pgtable_free(dev->pci, &dev->video_q.pt); +-- +2.39.2 + diff --git a/queue-4.19/media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch b/queue-4.19/media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch new file mode 100644 index 00000000000..8b2d5cec2b1 --- /dev/null +++ b/queue-4.19/media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch @@ -0,0 +1,82 @@ +From 1191922d42fbb4aad2a30fe20369ca0eab219251 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 14:46:08 +0100 +Subject: media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format. + +From: Dafna Hirschfeld + +[ Upstream commit 6ad253cc3436269fc6bcff03d704c672f368da0a ] + +MEDIA_BUS_FMT_METADATA_FIXED should be used when +the same driver handles both sides of the link and +the bus format is a fixed metadata format that is +not configurable from userspace. +The width and height will be set to 0 for this format. + +Signed-off-by: Dafna Hirschfeld +Acked-by: Helen Koike +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: eed9496a0501 ("media: av7110: prevent underflow in write_ts_to_decoder()") +Signed-off-by: Sasha Levin +--- + .../media/uapi/v4l/subdev-formats.rst | 27 +++++++++++++++++++ + include/uapi/linux/media-bus-format.h | 8 ++++++ + 2 files changed, 35 insertions(+) + +diff --git a/Documentation/media/uapi/v4l/subdev-formats.rst b/Documentation/media/uapi/v4l/subdev-formats.rst +index 8e73fcfc69000..cc2ad8af51ea0 100644 +--- a/Documentation/media/uapi/v4l/subdev-formats.rst ++++ b/Documentation/media/uapi/v4l/subdev-formats.rst +@@ -7565,3 +7565,30 @@ formats. + - 0x5001 + - Interleaved raw UYVY and JPEG image format with embedded meta-data + used by Samsung S3C73MX camera sensors. ++ ++.. _v4l2-mbus-metadata-fmts: ++ ++Metadata Formats ++^^^^^^^^^^^^^^^^ ++ ++This section lists all metadata formats. ++ ++The following table lists the existing metadata formats. ++ ++.. tabularcolumns:: |p{8.0cm}|p{1.4cm}|p{7.7cm}| ++ ++.. flat-table:: Metadata formats ++ :header-rows: 1 ++ :stub-columns: 0 ++ ++ * - Identifier ++ - Code ++ - Comments ++ * .. _MEDIA-BUS-FMT-METADATA-FIXED: ++ ++ - MEDIA_BUS_FMT_METADATA_FIXED ++ - 0x7001 ++ - This format should be used when the same driver handles ++ both sides of the link and the bus format is a fixed ++ metadata format that is not configurable from userspace. ++ Width and height will be set to 0 for this format. +diff --git a/include/uapi/linux/media-bus-format.h b/include/uapi/linux/media-bus-format.h +index d6a5a3bfe6c43..be53a8c1a2dff 100644 +--- a/include/uapi/linux/media-bus-format.h ++++ b/include/uapi/linux/media-bus-format.h +@@ -153,4 +153,12 @@ + /* HSV - next is 0x6002 */ + #define MEDIA_BUS_FMT_AHSV8888_1X32 0x6001 + ++/* ++ * This format should be used when the same driver handles ++ * both sides of the link and the bus format is a fixed ++ * metadata format that is not configurable from userspace. ++ * Width and height will be set to 0 for this format. ++ */ ++#define MEDIA_BUS_FMT_METADATA_FIXED 0x7001 ++ + #endif /* __LINUX_MEDIA_BUS_FORMAT_H */ +-- +2.39.2 + diff --git a/queue-4.19/mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch b/queue-4.19/mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch new file mode 100644 index 00000000000..70b31c9e86d --- /dev/null +++ b/queue-4.19/mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch @@ -0,0 +1,39 @@ +From 3fff330dd687af8aaa1cd344999f57e3242129ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:34:39 +0530 +Subject: mtd: spi-nor: cadence-quadspi: Don't initialize rx_dma_complete on + failure + +From: Vignesh Raghavendra + +[ Upstream commit 48aae57f0f9f57797772bd462b4d64902b1b4ae1 ] + +If driver fails to acquire DMA channel then don't initialize +rx_dma_complete struct as it won't be used. + +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Tudor Ambarus +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200601070444.16923-4-vigneshr@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index cdebe6853e6c3..bd62ed8710315 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -1173,6 +1173,7 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi) + if (IS_ERR(cqspi->rx_chan)) { + dev_err(&cqspi->pdev->dev, "No Rx DMA available\n"); + cqspi->rx_chan = NULL; ++ return; + } + init_completion(&cqspi->rx_dma_complete); + } +-- +2.39.2 + diff --git a/queue-4.19/mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch b/queue-4.19/mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch new file mode 100644 index 00000000000..fd9c92954ad --- /dev/null +++ b/queue-4.19/mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch @@ -0,0 +1,76 @@ +From c669aa3fb62a67b8b2765ff6cbe2d14f6955b5e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:34:41 +0530 +Subject: mtd: spi-nor: cadence-quadspi: Handle probe deferral while requesting + DMA channel + +From: Vignesh Raghavendra + +[ Upstream commit 935da5e5100f57d843cac4781b21f1c235059aa0 ] + +dma_request_chan_by_mask() can throw EPROBE_DEFER if DMA provider +is not yet probed. Currently driver just falls back to using PIO mode +(which is less efficient) in this case. Instead return probe deferral +error as is so that driver will be re probed once DMA provider is +available. + +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Tudor Ambarus +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200601070444.16923-6-vigneshr@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index bd62ed8710315..16ac2e3c351df 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -1162,7 +1162,7 @@ static void cqspi_controller_init(struct cqspi_st *cqspi) + cqspi_controller_enable(cqspi, 1); + } + +-static void cqspi_request_mmap_dma(struct cqspi_st *cqspi) ++static int cqspi_request_mmap_dma(struct cqspi_st *cqspi) + { + dma_cap_mask_t mask; + +@@ -1171,11 +1171,16 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi) + + cqspi->rx_chan = dma_request_chan_by_mask(&mask); + if (IS_ERR(cqspi->rx_chan)) { +- dev_err(&cqspi->pdev->dev, "No Rx DMA available\n"); ++ int ret = PTR_ERR(cqspi->rx_chan); ++ ++ if (ret != -EPROBE_DEFER) ++ dev_err(&cqspi->pdev->dev, "No Rx DMA available\n"); + cqspi->rx_chan = NULL; +- return; ++ return ret; + } + init_completion(&cqspi->rx_dma_complete); ++ ++ return 0; + } + + static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np) +@@ -1256,8 +1261,11 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np) + dev_dbg(nor->dev, "using direct mode for %s\n", + mtd->name); + +- if (!cqspi->rx_chan) +- cqspi_request_mmap_dma(cqspi); ++ if (!cqspi->rx_chan) { ++ ret = cqspi_request_mmap_dma(cqspi); ++ if (ret == -EPROBE_DEFER) ++ goto err; ++ } + } + } + +-- +2.39.2 + diff --git a/queue-4.19/mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch b/queue-4.19/mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch new file mode 100644 index 00000000000..df9c585b9c4 --- /dev/null +++ b/queue-4.19/mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch @@ -0,0 +1,101 @@ +From e21727346eb0b2ade271e801ab66c7092188ee10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:34:37 +0530 +Subject: mtd: spi-nor: cadence-quadspi: Make driver independent of flash + geometry + +From: Vignesh Raghavendra + +[ Upstream commit 834b4e8d344139ba64cda22099b2b2ef6c9a542d ] + +Drop configuration of Flash size, erase size and page size +configuration. Flash size is needed only if using AHB decoder (BIT 23 of +CONFIG_REG) which is not used by the driver. +Erase size and page size are needed if IP is configured to send WREN +automatically. But since SPI NOR layer takes care of sending WREN, there +is no need to configure these fields either. + +Therefore drop these in preparation to move the driver to spi-mem +framework where flash geometry is not visible to controller driver. + +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Tudor Ambarus +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200601070444.16923-2-vigneshr@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 36 +-------------------------- + 1 file changed, 1 insertion(+), 35 deletions(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index a92f531ad23a3..cdebe6853e6c3 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -80,9 +80,6 @@ struct cqspi_st { + dma_addr_t mmap_phys_base; + + int current_cs; +- int current_page_size; +- int current_erase_size; +- int current_addr_width; + unsigned long master_ref_clk_hz; + bool is_decoded_cs; + u32 fifo_depth; +@@ -734,32 +731,6 @@ static void cqspi_chipselect(struct spi_nor *nor) + writel(reg, reg_base + CQSPI_REG_CONFIG); + } + +-static void cqspi_configure_cs_and_sizes(struct spi_nor *nor) +-{ +- struct cqspi_flash_pdata *f_pdata = nor->priv; +- struct cqspi_st *cqspi = f_pdata->cqspi; +- void __iomem *iobase = cqspi->iobase; +- unsigned int reg; +- +- /* configure page size and block size. */ +- reg = readl(iobase + CQSPI_REG_SIZE); +- reg &= ~(CQSPI_REG_SIZE_PAGE_MASK << CQSPI_REG_SIZE_PAGE_LSB); +- reg &= ~(CQSPI_REG_SIZE_BLOCK_MASK << CQSPI_REG_SIZE_BLOCK_LSB); +- reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; +- reg |= (nor->page_size << CQSPI_REG_SIZE_PAGE_LSB); +- reg |= (ilog2(nor->mtd.erasesize) << CQSPI_REG_SIZE_BLOCK_LSB); +- reg |= (nor->addr_width - 1); +- writel(reg, iobase + CQSPI_REG_SIZE); +- +- /* configure the chip select */ +- cqspi_chipselect(nor); +- +- /* Store the new configuration of the controller */ +- cqspi->current_page_size = nor->page_size; +- cqspi->current_erase_size = nor->mtd.erasesize; +- cqspi->current_addr_width = nor->addr_width; +-} +- + static unsigned int calculate_ticks_for_ns(const unsigned int ref_clk_hz, + const unsigned int ns_val) + { +@@ -865,18 +836,13 @@ static void cqspi_configure(struct spi_nor *nor) + int switch_cs = (cqspi->current_cs != f_pdata->cs); + int switch_ck = (cqspi->sclk != sclk); + +- if ((cqspi->current_page_size != nor->page_size) || +- (cqspi->current_erase_size != nor->mtd.erasesize) || +- (cqspi->current_addr_width != nor->addr_width)) +- switch_cs = 1; +- + if (switch_cs || switch_ck) + cqspi_controller_enable(cqspi, 0); + + /* Switch chip select. */ + if (switch_cs) { + cqspi->current_cs = f_pdata->cs; +- cqspi_configure_cs_and_sizes(nor); ++ cqspi_chipselect(nor); + } + + /* Setup baudrate divisor and delays */ +-- +2.39.2 + diff --git a/queue-4.19/net-amd-fix-link-leak-when-verifying-config-failed.patch b/queue-4.19/net-amd-fix-link-leak-when-verifying-config-failed.patch new file mode 100644 index 00000000000..5633914fd87 --- /dev/null +++ b/queue-4.19/net-amd-fix-link-leak-when-verifying-config-failed.patch @@ -0,0 +1,47 @@ +From 8294542e62bd8c1ec0c9be93a5a01dc257b2b580 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 23:28:01 +0800 +Subject: net: amd: Fix link leak when verifying config failed + +From: Gencen Gan + +[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ] + +After failing to verify configuration, it returns directly without +releasing link, which may cause memory leak. + +Paolo Abeni thinks that the whole code of this driver is quite +"suboptimal" and looks unmainatained since at least ~15y, so he +suggests that we could simply remove the whole driver, please +take it into consideration. + +Simon Horman suggests that the fix label should be set to +"Linux-2.6.12-rc2" considering that the problem has existed +since the driver was introduced and the commit above doesn't +seem to exist in net/net-next. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Gan Gecen +Reviewed-by: Dongliang Mu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/nmclan_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c +index 9c152d85840d7..c9d2a6f150624 100644 +--- a/drivers/net/ethernet/amd/nmclan_cs.c ++++ b/drivers/net/ethernet/amd/nmclan_cs.c +@@ -652,7 +652,7 @@ static int nmclan_config(struct pcmcia_device *link) + } else { + pr_notice("mace id not found: %x %x should be 0x40 0x?9\n", + sig[0], sig[1]); +- return -ENODEV; ++ goto failed; + } + } + +-- +2.39.2 + diff --git a/queue-4.19/net-packet-convert-po-auxdata-to-an-atomic-flag.patch b/queue-4.19/net-packet-convert-po-auxdata-to-an-atomic-flag.patch new file mode 100644 index 00000000000..769dfce8b10 --- /dev/null +++ b/queue-4.19/net-packet-convert-po-auxdata-to-an-atomic-flag.patch @@ -0,0 +1,95 @@ +From b553af6a6635d61dcb3cba905d75c027f327c277 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:08 +0000 +Subject: net/packet: convert po->auxdata to an atomic flag + +From: Eric Dumazet + +[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ] + +po->auxdata can be read while another thread +is changing its value, potentially raising KCSAN splat. + +Convert it to PACKET_SOCK_AUXDATA flag. + +Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 8 +++----- + net/packet/diag.c | 2 +- + net/packet/internal.h | 4 ++-- + 3 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 91c35d45e43ca..60986c209311f 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3444,7 +3444,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); + } + +- if (pkt_sk(sk)->auxdata) { ++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) { + struct tpacket_auxdata aux; + + aux.tp_status = TP_STATUS_USER; +@@ -3827,9 +3827,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->auxdata = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val); + return 0; + } + case PACKET_ORIGDEV: +@@ -3971,7 +3969,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + + break; + case PACKET_AUXDATA: +- val = po->auxdata; ++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA); + break; + case PACKET_ORIGDEV: + val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); +diff --git a/net/packet/diag.c b/net/packet/diag.c +index bf5928e5df035..d9f912ad23dfa 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -22,7 +22,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags = 0; + if (po->running) + pinfo.pdi_flags |= PDI_RUNNING; +- if (po->auxdata) ++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA)) + pinfo.pdi_flags |= PDI_AUXDATA; + if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index f39dcc7608bc6..3d871cae85b8c 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -117,8 +117,7 @@ struct packet_sock { + struct mutex pg_vec_lock; + unsigned long flags; + unsigned int running; /* bind_lock must be held */ +- unsigned int auxdata:1, /* writer must hold sock lock */ +- has_vnet_hdr:1, ++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */ + tp_loss:1, + tp_tx_has_off:1; + int pressure; +@@ -144,6 +143,7 @@ static struct packet_sock *pkt_sk(struct sock *sk) + + enum packet_sock_flags { + PACKET_SOCK_ORIGDEV, ++ PACKET_SOCK_AUXDATA, + }; + + static inline void packet_sock_flag_set(struct packet_sock *po, +-- +2.39.2 + diff --git a/queue-4.19/net-packet-convert-po-origdev-to-an-atomic-flag.patch b/queue-4.19/net-packet-convert-po-origdev-to-an-atomic-flag.patch new file mode 100644 index 00000000000..35c442dd0cf --- /dev/null +++ b/queue-4.19/net-packet-convert-po-origdev-to-an-atomic-flag.patch @@ -0,0 +1,126 @@ +From 4c74e8a00c04812fe01f828e79949b62df67478a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:07 +0000 +Subject: net/packet: convert po->origdev to an atomic flag + +From: Eric Dumazet + +[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ] + +syzbot/KCAN reported that po->origdev can be read +while another thread is changing its value. + +We can avoid this splat by converting this field +to an actual bit. + +Following patches will convert remaining 1bit fields. + +Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 10 ++++------ + net/packet/diag.c | 2 +- + net/packet/internal.h | 22 +++++++++++++++++++++- + 3 files changed, 26 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 6fa0a9a453a8b..91c35d45e43ca 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2105,7 +2105,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, + sll = &PACKET_SKB_CB(skb)->sa.ll; + sll->sll_hatype = dev->type; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -2371,7 +2371,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + sll->sll_hatype = dev->type; + sll->sll_protocol = skb->protocol; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -3841,9 +3841,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->origdev = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val); + return 0; + } + case PACKET_VNET_HDR: +@@ -3976,7 +3974,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + val = po->auxdata; + break; + case PACKET_ORIGDEV: +- val = po->origdev; ++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); + break; + case PACKET_VNET_HDR: + val = po->has_vnet_hdr; +diff --git a/net/packet/diag.c b/net/packet/diag.c +index 7ef1c881ae741..bf5928e5df035 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -24,7 +24,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags |= PDI_RUNNING; + if (po->auxdata) + pinfo.pdi_flags |= PDI_AUXDATA; +- if (po->origdev) ++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; + if (po->has_vnet_hdr) + pinfo.pdi_flags |= PDI_VNETHDR; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index f10294800aafb..f39dcc7608bc6 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -115,9 +115,9 @@ struct packet_sock { + int copy_thresh; + spinlock_t bind_lock; + struct mutex pg_vec_lock; ++ unsigned long flags; + unsigned int running; /* bind_lock must be held */ + unsigned int auxdata:1, /* writer must hold sock lock */ +- origdev:1, + has_vnet_hdr:1, + tp_loss:1, + tp_tx_has_off:1; +@@ -142,4 +142,24 @@ static struct packet_sock *pkt_sk(struct sock *sk) + return (struct packet_sock *)sk; + } + ++enum packet_sock_flags { ++ PACKET_SOCK_ORIGDEV, ++}; ++ ++static inline void packet_sock_flag_set(struct packet_sock *po, ++ enum packet_sock_flags flag, ++ bool val) ++{ ++ if (val) ++ set_bit(flag, &po->flags); ++ else ++ clear_bit(flag, &po->flags); ++} ++ ++static inline bool packet_sock_flag(const struct packet_sock *po, ++ enum packet_sock_flags flag) ++{ ++ return test_bit(flag, &po->flags); ++} ++ + #endif +-- +2.39.2 + diff --git a/queue-4.19/netfilter-nf_tables-don-t-write-table-validation-sta.patch b/queue-4.19/netfilter-nf_tables-don-t-write-table-validation-sta.patch new file mode 100644 index 00000000000..39a121cc258 --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-don-t-write-table-validation-sta.patch @@ -0,0 +1,87 @@ +From a0cd963cd94caee75f07c4af51b7891cec5fcedc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 17:13:19 +0200 +Subject: netfilter: nf_tables: don't write table validation state without + mutex + +From: Florian Westphal + +[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ] + +The ->cleanup callback needs to be removed, this doesn't work anymore as +the transaction mutex is already released in the ->abort function. + +Just do it after a successful validation pass, this either happens +from commit or abort phases where transaction mutex is held. + +Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/nfnetlink.h | 1 - + net/netfilter/nf_tables_api.c | 8 ++------ + net/netfilter/nfnetlink.c | 2 -- + 3 files changed, 2 insertions(+), 9 deletions(-) + +diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h +index e713476ff29db..a806803fbe37a 100644 +--- a/include/linux/netfilter/nfnetlink.h ++++ b/include/linux/netfilter/nfnetlink.h +@@ -32,7 +32,6 @@ struct nfnetlink_subsystem { + struct module *owner; + int (*commit)(struct net *net, struct sk_buff *skb); + int (*abort)(struct net *net, struct sk_buff *skb); +- void (*cleanup)(struct net *net); + bool (*valid_genid)(struct net *net, u32 genid); + }; + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 079f768496937..d7a082d5cd70e 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6241,6 +6241,8 @@ static int nf_tables_validate(struct net *net) + if (nft_table_validate(net, table) < 0) + return -EAGAIN; + } ++ ++ nft_validate_state_update(net, NFT_VALIDATE_SKIP); + break; + } + +@@ -6767,11 +6769,6 @@ static int __nf_tables_abort(struct net *net) + return 0; + } + +-static void nf_tables_cleanup(struct net *net) +-{ +- nft_validate_state_update(net, NFT_VALIDATE_SKIP); +-} +- + static int nf_tables_abort(struct net *net, struct sk_buff *skb) + { + int ret = __nf_tables_abort(net); +@@ -6802,7 +6799,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = { + .cb = nf_tables_cb, + .commit = nf_tables_commit, + .abort = nf_tables_abort, +- .cleanup = nf_tables_cleanup, + .valid_genid = nf_tables_valid_genid, + .owner = THIS_MODULE, + }; +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 9bacddc761ba4..39e369e18cb87 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -495,8 +495,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + } else { + ss->abort(net, oskb); + } +- if (ss->cleanup) +- ss->cleanup(net); + + nfnl_err_deliver(&err_list, oskb); + kfree_skb(skb); +-- +2.39.2 + diff --git a/queue-4.19/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch b/queue-4.19/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch new file mode 100644 index 00000000000..ee9ace0100c --- /dev/null +++ b/queue-4.19/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch @@ -0,0 +1,161 @@ +From ea751f68d72b97c5e5eaf23c7ca3a700a6113010 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 11:52:55 -0700 +Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt(). + +From: Kuniyuki Iwashima + +[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ] + +Brad Spencer provided a detailed report [0] that when calling getsockopt() +for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such +options require at least sizeof(int) as length. + +The options return a flag value that fits into 1 byte, but such behaviour +confuses users who do not initialise the variable before calling +getsockopt() and do not strictly check the returned value as char. + +Currently, netlink_getsockopt() uses put_user() to copy data to optlen and +optval, but put_user() casts the data based on the pointer, char *optval. +As a result, only 1 byte is set to optval. + +To avoid this behaviour, we need to use copy_to_user() or cast optval for +put_user(). + +Note that this changes the behaviour on big-endian systems, but we document +that the size of optval is int in the man page. + + $ man 7 netlink + ... + Socket options + To set or get a netlink socket option, call getsockopt(2) to read + or setsockopt(2) to write the option with the option level argument + set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to + an int. + +Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups") +Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option") +Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag") +Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option") +Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting") +Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps") +Reported-by: Brad Spencer +Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Johannes Berg +Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 67 +++++++++++++--------------------------- + 1 file changed, 22 insertions(+), 45 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 6a49c0aa55bda..6867158656b86 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1738,7 +1738,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + { + struct sock *sk = sock->sk; + struct netlink_sock *nlk = nlk_sk(sk); +- int len, val, err; ++ unsigned int flag; ++ int len, val; + + if (level != SOL_NETLINK) + return -ENOPROTOOPT; +@@ -1750,39 +1751,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + + switch (optname) { + case NETLINK_PKTINFO: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_PKTINFO; + break; + case NETLINK_BROADCAST_ERROR: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_BROADCAST_SEND_ERROR; + break; + case NETLINK_NO_ENOBUFS: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_NO_ENOBUFS; + break; + case NETLINK_LIST_MEMBERSHIPS: { +- int pos, idx, shift; ++ int pos, idx, shift, err = 0; + +- err = 0; + netlink_lock_table(); + for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) { + if (len - pos < sizeof(u32)) +@@ -1799,31 +1778,29 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen)) + err = -EFAULT; + netlink_unlock_table(); +- break; ++ return err; + } + case NETLINK_CAP_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_CAP_ACK; + break; + case NETLINK_EXT_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0; +- if (put_user(len, optlen) || put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_EXT_ACK; + break; + default: +- err = -ENOPROTOOPT; ++ return -ENOPROTOOPT; + } +- return err; ++ ++ if (len < sizeof(int)) ++ return -EINVAL; ++ ++ len = sizeof(int); ++ val = nlk->flags & flag ? 