From: Sasha Levin Date: Sat, 6 May 2023 11:59:19 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.15.111~100 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=de320959b78bf3dbbff9ea1ed72fe264db111293;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch b/queue-5.4/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch new file mode 100644 index 00000000000..9cbacba1e3f --- /dev/null +++ b/queue-5.4/afs-fix-updating-of-i_size-with-dv-jump-from-server.patch @@ -0,0 +1,40 @@ +From 4c8ae9007454e372418b042e286b86a2ec02ade2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Dec 2022 10:07:01 -0400 +Subject: afs: Fix updating of i_size with dv jump from server + +From: Marc Dionne + +[ Upstream commit d7f74e9a917503ee78f2b603a456d7227cf38919 ] + +If the data version returned from the server is larger than expected, +the local data is invalidated, but we may still want to note the remote +file size. + +Since we're setting change_size, we have to also set data_changed +for the i_size to get updated. + +Fixes: 3f4aa9818163 ("afs: Fix EOF corruption") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +cc: linux-afs@lists.infradead.org +Signed-off-by: Sasha Levin +--- + fs/afs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index 622363af4c1bf..fd681eec49aa2 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -227,6 +227,7 @@ static void afs_apply_status(struct afs_fs_cursor *fc, + set_bit(AFS_VNODE_ZAP_DATA, &vnode->flags); + } + change_size = true; ++ data_changed = true; + } else if (vnode->status.type == AFS_FTYPE_DIR) { + /* Expected directory change is handled elsewhere so + * that we can locally edit the directory and save on a +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch b/queue-5.4/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..39577fee051 --- /dev/null +++ b/queue-5.4/arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,45 @@ +From 7d1868f4691161dbe88c36ba06a34464c0f66c89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:51 +0530 +Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ] + +For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address +(0x40200000) specified in the ranges property for I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 338256c59ca5a..fc31ee980639a 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -393,8 +393,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>, +- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>; ++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>, ++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>; + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch b/queue-5.4/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch new file mode 100644 index 00000000000..dc372c2cbb8 --- /dev/null +++ b/queue-5.4/arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch @@ -0,0 +1,68 @@ +From c68a4e500db1c08f2c198a23973df1075d6eaee1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Feb 2023 22:17:52 +0530 +Subject: ARM: dts: qcom: ipq8064: Fix the PCI I/O port range + +From: Manivannan Sadhasivam + +[ Upstream commit 0b16b34e491629016109e56747ad64588074194b ] + +For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are +located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses +(0x0fe00000, 0x31e00000, 0x35e00000) specified in the ranges property for +I/O region. + +While at it, let's use the missing 0x prefix for the addresses. + +Fixes: 93241840b664 ("ARM: dts: qcom: Add pcie nodes for ipq8064") +Reported-by: Arnd Bergmann +Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/ +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Arnd Bergmann +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20230228164752.55682-17-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq8064.dtsi | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi +index f2653600f47f8..976a8a1fa9535 100644 +--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi +@@ -451,8 +451,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x0fe00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x08000000 0x08000000 0x0 0x07e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -502,8 +502,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x31e00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x2e000000 0x2e000000 0x0 0x03e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +@@ -553,8 +553,8 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */ +- 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */ ++ ranges = <0x81000000 0x0 0x00000000 0x35e00000 0x0 0x00010000 /* I/O */ ++ 0x82000000 0x0 0x32000000 0x32000000 0x0 0x03e00000>; /* MEM */ + + interrupts = ; + interrupt-names = "msi"; +-- +2.39.2 + diff --git a/queue-5.4/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch b/queue-5.4/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch new file mode 100644 index 00000000000..b5f97bb722f --- /dev/null +++ b/queue-5.4/arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch @@ -0,0 +1,62 @@ +From 0adebd4e930cb7b957b747b9d9469eba88a27ce8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Jul 2022 03:09:40 +0200 +Subject: ARM: dts: qcom: ipq8064: reduce pci IO size to 64K + +From: Christian Marangi + +[ Upstream commit 8fafb7e5c041814876266259e5e439f93571dcef ] + +The current value for pci IO is problematic for ath10k wifi card +commonly connected to ipq8064 SoC. +The current value is probably a typo and is actually uncommon to find +1MB IO space even on a x86 arch. Also with recent changes to the pci +driver, pci1 and pci2 now fails to function as any connected device +fails any reg read/write. Reduce this to 64K as it should be more than +enough and 3 * 64K of total IO space doesn't exceed the IO_SPACE_LIMIT +hardcoded for the ARM arch. + +Signed-off-by: Christian Marangi +Tested-by: Jonathan McDowell +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220707010943.20857-7-ansuelsmth@gmail.com +Stable-dep-of: 0b16b34e4916 ("ARM: dts: qcom: ipq8064: Fix the PCI I/O port range") +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq8064.