1 : 0; ++ ++ if (put_user(len, optlen) || ++ copy_to_user(optval, &val, len)) ++ return -EFAULT; ++ ++ return 0; + } + + static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) +-- +2.39.2 + diff --git a/queue-4.19/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch b/queue-4.19/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch new file mode 100644 index 00000000000..10881a1668b --- /dev/null +++ b/queue-4.19/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch @@ -0,0 +1,45 @@ +From c02ca8e4e59936a686d538db43805bc6df9986b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 18:45:53 -0400 +Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease + +From: Trond Myklebust + +[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ] + +The spec requires that we always at least send a RECLAIM_COMPLETE when +we're done establishing the lease and recovering any state. + +Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index e5b4c6987c846..f0f0fb7499e3a 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -66,6 +66,8 @@ + + #define OPENOWNER_POOL_SIZE 8 + ++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp); ++ + const nfs4_stateid zero_stateid = { + { .data = { 0 } }, + .type = NFS4_SPECIAL_STATEID_TYPE, +@@ -338,6 +340,8 @@ int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred) + status = nfs4_proc_create_session(clp, cred); + if (status != 0) + goto out; ++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R)) ++ nfs4_state_start_reclaim_reboot(clp); + nfs41_finish_session_reset(clp); + nfs_mark_client_ready(clp, NFS_CS_READY); + out: +-- +2.39.2 + diff --git a/queue-4.19/of-fix-modalias-string-generation.patch b/queue-4.19/of-fix-modalias-string-generation.patch new file mode 100644 index 00000000000..119437f8e26 --- /dev/null +++ b/queue-4.19/of-fix-modalias-string-generation.patch @@ -0,0 +1,80 @@ +From be30cd6519405511f8bebff29d05933ee994ad4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 18:21:09 +0100 +Subject: of: Fix modalias string generation + +From: Miquel Raynal + +[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ] + +The helper generating an OF based modalias (of_device_get_modalias()) +works fine, but due to the use of snprintf() internally it needs a +buffer one byte longer than what should be needed just for the entire +string (excluding the '\0'). Most users of this helper are sysfs hooks +providing the modalias string to users. They all provide a PAGE_SIZE +buffer which is way above the number of bytes required to fit the +modalias string and hence do not suffer from this issue. + +There is another user though, of_device_request_module(), which is only +called by drivers/usb/common/ulpi.c. This request module function is +faulty, but maybe because in most cases there is an alternative, ULPI +driver users have not noticed it. + +In this function, of_device_get_modalias() is called twice. The first +time without buffer just to get the number of bytes required by the +modalias string (excluding the null byte), and a second time, after +buffer allocation, to fill the buffer. The allocation asks for an +additional byte, in order to store the trailing '\0'. However, the +buffer *length* provided to of_device_get_modalias() excludes this extra +byte. The internal use of snprintf() with a length that is exactly the +number of bytes to be written has the effect of using the last available +byte to store a '\0', which then smashes the last character of the +modalias string. + +Provide the actual size of the buffer to of_device_get_modalias() to fix +this issue. + +Note: the "str[size - 1] = '\0';" line is not really needed as snprintf +will anyway end the string with a null byte, but there is a possibility +that this function might be called on a struct device_node without +compatible, in this case snprintf() would not be executed. So we keep it +just to avoid possible unbounded strings. + +Cc: Stephen Boyd +Cc: Peter Chen +Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias") +Signed-off-by: Miquel Raynal +Reviewed-by: Rob Herring +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/of/device.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/device.c b/drivers/of/device.c +index 258742830e366..566d8af05157d 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -258,12 +258,15 @@ int of_device_request_module(struct device *dev) + if (size < 0) + return size; + +- str = kmalloc(size + 1, GFP_KERNEL); ++ /* Reserve an additional byte for the trailing '\0' */ ++ size++; ++ ++ str = kmalloc(size, GFP_KERNEL); + if (!str) + return -ENOMEM; + + of_device_get_modalias(dev, str, size); +- str[size] = '\0'; ++ str[size - 1] = '\0'; + ret = request_module(str); + kfree(str); + +-- +2.39.2 + diff --git a/queue-4.19/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch b/queue-4.19/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch new file mode 100644 index 00000000000..ecf15b12e0e --- /dev/null +++ b/queue-4.19/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch @@ -0,0 +1,56 @@ +From 471b8320a9f6ed3d6b943fbc80c58316a1e76630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 19:14:06 +0900 +Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions + +From: Stafford Horne + +[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ] + +In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on +exception") the unhandled exception path was changed to do an early +store of r30 instead of r31. The entry code was not updated and r31 is +not getting stored to pt_regs. + +This patch updates the entry handler to store r31 instead of r30. We +also remove some misleading commented out store r30 and r31 +instructrions. + +I noticed this while working on adding floating point exception +handling, This issue probably would never impact anything since we kill +the process or Oops right away on unhandled exceptions. + +Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception") +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/kernel/entry.S | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index c2c3ce8a0f84e..7b408d67f11e1 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -177,7 +177,6 @@ handler: ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ + /* r30 already save */ ;\ +-/* l.sw PT_GPR30(r1),r30*/ ;\ + l.sw PT_GPR31(r1),r31 ;\ + TRACE_IRQS_OFF_ENTRY ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ +@@ -215,9 +214,8 @@ handler: ;\ + l.sw PT_GPR27(r1),r27 ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ +- /* r31 already saved */ ;\ +- l.sw PT_GPR30(r1),r30 ;\ +-/* l.sw PT_GPR31(r1),r31 */ ;\ ++ /* r30 already saved */ ;\ ++ l.sw PT_GPR31(r1),r31 ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ + l.addi r30,r0,-1 ;\ + l.sw PT_ORIG_GPR11(r1),r30 ;\ +-- +2.39.2 + diff --git a/queue-4.19/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch b/queue-4.19/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch new file mode 100644 index 00000000000..6b6d5b43d0b --- /dev/null +++ b/queue-4.19/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch @@ -0,0 +1,51 @@ +From 86ab10cb20a0278f39eda74d4c6b792c07b1a38c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 10:35:08 +0800 +Subject: perf/core: Fix hardlockup failure caused by perf throttle + +From: Yang Jihong + +[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ] + +commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling") +introduces a change in throttling threshold judgment. Before this, +compare hwc->interrupts and max_samples_per_tick, then increase +hwc->interrupts by 1, but this commit reverses order of these two +behaviors, causing the semantics of max_samples_per_tick to change. +In literal sense of "max_samples_per_tick", if hwc->interrupts == +max_samples_per_tick, it should not be throttled, therefore, the judgment +condition should be changed to "hwc->interrupts > max_samples_per_tick". + +In fact, this may cause the hardlockup to fail, The minimum value of +max_samples_per_tick may be 1, in this case, the return value of +__perf_event_account_interrupt function is 1. +As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86 +architecture as an example, see x86_pmu_handle_irq). + +Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling") +Signed-off-by: Yang Jihong +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 72ed3f3d078fc..2bf4b6b109bf4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -7843,8 +7843,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle) + hwc->interrupts = 1; + } else { + hwc->interrupts++; +- if (unlikely(throttle +- && hwc->interrupts >= max_samples_per_tick)) { ++ if (unlikely(throttle && ++ hwc->interrupts > max_samples_per_tick)) { + __this_cpu_inc(perf_throttled_count); + tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS); + hwc->interrupts = MAX_INTERRUPTS; +-- +2.39.2 + diff --git a/queue-4.19/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch b/queue-4.19/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch new file mode 100644 index 00000000000..3e15edb4c82 --- /dev/null +++ b/queue-4.19/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch @@ -0,0 +1,47 @@ +From b730871fec2ca72209ef5eb6005c41eece479593 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 19:16:34 +0800 +Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for + usb2_port and ulpi_port + +From: Gaosheng Cui + +[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ] + +The tegra_xusb_port_unregister should be called when usb2_port +and ulpi_port map fails in tegra_xusb_add_usb2_port() or in +tegra_xusb_add_ulpi_port(), fix it. + +Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support") +Signed-off-by: Gaosheng Cui +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index 39c01ef57d83c..17211b31e1ed4 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -583,6 +583,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl, + usb2->base.lane = usb2->base.ops->map(&usb2->base); + if (IS_ERR(usb2->base.lane)) { + err = PTR_ERR(usb2->base.lane); ++ tegra_xusb_port_unregister(&usb2->base); + goto out; + } + +@@ -635,6 +636,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl, + ulpi->base.lane = ulpi->base.ops->map(&ulpi->base); + if (IS_ERR(ulpi->base.lane)) { + err = PTR_ERR(ulpi->base.lane); ++ tegra_xusb_port_unregister(&ulpi->base); + goto out; + } + +-- +2.39.2 + diff --git a/queue-4.19/power-supply-generic-adc-battery-fix-unit-scaling.patch b/queue-4.19/power-supply-generic-adc-battery-fix-unit-scaling.patch new file mode 100644 index 00000000000..8926cc753a1 --- /dev/null +++ b/queue-4.19/power-supply-generic-adc-battery-fix-unit-scaling.patch @@ -0,0 +1,42 @@ +From 55b82df54c702158935c1d3ba50ab2cfc9365f94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 23:56:57 +0100 +Subject: power: supply: generic-adc-battery: fix unit scaling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Reichel + +[ Upstream commit 44263f50065969f2344808388bd589740f026167 ] + +power-supply properties are reported in µV, µA and µW. +The IIO API provides mV, mA, mW, so the values need to +be multiplied by 1000. + +Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO") +Reviewed-by: Linus Walleij +Reviewed-by: Matti Vaittinen +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/generic-adc-battery.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c +index 97b0e873e87d2..c2d6378bb897d 100644 +--- a/drivers/power/supply/generic-adc-battery.c ++++ b/drivers/power/supply/generic-adc-battery.c +@@ -138,6 +138,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp, + result); + if (ret < 0) + pr_err("read channel error\n"); ++ else ++ *result *= 1000; ++ + return ret; + } + +-- +2.39.2 + diff --git a/queue-4.19/powerpc-mpc512x-fix-resource-printk-format-warning.patch b/queue-4.19/powerpc-mpc512x-fix-resource-printk-format-warning.patch new file mode 100644 index 00000000000..11e675ddca1 --- /dev/null +++ b/queue-4.19/powerpc-mpc512x-fix-resource-printk-format-warning.patch @@ -0,0 +1,46 @@ +From 20e4d81e7e09e399302fbc645a8a51f43f10bc41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:13 -0800 +Subject: powerpc/mpc512x: fix resource printk format warning + +From: Randy Dunlap + +[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + +../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat': +../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] + 989 | snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ + | ^~~~~~~~~ ~~~~~~~~~ + | | + | resource_size_t {aka long long unsigned int} + +Prevents 24 such warnings. + +Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/512x/clock-commonclk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c +index b3097fe6441b9..1019d78e44bb4 100644 +--- a/arch/powerpc/platforms/512x/clock-commonclk.c ++++ b/arch/powerpc/platforms/512x/clock-commonclk.c +@@ -985,7 +985,7 @@ static void mpc5121_clk_provide_migration_support(void) + + #define NODE_PREP do { \ + of_address_to_resource(np, 0, &res); \ +- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ ++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \ + } while (0) + + #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \ +-- +2.39.2 + diff --git a/queue-4.19/powerpc-rtas-use-memmove-for-potentially-overlapping.patch b/queue-4.19/powerpc-rtas-use-memmove-for-potentially-overlapping.patch new file mode 100644 index 00000000000..bdfc5c0a7c7 --- /dev/null +++ b/queue-4.19/powerpc-rtas-use-memmove-for-potentially-overlapping.patch @@ -0,0 +1,56 @@ +From 9dac2ee1db6093f91c42341b20fe9066535a8061 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:33:41 -0600 +Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy + +From: Nathan Lynch + +[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ] + +Using memcpy() isn't safe when buf is identical to rtas_err_buf, which +can happen during boot before slab is up. Full context which may not +be obvious from the diff: + + if (altbuf) { + buf = altbuf; + } else { + buf = rtas_err_buf; + if (slab_is_available()) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) + memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + +This was found by inspection and I'm not aware of it causing problems +in practice. It appears to have been introduced by commit +033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the +old ppc64 version of this code did not have this problem. + +Use memmove() instead. + +Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel") +Signed-off-by: Nathan Lynch +Reviewed-by: Andrew Donnellan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index 7c7648e6f1c22..2646dd54eb0bb 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -401,7 +401,7 @@ static char *__fetch_rtas_last_error(char *altbuf) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) +- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); ++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + } + + return buf; +-- +2.39.2 + diff --git a/queue-4.19/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch b/queue-4.19/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch new file mode 100644 index 00000000000..259c7c45eef --- /dev/null +++ b/queue-4.19/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch @@ -0,0 +1,45 @@ +From 2f1f4f9fcca9fed8deb1638a4766737fe288c827 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:16 -0800 +Subject: powerpc/sysdev/tsi108: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + + arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci': + include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' + +Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree") +Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function") +Signed-off-by: Randy Dunlap +[mpe: Use pr_info() and unsplit string] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/tsi108_pci.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c +index 28ff1f53cefc1..6bd50c690006f 100644 +--- a/arch/powerpc/sysdev/tsi108_pci.c ++++ b/arch/powerpc/sysdev/tsi108_pci.c +@@ -229,9 +229,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary) + + (hose)->ops = &tsi108_direct_pci_ops; + +- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. " +- "Firmware bus number: %d->%d\n", +- rsrc.start, hose->first_busno, hose->last_busno); ++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n", ++ &rsrc.start, hose->first_busno, hose->last_busno); + + /* Interpret the "ranges" property */ + /* This also maps the I/O region and sets isa_io/mem_base */ +-- +2.39.2 + diff --git a/queue-4.19/powerpc-wii-fix-resource-printk-format-warnings.patch b/queue-4.19/powerpc-wii-fix-resource-printk-format-warnings.patch new file mode 100644 index 00000000000..4a79fd5ae1b --- /dev/null +++ b/queue-4.19/powerpc-wii-fix-resource-printk-format-warnings.patch @@ -0,0 +1,87 @@ +From e8cf7bcc190a3e653155424b6c366b6caa54da09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:14 -0800 +Subject: powerpc/wii: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ] + +Use "%pa" format specifier for resource_size_t to avoid compiler +printk format warnings. + +../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info' + 148 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info' + 174 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info' + 77 | pr_info("%s at 0x%08x mapped to 0x%p\n", name, + | ^~~~~~~ + +Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support") +Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support") +Fixes: 5a7ee3198dfa ("powerpc: wii: platform support") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/wii.c | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +index db0be007fd063..bfca4d42b00d3 100644 +--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +@@ -149,7 +149,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np) + } + io_base = ioremap(res.start, resource_size(&res)); + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __flipper_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +index 7b4edf1cb2c8d..bdc7e1a80366f 100644 +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -178,7 +178,7 @@ static struct irq_domain *hlwd_pic_init(struct device_node *np) + return NULL; + } + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __hlwd_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c +index 343bffd20fcaf..768231005fb5a 100644 +--- a/arch/powerpc/platforms/embedded6xx/wii.c ++++ b/arch/powerpc/platforms/embedded6xx/wii.c +@@ -122,8 +122,8 @@ static void __iomem *wii_ioremap_hw_regs(char *name, char *compatible) + + hw_regs = ioremap(res.start, resource_size(&res)); + if (hw_regs) { +- pr_info("%s at 0x%08x mapped to 0x%p\n", name, +- res.start, hw_regs); ++ pr_info("%s at 0x%pa mapped to 0x%p\n", name, ++ &res.start, hw_regs); + } + + out_put: +-- +2.39.2 + diff --git a/queue-4.19/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch b/queue-4.19/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch new file mode 100644 index 00000000000..387b2979fdf --- /dev/null +++ b/queue-4.19/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch @@ -0,0 +1,100 @@ +From 7d2de15858cfb5077e22ef669c72f26a63be79d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 20:40:43 +0000 +Subject: pstore: Revert pmsg_lock back to a normal mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Stultz + +[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ] + +This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721. + +So while priority inversion on the pmsg_lock is an occasional +problem that an rt_mutex would help with, in uses where logging +is writing to pmsg heavily from multiple threads, the pmsg_lock +can be heavily contended. + +After this change landed, it was reported that cases where the +mutex locking overhead was commonly adding on the order of 10s +of usecs delay had suddenly jumped to ~msec delay with rtmutex. + +It seems the slight differences in the locks under this level +of contention causes the normal mutexes to utilize the spinning +optimizations, while the rtmutexes end up in the sleeping +slowpath (which allows additional threads to pile on trying +to take the lock). + +In this case, it devolves to a worse case senerio where the lock +acquisition and scheduling overhead dominates, and each thread +is waiting on the order of ~ms to do ~us of work. + +Obviously, having tons of threads all contending on a single +lock for logging is non-optimal, so the proper fix is probably +reworking pstore pmsg to have per-cpu buffers so we don't have +contention. + +Additionally, Steven Rostedt has provided some furhter +optimizations for rtmutexes that improves the rtmutex spinning +path, but at least in my testing, I still see the test tripping +into the sleeping path on rtmutexes while utilizing the spinning +path with mutexes. + +But in the short term, lets revert the change to the rt_mutex +and go back to normal mutexes to avoid a potentially major +performance regression. And we can work on optimizations to both +rtmutexes and finer-grained locking for pstore pmsg in the +future. + +Cc: Wei Wang +Cc: Midas Chien +Cc: "Chunhui Li (李春辉)" +Cc: Steven Rostedt +Cc: Kees Cook +Cc: Anton Vorontsov +Cc: "Guilherme G. Piccoli" +Cc: Tony Luck +Cc: kernel-team@android.com +Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion") +Reported-by: "Chunhui Li (李春辉)" +Signed-off-by: John Stultz +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com +Signed-off-by: Sasha Levin +--- + fs/pstore/pmsg.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c +index ffc13ea196d2a..24db02de17874 100644 +--- a/fs/pstore/pmsg.c ++++ b/fs/pstore/pmsg.c +@@ -15,10 +15,9 @@ + #include + #include + #include +-#include + #include "internal.h" + +-static DEFINE_RT_MUTEX(pmsg_lock); ++static DEFINE_MUTEX(pmsg_lock); + + static ssize_t write_pmsg(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) +@@ -37,9 +36,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf, + if (!access_ok(VERIFY_READ, buf, count)) + return -EFAULT; + +- rt_mutex_lock(&pmsg_lock); ++ mutex_lock(&pmsg_lock); + ret = psinfo->write_user(&record, buf); +- rt_mutex_unlock(&pmsg_lock); ++ mutex_unlock(&pmsg_lock); + return ret ? ret : count; + } + +-- +2.39.2 + diff --git a/queue-4.19/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch b/queue-4.19/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch new file mode 100644 index 00000000000..ad8b83c0156 --- /dev/null +++ b/queue-4.19/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch @@ -0,0 +1,198 @@ +From 0f1c0fb369a2994da8a68d4e9d0df4facdcf5915 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 21:24:29 +0800 +Subject: pwm: mtk-disp: Adjust the clocks to avoid them mismatch + +From: Jitao Shi + +[ Upstream commit d7a4e582587d97a586b1f7709e3bddcf35928e96 ] + +The clks "main" and "mm" are prepared in .probe() (and unprepared in +.remove()). This results in the clocks being on during suspend which +results in unnecessarily increased power consumption. + +Remove the clock operations from .probe() and .remove(). Add the +clk_prepare_enable() in .enable() and the clk_disable_unprepare() in +.disable(). + +Signed-off-by: Jitao Shi +[thierry.reding@gmail.com: squashed in fixup patch] +Signed-off-by: Thierry Reding +Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 91 +++++++++++++++++--------------------- + 1 file changed, 41 insertions(+), 50 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index dd31a00d6326c..6d08938866048 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -82,6 +82,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + u64 div, rate; + int err; + ++ err = clk_prepare_enable(mdp->clk_main); ++ if (err < 0) { ++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err)); ++ return err; ++ } ++ ++ err = clk_prepare_enable(mdp->clk_mm); ++ if (err < 0) { ++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err)); ++ clk_disable_unprepare(mdp->clk_main); ++ return err; ++ } ++ + /* + * Find period, high_width and clk_div to suit duty_ns and period_ns. + * Calculate proper div value to keep period value in the bound. +@@ -95,8 +108,11 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + rate = clk_get_rate(mdp->clk_main); + clk_div = div_u64(rate * period_ns, NSEC_PER_SEC) >> + PWM_PERIOD_BIT_WIDTH; +- if (clk_div > PWM_CLKDIV_MAX) ++ if (clk_div > PWM_CLKDIV_MAX) { ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + return -EINVAL; ++ } + + div = NSEC_PER_SEC * (clk_div + 1); + period = div64_u64(rate * period_ns, div); +@@ -106,16 +122,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + high_width = div64_u64(rate * duty_ns, div); + value = period | (high_width << PWM_HIGH_WIDTH_SHIFT); + +- err = clk_enable(mdp->clk_main); +- if (err < 0) +- return err; +- +- err = clk_enable(mdp->clk_mm); +- if (err < 0) { +- clk_disable(mdp->clk_main); +- return err; +- } +- + mtk_disp_pwm_update_bits(mdp, mdp->data->con0, + PWM_CLKDIV_MASK, + clk_div << PWM_CLKDIV_SHIFT); +@@ -130,10 +136,21 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + mtk_disp_pwm_update_bits(mdp, mdp->data->commit, + mdp->data->commit_mask, + 0x0); ++ } else { ++ /* ++ * For MT2701, disable double buffer before writing register ++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. ++ */ ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0, ++ mdp->data->con0_sel, ++ mdp->data->con0_sel); + } + +- clk_disable(mdp->clk_mm); +- clk_disable(mdp->clk_main); ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + + return 0; + } +@@ -143,13 +160,16 @@ static int mtk_disp_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + struct mtk_disp_pwm *mdp = to_mtk_disp_pwm(chip); + int err; + +- err = clk_enable(mdp->clk_main); +- if (err < 0) ++ err = clk_prepare_enable(mdp->clk_main); ++ if (err < 0) { ++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err)); + return err; ++ } + +- err = clk_enable(mdp->clk_mm); ++ err = clk_prepare_enable(mdp->clk_mm); + if (err < 0) { +- clk_disable(mdp->clk_main); ++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err)); ++ clk_disable_unprepare(mdp->clk_main); + return err; + } + +@@ -166,8 +186,8 @@ static void mtk_disp_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask, + 0x0); + +- clk_disable(mdp->clk_mm); +- clk_disable(mdp->clk_main); ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + } + + static const struct pwm_ops mtk_disp_pwm_ops = { +@@ -202,14 +222,6 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev) + if (IS_ERR(mdp->clk_mm)) + return PTR_ERR(mdp->clk_mm); + +- ret = clk_prepare(mdp->clk_main); +- if (ret < 0) +- return ret; +- +- ret = clk_prepare(mdp->clk_mm); +- if (ret < 0) +- goto disable_clk_main; +- + mdp->chip.dev = &pdev->dev; + mdp->chip.ops = &mtk_disp_pwm_ops; + mdp->chip.base = -1; +@@ -217,32 +229,13 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev) + + ret = pwmchip_add(&mdp->chip); + if (ret < 0) { +- dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret); +- goto disable_clk_mm; ++ dev_err(&pdev->dev, "pwmchip_add() failed: %pe\n", ERR_PTR(ret)); ++ return ret; + } + + platform_set_drvdata(pdev, mdp); + +- /* +- * For MT2701, disable double buffer before writing register +- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. +- */ +- if (!mdp->data->has_commit) { +- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, +- mdp->data->bls_debug_mask, +- mdp->data->bls_debug_mask); +- mtk_disp_pwm_update_bits(mdp, mdp->data->con0, +- mdp->data->con0_sel, +- mdp->data->con0_sel); +- } +- + return 0; +- +-disable_clk_mm: +- clk_unprepare(mdp->clk_mm); +-disable_clk_main: +- clk_unprepare(mdp->clk_main); +- return ret; + } + + static int mtk_disp_pwm_remove(struct platform_device *pdev) +@@ -250,8 +243,6 @@ static int mtk_disp_pwm_remove(struct platform_device *pdev) + struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev); + + pwmchip_remove(&mdp->chip); +- clk_unprepare(mdp->clk_mm); +- clk_unprepare(mdp->clk_main); + + return 0; + } +-- +2.39.2 + diff --git a/queue-4.19/pwm-mtk-disp-disable-shadow-registers-before-setting.patch b/queue-4.19/pwm-mtk-disp-disable-shadow-registers-before-setting.patch new file mode 100644 index 00000000000..73552f7d66b --- /dev/null +++ b/queue-4.19/pwm-mtk-disp-disable-shadow-registers-before-setting.patch @@ -0,0 +1,74 @@ +From 4ceed5f18ed6887d71c5474ca63bf85e792f2bf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 15:30:53 +0200 +Subject: pwm: mtk-disp: Disable shadow registers before setting backlight + values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: AngeloGioacchino Del Regno + +[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ] + +If shadow registers usage is not desired, disable that before performing +any write to CON0/1 registers in the .apply() callback, otherwise we may +lose clkdiv or period/width updates. + +Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: Alexandre Mergnat +Tested-by: Alexandre Mergnat +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 6d08938866048..c49b1e696b8c4 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -122,6 +122,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + high_width = div64_u64(rate * duty_ns, div); + value = period | (high_width << PWM_HIGH_WIDTH_SHIFT); + ++ if (mdp->data->bls_debug && !mdp->data->has_commit) { ++ /* ++ * For MT2701, disable double buffer before writing register ++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. ++ */ ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0, ++ mdp->data->con0_sel, ++ mdp->data->con0_sel); ++ } ++ + mtk_disp_pwm_update_bits(mdp, mdp->data->con0, + PWM_CLKDIV_MASK, + clk_div << PWM_CLKDIV_SHIFT); +@@ -136,17 +149,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + mtk_disp_pwm_update_bits(mdp, mdp->data->commit, + mdp->data->commit_mask, + 0x0); +- } else { +- /* +- * For MT2701, disable double buffer before writing register +- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. +- */ +- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, +- mdp->data->bls_debug_mask, +- mdp->data->bls_debug_mask); +- mtk_disp_pwm_update_bits(mdp, mdp->data->con0, +- mdp->data->con0_sel, +- mdp->data->con0_sel); + } + + clk_disable_unprepare(mdp->clk_mm); +-- +2.39.2 + diff --git a/queue-4.19/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch b/queue-4.19/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch new file mode 100644 index 00000000000..13810bafa97 --- /dev/null +++ b/queue-4.19/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch @@ -0,0 +1,47 @@ +From 393b6c4ff0afa2151e0d77de4182b70a789580f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 18:28:27 +0200 +Subject: pwm: mtk-disp: Don't check the return code of pwmchip_remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 9b7b5736ffd5da6f8f6329ebe5f1829cbcf8afae ] + +pwmchip_remove() returns always 0. Don't use the value to make it +possible to eventually change the function to return void. Also the +driver core ignores the return value of mtk_disp_pwm_remove(). + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 893940d45f0d0..dd31a00d6326c 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -248,13 +248,12 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev) + static int mtk_disp_pwm_remove(struct platform_device *pdev) + { + struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev); +- int ret; + +- ret = pwmchip_remove(&mdp->chip); ++ pwmchip_remove(&mdp->chip); + clk_unprepare(mdp->clk_mm); + clk_unprepare(mdp->clk_main); + +- return ret; ++ return 0; + } + + static const struct mtk_pwm_data mt2701_pwm_data = { +-- +2.39.2 + diff --git a/queue-4.19/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch b/queue-4.19/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch new file mode 100644 index 00000000000..0324ef34fe1 --- /dev/null +++ b/queue-4.19/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch @@ -0,0 +1,46 @@ +From 8bd7dfc2e71aa6e8514de70a00b03683ad7b1f99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 12:51:27 +0300 +Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() + +From: Dan Carpenter + +[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ] + +The ucmd->log_sq_bb_count variable is controlled by the user so this +shift can wrap. Fix it by using check_shl_overflow() in the same way +that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined +behavior in hns_roce_set_user_sq_size()"). + +Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/qp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 7209b8a9b0dd2..87358b8c45589 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -436,9 +436,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev, + struct mlx4_ib_qp *qp, + struct mlx4_ib_create_qp *ucmd) + { ++ u32 cnt; ++ + /* Sanity check SQ size before proceeding */ +- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes || +- ucmd->log_sq_stride > ++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) || ++ cnt > dev->dev->caps.max_wqes) ++ return -EINVAL; ++ if (ucmd->log_sq_stride > + ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) || + ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-4.19/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch b/queue-4.19/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch new file mode 100644 index 00000000000..0f2ac2b2a4a --- /dev/null +++ b/queue-4.19/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch @@ -0,0 +1,39 @@ +From 1d108ff91790cd92d736ef2d71c8f9ae1e38f098 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 04:39:06 +0300 +Subject: RDMA/mlx5: Use correct device num_ports when modify DC + +From: Mark Zhang + +[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ] + +Just like other QP types, when modify DC, the port_num should be compared +with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port +vHCA on DC may not work. + +Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP") +Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 1520a3098f7dc..0455abfba41c2 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -3350,7 +3350,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, + return -EINVAL; + + if (attr->port_num == 0 || +- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) { ++ attr->port_num > dev->num_ports) { + mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n", + attr->port_num, dev->num_ports); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-4.19/rdma-rdmavt-delete-unnecessary-null-check.patch b/queue-4.19/rdma-rdmavt-delete-unnecessary-null-check.patch new file mode 100644 index 00000000000..ba282df57fc --- /dev/null +++ b/queue-4.19/rdma-rdmavt-delete-unnecessary-null-check.patch @@ -0,0 +1,41 @@ +From de9029d82adcf9a8b83269ad1c9ef71451004142 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 15:44:08 +0300 +Subject: RDMA/rdmavt: Delete unnecessary NULL check + +From: Natalia Petrova + +[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ] + +There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev' +is created in rvt_register_device() which will fail if the 'qp_dev' +allocation fails in rvt_driver_qp_init(). Overwise this pointer +doesn't changed and passed to rvt_qp_exit() by the next step. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table") +Signed-off-by: Natalia Petrova +Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rdmavt/qp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index fbc316775669c..c12fc2eace161 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -321,8 +321,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi) + if (qps_inuse) + rvt_pr_err(rdi, "QP memory leak! %u still in use\n", + qps_inuse); +- if (!rdi->qp_dev) +- return; + + kfree(rdi->qp_dev->qp_table); + free_qpn_table(&rdi->qp_dev->qpn_table); +-- +2.39.2 + diff --git a/queue-4.19/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch b/queue-4.19/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch new file mode 100644 index 00000000000..166f96dd626 --- /dev/null +++ b/queue-4.19/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch @@ -0,0 +1,39 @@ +From 815ccadfcbd14180945cd2b4e8fdc7dde4dffb9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 18:30:06 +0800 +Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove + due to unfinished work" + +From: Liu Jian + +[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ] + +This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. + +This patch introduces a possible null-ptr-def problem. Revert it. And the +fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth: +btsdio: fix use after free bug in btsdio_remove due to race condition"). + +Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work") +Signed-off-by: Liu Jian +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btsdio.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index bd55bf7a9914c..20142bc77554c 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -353,7 +353,6 @@ static void btsdio_remove(struct sdio_func *func) + + BT_DBG("func %p", func); + +- cancel_work_sync(&data->work); + if (!data) + return; + +-- +2.39.2 + diff --git a/queue-4.19/rtlwifi-replace-rt_trace-with-rtl_dbg.patch b/queue-4.19/rtlwifi-replace-rt_trace-with-rtl_dbg.patch new file mode 100644 index 00000000000..480020c16fe --- /dev/null +++ b/queue-4.19/rtlwifi-replace-rt_trace-with-rtl_dbg.patch @@ -0,0 +1,2300 @@ +From 9a69181b79e0e6da48293b2321b232d2cad185b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 15:42:31 -0500 +Subject: rtlwifi: Replace RT_TRACE with rtl_dbg + +From: Larry Finger + +[ Upstream commit f108a420e50a62e0bc5cdcd7d4a2440986b526e3 ] + +The macro name RT_TRACE makes it seem that it is used for tracing, when +is actually used for debugging. Change the name to rtl_dbg. Any Sparse +errors exposed by this change were also fixed. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200723204244.24457-3-Larry.Finger@lwfinger.net +Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 144 +++++----- + drivers/net/wireless/realtek/rtlwifi/cam.c | 82 +++--- + drivers/net/wireless/realtek/rtlwifi/core.c | 259 ++++++++--------- + drivers/net/wireless/realtek/rtlwifi/debug.c | 4 +- + drivers/net/wireless/realtek/rtlwifi/efuse.c | 72 ++--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 282 +++++++++---------- + drivers/net/wireless/realtek/rtlwifi/ps.c | 98 +++---- + drivers/net/wireless/realtek/rtlwifi/regd.c | 18 +- + drivers/net/wireless/realtek/rtlwifi/usb.c | 18 +- + 9 files changed, 488 insertions(+), 489 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 6d1b6a4a81502..7644d7cbcb5af 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -217,8 +217,8 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw, + } else { + if (get_rf_type(rtlphy) == RF_1T2R || + get_rf_type(rtlphy) == RF_2T2R) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "1T2R or 2T2R\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "1T2R or 2T2R\n"); + ht_cap->mcs.rx_mask[0] = 0xFF; + ht_cap->mcs.rx_mask[1] = 0xFF; + ht_cap->mcs.rx_mask[4] = 0x01; +@@ -226,7 +226,7 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw, + ht_cap->mcs.rx_highest = + cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS15); + } else if (get_rf_type(rtlphy) == RF_1T1R) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n"); + + ht_cap->mcs.rx_mask[0] = 0xFF; + ht_cap->mcs.rx_mask[1] = 0x00; +@@ -1344,7 +1344,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb) + rtlpriv->cfg->ops->chk_switch_dmdp(hw); + } + if (ieee80211_is_auth(fc)) { +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); + + mac->link_state = MAC80211_LINKING; + /* Dul mac */ +@@ -1405,7 +1405,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) + if (mac->act_scanning) + return false; + +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, + "%s ACT_ADDBAREQ From :%pM\n", + is_tx ? "Tx" : "Rx", hdr->addr2); + RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, "req\n", +@@ -1420,8 +1420,8 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) + rcu_read_lock(); + sta = rtl_find_sta(hw, hdr->addr3); + if (sta == NULL) { +- RT_TRACE(rtlpriv, COMP_SEND | COMP_RECV, +- DBG_DMESG, "sta is NULL\n"); ++ rtl_dbg(rtlpriv, COMP_SEND | COMP_RECV, ++ DBG_DMESG, "sta is NULL\n"); + rcu_read_unlock(); + return true; + } +@@ -1448,13 +1448,13 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) + } + break; + case ACT_ADDBARSP: +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, +- "%s ACT_ADDBARSP From :%pM\n", +- is_tx ? "Tx" : "Rx", hdr->addr2); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ "%s ACT_ADDBARSP From :%pM\n", ++ is_tx ? "Tx" : "Rx", hdr->addr2); + break; + case ACT_DELBA: +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, +- "ACT_ADDBADEL From :%pM\n", hdr->addr2); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ "ACT_ADDBADEL From :%pM\n", hdr->addr2); + break; + } + break; +@@ -1539,9 +1539,9 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx, + /* 68 : UDP BOOTP client + * 67 : UDP BOOTP server + */ +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), +- DBG_DMESG, "dhcp %s !!\n", +- (is_tx) ? "Tx" : "Rx"); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), ++ DBG_DMESG, "dhcp %s !!\n", ++ (is_tx) ? "Tx" : "Rx"); + + if (is_tx) + setup_special_tx(rtlpriv, ppsc, +@@ -1560,8 +1560,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx, + rtlpriv->btcoexist.btc_info.in_4way = true; + rtlpriv->btcoexist.btc_info.in_4way_ts = jiffies; + +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, +- "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx"); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx"); + + if (is_tx) { + rtlpriv->ra.is_special_data = true; +@@ -1603,12 +1603,12 @@ static void rtl_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb, + info = IEEE80211_SKB_CB(skb); + ieee80211_tx_info_clear_status(info); + if (ack) { +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD, +- "tx report: ack\n"); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD, ++ "tx report: ack\n"); + info->flags |= IEEE80211_TX_STAT_ACK; + } else { +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD, +- "tx report: not ack\n"); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD, ++ "tx report: not ack\n"); + info->flags &= ~IEEE80211_TX_STAT_ACK; + } + ieee80211_tx_status_irqsafe(hw, skb); +@@ -1646,8 +1646,8 @@ static u16 rtl_get_tx_report_sn(struct ieee80211_hw *hw, + tx_report->last_sent_time = jiffies; + tx_info->sn = sn; + tx_info->send_time = tx_report->last_sent_time; +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG, +- "Send TX-Report sn=0x%X\n", sn); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG, ++ "Send TX-Report sn=0x%X\n", sn); + + return sn; + } +@@ -1694,9 +1694,9 @@ void rtl_tx_report_handler(struct ieee80211_hw *hw, u8 *tmp_buf, u8 c2h_cmd_len) + break; + } + } +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG, +- "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n", +- st, sn, retry); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG, ++ "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n", ++ st, sn, retry); + } + EXPORT_SYMBOL_GPL(rtl_tx_report_handler); + +@@ -1709,9 +1709,9 @@ bool rtl_check_tx_report_acked(struct ieee80211_hw *hw) + return true; + + if (time_before(tx_report->last_sent_time + 3 * HZ, jiffies)) { +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_WARNING, +- "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n", +- tx_report->last_sent_sn, tx_report->last_recv_sn); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_WARNING, ++ "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n", ++ tx_report->last_sent_sn, tx_report->last_recv_sn); + return true; /* 3 sec. (timeout) seen as acked */ + } + +@@ -1727,8 +1727,8 @@ void rtl_wait_tx_report_acked(struct ieee80211_hw *hw, u32 wait_ms) + if (rtl_check_tx_report_acked(hw)) + break; + usleep_range(1000, 2000); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms); + } + } + +@@ -1790,9 +1790,9 @@ int rtl_tx_agg_start(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + return -ENXIO; + tid_data = &sta_entry->tids[tid]; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d seq:%d\n", sta->addr, tid, +- *ssn); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d seq:%d\n", sta->addr, tid, ++ *ssn); + + tid_data->agg.agg_state = RTL_AGG_START; + +@@ -1809,8 +1809,8 @@ int rtl_tx_agg_stop(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + if (sta == NULL) + return -EINVAL; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + if (unlikely(tid >= MAX_TID_COUNT)) + return -EINVAL; +@@ -1849,8 +1849,8 @@ int rtl_rx_agg_start(struct ieee80211_hw *hw, + return -ENXIO; + tid_data = &sta_entry->tids[tid]; + +- RT_TRACE(rtlpriv, COMP_RECV, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_RECV, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + tid_data->agg.rx_agg_state = RTL_RX_AGG_START; + return 0; +@@ -1865,8 +1865,8 @@ int rtl_rx_agg_stop(struct ieee80211_hw *hw, + if (sta == NULL) + return -EINVAL; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + if (unlikely(tid >= MAX_TID_COUNT)) + return -EINVAL; +@@ -1885,8 +1885,8 @@ int rtl_tx_agg_oper(struct ieee80211_hw *hw, + if (sta == NULL) + return -EINVAL; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + if (unlikely(tid >= MAX_TID_COUNT)) + return -EINVAL; +@@ -1906,9 +1906,9 @@ void rtl_rx_ampdu_apply(struct rtl_priv *rtlpriv) + btc_ops->btc_get_ampdu_cfg(rtlpriv, &reject_agg, + &ctrl_agg_size, &agg_size); + +- RT_TRACE(rtlpriv, COMP_BT_COEXIST, DBG_DMESG, +- "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d", +- reject_agg, ctrl_agg_size, agg_size); ++ rtl_dbg(rtlpriv, COMP_BT_COEXIST, DBG_DMESG, ++ "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d", ++ reject_agg, ctrl_agg_size, agg_size); + + rtlpriv->hw->max_rx_aggregation_subframes = + (ctrl_agg_size ? agg_size : IEEE80211_MAX_AMPDU_BUF_HT); +@@ -1996,9 +1996,9 @@ void rtl_scan_list_expire(struct ieee80211_hw *hw) + list_del(&entry->list); + rtlpriv->scan_list.num--; + +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, +- "BSSID=%pM is expire in scan list (total=%d)\n", +- entry->bssid, rtlpriv->scan_list.num); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, ++ "BSSID=%pM is expire in scan list (total=%d)\n", ++ entry->bssid, rtlpriv->scan_list.num); + kfree(entry); + } + +@@ -2032,9 +2032,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) { + list_del_init(&entry->list); + entry_found = true; +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, +- "Update BSSID=%pM to scan list (total=%d)\n", +- hdr->addr3, rtlpriv->scan_list.num); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, ++ "Update BSSID=%pM to scan list (total=%d)\n", ++ hdr->addr3, rtlpriv->scan_list.num); + break; + } + } +@@ -2048,9 +2048,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + memcpy(entry->bssid, hdr->addr3, ETH_ALEN); + rtlpriv->scan_list.num++; + +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, +- "Add BSSID=%pM to scan list (total=%d)\n", +- hdr->addr3, rtlpriv->scan_list.num); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, ++ "Add BSSID=%pM to scan list (total=%d)\n", ++ hdr->addr3, rtlpriv->scan_list.num); + } + + entry->age = jiffies; +@@ -2213,8 +2213,8 @@ void rtl_watchdog_wq_callback(void *data) + if ((rtlpriv->link_info.bcn_rx_inperiod + + rtlpriv->link_info.num_rx_inperiod) == 0) { + rtlpriv->link_info.roam_times++; +- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, +- "AP off for %d s\n", ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, ++ "AP off for %d s\n", + (rtlpriv->link_info.roam_times * 2)); + + /* if we can't recv beacon for 10s, +@@ -2325,11 +2325,11 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw, + + switch (cmd_id) { + case C2H_DBG: +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n"); + break; + case C2H_TXBF: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], C2H_TXBF!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], C2H_TXBF!!\n"); + break; + case C2H_TX_REPORT: + rtl_tx_report_handler(hw, cmd_buf, cmd_len); +@@ -2339,20 +2339,20 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw, + hal_ops->c2h_ra_report_handler(hw, cmd_buf, cmd_len); + break; + case C2H_BT_INFO: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], C2H_BT_INFO!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], C2H_BT_INFO!!\n"); + if (rtlpriv->cfg->ops->get_btc_status()) + btc_ops->btc_btinfo_notify(rtlpriv, cmd_buf, cmd_len); + break; + case C2H_BT_MP: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], C2H_BT_MP!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], C2H_BT_MP!!\n"); + if (rtlpriv->cfg->ops->get_btc_status()) + btc_ops->btc_btmpinfo_notify(rtlpriv, cmd_buf, cmd_len); + break; + default: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id); + break; + } + } +@@ -2376,8 +2376,8 @@ void rtl_c2hcmd_launcher(struct ieee80211_hw *hw, int exec) + if (!skb) + break; + +- RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n", +- *((u8 *)skb->cb)); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n", ++ *((u8 *)skb->cb)); + RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_DMESG, + "C2H data: ", skb->data, skb->len); + +@@ -2721,29 +2721,29 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len) + (memcmp(mac->bssid, ap5_6, 3) == 0) || + vendor == PEER_ATH) { + vendor = PEER_ATH; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n"); + } else if ((memcmp(mac->bssid, ap4_4, 3) == 0) || + (memcmp(mac->bssid, ap4_5, 3) == 0) || + (memcmp(mac->bssid, ap4_1, 3) == 0) || + (memcmp(mac->bssid, ap4_2, 3) == 0) || + (memcmp(mac->bssid, ap4_3, 3) == 0) || + vendor == PEER_RAL) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n"); + vendor = PEER_RAL; + } else if (memcmp(mac->bssid, ap6_1, 3) == 0 || + vendor == PEER_CISCO) { + vendor = PEER_CISCO; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n"); + } else if ((memcmp(mac->bssid, ap3_1, 3) == 0) || + (memcmp(mac->bssid, ap3_2, 3) == 0) || + (memcmp(mac->bssid, ap3_3, 3) == 0) || + vendor == PEER_BROAD) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n"); + vendor = PEER_BROAD; + } else if (memcmp(mac->bssid, ap7_1, 3) == 0 || + vendor == PEER_MARV) { + vendor = PEER_MARV; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n"); + } + + mac->vendor = vendor; +diff --git a/drivers/net/wireless/realtek/rtlwifi/cam.c b/drivers/net/wireless/realtek/rtlwifi/cam.c +index f7a7dcbf945ef..c631295258752 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/cam.c ++++ b/drivers/net/wireless/realtek/rtlwifi/cam.c +@@ -64,14 +64,14 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], + target_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE %x: %x\n", +- rtlpriv->cfg->maps[WCAMI], target_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "The Key ID is %d\n", entry_no); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE %x: %x\n", +- rtlpriv->cfg->maps[RWCAM], target_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE %x: %x\n", ++ rtlpriv->cfg->maps[WCAMI], target_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "The Key ID is %d\n", entry_no); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE %x: %x\n", ++ rtlpriv->cfg->maps[RWCAM], target_command); + + } else if (entry_i == 1) { + +@@ -85,10 +85,10 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], + target_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A4: %x\n", target_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A0: %x\n", target_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A4: %x\n", target_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A0: %x\n", target_command); + + } else { + +@@ -104,15 +104,15 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], + target_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A4: %x\n", target_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A0: %x\n", target_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A4: %x\n", target_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A0: %x\n", target_command); + } + } + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "after set key, usconfig:%x\n", us_config); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "after set key, usconfig:%x\n", us_config); + } + + u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr, +@@ -122,14 +122,14 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr, + u32 us_config; + struct rtl_priv *rtlpriv = rtl_priv(hw); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n", +- ul_entry_idx, ul_key_id, ul_enc_alg, +- ul_default_key, mac_addr); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n", ++ ul_entry_idx, ul_key_id, ul_enc_alg, ++ ul_default_key, mac_addr); + + if (ul_key_id == TOTAL_CAM_ENTRY) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "ulKeyId exceed!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "ulKeyId exceed!\n"); + return 0; + } + +@@ -141,7 +141,7 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr, + rtl_cam_program_entry(hw, ul_entry_idx, mac_addr, + (u8 *)key_content, us_config); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "end\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "end\n"); + + return 1; + +@@ -154,7 +154,7 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw, + u32 ul_command; + struct rtl_priv *rtlpriv = rtl_priv(hw); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id); + + ul_command = ul_key_id * CAM_CONTENT_COUNT; + ul_command = ul_command | BIT(31) | BIT(16); +@@ -162,10 +162,10 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], 0); + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_delete_one_entry(): WRITE A4: %x\n", 0); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_delete_one_entry(): WRITE A0: %x\n", ul_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A4: %x\n", __func__, 0); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A0: %x\n", __func__, ul_command); + + return 0; + +@@ -216,10 +216,10 @@ void rtl_cam_mark_invalid(struct ieee80211_hw *hw, u8 uc_index) + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content); + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_mark_invalid(): WRITE A4: %x\n", ul_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_mark_invalid(): WRITE A0: %x\n", ul_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A4: %x\n", __func__, ul_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A0: %x\n", __func__, ul_command); + } + EXPORT_SYMBOL(rtl_cam_mark_invalid); + +@@ -266,12 +266,10 @@ void rtl_cam_empty_entry(struct ieee80211_hw *hw, u8 uc_index) + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content); + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "rtl_cam_empty_entry(): WRITE A4: %x\n", +- ul_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "rtl_cam_empty_entry(): WRITE A0: %x\n", +- ul_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "%s: WRITE A4: %x\n", __func__, ul_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "%s: WRITE A0: %x\n", __func__, ul_command); + } + + } +@@ -334,8 +332,8 @@ void rtl_cam_del_entry(struct ieee80211_hw *hw, u8 *sta_addr) + /* Remove from HW Security CAM */ + eth_zero_addr(rtlpriv->sec.hwsec_cam_sta_addr[i]); + rtlpriv->sec.hwsec_cam_bitmap &= ~(BIT(0) << i); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "&&&&&&&&&del entry %d\n", i); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "&&&&&&&&&del entry %d\n", i); + } + } + return; +diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c +index 4bf7967590ca7..0ad4e0f099f95 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -98,8 +98,8 @@ static void rtl_fw_do_work(const struct firmware *firmware, void *context, + struct rtl_priv *rtlpriv = rtl_priv(hw); + int err; + +- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD, +- "Firmware callback routine entered!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, ++ "Firmware callback routine entered!\n"); + complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { + if (rtlpriv->cfg->alt_fw_name) { +@@ -235,8 +235,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + u8 retry_limit = 0x30; + + if (mac->vif) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "vif has been set!! mac->vif = 0x%p\n", mac->vif); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "vif has been set!! mac->vif = 0x%p\n", mac->vif); + return -EOPNOTSUPP; + } + +@@ -251,16 +251,16 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + /*fall through*/ + case NL80211_IFTYPE_STATION: + if (mac->beacon_enabled == 1) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_STATION\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_STATION\n"); + mac->beacon_enabled = 0; + rtlpriv->cfg->ops->update_interrupt_mask(hw, 0, + rtlpriv->cfg->maps[RTL_IBSS_INT_MASKS]); + } + break; + case NL80211_IFTYPE_ADHOC: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_ADHOC\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_ADHOC\n"); + + mac->link_state = MAC80211_LINKED; + rtlpriv->cfg->ops->set_bcn_reg(hw); +@@ -277,8 +277,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + mac->p2p = P2P_ROLE_GO; + /*fall through*/ + case NL80211_IFTYPE_AP: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_AP\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_AP\n"); + + mac->link_state = MAC80211_LINKED; + rtlpriv->cfg->ops->set_bcn_reg(hw); +@@ -292,8 +292,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + retry_limit = 0x07; + break; + case NL80211_IFTYPE_MESH_POINT: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_MESH_POINT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_MESH_POINT\n"); + + mac->link_state = MAC80211_LINKED; + rtlpriv->cfg->ops->set_bcn_reg(hw); +@@ -314,8 +314,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + } + + if (mac->p2p) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "p2p role %x\n", vif->type); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "p2p role %x\n", vif->type); + mac->basic_rates = 0xff0;/*disable cck rate for p2p*/ + rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE, + (u8 *)(&mac->basic_rates)); +@@ -379,8 +379,8 @@ static int rtl_op_change_interface(struct ieee80211_hw *hw, + vif->type = new_type; + vif->p2p = p2p; + ret = rtl_op_add_interface(hw, vif); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "p2p %x\n", p2p); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "p2p %x\n", p2p); + return ret; + } + +@@ -454,8 +454,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw, + memset(mask, 0, MAX_WOL_BIT_MASK_SIZE); + if (patterns[i].pattern_len < 0 || + patterns[i].pattern_len > MAX_WOL_PATTERN_SIZE) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_WARNING, +- "Pattern[%d] is too long\n", i); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_WARNING, ++ "Pattern[%d] is too long\n", i); + continue; + } + pattern_os = patterns[i].pattern; +@@ -534,8 +534,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw, + "pattern to hw\n", content, len); + /* 3. calculate crc */ + rtl_pattern.crc = _calculate_wol_pattern_crc(content, len); +- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE, +- "CRC_Remainder = 0x%x\n", rtl_pattern.crc); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE, ++ "CRC_Remainder = 0x%x\n", rtl_pattern.crc); + + /* 4. write crc & mask_for_hw to hw */ + rtlpriv->cfg->ops->add_wowlan_pattern(hw, &rtl_pattern, i); +@@ -550,7 +550,7 @@ static int rtl_op_suspend(struct ieee80211_hw *hw, + struct rtl_hal *rtlhal = rtl_hal(rtlpriv); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); + if (WARN_ON(!wow)) + return -EINVAL; + +@@ -576,7 +576,7 @@ static int rtl_op_resume(struct ieee80211_hw *hw) + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + time64_t now; + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); + rtlhal->driver_is_goingto_unload = false; + rtlhal->enter_pnp_sleep = false; + rtlhal->wake_from_pnp_sleep = true; +@@ -607,8 +607,8 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed) + + mutex_lock(&rtlpriv->locks.conf_mutex); + if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) { /* BIT(2)*/ +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n"); + } + + /*For IPS */ +@@ -651,9 +651,9 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed) + } + + if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n", +- hw->conf.long_frame_max_tx_count); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n", ++ hw->conf.long_frame_max_tx_count); + /* brought up everything changes (changed == ~0) indicates first + * open, so use our default value instead of that of wiphy. + */ +@@ -828,13 +828,13 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (*new_flags & FIF_ALLMULTI) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AM] | + rtlpriv->cfg->maps[MAC_RCR_AB]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive multicast frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive multicast frame\n"); + } else { + mac->rx_conf &= ~(rtlpriv->cfg->maps[MAC_RCR_AM] | + rtlpriv->cfg->maps[MAC_RCR_AB]); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive multicast frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive multicast frame\n"); + } + update_rcr = true; + } +@@ -842,12 +842,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (changed_flags & FIF_FCSFAIL) { + if (*new_flags & FIF_FCSFAIL) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACRC32]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive FCS error frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive FCS error frame\n"); + } else { + mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACRC32]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive FCS error frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive FCS error frame\n"); + } + if (!update_rcr) + update_rcr = true; +@@ -874,12 +874,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (*new_flags & FIF_CONTROL) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACF]; + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive control frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive control frame.\n"); + } else { + mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACF]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive control frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive control frame.\n"); + } + if (!update_rcr) + update_rcr = true; +@@ -888,12 +888,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (changed_flags & FIF_OTHER_BSS) { + if (*new_flags & FIF_OTHER_BSS) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AAP]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive other BSS's frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive other BSS's frame.\n"); + } else { + mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_AAP]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive other BSS's frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive other BSS's frame.\n"); + } + if (!update_rcr) + update_rcr = true; +@@ -941,7 +941,7 @@ static int rtl_op_sta_add(struct ieee80211_hw *hw, + sta->supp_rates[0] &= 0xfffffff0; + + memcpy(sta_entry->mac_addr, sta->addr, ETH_ALEN); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, + "Add sta addr is %pM\n", sta->addr); + rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0, true); + } +@@ -956,8 +956,8 @@ static int rtl_op_sta_remove(struct ieee80211_hw *hw, + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_sta_info *sta_entry; + if (sta) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "Remove sta addr is %pM\n", sta->addr); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "Remove sta addr is %pM\n", sta->addr); + sta_entry = (struct rtl_sta_info *)sta->drv_priv; + sta_entry->wireless_mode = 0; + sta_entry->ratr_index = 0; +@@ -1004,8 +1004,8 @@ static int rtl_op_conf_tx(struct ieee80211_hw *hw, + int aci; + + if (queue >= AC_MAX) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "queue number %d is incorrect!\n", queue); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "queue number %d is incorrect!\n", queue); + return -EINVAL; + } + +@@ -1050,8 +1050,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + (changed & BSS_CHANGED_BEACON_ENABLED && + bss_conf->enable_beacon)) { + if (mac->beacon_enabled == 0) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "BSS_CHANGED_BEACON_ENABLED\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "BSS_CHANGED_BEACON_ENABLED\n"); + + /*start hw beacon interrupt. */ + /*rtlpriv->cfg->ops->set_bcn_reg(hw); */ +@@ -1068,8 +1068,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + if ((changed & BSS_CHANGED_BEACON_ENABLED && + !bss_conf->enable_beacon)) { + if (mac->beacon_enabled == 1) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "ADHOC DISABLE BEACON\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "ADHOC DISABLE BEACON\n"); + + mac->beacon_enabled = 0; + rtlpriv->cfg->ops->update_interrupt_mask(hw, 0, +@@ -1078,8 +1078,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } + } + if (changed & BSS_CHANGED_BEACON_INT) { +- RT_TRACE(rtlpriv, COMP_BEACON, DBG_TRACE, +- "BSS_CHANGED_BEACON_INT\n"); ++ rtl_dbg(rtlpriv, COMP_BEACON, DBG_TRACE, ++ "BSS_CHANGED_BEACON_INT\n"); + mac->beacon_interval = bss_conf->beacon_int; + rtlpriv->cfg->ops->set_bcn_intv(hw); + } +@@ -1117,8 +1117,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + rcu_read_unlock(); + goto out; + } +- RT_TRACE(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD, +- "send PS STATIC frame\n"); ++ rtl_dbg(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD, ++ "send PS STATIC frame\n"); + if (rtlpriv->dm.supp_phymode_switch) { + if (sta->ht_cap.ht_supported) + rtl_send_smps_action(hw, sta, +@@ -1158,8 +1158,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + HW_VAR_KEEP_ALIVE, + (u8 *)(&keep_alive)); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "BSS_CHANGED_ASSOC\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "BSS_CHANGED_ASSOC\n"); + } else { + struct cfg80211_bss *bss = NULL; + +@@ -1176,14 +1176,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + IEEE80211_BSS_TYPE_ESS, + IEEE80211_PRIVACY_OFF); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "bssid = %pMF\n", mac->bssid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "bssid = %pMF\n", mac->bssid); + + if (bss) { + cfg80211_unlink_bss(hw->wiphy, bss); + cfg80211_put_bss(hw->wiphy, bss); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "cfg80211_unlink !!\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "cfg80211_unlink !!\n"); + } + + eth_zero_addr(mac->bssid); +@@ -1194,8 +1194,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + if (rtlpriv->cfg->ops->chk_switch_dmdp) + rtlpriv->cfg->ops->chk_switch_dmdp(hw); + } +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "BSS_CHANGED_UN_ASSOC\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "BSS_CHANGED_UN_ASSOC\n"); + } + rtlpriv->cfg->ops->set_network_type(hw, vif->type); + /* For FW LPS: +@@ -1213,14 +1213,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } + + if (changed & BSS_CHANGED_ERP_CTS_PROT) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "BSS_CHANGED_ERP_CTS_PROT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "BSS_CHANGED_ERP_CTS_PROT\n"); + mac->use_cts_protect = bss_conf->use_cts_prot; + } + + if (changed & BSS_CHANGED_ERP_PREAMBLE) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n", ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n", + bss_conf->use_short_preamble); + + mac->short_preamble = bss_conf->use_short_preamble; +@@ -1229,8 +1229,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } + + if (changed & BSS_CHANGED_ERP_SLOT) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "BSS_CHANGED_ERP_SLOT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "BSS_CHANGED_ERP_SLOT\n"); + + if (bss_conf->use_short_slot) + mac->slot_time = RTL_SLOT_TIME_9; +@@ -1244,8 +1244,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + if (changed & BSS_CHANGED_HT) { + struct ieee80211_sta *sta = NULL; + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "BSS_CHANGED_HT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "BSS_CHANGED_HT\n"); + + rcu_read_lock(); + sta = ieee80211_find_sta(vif, (u8 *)bss_conf->bssid); +@@ -1276,8 +1276,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BSSID, + (u8 *)bss_conf->bssid); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "bssid: %pM\n", bss_conf->bssid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "bssid: %pM\n", bss_conf->bssid); + + mac->vendor = PEER_UNKNOWN; + memcpy(mac->bssid, bss_conf->bssid, ETH_ALEN); +@@ -1407,27 +1407,27 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw, + + switch (action) { + case IEEE80211_AMPDU_TX_START: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_TX_START: TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_TX_START: TID:%d\n", tid); + return rtl_tx_agg_start(hw, vif, sta, tid, ssn); + case IEEE80211_AMPDU_TX_STOP_CONT: + case IEEE80211_AMPDU_TX_STOP_FLUSH: + case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid); + return rtl_tx_agg_stop(hw, vif, sta, tid); + case IEEE80211_AMPDU_TX_OPERATIONAL: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid); + rtl_tx_agg_oper(hw, sta, tid); + break; + case IEEE80211_AMPDU_RX_START: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_RX_START:TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_RX_START:TID:%d\n", tid); + return rtl_rx_agg_start(hw, sta, tid); + case IEEE80211_AMPDU_RX_STOP: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid); + return rtl_rx_agg_stop(hw, sta, tid); + default: + pr_err("IEEE80211_AMPDU_ERR!!!!:\n"); +@@ -1443,7 +1443,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw, + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); + mac->act_scanning = true; + if (rtlpriv->link_info.higher_busytraffic) { + mac->skip_scan = true; +@@ -1481,7 +1481,7 @@ static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw, + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); + mac->act_scanning = false; + mac->skip_scan = false; + +@@ -1531,8 +1531,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + rtlpriv->btcoexist.btc_info.in_4way = false; + + if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "not open hw encryption\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "not open hw encryption\n"); + return -ENOSPC; /*User disabled HW-crypto */ + } + /* To support IBSS, use sw-crypto for GTK */ +@@ -1540,10 +1540,10 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + vif->type == NL80211_IFTYPE_MESH_POINT) && + !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) + return -ENOSPC; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "%s hardware based encryption for keyidx: %d, mac: %pM\n", +- cmd == SET_KEY ? "Using" : "Disabling", key->keyidx, +- sta ? sta->addr : bcast_addr); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s hardware based encryption for keyidx: %d, mac: %pM\n", ++ cmd == SET_KEY ? "Using" : "Disabling", key->keyidx, ++ sta ? sta->addr : bcast_addr); + rtlpriv->sec.being_setkey = true; + rtl_ips_nic_on(hw); + mutex_lock(&rtlpriv->locks.conf_mutex); +@@ -1552,28 +1552,28 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + switch (key->cipher) { + case WLAN_CIPHER_SUITE_WEP40: + key_type = WEP40_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n"); + break; + case WLAN_CIPHER_SUITE_WEP104: +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n"); + key_type = WEP104_ENCRYPTION; + break; + case WLAN_CIPHER_SUITE_TKIP: + key_type = TKIP_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n"); + break; + case WLAN_CIPHER_SUITE_CCMP: + key_type = AESCCMP_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n"); + break; + case WLAN_CIPHER_SUITE_AES_CMAC: + /* HW don't support CMAC encryption, + * use software CMAC encryption + */ + key_type = AESCMAC_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n"); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "HW don't support CMAC encryption, use software CMAC encryption\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "HW don't support CMAC encryption, use software CMAC encryption\n"); + err = -EOPNOTSUPP; + goto out_unlock; + default: +@@ -1619,9 +1619,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + key_type == WEP104_ENCRYPTION)) + wep_only = true; + rtlpriv->sec.pairwise_enc_algorithm = key_type; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n", +- key_type); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n", ++ key_type); + rtlpriv->cfg->ops->enable_hw_sec(hw); + } + } +@@ -1629,8 +1629,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + switch (cmd) { + case SET_KEY: + if (wep_only) { +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set WEP(group/pairwise) key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set WEP(group/pairwise) key\n"); + /* Pairwise key with an assigned MAC address. */ + rtlpriv->sec.pairwise_enc_algorithm = key_type; + rtlpriv->sec.group_enc_algorithm = key_type; +@@ -1640,8 +1640,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + rtlpriv->sec.key_len[key_idx] = key->keylen; + eth_zero_addr(mac_addr); + } else if (group_key) { /* group key */ +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set group key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set group key\n"); + /* group key */ + rtlpriv->sec.group_enc_algorithm = key_type; + /*set local buf about group key. */ +@@ -1650,8 +1650,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + rtlpriv->sec.key_len[key_idx] = key->keylen; + memcpy(mac_addr, bcast_addr, ETH_ALEN); + } else { /* pairwise key */ +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set pairwise key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set pairwise key\n"); + if (!sta) { + WARN_ONCE(true, + "rtlwifi: pairwise key without mac_addr\n"); +@@ -1683,8 +1683,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX; + break; + case DISABLE_KEY: +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "disable key delete one entry\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "disable key delete one entry\n"); + /*set local buf about wep key. */ + if (vif->type == NL80211_IFTYPE_AP || + vif->type == NL80211_IFTYPE_MESH_POINT) { +@@ -1732,9 +1732,9 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw) + if (unlikely(radio_state != rtlpriv->rfkill.rfkill_state)) { + rtlpriv->rfkill.rfkill_state = radio_state; + +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "wireless radio switch turned %s\n", +- radio_state ? "on" : "off"); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "wireless radio switch turned %s\n", ++ radio_state ? "on" : "off"); + + blocked = (rtlpriv->rfkill.rfkill_state == 1) ? 0 : 1; + wiphy_rfkill_set_hw_state(hw->wiphy, blocked); +@@ -1779,26 +1779,27 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + + do { + cfg_cmd = pwrcfgcmd[ary_idx]; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "rtl_hal_pwrseqcmdparsing(): offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n", +- GET_PWR_CFG_OFFSET(cfg_cmd), +- GET_PWR_CFG_CUT_MASK(cfg_cmd), +- GET_PWR_CFG_FAB_MASK(cfg_cmd), +- GET_PWR_CFG_INTF_MASK(cfg_cmd), +- GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd), +- GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd)); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s: offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n", ++ __func__, ++ GET_PWR_CFG_OFFSET(cfg_cmd), ++ GET_PWR_CFG_CUT_MASK(cfg_cmd), ++ GET_PWR_CFG_FAB_MASK(cfg_cmd), ++ GET_PWR_CFG_INTF_MASK(cfg_cmd), ++ GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd), ++ GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd)); + + if ((GET_PWR_CFG_FAB_MASK(cfg_cmd)&faversion) && + (GET_PWR_CFG_CUT_MASK(cfg_cmd)&cut_version) && + (GET_PWR_CFG_INTF_MASK(cfg_cmd)&interface_type)) { + switch (GET_PWR_CFG_CMD(cfg_cmd)) { + case PWR_CMD_READ: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, + "rtl_hal_pwrseqcmdparsing(): PWR_CMD_READ\n"); + break; + case PWR_CMD_WRITE: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "%s(): PWR_CMD_WRITE\n", __func__); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s(): PWR_CMD_WRITE\n", __func__); + offset = GET_PWR_CFG_OFFSET(cfg_cmd); + + /*Read the value from system register*/ +@@ -1811,7 +1812,7 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + rtl_write_byte(rtlpriv, offset, value); + break; + case PWR_CMD_POLLING: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, + "rtl_hal_pwrseqcmdparsing(): PWR_CMD_POLLING\n"); + polling_bit = false; + offset = GET_PWR_CFG_OFFSET(cfg_cmd); +@@ -1832,8 +1833,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + } while (!polling_bit); + break; + case PWR_CMD_DELAY: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_DELAY\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s: PWR_CMD_DELAY\n", __func__); + if (GET_PWR_CFG_VALUE(cfg_cmd) == + PWRSEQ_DELAY_US) + udelay(GET_PWR_CFG_OFFSET(cfg_cmd)); +@@ -1841,8 +1842,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + mdelay(GET_PWR_CFG_OFFSET(cfg_cmd)); + break; + case PWR_CMD_END: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_END\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s: PWR_CMD_END\n", __func__); + return true; + default: + WARN_ONCE(true, +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index 474439fc2da1f..cead66f7eb9f5 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -425,8 +425,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + &path, &addr, &bitmask, &data); + + if (num != 4) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, +- "Format is \n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, ++ "Format is \n"); + return count; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c +index 9729e51fce381..5d8995097ee79 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c ++++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c +@@ -160,8 +160,8 @@ void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value) + const u32 efuse_len = + rtlpriv->cfg->maps[EFUSE_REAL_CONTENT_SIZE]; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n", +- address, value); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n", ++ address, value); + + if (address < efuse_len) { + rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL], value); +@@ -251,9 +251,9 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf) + u8 efuse_usage; + + if ((_offset + _size_byte) > rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]) { +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "read_efuse(): Invalid offset(%#x) with read bytes(%#x)!!\n", +- _offset, _size_byte); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "%s: Invalid offset(%#x) with read bytes(%#x)!!\n", ++ __func__, _offset, _size_byte); + return; + } + +@@ -416,9 +416,9 @@ bool efuse_shadow_update_chk(struct ieee80211_hw *hw) + (EFUSE_MAX_SIZE - rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) + result = false; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "efuse_shadow_update_chk(): totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n", +- totalbytes, hdr_num, words_need, efuse_used); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "%s: totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n", ++ __func__, totalbytes, hdr_num, words_need, efuse_used); + + return result; + } +@@ -456,7 +456,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + u8 word_en = 0x0F; + u8 first_pg = false; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); + + if (!efuse_shadow_update_chk(hw)) { + efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]); +@@ -464,8 +464,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + &rtlefuse->efuse_map[EFUSE_INIT_MAP][0], + rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]); + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "efuse out of capacity!!