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi +index 16c0da97932c1..f2653600f47f8 100644 +--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi +@@ -451,7 +451,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00100000 /* downstream I/O */ ++ ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */ + 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */ + + interrupts = ; +@@ -502,7 +502,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00100000 /* downstream I/O */ ++ ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */ + 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */ + + interrupts = ; +@@ -553,7 +553,7 @@ + #address-cells = <3>; + #size-cells = <2>; + +- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00100000 /* downstream I/O */ ++ ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */ + 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */ + + interrupts = ; +-- +2.39.2 + diff --git a/queue-5.4/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch b/queue-5.4/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch new file mode 100644 index 00000000000..f9693960c28 --- /dev/null +++ b/queue-5.4/arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch @@ -0,0 +1,53 @@ +From 87a11bd6e37f1b84801bcdb7008a6c69608e3c2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 16:30:32 +0100 +Subject: arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 554edc3e9239bb81e61be9f0f5dbbeb528a69e72 ] + +According to the RZ/G Series, 2nd Generation Hardware User’s Manual +Rev. 1.11, the System CPU cores on RZ/G2E do not have their own power +supply, but use the common internal power supply (typical 1.03V). + +Hence remove the "opp-microvolt" properties from the Operating +Performance Points table. They are optional, and unused, when none of +the CPU nodes is tied to a regulator using the "cpu-supply" property. + +Fixes: 231d8908a66fa98f ("arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/8348e18a011ded94e35919cd8e17c0be1f9acf2f.1676560856.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +index 73ded80a79ba0..1de7891c658cf 100644 +--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +@@ -49,17 +49,14 @@ + opp-shared; + opp-800000000 { + opp-hz = /bits/ 64 <800000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1200000000 { + opp-hz = /bits/ 64 <1200000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + opp-suspend; + }; +-- +2.39.2 + diff --git a/queue-5.4/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch b/queue-5.4/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch new file mode 100644 index 00000000000..2fa66166145 --- /dev/null +++ b/queue-5.4/arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch @@ -0,0 +1,53 @@ +From fd069cc82fede04f3a771ab2e033764208f67970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 16:30:31 +0100 +Subject: arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit fb76b0fae3ca880363214e1dcd6513ab8bd529e7 ] + +According to the R-Car Series, 3rd Generation Hardware User’s Manual +Rev. 2.30, the System CPU cores on R-Car E3 do not have their own power +supply, but use the common internal power supply (typical 1.03V). + +Hence remove the "opp-microvolt" properties from the Operating +Performance Points table. They are optional, and unused, when none of +the CPU nodes is tied to a regulator using the "cpu-supply" property. + +Fixes: dd7188eb4ed128dc ("arm64: dts: renesas: r8a77990: Add OPPs table for cpu devices") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/9232578d9d395d529f64db3333a371e31327f459.1676560856.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77990.dtsi | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +index dabee157119f9..82efc8a3627d9 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +@@ -60,17 +60,14 @@ + opp-shared; + opp-800000000 { + opp-hz = /bits/ 64 <800000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1000000000 { + opp-hz = /bits/ 64 <1000000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + }; + opp-1200000000 { + opp-hz = /bits/ 64 <1200000000>; +- opp-microvolt = <820000>; + clock-latency-ns = <300000>; + opp-suspend; + }; +-- +2.39.2 + diff --git a/queue-5.4/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch b/queue-5.4/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch new file mode 100644 index 00000000000..f0212a6c636 --- /dev/null +++ b/queue-5.4/arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch @@ -0,0 +1,128 @@ +From 9854fb1df84e982146a78918ad05acc8f03c992b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 13:01:48 +0530 +Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step + +From: Sumit Garg + +[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ] + +Currently only the first attempt to single-step has any effect. After +that all further stepping remains "stuck" at the same program counter +value. + +Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12, +PSTATE.SS=1 should be set at each step before transferring the PE to the +'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set +since the second single-step. + +After the first single-step, the PE transferes to the 'Inactive' state, +with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to +kernel_active_single_step()=true. Then the PE transferes to the +'Active-pending' state when ERET and returns to the debugger by step +exception. + +Before this patch: +================== +Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> + +[0]kdb> +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger) + is enabled addr at ffffa45c13d09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> ss + +Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294 +[1]kdb> + +After this patch: +================= +Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry +[0]kdb> bp write_sysrq_trigger +Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger) + is enabled addr at ffffc02d2dd09290, hardtype=0 installed=0 + +[0]kdb> go +$ echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298 +[1]kdb> ss + +Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c +[1]kdb> + +Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support") +Co-developed-by: Wei Li +Signed-off-by: Wei Li +Signed-off-by: Sumit Garg +Tested-by: Douglas Anderson +Acked-by: Daniel Thompson +Tested-by: Daniel Thompson +Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/debug-monitors.h | 1 + + arch/arm64/kernel/debug-monitors.c | 5 +++++ + arch/arm64/kernel/kgdb.c | 2 ++ + 3 files changed, 8 insertions(+) + +diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h +index 0253691c4b3a1..bd451732a3afb 100644 +--- a/arch/arm64/include/asm/debug-monitors.h ++++ b/arch/arm64/include/asm/debug-monitors.h +@@ -116,6 +116,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs, + void kernel_enable_single_step(struct pt_regs *regs); + void kernel_disable_single_step(void); + int kernel_active_single_step(void); ++void kernel_rewind_single_step(struct pt_regs *regs); + + #ifdef CONFIG_HAVE_HW_BREAKPOINT + int reinstall_suspended_bps(struct pt_regs *regs); +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index d64a3c1e1b6ba..62ab9d4f995eb 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -441,6 +441,11 @@ int kernel_active_single_step(void) + } + NOKPROBE_SYMBOL(kernel_active_single_step); + ++void kernel_rewind_single_step(struct pt_regs *regs) ++{ ++ set_regs_spsr_ss(regs); ++} ++ + /* ptrace API */ + void user_enable_single_step(struct task_struct *task) + { +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index 1a157ca33262d..e4e95821b1f6c 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -223,6 +223,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo, + */ + if (!kernel_active_single_step()) + kernel_enable_single_step(linux_regs); ++ else ++ kernel_rewind_single_step(linux_regs); + err = 0; + break; + default: +-- +2.39.2 + diff --git a/queue-5.4/asoc-es8316-handle-optional-irq-assignment.patch b/queue-5.4/asoc-es8316-handle-optional-irq-assignment.patch new file mode 100644 index 00000000000..6a5cad8cd5a --- /dev/null +++ b/queue-5.4/asoc-es8316-handle-optional-irq-assignment.patch @@ -0,0 +1,62 @@ +From fa47fe768b9ef05affe35ab978bc8a48475935c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 12:49:01 +0300 +Subject: ASoC: es8316: Handle optional IRQ assignment + +From: Cristian Ciocaltea + +[ Upstream commit 39db65a0a17b54915b269d3685f253a4731f344c ] + +The driver is able to work fine without relying on a mandatory interrupt +being assigned to the I2C device. This is only needed when making use of +the jack-detect support. + +However, the following warning message is always emitted when there is +no such interrupt available: + + es8316 0-0011: Failed to get IRQ 0: -22 + +Do not attempt to request an IRQ if it is not available/valid. This also +ensures the rather misleading message is not displayed anymore. + +Also note the IRQ validation relies on commit dab472eb931bc291 ("i2c / +ACPI: Use 0 to indicate that device does not have interrupt assigned"). + +Fixes: 822257661031 ("ASoC: es8316: Add jack-detect support") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20230328094901.50763-1-cristian.ciocaltea@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index 573085f7cfd1e..efeffa0bf2d78 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -806,12 +806,14 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client, + es8316->irq = i2c_client->irq; + mutex_init(&es8316->lock); + +- ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN, +- "es8316", es8316); +- if (ret) { +- dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret); +- es8316->irq = -ENXIO; ++ if (es8316->irq > 0) { ++ ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq, ++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN, ++ "es8316", es8316); ++ if (ret) { ++ dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret); ++ es8316->irq = -ENXIO; ++ } + } + + return devm_snd_soc_register_component(&i2c_client->dev, +-- +2.39.2 + diff --git a/queue-5.4/asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch b/queue-5.4/asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch new file mode 100644 index 00000000000..1b6f5a846da --- /dev/null +++ b/queue-5.4/asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch @@ -0,0 +1,46 @@ +From e03dc9f63a5175510ae3902c5bb246ef329a7d30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Oct 2021 15:22:54 +0200 +Subject: ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ + +From: Hans de Goede + +[ Upstream commit 1cf2aa665901054b140eb71748661ceae99b6b5a ] + +Use the new IRQF_NO_AUTOEN flag when requesting the IRQ, rather then +disabling it immediately after requesting it. + +This fixes a possible race where the IRQ might trigger between requesting +and disabling it; and this also leads to a small code cleanup. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20211003132255.31743-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Stable-dep-of: 39db65a0a17b ("ASoC: es8316: Handle optional IRQ assignment") +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8316.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c +index b781b28de0126..573085f7cfd1e 100644 +--- a/sound/soc/codecs/es8316.c ++++ b/sound/soc/codecs/es8316.c +@@ -807,12 +807,9 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client, + mutex_init(&es8316->lock); + + ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq, +- IRQF_TRIGGER_HIGH | IRQF_ONESHOT, ++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN, + "es8316", es8316); +- if (ret == 0) { +- /* Gets re-enabled by es8316_set_jack() */ +- disable_irq(es8316->irq); +- } else { ++ if (ret) { + dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret); + es8316->irq = -ENXIO; + } +-- +2.39.2 + diff --git a/queue-5.4/bpf-don-t-efault-for-getsockopt-with-optval-null.patch b/queue-5.4/bpf-don-t-efault-for-getsockopt-with-optval-null.patch new file mode 100644 index 00000000000..cc02a6d3665 --- /dev/null +++ b/queue-5.4/bpf-don-t-efault-for-getsockopt-with-optval-null.patch @@ -0,0 +1,55 @@ +From 01647a5393028bcde1e007d9caefa4f4d4d2c30b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 15:53:38 -0700 +Subject: bpf: Don't EFAULT for getsockopt with optval=NULL + +From: Stanislav Fomichev + +[ Upstream commit 00e74ae0863827d944e36e56a4ce1e77e50edb91 ] + +Some socket options do getsockopt with optval=NULL to estimate the size +of the final buffer (which is returned via optlen). This breaks BPF +getsockopt assumptions about permitted optval buffer size. Let's enforce +these assumptions only when non-NULL optval is provided. + +Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks") +Reported-by: Martin KaFai Lau +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/ZD7Js4fj5YyI2oLd@google.com/T/#mb68daf700f87a9244a15d01d00c3f0e5b08f49f7 +Link: https://lore.kernel.org/bpf/20230418225343.553806-2-sdf@google.