\n"); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "efuse out of capacity!!\n"); + return false; + } + efuse_power_switch(hw, true, true); +@@ -503,8 +503,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + + if (!efuse_pg_packet_write(hw, (u8) offset, word_en, + tmpdata)) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "PG section(%#x) fail!!\n", offset); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "PG section(%#x) fail!!\n", offset); + break; + } + } +@@ -518,7 +518,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + &rtlefuse->efuse_map[EFUSE_INIT_MAP][0], + rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]); + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); + return true; + } + +@@ -656,8 +656,8 @@ static int efuse_one_byte_write(struct ieee80211_hw *hw, u16 addr, u8 data) + struct rtl_priv *rtlpriv = rtl_priv(hw); + u8 tmpidx = 0; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "Addr = %x Data=%x\n", addr, data); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "Addr = %x Data=%x\n", addr, data); + + rtl_write_byte(rtlpriv, + rtlpriv->cfg->maps[EFUSE_CTRL] + 1, (u8) (addr & 0xff)); +@@ -1036,8 +1036,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw, + + if (efuse_addr >= (EFUSE_MAX_SIZE - + rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) { +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "efuse_addr(%#x) Out of size!!\n", efuse_addr); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "efuse_addr(%#x) Out of size!!\n", efuse_addr); + } + + return true; +@@ -1077,8 +1077,8 @@ static u8 enable_efuse_data_write(struct ieee80211_hw *hw, + u8 tmpdata[8]; + + memset(tmpdata, 0xff, PGPKT_DATA_SIZE); +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "word_en = %x efuse_addr=%x\n", word_en, efuse_addr); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "word_en = %x efuse_addr=%x\n", word_en, efuse_addr); + + if (!(word_en & BIT(0))) { + tmpaddr = start_addr; +@@ -1281,11 +1281,11 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv, + + eeprom_id = *((u16 *)&hwinfo[0]); + if (eeprom_id != params[0]) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "EEPROM ID(%#x) is invalid!!\n", eeprom_id); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "EEPROM ID(%#x) is invalid!!\n", eeprom_id); + rtlefuse->autoload_failflag = true; + } else { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); + rtlefuse->autoload_failflag = false; + } + +@@ -1296,30 +1296,30 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv, + rtlefuse->eeprom_did = *(u16 *)&hwinfo[params[2]]; + rtlefuse->eeprom_svid = *(u16 *)&hwinfo[params[3]]; + rtlefuse->eeprom_smid = *(u16 *)&hwinfo[params[4]]; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROMId = 0x%4x\n", eeprom_id); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROMId = 0x%4x\n", eeprom_id); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid); + + for (i = 0; i < 6; i += 2) { + usvalue = *(u16 *)&hwinfo[params[5] + i]; + *((u16 *)(&rtlefuse->dev_addr[i])) = usvalue; + } +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr); + + rtlefuse->eeprom_channelplan = *&hwinfo[params[6]]; + rtlefuse->eeprom_version = *(u16 *)&hwinfo[params[7]]; + rtlefuse->txpwr_fromeprom = true; + rtlefuse->eeprom_oemid = *&hwinfo[params[8]]; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid); + + /* set channel plan to world wide 13 */ + rtlefuse->channel_plan = params[9]; +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 8bda1104bda85..0d22bd300f049 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -226,8 +226,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw) + return; + + if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE, +- "PCI(Bridge) UNKNOWN\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE, ++ "PCI(Bridge) UNKNOWN\n"); + + return; + } +@@ -276,8 +276,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) + return; + + if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE, +- "PCI(Bridge) UNKNOWN\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE, ++ "PCI(Bridge) UNKNOWN\n"); + return; + } + +@@ -293,10 +293,10 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) + pci_write_config_byte(rtlpci->pdev, (num4bytes << 2), + u_pcibridge_aspmsetting); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "PlatformEnableASPM(): Write reg[%x] = %x\n", +- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10), +- u_pcibridge_aspmsetting); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "PlatformEnableASPM(): Write reg[%x] = %x\n", ++ (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10), ++ u_pcibridge_aspmsetting); + + udelay(50); + +@@ -353,11 +353,11 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list, + list) { + tpcipriv = (struct rtl_pci_priv *)tpriv->priv; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "pcipriv->ndis_adapter.funcnumber %x\n", ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "pcipriv->ndis_adapter.funcnumber %x\n", + pcipriv->ndis_adapter.funcnumber); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "tpcipriv->ndis_adapter.funcnumber %x\n", ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "tpcipriv->ndis_adapter.funcnumber %x\n", + tpcipriv->ndis_adapter.funcnumber); + + if (pcipriv->ndis_adapter.busnumber == +@@ -372,8 +372,8 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + } + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "find_buddy_priv %d\n", find_buddy_priv); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "find_buddy_priv %d\n", find_buddy_priv); + + if (find_buddy_priv) + *buddy_priv = tpriv; +@@ -410,8 +410,8 @@ static void rtl_pci_parse_configuration(struct pci_dev *pdev, + pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &linkctrl_reg); + pcipriv->ndis_adapter.linkctrl_reg = (u8)linkctrl_reg; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n", +- pcipriv->ndis_adapter.linkctrl_reg); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n", ++ pcipriv->ndis_adapter.linkctrl_reg); + + pci_read_config_byte(pdev, 0x98, &tmp); + tmp |= BIT(4); +@@ -579,11 +579,11 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio) + if (rtlpriv->rtlhal.earlymode_enable) + skb_pull(skb, EM_HDR_LEN); + +- RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE, +- "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n", +- ring->idx, +- skb_queue_len(&ring->queue), +- *(u16 *)(skb->data + 22)); ++ rtl_dbg(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE, ++ "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n", ++ ring->idx, ++ skb_queue_len(&ring->queue), ++ *(u16 *)(skb->data + 22)); + + if (prio == TXCMD_QUEUE) { + dev_kfree_skb(skb); +@@ -630,10 +630,10 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio) + } + + if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, +- "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n", +- prio, ring->idx, +- skb_queue_len(&ring->queue)); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, ++ "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n", ++ prio, ring->idx, ++ skb_queue_len(&ring->queue)); + + ieee80211_wake_queue(hw, skb_get_queue_mapping(skb)); + } +@@ -823,9 +823,9 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) + skb_reserve(skb, stats.rx_drvinfo_size + + stats.rx_bufshift); + } else { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "skb->end - skb->tail = %d, len is %d\n", +- skb->end - skb->tail, len); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "skb->end - skb->tail = %d, len is %d\n", ++ skb->end - skb->tail, len); + dev_kfree_skb_any(skb); + goto new_trx_end; + } +@@ -946,67 +946,67 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + + /*<1> beacon related */ + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDOK]) +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "beacon ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "beacon ok interrupt!\n"); + + if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDER])) +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "beacon err interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "beacon err interrupt!\n"); + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BDOK]) +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n"); + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BCNINT]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "prepare beacon for interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "prepare beacon for interrupt!\n"); + tasklet_schedule(&rtlpriv->works.irq_prepare_bcn_tasklet); + } + + /*<2> Tx related */ + if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_TXFOVW])) +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n"); + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_MGNTDOK]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "Manage ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "Manage ok interrupt!\n"); + _rtl_pci_tx_isr(hw, MGNT_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_HIGHDOK]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "HIGH_QUEUE ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "HIGH_QUEUE ok interrupt!\n"); + _rtl_pci_tx_isr(hw, HIGH_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BKDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "BK Tx OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "BK Tx OK interrupt!\n"); + _rtl_pci_tx_isr(hw, BK_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BEDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "BE TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "BE TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, BE_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VIDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "VI TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "VI TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, VI_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VODOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "Vo TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "Vo TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, VO_QUEUE); + } + +@@ -1014,8 +1014,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + if (intvec.intd & rtlpriv->cfg->maps[RTL_IMR_H2CDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "H2C TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "H2C TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, H2C_QUEUE); + } + } +@@ -1024,34 +1024,34 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_COMDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "CMD TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "CMD TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, TXCMD_QUEUE); + } + } + + /*<3> Rx related */ + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_ROK]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n"); + _rtl_pci_rx_interrupt(hw); + } + + if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_RDU])) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "rx descriptor unavailable!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "rx descriptor unavailable!\n"); + _rtl_pci_rx_interrupt(hw); + } + + if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_RXFOVW])) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n"); + _rtl_pci_rx_interrupt(hw); + } + + /*<4> fw related*/ + if (rtlhal->hw_type == HARDWARE_TYPE_RTL8723AE) { + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_C2HCMD]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "firmware interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "firmware interrupt!\n"); + queue_delayed_work(rtlpriv->works.rtl_wq, + &rtlpriv->works.fwevt_wq, 0); + } +@@ -1067,8 +1067,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + rtlhal->hw_type == HARDWARE_TYPE_RTL8723BE) { + if (unlikely(intvec.inta & + rtlpriv->cfg->maps[RTL_IMR_HSISR_IND])) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "hsisr interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "hsisr interrupt!\n"); + _rtl_pci_hs_interrupt(hw); + } + } +@@ -1272,8 +1272,8 @@ static int _rtl_pci_init_tx_ring(struct ieee80211_hw *hw, + rtlpci->tx_ring[prio].entries = entries; + skb_queue_head_init(&rtlpci->tx_ring[prio].queue); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n", +- prio, desc); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n", ++ prio, desc); + + /* init every desc in this ring */ + if (!rtlpriv->use_new_trx_flow) { +@@ -1670,10 +1670,10 @@ static int rtl_pci_tx(struct ieee80211_hw *hw, + true, HW_DESC_OWN); + + if (own == 1 && hw_queue != BEACON_QUEUE) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", +- hw_queue, ring->idx, idx, +- skb_queue_len(&ring->queue)); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", ++ hw_queue, ring->idx, idx, ++ skb_queue_len(&ring->queue)); + + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, + flags); +@@ -1683,8 +1683,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw, + + if (rtlpriv->cfg->ops->get_available_desc && + rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "get_available_desc fail\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "get_available_desc fail\n"); + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); + return skb->len; + } +@@ -1707,8 +1707,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw, + + if ((ring->entries - skb_queue_len(&ring->queue)) < 2 && + hw_queue != BEACON_QUEUE) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD, +- "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, ++ "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", + hw_queue, ring->idx, idx, + skb_queue_len(&ring->queue)); + +@@ -1815,8 +1815,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw) + + err = rtlpriv->cfg->ops->hw_init(hw); + if (err) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "Failed to config hardware!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "Failed to config hardware!\n"); + kfree(rtlpriv->btcoexist.btc_context); + kfree(rtlpriv->btcoexist.wifi_only_context); + return err; +@@ -1825,7 +1825,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw) + &rtlmac->retry_long); + + rtlpriv->cfg->ops->enable_interrupt(hw); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n"); + + rtl_init_rx_config(hw); + +@@ -1836,7 +1836,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw) + + rtlpci->up_first_time = false; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__); + return 0; + } + +@@ -1930,71 +1930,71 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + deviceid == RTL_PCI_8171_DID) { + switch (revisionid) { + case RTL_PCI_REVISION_ID_8192PCIE: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192 PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192 PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + rtlhal->hw_type = HARDWARE_TYPE_RTL8192E; + return false; + case RTL_PCI_REVISION_ID_8192SE: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192SE is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192SE is found - vid/did=%x/%x\n", ++ venderid, deviceid); + rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE; + break; + default: +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "Err: Unknown device - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "Err: Unknown device - vid/did=%x/%x\n", ++ venderid, deviceid); + rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE; + break; + } + } else if (deviceid == RTL_PCI_8723AE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8723AE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8723AE PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8723AE PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + } else if (deviceid == RTL_PCI_8192CET_DID || + deviceid == RTL_PCI_8192CE_DID || + deviceid == RTL_PCI_8191CE_DID || + deviceid == RTL_PCI_8188CE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8192CE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192C PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192C PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + } else if (deviceid == RTL_PCI_8192DE_DID || + deviceid == RTL_PCI_8192DE_DID2) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8192DE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192D PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192D PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + } else if (deviceid == RTL_PCI_8188EE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8188EE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8188EE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8188EE\n"); + } else if (deviceid == RTL_PCI_8723BE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8723BE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8723BE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8723BE\n"); + } else if (deviceid == RTL_PCI_8192EE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8192EE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8192EE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8192EE\n"); + } else if (deviceid == RTL_PCI_8821AE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8821AE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8821AE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8821AE\n"); + } else if (deviceid == RTL_PCI_8812AE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8812AE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8812AE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8812AE\n"); + } else if (deviceid == RTL_PCI_8822BE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8822BE; + rtlhal->bandset = BAND_ON_BOTH; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8822BE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8822BE\n"); + } else { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "Err: Unknown device - vid/did=%x/%x\n", ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "Err: Unknown device - vid/did=%x/%x\n", + venderid, deviceid); + + rtlhal->hw_type = RTL_DEFAULT_HARDWARE_TYPE; +@@ -2003,17 +2003,17 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192DE) { + if (revisionid == 0 || revisionid == 1) { + if (revisionid == 0) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find 92DE MAC0\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find 92DE MAC0\n"); + rtlhal->interfaceindex = 0; + } else if (revisionid == 1) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find 92DE MAC1\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find 92DE MAC1\n"); + rtlhal->interfaceindex = 1; + } + } else { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n", ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n", + venderid, deviceid, revisionid); + rtlhal->interfaceindex = 0; + } +@@ -2047,9 +2047,9 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) { + if (bridge_pdev->vendor == pcibridge_vendors[tmp]) { + pcipriv->ndis_adapter.pcibridge_vendor = tmp; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "Pci Bridge Vendor is found index: %d\n", +- tmp); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "Pci Bridge Vendor is found index: %d\n", ++ tmp); + break; + } + } +@@ -2077,22 +2077,22 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + } + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n", +- pcipriv->ndis_adapter.busnumber, +- pcipriv->ndis_adapter.devnumber, +- pcipriv->ndis_adapter.funcnumber, +- pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n", ++ pcipriv->ndis_adapter.busnumber, ++ pcipriv->ndis_adapter.devnumber, ++ pcipriv->ndis_adapter.funcnumber, ++ pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n", +- pcipriv->ndis_adapter.pcibridge_busnum, +- pcipriv->ndis_adapter.pcibridge_devnum, +- pcipriv->ndis_adapter.pcibridge_funcnum, +- pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor], +- pcipriv->ndis_adapter.pcibridge_pciehdr_offset, +- pcipriv->ndis_adapter.pcibridge_linkctrlreg, +- pcipriv->ndis_adapter.amd_l1_patch); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n", ++ pcipriv->ndis_adapter.pcibridge_busnum, ++ pcipriv->ndis_adapter.pcibridge_devnum, ++ pcipriv->ndis_adapter.pcibridge_funcnum, ++ pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor], ++ pcipriv->ndis_adapter.pcibridge_pciehdr_offset, ++ pcipriv->ndis_adapter.pcibridge_linkctrlreg, ++ pcipriv->ndis_adapter.amd_l1_patch); + + rtl_pci_parse_configuration(pdev, hw); + list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list); +@@ -2120,8 +2120,8 @@ static int rtl_pci_intr_mode_msi(struct ieee80211_hw *hw) + + rtlpci->using_msi = true; + +- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, +- "MSI Interrupt Mode!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, ++ "MSI Interrupt Mode!\n"); + return 0; + } + +@@ -2138,8 +2138,8 @@ static int rtl_pci_intr_mode_legacy(struct ieee80211_hw *hw) + return ret; + + rtlpci->using_msi = false; +- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, +- "Pin-based Interrupt Mode!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, ++ "Pin-based Interrupt Mode!\n"); + return 0; + } + +@@ -2266,10 +2266,10 @@ int rtl_pci_probe(struct pci_dev *pdev, + goto fail2; + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n", +- pmem_start, pmem_len, pmem_flags, +- rtlpriv->io.pci_mem_start); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n", ++ pmem_start, pmem_len, pmem_flags, ++ rtlpriv->io.pci_mem_start); + + /* Disable Clk Request */ + pci_write_config_byte(pdev, 0x81, 0); +@@ -2331,9 +2331,9 @@ int rtl_pci_probe(struct pci_dev *pdev, + rtlpci = rtl_pcidev(pcipriv); + err = rtl_pci_intr_mode_decide(hw); + if (err) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "%s: failed to register IRQ handler\n", +- wiphy_name(hw->wiphy)); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "%s: failed to register IRQ handler\n", ++ wiphy_name(hw->wiphy)); + goto fail3; + } + rtlpci->irq_alloc = 1; +diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c +index 5f998ea2d5a67..102f0d0e1cd01 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/ps.c ++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c +@@ -41,8 +41,8 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw) + rtlpriv->intf_ops->reset_trx_ring(hw); + + if (is_hal_stop(rtlhal)) +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "Driver is already down!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "Driver is already down!\n"); + + /*<2> Enable Adapter */ + if (rtlpriv->cfg->ops->hw_init(hw)) +@@ -103,9 +103,9 @@ static bool rtl_ps_set_rf_state(struct ieee80211_hw *hw, + if (ppsc->rfchange_inprogress) { + spin_unlock(&rtlpriv->locks.rf_ps_lock); + +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "RF Change in progress! Wait to set..state_toset(%d).\n", +- state_toset); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "RF Change in progress! Wait to set..state_toset(%d).\n", ++ state_toset); + + /* Set RF after the previous action is done. */ + while (ppsc->rfchange_inprogress) { +@@ -217,8 +217,8 @@ void rtl_ips_nic_off_wq_callback(void *data) + enum rf_pwrstate rtstate; + + if (mac->opmode != NL80211_IFTYPE_STATION) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "not station return\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "not station return\n"); + return; + } + +@@ -254,8 +254,8 @@ void rtl_ips_nic_off_wq_callback(void *data) + !ppsc->swrf_processing && + (mac->link_state == MAC80211_NOLINK) && + !mac->act_scanning) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "IPSEnter(): Turn off RF\n"); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "IPSEnter(): Turn off RF\n"); + + ppsc->inactive_pwrstate = ERFOFF; + ppsc->in_powersavemode = true; +@@ -333,8 +333,8 @@ static bool rtl_get_fwlps_doze(struct ieee80211_hw *hw) + ppsc->last_delaylps_stamp_jiffies); + + if (ps_timediff < 2000) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n"); + return false; + } + +@@ -379,9 +379,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode) + + if ((ppsc->fwctrl_lps) && ppsc->report_linked) { + if (ppsc->dot11_psmode == EACTIVE) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "FW LPS leave ps_mode:%x\n", +- FW_PS_ACTIVE_MODE); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "FW LPS leave ps_mode:%x\n", ++ FW_PS_ACTIVE_MODE); + enter_fwlps = false; + ppsc->pwr_mode = FW_PS_ACTIVE_MODE; + ppsc->smart_ps = 0; +@@ -394,9 +394,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode) + rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode); + } else { + if (rtl_get_fwlps_doze(hw)) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "FW LPS enter ps_mode:%x\n", +- ppsc->fwctrl_psmode); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "FW LPS enter ps_mode:%x\n", ++ ppsc->fwctrl_psmode); + if (rtlpriv->cfg->ops->get_btc_status()) + rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode); + enter_fwlps = true; +@@ -446,8 +446,8 @@ static void rtl_lps_enter_core(struct ieee80211_hw *hw) + * bt_ccoexist may ask to enter lps. + * In normal case, this constraint move to rtl_lps_set_psmode(). + */ +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Enter 802.11 power save mode...\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Enter 802.11 power save mode...\n"); + rtl_lps_set_psmode(hw, EAUTOPS); + + mutex_unlock(&rtlpriv->locks.lps_mutex); +@@ -475,8 +475,8 @@ static void rtl_lps_leave_core(struct ieee80211_hw *hw) + RT_CLEAR_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM); + } + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Busy Traffic,Leave 802.11 power save..\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Busy Traffic,Leave 802.11 power save..\n"); + + rtl_lps_set_psmode(hw, EACTIVE); + } +@@ -560,8 +560,8 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len) + queue_delayed_work(rtlpriv->works.rtl_wq, + &rtlpriv->works.ps_work, MSECS(5)); + } else { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, +- "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, ++ "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed); + } + } + EXPORT_SYMBOL_GPL(rtl_swlps_beacon); +@@ -656,9 +656,9 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw) + /* this print should always be dtim_conter = 0 & + * sleep = dtim_period, that meaons, we should + * awake before every dtim */ +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, +- "dtim_counter:%x will sleep :%d beacon_intv\n", +- rtlpriv->psc.dtim_counter, sleep_intv); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, ++ "dtim_counter:%x will sleep :%d beacon_intv\n", ++ rtlpriv->psc.dtim_counter, sleep_intv); + + /* we tested that 40ms is enough for sw & hw sw delay */ + queue_delayed_work(rtlpriv->works.rtl_wq, &rtlpriv->works.ps_rfon_wq, +@@ -769,9 +769,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data, + if (ie[0] == 12) { + find_p2p_ps_ie = true; + if ((noa_len - 2) % 13 != 0) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "P2P notice of absence: invalid length.%d\n", +- noa_len); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "P2P notice of absence: invalid length.%d\n", ++ noa_len); + return; + } else { + noa_num = (noa_len - 2) / 13; +@@ -782,8 +782,8 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data, + noa_index = ie[3]; + if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode == + P2P_PS_NONE || noa_index != p2pinfo->noa_index) { +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "update NOA ie.\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "update NOA ie.\n"); + p2pinfo->noa_index = noa_index; + p2pinfo->opp_ps = (ie[4] >> 7); + p2pinfo->ctwindow = ie[4] & 0x7F; +@@ -854,7 +854,7 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data, + if (ie == NULL) + return; + +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n"); + /*to find noa ie*/ + while (ie + 1 < end) { + noa_len = READEF2BYTE((__le16 *)&ie[1]); +@@ -862,13 +862,13 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data, + return; + + if (ie[0] == 12) { +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n"); + RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_LOUD, "noa ie ", + ie, noa_len); + if ((noa_len - 2) % 13 != 0) { +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "P2P notice of absence: invalid length.%d\n", +- noa_len); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "P2P notice of absence: invalid length.%d\n", ++ noa_len); + return; + } else { + noa_num = (noa_len - 2) / 13; +@@ -926,7 +926,7 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state) + struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw)); + struct rtl_p2p_ps_info *p2pinfo = &(rtlpriv->psc.p2p_ps_info); + +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n" , p2p_ps_state); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n", p2p_ps_state); + switch (p2p_ps_state) { + case P2P_PS_DISABLE: + p2pinfo->p2p_ps_state = p2p_ps_state; +@@ -978,18 +978,18 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state) + default: + break; + } +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "ctwindow %x oppps %x\n", +- p2pinfo->ctwindow , p2pinfo->opp_ps); +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "count %x duration %x index %x interval %x start time %x noa num %x\n", +- p2pinfo->noa_count_type[0], +- p2pinfo->noa_duration[0], +- p2pinfo->noa_index, +- p2pinfo->noa_interval[0], +- p2pinfo->noa_start_time[0], +- p2pinfo->noa_num); +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "end\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "ctwindow %x oppps %x\n", ++ p2pinfo->ctwindow, p2pinfo->opp_ps); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "count %x duration %x index %x interval %x start time %x noa num %x\n", ++ p2pinfo->noa_count_type[0], ++ p2pinfo->noa_duration[0], ++ p2pinfo->noa_index, ++ p2pinfo->noa_interval[0], ++ p2pinfo->noa_start_time[0], ++ p2pinfo->noa_num); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "end\n"); + } + + void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len) +diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c +index 72ca370331fb4..f89f60ddfebe0 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/regd.c ++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c +@@ -434,13 +434,13 @@ int rtl_regd_init(struct ieee80211_hw *hw, + rtlpriv->regd.country_code = + channel_plan_to_country_code(rtlpriv->efuse.channel_plan); + +- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG, +- "rtl: EEPROM regdomain: 0x%0x country code: %d\n", +- rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG, ++ "rtl: EEPROM regdomain: 0x%0x country code: %d\n", ++ rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code); + + if (rtlpriv->regd.country_code >= COUNTRY_CODE_MAX) { +- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG, +- "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n"); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG, ++ "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n"); + + rtlpriv->regd.country_code = COUNTRY_CODE_WORLD_WIDE_13; + } +@@ -455,9 +455,9 @@ int rtl_regd_init(struct ieee80211_hw *hw, + rtlpriv->regd.alpha2[1] = '0'; + } + +- RT_TRACE(rtlpriv, COMP_REGD, DBG_TRACE, +- "rtl: Country alpha2 being used: %c%c\n", +- rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_TRACE, ++ "rtl: Country alpha2 being used: %c%c\n", ++ rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]); + + _rtl_regd_init_wiphy(&rtlpriv->regd, wiphy, reg_notifier); + +@@ -469,7 +469,7 @@ void rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request) + struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy); + struct rtl_priv *rtlpriv = rtl_priv(hw); + +- RT_TRACE(rtlpriv, COMP_REGD, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_LOUD, "\n"); + + _rtl_reg_notifier_apply(wiphy, request, &rtlpriv->regd); + } +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 395671383ca93..35ebbd8ca9caf 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -282,14 +282,14 @@ static int _rtl_usb_init_tx(struct ieee80211_hw *hw) + ? USB_HIGH_SPEED_BULK_SIZE + : USB_FULL_SPEED_BULK_SIZE; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n", +- rtlusb->max_bulk_out_size); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n", ++ rtlusb->max_bulk_out_size); + + for (i = 0; i < __RTL_TXQ_NUM; i++) { + u32 ep_num = rtlusb->ep_map.ep_mapping[i]; + if (!ep_num) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "Invalid endpoint map setting!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "Invalid endpoint map setting!\n"); + return -EINVAL; + } + } +@@ -358,10 +358,10 @@ static int _rtl_usb_init(struct ieee80211_hw *hw) + else if (usb_endpoint_dir_out(pep_desc)) + rtlusb->out_ep_nums++; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n", +- pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize, +- pep_desc->bInterval); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n", ++ pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize, ++ pep_desc->bInterval); + } + if (rtlusb->in_ep_nums < rtlpriv->cfg->usb_interface_cfg->in_ep_num) { + pr_err("Too few input end points found\n"); +@@ -960,7 +960,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, + + memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc)); + if (ieee80211_is_auth(fc)) { +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); + } + + if (rtlpriv->psc.sw_ps_enabled) { +-- +2.39.2 + diff --git a/queue-4.19/rtlwifi-rtl_pci-fix-memory-leak-when-hardware-init-f.patch b/queue-4.19/rtlwifi-rtl_pci-fix-memory-leak-when-hardware-init-f.patch new file mode 100644 index 00000000000..38868456f51 --- /dev/null +++ b/queue-4.19/rtlwifi-rtl_pci-fix-memory-leak-when-hardware-init-f.patch @@ -0,0 +1,38 @@ +From c6b3a45aa4d7ffbb188e333a947b37bdecf48b55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Aug 2019 17:03:44 -0500 +Subject: rtlwifi: rtl_pci: Fix memory leak when hardware init fails + +From: Larry Finger + +[ Upstream commit 8cc782cd997dc4eb3ac183228d563727884ba874 ] + +If the call to hw_init() fails for any of the drivers, the driver will +leak memory that was allocated in BT coexistence setup. Technically, each +of the drivers should have done this free; however placing it in rtl_pci +fixes all the drivers with only a single patch. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 83749578fa8b3..8bda1104bda85 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -1817,6 +1817,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw) + if (err) { + RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, + "Failed to config hardware!\n"); ++ kfree(rtlpriv->btcoexist.btc_context); ++ kfree(rtlpriv->btcoexist.wifi_only_context); + return err; + } + rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RETRY_LIMIT, +-- +2.39.2 + diff --git a/queue-4.19/rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch b/queue-4.19/rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch new file mode 100644 index 00000000000..5211d47a0fa --- /dev/null +++ b/queue-4.19/rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch @@ -0,0 +1,56 @@ +From d2c9c3b66bbe13631840a23cf2c643376e43db7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 15:42:30 -0500 +Subject: rtlwifi: Start changing RT_TRACE into rtl_dbg + +From: Larry Finger + +[ Upstream commit 78a7245d84300cd616dbce26e6fc42a039a62279 ] + +The macro name RT_TRACE makes it seem that it is used for tracing, when +is actually used for debugging. Change the name to RT_DEBUG. + +This step creates the new macro while keeping the old RT_TRACE to allow +building. It will be removed at the end of the patch series. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200723204244.24457-2-Larry.Finger@lwfinger.net +Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.h b/drivers/net/wireless/realtek/rtlwifi/debug.h +index ad6834af618b4..14f822afc89ac 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.h ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.h +@@ -181,6 +181,10 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level, + const char *titlestring, + const void *hexdata, int hexdatalen); + ++#define rtl_dbg(rtlpriv, comp, level, fmt, ...) \ ++ _rtl_dbg_trace(rtlpriv, comp, level, \ ++ fmt, ##__VA_ARGS__) ++ + #define RT_TRACE(rtlpriv, comp, level, fmt, ...) \ + _rtl_dbg_trace(rtlpriv, comp, level, \ + fmt, ##__VA_ARGS__) +@@ -197,6 +201,13 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level, + + struct rtl_priv; + ++__printf(4, 5) ++static inline void rtl_dbg(struct rtl_priv *rtlpriv, ++ u64 comp, int level, ++ const char *fmt, ...) ++{ ++} ++ + __printf(4, 5) + static inline void RT_TRACE(struct rtl_priv *rtlpriv, + u64 comp, int level, +-- +2.39.2 + diff --git a/queue-4.19/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch b/queue-4.19/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch new file mode 100644 index 00000000000..172b8da2b02 --- /dev/null +++ b/queue-4.19/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch @@ -0,0 +1,77 @@ +From 0a7e86091ddd70d1afa6349a618b0a5cee9252b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 12:32:11 +0100 +Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC + +From: Alexander Mikhalitsyn + +[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ] + +Currently, kernel would set MSG_CTRUNC flag if msg_control buffer +wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS. + +For some reason we have no corresponding check for SO_PASSSEC. + +In the recvmsg(2) doc we have: + MSG_CTRUNC + indicates that some control data was discarded due to lack + of space in the buffer for ancillary data. + +So, we need to set MSG_CTRUNC flag for all types of SCM. + +This change can break applications those don't check MSG_CTRUNC flag. + +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Leon Romanovsky +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Alexander Mikhalitsyn + +v2: +- commit message was rewritten according to Eric's suggestion +Acked-by: Paul Moore + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/scm.h | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/include/net/scm.h b/include/net/scm.h +index 1ce365f4c2560..585adc1346bd0 100644 +--- a/include/net/scm.h ++++ b/include/net/scm.h +@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc + } + } + } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return test_bit(SOCK_PASSSEC, &sock->flags); ++} + #else + static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) + { } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return false; ++} + #endif /* CONFIG_SECURITY_NETWORK */ + + static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, + struct scm_cookie *scm, int flags) + { + if (!msg->msg_control) { +- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) ++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp || ++ scm_has_secdata(sock)) + msg->msg_flags |= MSG_CTRUNC; + scm_destroy(scm); + return; +-- +2.39.2 + diff --git a/queue-4.19/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch b/queue-4.19/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch new file mode 100644 index 00000000000..56ae3ced22e --- /dev/null +++ b/queue-4.19/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch @@ -0,0 +1,38 @@ +From a470ed047c99624268df95c13f542acc0dd6566f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 17:51:09 +0000 +Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS + +From: Danila Chernetsov + +[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ] + +When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is +dereferenced below. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling") +Signed-off-by: Danila Chernetsov +Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c +index 7352d46ebb093..44d648baabd87 100644 +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -1444,6 +1444,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status) + */ + if (cmdid == CMDID_INT_CMDS) { + scb = &adapter->int_scb; ++ cmd = scb->cmd; + + list_del_init(&scb->list); + scb->state = SCB_FREE; +-- +2.39.2 + diff --git a/queue-4.19/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch b/queue-4.19/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch new file mode 100644 index 00000000000..0461470bb59 --- /dev/null +++ b/queue-4.19/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch @@ -0,0 +1,67 @@ +From 0a097e20ab61b57f60ef80370f83101389a5bb56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:19 -0500 +Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup + +From: Mike Christie + +[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ] + +Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort +fabric stop race"). + +If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the +last put on the cmd and free it, because the connection is down and we will +not up sending the response and doing the put from the normal I/O +path. + +Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now +detect this case and run iscsit_free_cmd(). + +Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race") +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 58ccded1be857..7738e249c4a24 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4056,9 +4056,12 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + +- if (se_cmd->se_tfo != NULL) { +- spin_lock_irq(&se_cmd->t_state_lock); +- if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!se_cmd->se_tfo) ++ continue; ++ ++ spin_lock_irq(&se_cmd->t_state_lock); ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!(se_cmd->transport_state & CMD_T_TAS)) + /* + * LIO's abort path owns the cleanup for this, + * so put it back on the list and let +@@ -4066,11 +4069,10 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + */ + list_move_tail(&cmd->i_conn_node, + &conn->conn_cmd_list); +- } else { +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; +- } +- spin_unlock_irq(&se_cmd->t_state_lock); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; + } ++ spin_unlock_irq(&se_cmd->t_state_lock); + } + spin_unlock_bh(&conn->cmd_lock); + +-- +2.39.2 + diff --git a/queue-4.19/selinux-ensure-av_permissions.h-is-built-when-needed.patch b/queue-4.19/selinux-ensure-av_permissions.h-is-built-when-needed.patch new file mode 100644 index 00000000000..1e13bc4b9b6 --- /dev/null +++ b/queue-4.19/selinux-ensure-av_permissions.h-is-built-when-needed.patch @@ -0,0 +1,36 @@ +From 98a247b368ef15b2338fd2e08b04d4fd76b05039 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:29:11 -0400 +Subject: selinux: ensure av_permissions.h is built when needed + +From: Paul Moore + +[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ] + +The Makefile rule responsible for building flask.h and +av_permissions.h only lists flask.h as a target which means that +av_permissions.h is only generated when flask.h needs to be +generated. This patch fixes this by adding av_permissions.h as a +target to the rule. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index 3efb0dda95b55..08ba8ca81d403 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -22,5 +22,5 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h + cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE ++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-4.19/selinux-fix-makefile-dependencies-of-flask.h.patch b/queue-4.19/selinux-fix-makefile-dependencies-of-flask.h.patch new file mode 100644 index 00000000000..ce8f49c1460 --- /dev/null +++ b/queue-4.19/selinux-fix-makefile-dependencies-of-flask.h.patch @@ -0,0 +1,43 @@ +From 4774f58e8b412d87595b1403a73c31923f309598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 15:59:19 +0200 +Subject: selinux: fix Makefile dependencies of flask.h + +From: Ondrej Mosnacek + +[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ] + +Make the flask.h target depend on the genheaders binary instead of +classmap.h to ensure that it is rebuilt if any of the dependencies of +genheaders are changed. + +Notably this fixes flask.h not being rebuilt when +initial_sid_to_string.h is modified. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Ondrej Mosnacek +Acked-by: Stephen Smalley +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index c7161f8792b2d..3efb0dda95b55 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -19,8 +19,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include + $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h + + quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h +- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h ++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: $(src)/include/classmap.h FORCE ++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-4.19/serial-8250-add-missing-wakeup-event-reporting.patch b/queue-4.19/serial-8250-add-missing-wakeup-event-reporting.patch new file mode 100644 index 00000000000..0721699859c --- /dev/null +++ b/queue-4.19/serial-8250-add-missing-wakeup-event-reporting.patch @@ -0,0 +1,53 @@ +From a310e3e70667b1219bc3826a61463b4dfd8ed56d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 10:02:39 -0700 +Subject: serial: 8250: Add missing wakeup event reporting + +From: Florian Fainelli + +[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ] + +An 8250 UART configured as a wake-up source would not have reported +itself through sysfs as being the source of wake-up, correct that. + +Fixes: b3b708fa2780 ("wake up from a serial port") +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index ce266e10a21e0..81574efff3c1c 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1885,6 +1886,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + unsigned char status; + unsigned long flags; + struct uart_8250_port *up = up_to_u8250p(port); ++ struct tty_port *tport = &port->state->port; + bool skip_rx = false; + + if (iir & UART_IIR_NO_INT) +@@ -1908,6 +1910,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + skip_rx = true; + + if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) { ++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) ++ pm_wakeup_event(tport->tty->dev, 0); + if (!up->dma || handle_rx_dma(up, iir)) + status = serial8250_rx_chars(up, status); + } +-- +2.39.2 + diff --git a/queue-4.19/series b/queue-4.19/series index 5f4a4562b99..6d093b623b1 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,106 @@ revert-ubifs-dirty_cow_znode-fix-memleak-in-error-handling-path.patch ubifs-fix-memleak-when-insert_old_idx-failed.patch ubi-fix-return-value-overwrite-issue-in-try_write_vid_and_data.patch ubifs-free-memory-for-tmpfile-name.patch +selinux-fix-makefile-dependencies-of-flask.h.patch +selinux-ensure-av_permissions.h-is-built-when-needed.patch +drm-rockchip-drop-unbalanced-obj-unref.patch +drm-vgem-add-missing-mutex_destroy.patch +drm-probe-helper-cancel-previous-job-before-starting.patch +edac-skx-move-debugfs-node-under-edac-s-hierarchy.patch +edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch +arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch +media-bdisp-add-missing-check-for-create_workqueue.patch +media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch +media-av7110-prevent-underflow-in-write_ts_to_decode.patch +firmware-qcom_scm-clear-download-bit-during-reboot.patch +drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch +drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch +x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch +media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch +media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch +media-rcar_fdp1-fix-the-correct-variable-assignments.patch +media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch +media-rc-gpio-ir-recv-fix-support-for-wake-up.patch +x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch +arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch +debugobjects-add-percpu-free-pools.patch +debugobjects-move-printk-out-of-db-lock-critical-sec.patch +debugobject-prevent-init-race-with-static-objects.patch +wifi-ath6kl-minor-fix-for-allocation-size.patch +wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch +wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch +wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch +tools-bpftool-remove-invalid-json-escape.patch +scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch +vlan-partially-enable-siocshwtstamp-in-container.patch +net-packet-convert-po-origdev-to-an-atomic-flag.patch +net-packet-convert-po-auxdata-to-an-atomic-flag.patch +scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch +scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch +rtlwifi-rtl_pci-fix-memory-leak-when-hardware-init-f.patch +rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch +rtlwifi-replace-rt_trace-with-rtl_dbg.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-14890 +bpftool-fix-bug-for-long-instructions-in-program-cfg.patch +crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch +crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch +md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch +md-raid10-fix-memleak-for-conf-bio_split.patch +md-update-the-optimal-i-o-size-on-reshape.patch +md-raid10-fix-memleak-of-md-thread.patch +wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch +wifi-iwlwifi-mvm-check-firmware-response-size.patch +ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch +ixgbe-enable-setting-rss-table-to-default-values.patch +netfilter-nf_tables-don-t-write-table-validation-sta.patch +ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch +revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch +netlink-use-copy_to_user-for-optval-in-netlink_getso.patch +net-amd-fix-link-leak-when-verifying-config-failed.patch +tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch +pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch +usb-host-xhci-rcar-remove-leftover-quirk-handling.patch +fpga-bridge-fix-kernel-doc-parameter-description.patch +usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch +linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch +spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch +spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch +spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch +vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch +of-fix-modalias-string-generation.patch +ia64-mm-contig-fix-section-mismatch-warning-error.patch +ia64-salinfo-placate-defined-but-not-used-warning.patch +mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch +mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch +mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch +spi-cadence-quadspi-fix-suspend-resume-implementatio.patch +uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch +sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch +usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch +tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch +serial-8250-add-missing-wakeup-event-reporting.patch +staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch +spmi-add-a-check-for-remove-callback-when-removing-a.patch +spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch +macintosh-windfarm_smu_sat-add-missing-of_node_put.patch +powerpc-mpc512x-fix-resource-printk-format-warning.patch +powerpc-wii-fix-resource-printk-format-warnings.patch +powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch +macintosh-via-pmu-led-requires-ata-to-be-set.patch +powerpc-rtas-use-memmove-for-potentially-overlapping.patch +perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch +rdma-rdmavt-delete-unnecessary-null-check.patch +rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch +power-supply-generic-adc-battery-fix-unit-scaling.patch +clk-add-missing-of_node_put-in-assigned-clocks-prope.patch +ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch +nfsv4.1-always-send-a-reclaim_complete-after-establi.patch +sunrpc-remove-the-maximum-number-of-retries-in-call_.patch +rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch +openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch +pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch +pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch +pwm-mtk-disp-disable-shadow-registers-before-setting.patch +phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch +dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch diff --git a/queue-4.19/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch b/queue-4.19/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch new file mode 100644 index 00000000000..d18bef59216 --- /dev/null +++ b/queue-4.19/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch @@ -0,0 +1,44 @@ +From 0245c1f065774156ec2d3be954c5c1cfcd408e68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 13:48:52 +0200 +Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer + +From: John Paul Adrian Glaubitz + +[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ] + +The Store Queue code allocates a bitmap buffer with the size of +multiple of sizeof(long) in sq_api_init(). While the buffer size +is calculated correctly, the code uses the wrong element size to +allocate the buffer which results in the allocated bitmap buffer +being too small. + +Fix this by allocating the buffer with kcalloc() with element size +sizeof(long) instead of kzalloc() whose elements size defaults to +sizeof(char). + +Fixes: d7c30c682a27 ("sh: Store Queue API rework.") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh4/sq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c +index 4ca78ed71ad2c..c218bae8fe208 100644 +--- a/arch/sh/kernel/cpu/sh4/sq.c ++++ b/arch/sh/kernel/cpu/sh4/sq.c +@@ -383,7 +383,7 @@ static int __init sq_api_init(void) + if (unlikely(!sq_cache)) + return ret; + +- sq_bitmap = kzalloc(size, GFP_KERNEL); ++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL); + if (unlikely(!sq_bitmap)) + goto out; + +-- +2.39.2 + diff --git a/queue-4.19/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch b/queue-4.19/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch new file mode 100644 index 00000000000..2e566d9a533 --- /dev/null +++ b/queue-4.19/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch @@ -0,0 +1,48 @@ +From 77c742edaec6bb38b0da9ad55dc7289d5b2f5ada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 17:46:15 +0530 +Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation + +From: Dhruva Gole + +[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ] + +Get rid of conditional compilation based on CONFIG_PM_SLEEP because +it may introduce build issues with certain configs where it maybe disabled +This is because if above config is not enabled the suspend-resume +functions are never part of the code but the bcm63xx_spi_pm_ops struct +still inits them to non-existent suspend-resume functions. + +Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") + +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c +index bfe5754768f97..c7b67388709fe 100644 +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -625,7 +625,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev) + return 0; + } + +-#ifdef CONFIG_PM_SLEEP + static int bcm63xx_spi_suspend(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); +@@ -652,7 +651,6 @@ static int bcm63xx_spi_resume(struct device *dev) + + return 0; + } +-#endif + + static const struct dev_pm_ops bcm63xx_spi_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume) +-- +2.39.2 + diff --git a/queue-4.19/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch b/queue-4.19/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch new file mode 100644 index 00000000000..cdffe8258b2 --- /dev/null +++ b/queue-4.19/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch @@ -0,0 +1,68 @@ +From e380b260536d81580a132fb28def11c951a37f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 14:40:27 +0530 +Subject: spi: cadence-quadspi: fix suspend-resume implementations + +From: Dhruva Gole + +[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ] + +The cadence QSPI driver misbehaves after performing a full system suspend +resume: +... +spi-nor spi0.0: resume() failed +... +This results in a flash connected via OSPI interface after system suspend- +resume to be unusable. +fix these suspend and resume functions. + +Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 16ac2e3c351df..d5c6b91fd1139 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -1412,17 +1412,30 @@ static int cqspi_remove(struct platform_device *pdev) + static int cqspi_suspend(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); ++ int ret; + ++ ret = spi_master_suspend(master); + cqspi_controller_enable(cqspi, 0); +- return 0; ++ ++ clk_disable_unprepare(cqspi->clk); ++ ++ return ret; + } + + static int cqspi_resume(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); + +- cqspi_controller_enable(cqspi, 1); +- return 0; ++ clk_prepare_enable(cqspi->clk); ++ cqspi_wait_idle(cqspi); ++ cqspi_controller_init(cqspi); ++ ++ cqspi->current_cs = -1; ++ cqspi->sclk = 0; ++ ++ return spi_master_resume(master); + } + + static const struct dev_pm_ops cqspi__dev_pm_ops = { +-- +2.39.2 + diff --git a/queue-4.19/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch b/queue-4.19/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch new file mode 100644 index 00000000000..de8bb29fcbb --- /dev/null +++ b/queue-4.19/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch @@ -0,0 +1,71 @@ +From 9d92308230698af10d9b250c455e572eb96fd68e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Apr 2023 19:59:46 +0200 +Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian + +From: Christophe Leroy + +[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ] + +CPM has the same problem as QE so for CPM also use the fix added +by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"): + + CPM mode uses Little Endian so words > 8 bits are byte swapped. + Workaround this by always enforcing wordsize 8 for 16 and 32 bits + words. Unfortunately this will not work for LSB transfers + where wordsize is > 8 bits so disable these for now. + +Also limit the workaround to 16 and 32 bits words because it can +only work for multiples of 8-bits. + +Signed-off-by: Christophe Leroy +Cc: Joakim Tjernlund +Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian") +Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-spi.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index cd784552de7f1..479d10dc6cb84 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -205,8 +205,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + struct spi_device *spi, + int bits_per_word) + { +- /* QE uses Little Endian for words > 8 +- * so transform all words > 8 into 8 bits ++ /* CPM/QE uses Little Endian for words > 8 ++ * so transform 16 and 32 bits words into 8 bits + * Unfortnatly that doesn't work for LSB so + * reject these for now */ + /* Note: 32 bits word, LSB works iff +@@ -214,9 +214,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + if (spi->mode & SPI_LSB_FIRST && + bits_per_word > 8) + return -EINVAL; +- if (bits_per_word > 8) ++ if (bits_per_word <= 8) ++ return bits_per_word; ++ if (bits_per_word == 16 || bits_per_word == 32) + return 8; /* pretend its 8 bits */ +- return bits_per_word; ++ return -EINVAL; + } + + static int fsl_spi_setup_transfer(struct spi_device *spi, +@@ -246,7 +248,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi, + bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi, + mpc8xxx_spi, + bits_per_word); +- else if (mpc8xxx_spi->flags & SPI_QE) ++ else + bits_per_word = mspi_apply_qe_mode_quirks(cs, spi, + bits_per_word); + +-- +2.39.2 + diff --git a/queue-4.19/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-4.19/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch new file mode 100644 index 00000000000..a9e78b879ba --- /dev/null +++ b/queue-4.19/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch @@ -0,0 +1,65 @@ +From c7d0ae7cb08171321d4b2b6f5b4ea4a12830653b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 23:03:40 +0200 +Subject: spi: qup: Don't skip cleanup in remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ] + +Returning early in a platform driver's remove callback is wrong. In this +case the dma resources are not released in the error path. this is never +retried later and so this is a permanent leak. To fix this, only skip +hardware disabling if waking the device fails. + +Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index e8009f8c212c0..defe959884dae 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1249,18 +1249,22 @@ static int spi_qup_remove(struct platform_device *pdev) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_resume_and_get(&pdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(&pdev->dev); + +- ret = spi_qup_set_state(controller, QUP_STATE_RESET); +- if (ret) +- return ret; ++ if (ret >= 0) { ++ ret = spi_qup_set_state(controller, QUP_STATE_RESET); ++ if (ret) ++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n", ++ ERR_PTR(ret)); + +- spi_qup_release_dma(master); ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); ++ } else { ++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n", ++ ERR_PTR(ret)); ++ } + +- clk_disable_unprepare(controller->cclk); +- clk_disable_unprepare(controller->iclk); ++ spi_qup_release_dma(master); + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.39.2 + diff --git a/queue-4.19/spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch b/queue-4.19/spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch new file mode 100644 index 00000000000..74131bcbaa2 --- /dev/null +++ b/queue-4.19/spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch @@ -0,0 +1,41 @@ +From e78d8a0bcfe33aad81d6559dd3644745a14fbb17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 09:54:58 +0000 +Subject: spi: qup: fix PM reference leak in spi_qup_remove() + +From: Wang Li + +[ Upstream commit cec77e0a249892ceb10061bf17b63f9fb111d870 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Reported-by: Hulk Robot +Signed-off-by: Wang Li +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20210409095458.29921-1-wangli74@huawei.com +Signed-off-by: Mark Brown +Stable-dep-of: 61f49171a43a ("spi: qup: Don't skip cleanup in remove's error path") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index 1ca678bcb5279..e8009f8c212c0 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1249,7 +1249,7 @@ static int spi_qup_remove(struct platform_device *pdev) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) + return ret; + +-- +2.39.2 + diff --git a/queue-4.19/spmi-add-a-check-for-remove-callback-when-removing-a.patch b/queue-4.19/spmi-add-a-check-for-remove-callback-when-removing-a.patch new file mode 100644 index 00000000000..1f89246860d --- /dev/null +++ b/queue-4.19/spmi-add-a-check-for-remove-callback-when-removing-a.patch @@ -0,0 +1,65 @@ +From 3769bfa3ee81b2eabb4b3def31dc524c97570a2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 15:38:34 -0700 +Subject: spmi: Add a check for remove callback when removing a SPMI driver + +From: Jishnu Prakash + +[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ] + +When removing a SPMI driver, there can be a crash due to NULL pointer +dereference if it does not have a remove callback defined. This is +one such call trace observed when removing the QCOM SPMI PMIC driver: + + dump_backtrace.cfi_jt+0x0/0x8 + dump_stack_lvl+0xd8/0x16c + panic+0x188/0x498 + __cfi_slowpath+0x0/0x214 + __cfi_slowpath+0x1dc/0x214 + spmi_drv_remove+0x16c/0x1e0 + device_release_driver_internal+0x468/0x79c + driver_detach+0x11c/0x1a0 + bus_remove_driver+0xc4/0x124 + driver_unregister+0x58/0x84 + cleanup_module+0x1c/0xc24 [qcom_spmi_pmic] + __do_sys_delete_module+0x3ec/0x53c + __arm64_sys_delete_module+0x18/0x28 + el0_svc_common+0xdc/0x294 + el0_svc+0x38/0x9c + el0_sync_handler+0x8c/0xf0 + el0_sync+0x1b4/0x1c0 + +If a driver has all its resources allocated through devm_() APIs and +does not need any other explicit cleanup, it would not require a +remove callback to be defined. Hence, add a check for remove callback +presence before calling it when removing a SPMI driver. + +Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com +Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()") +Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI") +Signed-off-by: Jishnu Prakash +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/spmi/spmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c +index aa3edabc2b0fe..55f1cad836ba2 100644 +--- a/drivers/spmi/spmi.c ++++ b/drivers/spmi/spmi.c +@@ -356,7 +356,8 @@ static int spmi_drv_remove(struct device *dev) + const struct spmi_driver *sdrv = to_spmi_driver(dev->driver); + + pm_runtime_get_sync(dev); +- sdrv->remove(to_spmi_device(dev)); ++ if (sdrv->remove) ++ sdrv->remove(to_spmi_device(dev)); + pm_runtime_put_noidle(dev); + + pm_runtime_disable(dev); +-- +2.39.2 + diff --git a/queue-4.19/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch b/queue-4.19/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch new file mode 100644 index 00000000000..4b9fa65a874 --- /dev/null +++ b/queue-4.19/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch @@ -0,0 +1,44 @@ +From 3e6dffec9685262aacd356fbab04099104204d7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 22:02:01 +0200 +Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start + +From: Philipp Hortmann + +[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ] + +When loading the driver for rtl8192e, the W_DISABLE# switch is working as +intended. But when the WLAN is turned off in software and then turned on +again the W_DISABLE# does not work anymore. Reason for this is that in +the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is +checked and returned when true. bfirst_after_down is set true when +switching the WLAN off in software. But it is not set to false again +when WLAN is turned on again. + +Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix +above described bug. + +Fixes: 94a799425eee ("From: wlanfae [PATCH 1/8] rtl8192e: Import new version of driver from realtek") +Signed-off-by: Philipp Hortmann +Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710 +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index da73998bc5f70..d5ef1986bde4d 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -778,6 +778,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset) + else + netif_wake_queue(dev); + ++ priv->bfirst_after_down = false; + return 0; + } + +-- +2.39.2 + diff --git a/queue-4.19/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch b/queue-4.19/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch new file mode 100644 index 00000000000..cde6376f984 --- /dev/null +++ b/queue-4.19/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch @@ -0,0 +1,74 @@ +From 7d46b94ae8c3258cf1ba938b9ad2d4a5a119491d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 13:19:02 -0700 +Subject: SUNRPC: remove the maximum number of retries in call_bind_status + +From: Dai Ngo + +[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ] + +Currently call_bind_status places a hard limit of 3 to the number of +retries on EACCES error. This limit was done to prevent NLM unlock +requests from being hang forever when the server keeps returning garbage. +However this change causes problem for cases when NLM service takes +longer than 9 seconds to register with the port mapper after a restart. + +This patch removes this hard coded limit and let the RPC handles +the retry based on the standard hard/soft task semantics. + +Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests") +Reported-by: Helen Chao +Tested-by: Helen Chao +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 3 +-- + net/sunrpc/clnt.c | 3 --- + net/sunrpc/sched.c | 1 - + 3 files changed, 1 insertion(+), 6 deletions(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index ad2e243f3f032..96837ae07822b 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -88,8 +88,7 @@ struct rpc_task { + #endif + unsigned char tk_priority : 2,/* Task priority */ + tk_garb_retry : 2, +- tk_cred_retry : 2, +- tk_rebind_retry : 2; ++ tk_cred_retry : 2; + }; + + typedef void (*rpc_action)(struct rpc_task *); +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 1946bd13d5df7..e5498253ad93b 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1814,9 +1814,6 @@ call_bind_status(struct rpc_task *task) + status = -EOPNOTSUPP; + break; + } +- if (task->tk_rebind_retry == 0) +- break; +- task->tk_rebind_retry--; + rpc_delay(task, 3*HZ); + goto retry_timeout; + case -ETIMEDOUT: +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index e36ae4d4b540c..9af919364a001 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -709,7 +709,6 @@ rpc_init_task_statistics(struct rpc_task *task) + /* Initialize retry counters */ + task->tk_garb_retry = 2; + task->tk_cred_retry = 2; +- task->tk_rebind_retry = 2; + + /* starting timestamp */ + task->tk_start = ktime_get(); +-- +2.39.2 + diff --git a/queue-4.19/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch b/queue-4.19/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch new file mode 100644 index 00000000000..02453baa219 --- /dev/null +++ b/queue-4.19/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch @@ -0,0 +1,125 @@ +From 8da86b9bbd054b92783ddee390ec9f625db1a57a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:20:22 -0700 +Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. + +From: Kuniyuki Iwashima + +[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ] + +syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY +skbs. We can reproduce the problem with these sequences: + + sk = socket(AF_INET, SOCK_DGRAM, 0) + sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE) + sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1) + sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53)) + sk.close() + +sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets +skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct +ubuf_info_msgzc indirectly holds a refcnt of the socket. When the +skb is sent, __skb_tstamp_tx() clones it and puts the clone into +the socket's error queue with the TX timestamp. + +When the original skb is received locally, skb_copy_ubufs() calls +skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt. +This additional count is decremented while freeing the skb, but struct +ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is +not called. + +The last refcnt is not released unless we retrieve the TX timestamped +skb by recvmsg(). Since we clear the error queue in inet_sock_destruct() +after the socket's refcnt reaches 0, there is a circular dependency. +If we close() the socket holding such skbs, we never call sock_put() +and leak the count, sk, and skb. + +TCP has the same problem, and commit e0c8bccd40fc ("net: stream: +purge sk_error_queue in sk_stream_kill_queues()") tried to fix it +by calling skb_queue_purge() during close(). However, there is a +small chance that skb queued in a qdisc or device could be put +into the error queue after the skb_queue_purge() call. + +In __skb_tstamp_tx(), the cloned skb should not have a reference +to the ubuf to remove the circular dependency, but skb_clone() does +not call skb_copy_ubufs() for zerocopy skb. So, we need to call +skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs(). + +[0]: +BUG: memory leak +unreferenced object 0xffff88800c6d2d00 (size 1152): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................ + 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ + backtrace: + [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024 + [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083 + [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline] + [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245 + [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515 + [<00000000b9b11231>] sock_create net/socket.c:1566 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline] + [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636 + [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline] + [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline] + [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +BUG: memory leak +unreferenced object 0xffff888017633a00 (size 240): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m..... + backtrace: + [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497 + [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline] + [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596 + [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline] + [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370 + [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037 + [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652 + [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253 + [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819 + [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline] + [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734 + [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117 + [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline] + [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline] + [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY") +Fixes: b5947e5d1e71 ("udp: msg_zerocopy") +Reported-by: syzbot +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 7f501dff4501c..5ae62d7433575 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4445,6 +4445,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb, + skb = alloc_skb(0, GFP_ATOMIC); + } else { + skb = skb_clone(orig_skb, GFP_ATOMIC); ++ ++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) ++ return; + } + if (!skb) + return; +-- +2.39.2 + diff --git a/queue-4.19/tools-bpftool-remove-invalid-json-escape.patch b/queue-4.19/tools-bpftool-remove-invalid-json-escape.patch new file mode 100644 index 00000000000..4dc1f89287b --- /dev/null +++ b/queue-4.19/tools-bpftool-remove-invalid-json-escape.patch @@ -0,0 +1,53 @@ +From dd2a3bb623c73d67248f82adebb6715dd72c8b40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 16:08:54 +0100 +Subject: tools: bpftool: Remove invalid \' json escape + +From: Luis Gerhorst + +[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ] + +RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange +Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid +two-character escape sequences. This does not include \', which is not +required in JSON because it exclusively uses double quotes as string +separators. + +Solidus (/) may be escaped, but does not have to. Only reverse +solidus (\), double quotes ("), and the control characters have to be +escaped. Therefore, with this fix, bpftool correctly supports all valid +two-character escape sequences (but still does not support characters +that require multi-character escape sequences). + +Witout this fix, attempting to load a JSON file generated by bpftool +using Python 3.10.6's default json.load() may fail with the error +"Invalid \escape" if the file contains the invalid escaped single +quote (\'). + +Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository") +Signed-off-by: Luis Gerhorst +Signed-off-by: Andrii Nakryiko +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/json_writer.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c +index c6eef76322ae9..0c38c41269bee 100644 +--- a/tools/bpf/bpftool/json_writer.c ++++ b/tools/bpf/bpftool/json_writer.c +@@ -84,9 +84,6 @@ static void jsonw_puts(json_writer_t *self, const char *str) + case '"': + fputs("\\\"", self->out); + break; +- case '\'': +- fputs("\\\'", self->out); +- break; + default: + putc(*str, self->out); + } +-- +2.39.2 + diff --git a/queue-4.19/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch b/queue-4.19/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch new file mode 100644 index 00000000000..86aaf4e6be7 --- /dev/null +++ b/queue-4.19/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch @@ -0,0 +1,39 @@ +From 148518db9ff42e114c561f8d0bd5c82ae248715c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 14:55:55 -0500 +Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size + +From: Shenwei Wang + +[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ] + +Based on the fls function definition provided below, we should not +subtract 1 to obtain the correct buffer length: + +fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. + +Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx") +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 6ea1d23623e51..dbfec943071d6 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -994,7 +994,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport) + * 10ms at any baud rate. + */ + sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2; +- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1)); ++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len)); + if (sport->rx_dma_rng_buf_len < 16) + sport->rx_dma_rng_buf_len = 16; + +-- +2.39.2 + diff --git a/queue-4.19/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch b/queue-4.19/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch new file mode 100644 index 00000000000..23490f1f667 --- /dev/null +++ b/queue-4.19/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch @@ -0,0 +1,65 @@ +From aea1b808e8161600d444efd421416bab69849a40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 10:27:47 +0100 +Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__ + +From: Kevin Brodsky + +[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ] + +typeof is (still) a GNU extension, which means that it cannot be used when +building ISO C (e.g. -std=c99). It should therefore be avoided in uapi +headers in favour of the ISO-friendly __typeof__. + +Unfortunately this issue could not be detected by +CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in +any uapi header. + +This matters from a userspace perspective, not a kernel one. uapi +headers and their contents are expected to be usable in a variety of +situations, and in particular when building ISO C applications (with +-std=c99 or similar). + +This particular problem can be reproduced by trying to use the +__ALIGN_KERNEL macro directly in application code, say: + +#include + +int align(int x, int a) +{ + return __KERNEL_ALIGN(x, a); +} + +and trying to build that with -std=c99. + +Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com +Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()") +Signed-off-by: Kevin Brodsky +Reported-by: Ruben Ayrapetyan +Tested-by: Ruben Ayrapetyan +Reviewed-by: Petr Vorel +Tested-by: Petr Vorel +Reviewed-by: Masahiro Yamada +Cc: Sam Ravnborg +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/uapi/linux/const.