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/cgroup.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index c2f0aa818b7af..08c1246c758ea 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -1131,7 +1131,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + goto out; + } + +- if (ctx.optlen > max_optlen || ctx.optlen < 0) { ++ if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) { + ret = -EFAULT; + goto out; + } +@@ -1145,8 +1145,11 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level, + } + + if (ctx.optlen != 0) { +- if (copy_to_user(optval, ctx.optval, ctx.optlen) || +- put_user(ctx.optlen, optlen)) { ++ if (optval && copy_to_user(optval, ctx.optval, ctx.optlen)) { ++ ret = -EFAULT; ++ goto out; ++ } ++ if (put_user(ctx.optlen, optlen)) { + ret = -EFAULT; + goto out; + } +-- +2.39.2 + diff --git a/queue-5.4/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch b/queue-5.4/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch new file mode 100644 index 00000000000..2b958a7a314 --- /dev/null +++ b/queue-5.4/bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch @@ -0,0 +1,83 @@ +From e3d86fe224f93df47cf4b38d773e24bada9dd250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 20:26:22 +0800 +Subject: bpf, sockmap: fix deadlocks in the sockhash and sockmap + +From: Xin Liu + +[ Upstream commit ed17aa92dc56b6d8883e4b7a8f1c6fbf5ed6cd29 ] + +When huang uses sched_switch tracepoint, the tracepoint +does only one thing in the mounted ebpf program, which +deletes the fixed elements in sockhash ([0]) + +It seems that elements in sockhash are rarely actively +deleted by users or ebpf program. Therefore, we do not +pay much attention to their deletion. Compared with hash +maps, sockhash only provides spin_lock_bh protection. +This causes it to appear to have self-locking behavior +in the interrupt context. + + [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/ + +Reported-by: Hsin-Wei Hung +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Xin Liu +Acked-by: John Fastabend +Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index 5bce6d4d20573..78f2b6b265b2a 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -322,8 +322,9 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + { + struct sock *sk; + int err = 0; ++ unsigned long flags; + +- raw_spin_lock_bh(&stab->lock); ++ raw_spin_lock_irqsave(&stab->lock, flags); + sk = *psk; + if (!sk_test || sk_test == sk) + sk = xchg(psk, NULL); +@@ -333,7 +334,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + else + err = -EINVAL; + +- raw_spin_unlock_bh(&stab->lock); ++ raw_spin_unlock_irqrestore(&stab->lock, flags); + return err; + } + +@@ -655,11 +656,12 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + struct bpf_htab_bucket *bucket; + struct bpf_htab_elem *elem; + int ret = -ENOENT; ++ unsigned long flags; + + hash = sock_hash_bucket_hash(key, key_size); + bucket = sock_hash_select_bucket(htab, hash); + +- raw_spin_lock_bh(&bucket->lock); ++ raw_spin_lock_irqsave(&bucket->lock, flags); + elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size); + if (elem) { + hlist_del_rcu(&elem->node); +@@ -667,7 +669,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + sock_hash_free_elem(htab, elem); + ret = 0; + } +- raw_spin_unlock_bh(&bucket->lock); ++ raw_spin_unlock_irqrestore(&bucket->lock, flags); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.4/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch b/queue-5.4/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch new file mode 100644 index 00000000000..8a007e8524e --- /dev/null +++ b/queue-5.4/bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch @@ -0,0 +1,101 @@ +From 658fe6b83bdfb06c0abf45caa449aac0285f7899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 20:28:42 +0200 +Subject: bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap + +From: Daniel Borkmann + +[ Upstream commit 8c5c2a4898e3d6bad86e29d471e023c8a19ba799 ] + +syzbot reported a splat and bisected it to recent commit ed17aa92dc56 ("bpf, +sockmap: fix deadlocks in the sockhash and sockmap"): + + [...] + WARNING: CPU: 1 PID: 9280 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 + Modules linked in: + CPU: 1 PID: 9280 Comm: syz-executor.1 Not tainted 6.2.0-syzkaller-13249-gd319f344561d #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 + RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376 + [...] + Call Trace: + + spin_unlock_bh include/linux/spinlock.h:395 [inline] + sock_map_del_link+0x2ea/0x510 net/core/sock_map.c:165 + sock_map_unref+0xb0/0x1d0 net/core/sock_map.c:184 + sock_hash_delete_elem+0x1ec/0x2a0 net/core/sock_map.c:945 + map_delete_elem kernel/bpf/syscall.c:1536 [inline] + __sys_bpf+0x2edc/0x53e0 kernel/bpf/syscall.c:5053 + __do_sys_bpf kernel/bpf/syscall.c:5166 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5164 [inline] + __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5164 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + RIP: 0033:0x7fe8f7c8c169 + + [...] + +Revert for now until we have a proper solution. + +Fixes: ed17aa92dc56 ("bpf, sockmap: fix deadlocks in the sockhash and sockmap") +Reported-by: syzbot+49f6cef45247ff249498@syzkaller.appspotmail.com +Cc: Hsin-Wei Hung +Cc: Xin Liu +Cc: John Fastabend +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/000000000000f1db9605f939720e@google.com/ +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index 78f2b6b265b2a..5bce6d4d20573 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -322,9 +322,8 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + { + struct sock *sk; + int err = 0; +- unsigned long flags; + +- raw_spin_lock_irqsave(&stab->lock, flags); ++ raw_spin_lock_bh(&stab->lock); + sk = *psk; + if (!sk_test || sk_test == sk) + sk = xchg(psk, NULL); +@@ -334,7 +333,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + else + err = -EINVAL; + +- raw_spin_unlock_irqrestore(&stab->lock, flags); ++ raw_spin_unlock_bh(&stab->lock); + return err; + } + +@@ -656,12 +655,11 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + struct bpf_htab_bucket *bucket; + struct bpf_htab_elem *elem; + int ret = -ENOENT; +- unsigned long flags; + + hash = sock_hash_bucket_hash(key, key_size); + bucket = sock_hash_select_bucket(htab, hash); + +- raw_spin_lock_irqsave(&bucket->lock, flags); ++ raw_spin_lock_bh(&bucket->lock); + elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size); + if (elem) { + hlist_del_rcu(&elem->node); +@@ -669,7 +667,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key) + sock_hash_free_elem(htab, elem); + ret = 0; + } +- raw_spin_unlock_irqrestore(&bucket->lock, flags); ++ raw_spin_unlock_bh(&bucket->lock); + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.4/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch b/queue-5.4/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch new file mode 100644 index 00000000000..cce51639310 --- /dev/null +++ b/queue-5.4/bpftool-fix-bug-for-long-instructions-in-program-cfg.patch @@ -0,0 +1,46 @@ +From 6212176573d42400f51785571278d3df7debf017 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 14:21:15 +0100 +Subject: bpftool: Fix bug for long instructions in program CFG dumps + +From: Quentin Monnet + +[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ] + +When dumping the control flow graphs for programs using the 16-byte long +load instruction, we need to skip the second part of this instruction +when looking for the next instruction to process. Otherwise, we end up +printing "BUG_ld_00" from the kernel disassembler in the CFG. + +Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information") +Signed-off-by: Quentin Monnet +Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/xlated_dumper.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c +index 5b91ee65a0802..762ca450d1980 100644 +--- a/tools/bpf/bpftool/xlated_dumper.c ++++ b/tools/bpf/bpftool/xlated_dumper.c +@@ -363,8 +363,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end, + struct bpf_insn *insn_start = buf_start; + struct bpf_insn *insn_end = buf_end; + struct bpf_insn *cur = insn_start; ++ bool double_insn = false; + + for (; cur <= insn_end; cur++) { ++ if (double_insn) { ++ double_insn = false; ++ continue; ++ } ++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW); ++ + printf("% 4d: ", (int)(cur - insn_start + start_idx)); + print_bpf_insn(&cbs, cur, true); + if (cur != insn_end) +-- +2.39.2 + diff --git a/queue-5.4/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch b/queue-5.4/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch new file mode 100644 index 00000000000..3ea0738f4e0 --- /dev/null +++ b/queue-5.4/clk-add-missing-of_node_put-in-assigned-clocks-prope.patch @@ -0,0 +1,74 @@ +From 1f99292ffd01cf8972d848a1194409ba39382630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jan 2023 09:32:27 +0100 +Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Léger + +[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ] + +When returning from of_parse_phandle_with_args(), the np member of the +of_phandle_args structure should be put after usage. Add missing +of_node_put() calls in both __set_clk_parents() and __set_clk_rates(). + +Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree") +Signed-off-by: Clément Léger +Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-conf.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c +index 2ef819606c417..1a4e6340f95ce 100644 +--- a/drivers/clk/clk-conf.c ++++ b/drivers/clk/clk-conf.c +@@ -33,9 +33,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + pclk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(pclk)) { + if (PTR_ERR(pclk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get parent clock %d for %pOF\n", +@@ -48,10 +51,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier) + if (rc < 0) + goto err; + if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + rc = 0; + goto err; + } + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get assigned clock %d for %pOF\n", +@@ -93,10 +98,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier) + else + return rc; + } +- if (clkspec.np == node && !clk_supplier) ++ if (clkspec.np == node && !clk_supplier) { ++ of_node_put(clkspec.np); + return 0; ++ } + + clk = of_clk_get_from_provider(&clkspec); ++ of_node_put(clkspec.np); + if (IS_ERR(clk)) { + if (PTR_ERR(clk) != -EPROBE_DEFER) + pr_warn("clk: couldn't get clock %d for %pOF\n", +-- +2.39.2 + diff --git a/queue-5.4/clocksource-davinci-axe-a-pointless-__gfp_nofail.patch b/queue-5.4/clocksource-davinci-axe-a-pointless-__gfp_nofail.patch new file mode 100644 index 00000000000..16fddb57087 --- /dev/null +++ b/queue-5.4/clocksource-davinci-axe-a-pointless-__gfp_nofail.patch @@ -0,0 +1,37 @@ +From 1f77d308061cd7a80d669addae17306f884ac774 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Apr 2020 12:12:26 +0200 +Subject: clocksource: davinci: axe a pointless __GFP_NOFAIL + +From: Christophe JAILLET + +[ Upstream commit 4855f2bd91b6e3461af7d795bfe9a40420122131 ] + +There is no need to specify __GFP_NOFAIL when allocating memory here, so +axe it. + +Signed-off-by: Christophe JAILLET +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200409101226.15432-1-christophe.jaillet@wanadoo.fr +Stable-dep-of: fb73556386e0 ("clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails") +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-davinci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c +index aae9383682303..bb4eee31ae082 100644 +--- a/drivers/clocksource/timer-davinci.c ++++ b/drivers/clocksource/timer-davinci.c +@@ -270,7 +270,7 @@ int __init davinci_timer_register(struct clk *clk, + davinci_timer_init(base); + tick_rate = clk_get_rate(clk); + +- clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL | __GFP_NOFAIL); ++ clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL); + if (!clockevent) + return -ENOMEM; + +-- +2.39.2 + diff --git a/queue-5.4/clocksource-drivers-davinci-avoid-trailing-n-hidden-.patch b/queue-5.4/clocksource-drivers-davinci-avoid-trailing-n-hidden-.patch new file mode 100644 index 00000000000..0d6bc1e814d --- /dev/null +++ b/queue-5.4/clocksource-drivers-davinci-avoid-trailing-n-hidden-.patch @@ -0,0 +1,122 @@ +From 8628e6f21d6952bf80721a1f83fae6022791c894 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Apr 2020 11:25:43 +0200 +Subject: clocksource/drivers/davinci: Avoid trailing '\n' hidden in pr_fmt() + +From: Christophe JAILLET + +[ Upstream commit bdf8783c0dae9d3d8fc1c4078fe849ab8aa8b583 ] + +pr_xxx() functions usually have '\n' at the end of the logging message. +Here, this '\n' is added via the 'pr_fmt' macro. + +In order to be more consistent with other files, use a more standard +convention and put these '\n' back in the messages themselves and remove it +from the pr_fmt macro. + +While at it, remove a useless message in case of 'kzalloc' failure, +especially with a __GFP_NOFAIL flag. + +Signed-off-by: Christophe JAILLET +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200409092543.14727-1-christophe.jaillet@wanadoo.fr +Stable-dep-of: fb73556386e0 ("clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails") +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-davinci.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c +index e421946a91c5a..aae9383682303 100644 +--- a/drivers/clocksource/timer-davinci.c ++++ b/drivers/clocksource/timer-davinci.c +@@ -18,7 +18,7 @@ + #include + + #undef pr_fmt +-#define pr_fmt(fmt) "%s: " fmt "\n", __func__ ++#define pr_fmt(fmt) "%s: " fmt, __func__ + + #define DAVINCI_TIMER_REG_TIM12 0x10 + #define DAVINCI_TIMER_REG_TIM34 0x14 +@@ -250,20 +250,20 @@ int __init davinci_timer_register(struct clk *clk, + + rv = clk_prepare_enable(clk); + if (rv) { +- pr_err("Unable to prepare and enable the timer clock"); ++ pr_err("Unable to prepare and enable the timer clock\n"); + return rv; + } + + if (!request_mem_region(timer_cfg->reg.start, + resource_size(&timer_cfg->reg), + "davinci-timer")) { +- pr_err("Unable to request memory region"); ++ pr_err("Unable to request memory region\n"); + return -EBUSY; + } + + base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg)); + if (!base) { +- pr_err("Unable to map the register range"); ++ pr_err("Unable to map the register range\n"); + return -ENOMEM; + } + +@@ -271,10 +271,8 @@ int __init davinci_timer_register(struct clk *clk, + tick_rate = clk_get_rate(clk); + + clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL | __GFP_NOFAIL); +- if (!clockevent) { +- pr_err("Error allocating memory for clockevent data"); ++ if (!clockevent) + return -ENOMEM; +- } + + clockevent->dev.name = "tim12"; + clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT; +@@ -298,7 +296,7 @@ int __init davinci_timer_register(struct clk *clk, + davinci_timer_irq_timer, IRQF_TIMER, + "clockevent/tim12", clockevent); + if (rv) { +- pr_err("Unable to request the clockevent interrupt"); ++ pr_err("Unable to request the clockevent interrupt\n"); + return rv; + } + +@@ -325,7 +323,7 @@ int __init davinci_timer_register(struct clk *clk, + + rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate); + if (rv) { +- pr_err("Unable to register clocksource"); ++ pr_err("Unable to register clocksource\n"); + return rv; + } + +@@ -343,20 +341,20 @@ static int __init of_davinci_timer_register(struct device_node *np) + + rv = of_address_to_resource(np, 0, &timer_cfg.reg); + if (rv) { +- pr_err("Unable to get the register range for timer"); ++ pr_err("Unable to get the register range for timer\n"); + return rv; + } + + rv = of_irq_to_resource_table(np, timer_cfg.irq, + DAVINCI_TIMER_NUM_IRQS); + if (rv != DAVINCI_TIMER_NUM_IRQS) { +- pr_err("Unable to get the interrupts for timer"); ++ pr_err("Unable to get the interrupts for timer\n"); + return rv; + } + + clk = of_clk_get(np, 0); + if (IS_ERR(clk)) { +- pr_err("Unable to get the timer clock"); ++ pr_err("Unable to get the timer clock\n"); + return PTR_ERR(clk); + } + +-- +2.39.2 + diff --git a/queue-5.4/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch b/queue-5.4/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch new file mode 100644 index 00000000000..10701673a6d --- /dev/null +++ b/queue-5.4/clocksource-drivers-davinci-fix-memory-leak-in-davin.patch @@ -0,0 +1,101 @@ +From b3ab4e8875be6b52b5f8417e73e7aa540a9fb9e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 13:50:37 +0000 +Subject: clocksource/drivers/davinci: Fix memory leak in + davinci_timer_register when init fails + +From: Qinrun Dai + +[ Upstream commit fb73556386e074e9bee9fa2d253aeaefe4e063e0 ] + +Smatch reports: +drivers/clocksource/timer-davinci.c:332 davinci_timer_register() +warn: 'base' from ioremap() not released on lines: 274. + +Fix this and other potential memory leak problems +by adding a set of corresponding exit lables. + +Fixes: 721154f972aa ("clocksource/drivers/davinci: Add support for clockevents") +Signed-off-by: Qinrun Dai +Link: https://lore.kernel.org/r/20230413135037.1505799-1-flno@hust.edu.cn +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-davinci.c | 30 +++++++++++++++++++++++------ + 1 file changed, 24 insertions(+), 6 deletions(-) + +diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c +index bb4eee31ae082..3dc0c6ceed027 100644 +--- a/drivers/clocksource/timer-davinci.c ++++ b/drivers/clocksource/timer-davinci.c +@@ -258,21 +258,25 @@ int __init davinci_timer_register(struct clk *clk, + resource_size(&timer_cfg->reg), + "davinci-timer")) { + pr_err("Unable to request memory region\n"); +- return -EBUSY; ++ rv = -EBUSY; ++ goto exit_clk_disable; + } + + base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg)); + if (!base) { + pr_err("Unable to map the register range\n"); +- return -ENOMEM; ++ rv = -ENOMEM; ++ goto exit_mem_region; + } + + davinci_timer_init(base); + tick_rate = clk_get_rate(clk); + + clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL); +- if (!clockevent) +- return -ENOMEM; ++ if (!clockevent) { ++ rv = -ENOMEM; ++ goto exit_iounmap_base; ++ } + + clockevent->dev.name = "tim12"; + clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT; +@@ -297,7 +301,7 @@ int __init davinci_timer_register(struct clk *clk, + "clockevent/tim12", clockevent); + if (rv) { + pr_err("Unable to request the clockevent interrupt\n"); +- return rv; ++ goto exit_free_clockevent; + } + + davinci_clocksource.dev.rating = 300; +@@ -324,13 +328,27 @@ int __init davinci_timer_register(struct clk *clk, + rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate); + if (rv) { + pr_err("Unable to register clocksource\n"); +- return rv; ++ goto exit_free_irq; + } + + sched_clock_register(davinci_timer_read_sched_clock, + DAVINCI_TIMER_CLKSRC_BITS, tick_rate); + + return 0; ++ ++exit_free_irq: ++ free_irq(timer_cfg->irq[DAVINCI_TIMER_CLOCKEVENT_IRQ].start, ++ clockevent); ++exit_free_clockevent: ++ kfree(clockevent); ++exit_iounmap_base: ++ iounmap(base); ++exit_mem_region: ++ release_mem_region(timer_cfg->reg.start, ++ resource_size(&timer_cfg->reg)); ++exit_clk_disable: ++ clk_disable_unprepare(clk); ++ return rv; + } + + static int __init of_davinci_timer_register(struct device_node *np) +-- +2.39.2 + diff --git a/queue-5.4/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch b/queue-5.4/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch new file mode 100644 index 00000000000..1b1da2b4e3e --- /dev/null +++ b/queue-5.4/crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch @@ -0,0 +1,68 @@ +From 8118937dcd9b30a38a02bca18bac3529b957735b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 15:18:08 +0100 +Subject: crypto: drbg - make drbg_prepare_hrng() handle jent instantiation + errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nicolai Stange + +[ Upstream commit 559edd47cce4cc407d606b4d7f376822816fd4b8 ] + +Now that drbg_prepare_hrng() doesn't do anything but to instantiate a +jitterentropy crypto_rng instance, it looks a little odd to have the +related error handling at its only caller, drbg_instantiate(). + +Move the handling of jitterentropy allocation failures from +drbg_instantiate() close to the allocation itself in drbg_prepare_hrng(). + +There is no change in behaviour. + +Signed-off-by: Nicolai Stange +Reviewed-by: Stephan Müller +Signed-off-by: Herbert Xu +Stable-dep-of: 686cd976b6dd ("crypto: drbg - Only fail when jent is unavailable in FIPS mode") +Signed-off-by: Sasha Levin +--- + crypto/drbg.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/crypto/drbg.c b/crypto/drbg.c +index 9329d9dcc210f..732b72e4ee4dd 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1515,6 +1515,14 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) + return 0; + + drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0); ++ if (IS_ERR(drbg->jent)) { ++ const int err = PTR_ERR(drbg->jent); ++ ++ drbg->jent = NULL; ++ if (fips_enabled || err != -ENOENT) ++ return err; ++ pr_info("DRBG: Continuing without Jitter RNG\n"); ++ } + + return 0; + } +@@ -1570,14 +1578,6 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, + if (ret) + goto free_everything; + +- if (IS_ERR(drbg->jent)) { +- ret = PTR_ERR(drbg->jent); +- drbg->jent = NULL; +- if (fips_enabled || ret != -ENOENT) +- goto free_everything; +- pr_info("DRBG: Continuing without Jitter RNG\n"); +- } +- + reseed = false; + } + +-- +2.39.2 + diff --git a/queue-5.4/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch b/queue-5.4/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch new file mode 100644 index 00000000000..f1adddd95d9 --- /dev/null +++ b/queue-5.4/crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch @@ -0,0 +1,41 @@ +From 31ece2cd74e85b74397a60d09304988a70f825cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 11:35:23 +0800 +Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode + +From: Herbert Xu + +[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] + +When jent initialisation fails for any reason other than ENOENT, +the entire drbg fails to initialise, even when we're not in FIPS +mode. This is wrong because we can still use the kernel RNG when +we're not in FIPS mode. + +Change it so that it only fails when we are in FIPS mode. + +Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") +Signed-off-by: Herbert Xu +Reviewed-by: Stephan Mueller +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/drbg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/drbg.c b/crypto/drbg.c +index 732b72e4ee4dd..df80752fb649b 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1519,7 +1519,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg) + const int err = PTR_ERR(drbg->jent); + + drbg->jent = NULL; +- if (fips_enabled || err != -ENOENT) ++ if (fips_enabled) + return err; + pr_info("DRBG: Continuing without Jitter RNG\n"); + } +-- +2.39.2 + diff --git a/queue-5.4/debugobject-prevent-init-race-with-static-objects.patch b/queue-5.4/debugobject-prevent-init-race-with-static-objects.patch new file mode 100644 index 00000000000..fd3a8d4d876 --- /dev/null +++ b/queue-5.4/debugobject-prevent-init-race-with-static-objects.patch @@ -0,0 +1,283 @@ +From 4c5eef0063529ea25571180a3031374baa794a50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 09:54:39 +0200 +Subject: debugobject: Prevent init race with static objects + +From: Thomas Gleixner + +[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ] + +Statically initialized objects are usually not initialized via the init() +function of the subsystem. They are special cased and the subsystem +provides a function to validate whether an object which is not yet tracked +by debugobjects is statically initialized. This means the object is started +to be tracked on first use, e.g. activation. + +This works perfectly fine, unless there are two concurrent operations on +that object. Schspa decoded the problem: + +T0 T1 + +debug_object_assert_init(addr) + lock_hash_bucket() + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + - > preemption + lock_subsytem_object(addr); + activate_object(addr) + lock_hash_bucket(); + obj = lookup_object(addr); + if (!obj) { + unlock_hash_bucket(); + if (is_static_object(addr)) + init_and_track(addr); + lock_hash_bucket(); + obj = lookup_object(addr); + obj->state = ACTIVATED; + unlock_hash_bucket(); + + subsys function modifies content of addr, + so static object detection does + not longer