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h +index af2a44c08683d..a429381e7ca50 100644 +--- a/include/uapi/linux/const.h ++++ b/include/uapi/linux/const.h +@@ -28,7 +28,7 @@ + #define _BITUL(x) (_UL(1) << (x)) + #define _BITULL(x) (_ULL(1) << (x)) + +-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) ++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1) + #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask)) + + #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +-- +2.39.2 + diff --git a/queue-4.19/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch b/queue-4.19/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch new file mode 100644 index 00000000000..d8c2a25242e --- /dev/null +++ b/queue-4.19/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch @@ -0,0 +1,42 @@ +From 137a949703fdd4fbae8e0f6edea981f9becd1fb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:58:52 +0800 +Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe` + +From: Yinhao Hu + +[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ] + +From the comment of ci_usb_phy_init, it returns an error code if +usb_phy_init has failed, and it should do some clean up, not just +return directly. + +Fix this by goto the error handling. + +Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core") +Reviewed-by: Dongliang Mu +Acked-by: Peter Chen +Signed-off-by: Yinhao Hu +Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 3fd1073a345db..9f6a52ed038e2 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -984,7 +984,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + ret = ci_usb_phy_init(ci); + if (ret) { + dev_err(dev, "unable to init phy: %d\n", ret); +- return ret; ++ goto ulpi_exit; + } + + ci->hw_bank.phys = res->start; +-- +2.39.2 + diff --git a/queue-4.19/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch b/queue-4.19/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch new file mode 100644 index 00000000000..1fa433a6c69 --- /dev/null +++ b/queue-4.19/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch @@ -0,0 +1,62 @@ +From e15fccb666b414759167c483a190a1374eff4cbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 14:29:31 +0800 +Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in + renesas_usb3_remove due to race condition + +From: Zheng Wang + +[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ] + +In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. +renesas_usb3_start will be called to start the work. + +If we remove the driver which will call usbhs_remove, there may be +an unfinished work. The possible sequence is as follows: + +CPU0 CPU1 + + renesas_usb3_role_work +renesas_usb3_remove +usb_role_switch_unregister +device_unregister +kfree(sw) +//free usb3->role_sw + usb_role_switch_set_role + //use usb3->role_sw + +The usb3->role_sw could be freed under such circumstance and then +used in usb_role_switch_set_role. + +This bug was found by static analysis. And note that removing a +driver is a root-only operation, and should never happen in normal +case. But the root user may directly remove the device which +will also trigger the remove function. + +Fix it by canceling the work before cleanup in the renesas_usb3_remove. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Signed-off-by: Zheng Wang +Reviewed-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index c17d7a71e29a3..013db752d55da 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2478,6 +2478,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) + debugfs_remove_recursive(usb3->dentry); + device_remove_file(&pdev->dev, &dev_attr_role); + ++ cancel_work_sync(&usb3->role_work); + usb_role_switch_unregister(usb3->role_sw); + + usb_del_gadget_udc(&usb3->gadget); +-- +2.39.2 + diff --git a/queue-4.19/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch b/queue-4.19/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch new file mode 100644 index 00000000000..142872bfe20 --- /dev/null +++ b/queue-4.19/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch @@ -0,0 +1,46 @@ +From f3b6597804eb620281941b9ba4006ea96a27d124 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 17:30:37 +0100 +Subject: usb: host: xhci-rcar: remove leftover quirk handling + +From: Wolfram Sang + +[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ] + +Loading V3 firmware does not need a quirk anymore, remove the leftover +code. + +Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-rcar.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c +index 4ebbe2c232926..4353c1948e5c6 100644 +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -74,7 +74,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3); + + /* For soc_device_attribute */ + #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */ +-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */ + + static const struct soc_device_attribute rcar_quirks_match[] = { + { +@@ -156,8 +155,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd) + + if (quirks & RCAR_XHCI_FIRMWARE_V2) + firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2; +- else if (quirks & RCAR_XHCI_FIRMWARE_V3) +- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3; + else + firmware_name = priv->firmware_name; + +-- +2.39.2 + diff --git a/queue-4.19/vlan-partially-enable-siocshwtstamp-in-container.patch b/queue-4.19/vlan-partially-enable-siocshwtstamp-in-container.patch new file mode 100644 index 00000000000..7be6c04514a --- /dev/null +++ b/queue-4.19/vlan-partially-enable-siocshwtstamp-in-container.patch @@ -0,0 +1,37 @@ +From c99f4fc9d6aa6c36b88dfb3a7f50ef1bc774b9ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 08:33:02 -0700 +Subject: vlan: partially enable SIOCSHWTSTAMP in container + +From: Vadim Fedorenko + +[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ] + +Setting timestamp filter was explicitly disabled on vlan devices in +containers because it might affect other processes on the host. But it's +absolutely legit in case when real device is in the same namespace. + +Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container") +Signed-off-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/8021q/vlan_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index 84ef837721141..c80add6edf598 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -369,7 +369,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + + switch (cmd) { + case SIOCSHWTSTAMP: +- if (!net_eq(dev_net(dev), &init_net)) ++ if (!net_eq(dev_net(dev), dev_net(real_dev))) + break; + case SIOCGMIIPHY: + case SIOCGMIIREG: +-- +2.39.2 + diff --git a/queue-4.19/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch b/queue-4.19/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch new file mode 100644 index 00000000000..1a3ef66f544 --- /dev/null +++ b/queue-4.19/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch @@ -0,0 +1,95 @@ +From 670a717976446e70e79e8ee6a794bd9905c504ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 21:01:53 +0900 +Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF + +From: Dae R. Jeong + +[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ] + +During fuzzing, a general protection fault is observed in +vmci_host_poll(). + +general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] +RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 +<- omitting registers -> +Call Trace: + + lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 + add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 + poll_wait include/linux/poll.h:49 [inline] + vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 + vfs_poll include/linux/poll.h:88 [inline] + do_pollfd fs/select.c:873 [inline] + do_poll fs/select.c:921 [inline] + do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 + __do_sys_ppoll fs/select.c:1121 [inline] + __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Example thread interleaving that causes the general protection fault +is as follows: + +CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) +----- ----- +// Read uninitialized context +context = vmci_host_dev->context; + // Initialize context + vmci_host_dev->context = vmci_ctx_create(); + vmci_host_dev->ct_type = VMCIOBJ_CONTEXT; + +if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { + // Dereferencing the wrong pointer + poll_wait(..., &context->host_context); +} + +In this scenario, vmci_host_poll() reads vmci_host_dev->context first, +and then reads vmci_host_dev->ct_type to check that +vmci_host_dev->context is initialized. However, since these two reads +are not atomically executed, there is a chance of a race condition as +described above. + +To fix this race condition, read vmci_host_dev->context after checking +the value of vmci_host_dev->ct_type so that vmci_host_poll() always +reads an initialized context. + +Reported-by: Dae R. Jeong +Fixes: 8bf503991f87 ("VMCI: host side driver implementation.") +Signed-off-by: Dae R. Jeong +Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c +index 83e0c95d20a47..5acbf384ffa64 100644 +--- a/drivers/misc/vmw_vmci/vmci_host.c ++++ b/drivers/misc/vmw_vmci/vmci_host.c +@@ -169,10 +169,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp) + static __poll_t vmci_host_poll(struct file *filp, poll_table *wait) + { + struct vmci_host_dev *vmci_host_dev = filp->private_data; +- struct vmci_ctx *context = vmci_host_dev->context; ++ struct vmci_ctx *context; + __poll_t mask = 0; + + if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { ++ /* ++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make ++ * sure that context is initialized ++ */ ++ context = vmci_host_dev->context; ++ + /* Check for VMCI calls to this VM context. */ + if (wait) + poll_wait(filp, &context->host_context.wait_queue, +-- +2.39.2 + diff --git a/queue-4.19/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch b/queue-4.19/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch new file mode 100644 index 00000000000..67b5ee66ce5 --- /dev/null +++ b/queue-4.19/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch @@ -0,0 +1,39 @@ +From 24bd8e94d5955254433995f5b0bbfab298552e70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 16:15:48 +0300 +Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() + +From: Dan Carpenter + +[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ] + +This loop checks that i < max at the start of loop but then it does +i++ which could put it past the end of the array. It's harmless to +check again and prevent a potential out of bounds. + +Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data") +Signed-off-by: Dan Carpenter +Reviewed-by: Luis Chamberlain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index 01163b3339451..92f5c8e830901 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max, + ee->ee_n_piers[mode]++; + + freq2 = (val >> 8) & 0xff; +- if (!freq2) ++ if (!freq2 || i >= max) + break; + + pc[i++].freq = ath5k_eeprom_bin2freq(ee, +-- +2.39.2 + diff --git a/queue-4.19/wifi-ath6kl-minor-fix-for-allocation-size.patch b/queue-4.19/wifi-ath6kl-minor-fix-for-allocation-size.patch new file mode 100644 index 00000000000..f97e95df524 --- /dev/null +++ b/queue-4.19/wifi-ath6kl-minor-fix-for-allocation-size.patch @@ -0,0 +1,40 @@ +From 521490349b094e659dca70a311017b55f511df00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 20:31:37 +0200 +Subject: wifi: ath6kl: minor fix for allocation size + +From: Alexey V. Vissarionov + +[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ] + +Although the "param" pointer occupies more or equal space compared +to "*param", the allocation size should use the size of variable +itself. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver") +Signed-off-by: Alexey V. Vissarionov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/bmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c +index bde5a10d470c8..af98e871199d3 100644 +--- a/drivers/net/wireless/ath/ath6kl/bmi.c ++++ b/drivers/net/wireless/ath/ath6kl/bmi.c +@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param) + return -EACCES; + } + +- size = sizeof(cid) + sizeof(addr) + sizeof(param); ++ size = sizeof(cid) + sizeof(addr) + sizeof(*param); + if (size > ar->bmi.max_cmd_size) { + WARN_ON(1); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-4.19/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch b/queue-4.19/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch new file mode 100644 index 00000000000..caa1eba5916 --- /dev/null +++ b/queue-4.19/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch @@ -0,0 +1,43 @@ +From 977e58334093bab4745e40f9cbcf5fa4984a34b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 12:28:05 +0200 +Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback + +From: Fedor Pchelkin + +[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ] + +The warn is triggered on a known race condition, documented in the code above +the test, that is correctly handled. Using WARN() hinders automated testing. +Reducing severity. + +Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload") +Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +index 434b668296466..73bf4af1f3c7c 100644 +--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c ++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +@@ -963,8 +963,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb, + * Thus the possibility of ar->htc_target being NULL + * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work. + */ +- if (WARN_ON_ONCE(!target)) { +- ath6kl_err("Target not yet initialized\n"); ++ if (!target) { ++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n"); + status = -EINVAL; + goto free_skb; + } +-- +2.39.2 + diff --git a/queue-4.19/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch b/queue-4.19/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch new file mode 100644 index 00000000000..1a8296236e0 --- /dev/null +++ b/queue-4.19/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch @@ -0,0 +1,87 @@ +From aab0d0f7bdec6aae5fd661f604a89672c82aeca0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 22:23:01 +0300 +Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ] + +hif_dev->remain_skb is allocated and used exclusively in +ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is +processed and subsequently freed (in error paths) only during the next +call of ath9k_hif_usb_rx_stream(). + +So, if the urbs are deallocated between those two calls due to the device +deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() +is not called next time and the allocated remain_skb is leaked. Our local +Syzkaller instance was able to trigger that. + +remain_skb makes sense when receiving two consecutive urbs which are +logically linked together, i.e. a specific data field from the first skb +indicates a cached skb to be allocated, memcpy'd with some data and +subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs +deallocation supposedly makes that link irrelevant so we need to free the +cached skb in those cases. + +Fix the leak by introducing a function to explicitly free remain_skb (if +it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL +when it has not been allocated at all (hif_dev struct is kzalloced) or +when it has been processed in next call to ath9k_hif_usb_rx_stream(). + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index e23d58f83dd6f..3aa915d215545 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = { + .send = hif_usb_send, + }; + ++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream ++ * in case ath9k_hif_usb_rx_stream wasn't called next time to ++ * process the buffer and subsequently free it. ++ */ ++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&hif_dev->rx_lock, flags); ++ if (hif_dev->remain_skb) { ++ dev_kfree_skb_any(hif_dev->remain_skb); ++ hif_dev->remain_skb = NULL; ++ hif_dev->rx_remain_len = 0; ++ RX_STAT_INC(hif_dev, skb_dropped); ++ } ++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags); ++} ++ + static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + struct sk_buff *skb) + { +@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) + static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) + { + usb_kill_anchored_urbs(&hif_dev->rx_submitted); ++ ath9k_hif_usb_free_rx_remain_skb(hif_dev); + } + + static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) +-- +2.39.2 + diff --git a/queue-4.19/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch b/queue-4.19/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch new file mode 100644 index 00000000000..760092c7b65 --- /dev/null +++ b/queue-4.19/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch @@ -0,0 +1,50 @@ +From 60d5914aef2c3ec5a20f498a051ebcf3d8a22366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 15:47:38 +0300 +Subject: wifi: iwlwifi: make the loop for card preparation effective + +From: Emmanuel Grumbach + +[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ] + +Since we didn't reset t to 0, only the first iteration of the loop +did checked the ready bit several times. +From the second iteration and on, we just tested the bit once and +continued to the next iteration. + +Reported-and-tested-by: Lorenzo Zolfanelli +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452 +Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 2d2afc1758304..c69c13e762bbe 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -666,7 +666,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans) + int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + { + int ret; +- int t = 0; + int iter; + + IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n"); +@@ -681,6 +680,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + usleep_range(1000, 2000); + + for (iter = 0; iter < 10; iter++) { ++ int t = 0; ++ + /* If HW is not ready, prepare the conditions to check again */ + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, + CSR_HW_IF_CONFIG_REG_PREPARE); +-- +2.39.2 + diff --git a/queue-4.19/wifi-iwlwifi-mvm-check-firmware-response-size.patch b/queue-4.19/wifi-iwlwifi-mvm-check-firmware-response-size.patch new file mode 100644 index 00000000000..7f57beb3f32 --- /dev/null +++ b/queue-4.19/wifi-iwlwifi-mvm-check-firmware-response-size.patch @@ -0,0 +1,53 @@ +From 63bb78a4220a1dee17e7571c4b6e524ca3603f5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 11:41:33 +0300 +Subject: wifi: iwlwifi: mvm: check firmware response size + +From: Johannes Berg + +[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ] + +Check the firmware response size for responses to the +memory read/write command in debugfs before using it. + +Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +index 05b77419953ce..9540c874fc380 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +@@ -1835,6 +1835,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +@@ -1912,6 +1917,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +-- +2.39.2 + diff --git a/queue-4.19/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch b/queue-4.19/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch new file mode 100644 index 00000000000..844ffe28deb --- /dev/null +++ b/queue-4.19/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch @@ -0,0 +1,54 @@ +From b6eb033d3231c9906489c20cbba435a86ae3df78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:31:38 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_rfreg() + +From: Wei Chen + +[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ] + +If there is a failure during copy_from_user or user-provided data buffer +is invalid, rtl_debugfs_set_write_rfreg should return negative error code +instead of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index cead66f7eb9f5..deacc7a28d3a7 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -416,8 +416,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -427,7 +427,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + if (num != 4) { + rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, + "Format is \n"); +- return count; ++ return -EINVAL; + } + + rtl_set_rfreg(hw, path, addr, bitmask, data); +-- +2.39.2 + diff --git a/queue-4.19/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-14890 b/queue-4.19/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-14890 new file mode 100644 index 00000000000..a0118591877 --- /dev/null +++ b/queue-4.19/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-14890 @@ -0,0 +1,54 @@ +From ad2f3d20ee05ce644d868aea74cb9c03bdf99fa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:42:17 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_reg() + +From: Wei Chen + +[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ] + +If there is a failure during copy_from_user or user-provided data buffer is +invalid, rtl_debugfs_set_write_reg should return negative error code instead +of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index deacc7a28d3a7..6a0dfc6d4905e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -319,8 +319,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -328,7 +328,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + num = sscanf(tmp, "%x %x %x", &addr, &val, &len); + + if (num != 3) +- return count; ++ return -EINVAL; + + switch (len) { + case 1: +-- +2.39.2 + diff --git a/queue-4.19/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch b/queue-4.19/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch new file mode 100644 index 00000000000..ab24fb72f9b --- /dev/null +++ b/queue-4.19/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch @@ -0,0 +1,49 @@ +From 4749c6bdf416084c30139fabc6859f1f061afa3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 17:09:17 +0100 +Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset() + +From: Uros Bizjak + +[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ] + +The detection of atomic update failure in reserve_eilvt_offset() is +not correct. The value returned by atomic_cmpxchg() should be compared +to the old value from the location to be updated. + +If these two are the same, then atomic update succeeded and +"eilvt_offsets[offset]" location is updated to "new" in an atomic way. + +Otherwise, the atomic update failed and it should be retried with the +value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg() +does in a correct and more optimal way. + +Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 926939978c1c3..9318fe7d850e3 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -403,10 +403,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new) + if (vector && !eilvt_entry_is_changeable(vector, new)) + /* may not change if vectors are different */ + return rsvd; +- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new); +- } while (rsvd != new); ++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new)); + +- rsvd &= ~APIC_EILVT_MASKED; ++ rsvd = new & ~APIC_EILVT_MASKED; + if (rsvd && rsvd != vector) + pr_info("LVT offset %d assigned for vector 0x%02x\n", + offset, rsvd); +-- +2.39.2 + diff --git a/queue-4.19/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch b/queue-4.19/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch new file mode 100644 index 00000000000..63cf88a5e51 --- /dev/null +++ b/queue-4.19/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch @@ -0,0 +1,72 @@ +From 7ad55a4e06e578a83b8e44f390ba7010ed08ac58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 00:30:04 -0700 +Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() + +From: Saurabh Sengar + +[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ] + +arch_dynirq_lower_bound() is invoked by the core interrupt code to +retrieve the lowest possible Linux interrupt number for dynamically +allocated interrupts like MSI. + +The x86 implementation uses this to exclude the IO/APIC GSI space. +This works correctly as long as there is an IO/APIC registered, but +returns 0 if not. This has been observed in VMs where the BIOS does +not advertise an IO/APIC. + +0 is an invalid interrupt number except for the legacy timer interrupt +on x86. The return value is unchecked in the core code, so it ends up +to allocate interrupt number 0 which is subsequently considered to be +invalid by the caller, e.g. the MSI allocation code. + +The function has already a check for 0 in the case that an IO/APIC is +registered, as ioapic_dynirq_base is 0 in case of device tree setups. + +Consolidate this and zero check for both ioapic_dynirq_base and gsi_top, +which is used in the case that no IO/APIC is registered. + +Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines") +Signed-off-by: Saurabh Sengar +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/io_apic.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index 677508baf95a0..af59aa9c55233 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2449,17 +2449,21 @@ static int io_apic_get_redir_entries(int ioapic) + + unsigned int arch_dynirq_lower_bound(unsigned int from) + { ++ unsigned int ret; ++ + /* + * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use + * gsi_top if ioapic_dynirq_base hasn't been initialized yet. + */ +- if (!ioapic_initialized) +- return gsi_top; ++ ret = ioapic_dynirq_base ? : gsi_top; ++ + /* +- * For DT enabled machines ioapic_dynirq_base is irrelevant and not +- * updated. So simply return @from if ioapic_dynirq_base == 0. ++ * For DT enabled machines ioapic_dynirq_base is irrelevant and ++ * always 0. gsi_top can be 0 if there is no IO/APIC registered. ++ * 0 is an invalid interrupt number for dynamic allocations. Return ++ * @from instead. + */ +- return ioapic_dynirq_base ? : from; ++ return ret ? : from; + } + + #ifdef CONFIG_X86_32 +-- +2.39.2 +