work. + + unlock_subsytem_object(addr); + + if (is_static_object(addr)) <- Fails + + debugobject emits a warning and invokes the fixup function which + reinitializes the already active object in the worst case. + +This race exists forever, but was never observed until mod_timer() got a +debug_object_assert_init() added which is outside of the timer base lock +held section right at the beginning of the function to cover the lockless +early exit points too. + +Rework the code so that the lookup, the static object check and the +tracking object association happens atomically under the hash bucket +lock. This prevents the issue completely as all callers are serialized on +the hash bucket lock and therefore cannot observe inconsistent state. + +Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects") +Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com +Debugged-by: Schspa Shi +Signed-off-by: Thomas Gleixner +Reviewed-by: Stephen Boyd +Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462 +Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com +Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx +Signed-off-by: Sasha Levin +--- + lib/debugobjects.c | 125 ++++++++++++++++++++++++--------------------- + 1 file changed, 66 insertions(+), 59 deletions(-) + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index 48054dbf1b51f..c7cebd2abf482 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -218,10 +218,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list) + return obj; + } + +-/* +- * Allocate a new object. If the pool is empty, switch off the debugger. +- * Must be called with interrupts disabled. +- */ + static struct debug_obj * + alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr) + { +@@ -528,11 +524,49 @@ static void debug_object_is_on_stack(void *addr, int onstack) + WARN_ON(1); + } + ++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b, ++ struct debug_obj_descr *descr, ++ bool onstack, bool alloc_ifstatic) ++{ ++ struct debug_obj *obj = lookup_object(addr, b); ++ enum debug_obj_state state = ODEBUG_STATE_NONE; ++ ++ if (likely(obj)) ++ return obj; ++ ++ /* ++ * debug_object_init() unconditionally allocates untracked ++ * objects. It does not matter whether it is a static object or ++ * not. ++ * ++ * debug_object_assert_init() and debug_object_activate() allow ++ * allocation only if the descriptor callback confirms that the ++ * object is static and considered initialized. For non-static ++ * objects the allocation needs to be done from the fixup callback. ++ */ ++ if (unlikely(alloc_ifstatic)) { ++ if (!descr->is_static_object || !descr->is_static_object(addr)) ++ return ERR_PTR(-ENOENT); ++ /* Statically allocated objects are considered initialized */ ++ state = ODEBUG_STATE_INIT; ++ } ++ ++ obj = alloc_object(addr, b, descr); ++ if (likely(obj)) { ++ obj->state = state; ++ debug_object_is_on_stack(addr, onstack); ++ return obj; ++ } ++ ++ /* Out of memory. Do the cleanup outside of the locked region */ ++ debug_objects_enabled = 0; ++ return NULL; ++} ++ + static void + __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + { + enum debug_obj_state state; +- bool check_stack = false; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -543,16 +577,11 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (!obj) { +- obj = alloc_object(addr, db, descr); +- if (!obj) { +- debug_objects_enabled = 0; +- raw_spin_unlock_irqrestore(&db->lock, flags); +- debug_objects_oom(); +- return; +- } +- check_stack = true; ++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false); ++ if (unlikely(!obj)) { ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ debug_objects_oom(); ++ return; + } + + switch (obj->state) { +@@ -578,8 +607,6 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack) + } + + raw_spin_unlock_irqrestore(&db->lock, flags); +- if (check_stack) +- debug_object_is_on_stack(addr, onstack); + } + + /** +@@ -619,14 +646,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack); + */ + int debug_object_activate(void *addr, struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + enum debug_obj_state state; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; + int ret; +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; + + if (!debug_objects_enabled) + return 0; +@@ -635,8 +660,8 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr) + + raw_spin_lock_irqsave(&db->lock, flags); + +- obj = lookup_object(addr, db); +- if (obj) { ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ if (likely(!IS_ERR_OR_NULL(obj))) { + bool print_object = false; + + switch (obj->state) { +@@ -669,24 +694,16 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr) + + raw_spin_unlock_irqrestore(&db->lock, flags); + +- /* +- * We are here when a static object is activated. We +- * let the type specific code confirm whether this is +- * true or not. if true, we just make sure that the +- * static object is tracked in the object tracker. If +- * not, this must be a bug, so we try to fix it up. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* track this static object */ +- debug_object_init(addr, descr); +- debug_object_activate(addr, descr); +- } else { +- debug_print_object(&o, "activate"); +- ret = debug_object_fixup(descr->fixup_activate, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- return ret ? 0 : -EINVAL; ++ /* If NULL the allocation has hit OOM */ ++ if (!obj) { ++ debug_objects_oom(); ++ return 0; + } +- return 0; ++ ++ /* Object is neither static nor tracked. It's not initialized */ ++ debug_print_object(&o, "activate"); ++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE); ++ return ret ? 0 : -EINVAL; + } + EXPORT_SYMBOL_GPL(debug_object_activate); + +@@ -840,6 +857,7 @@ EXPORT_SYMBOL_GPL(debug_object_free); + */ + void debug_object_assert_init(void *addr, struct debug_obj_descr *descr) + { ++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr }; + struct debug_bucket *db; + struct debug_obj *obj; + unsigned long flags; +@@ -850,31 +868,20 @@ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr) + db = get_bucket((unsigned long) addr); + + raw_spin_lock_irqsave(&db->lock, flags); ++ obj = lookup_object_or_alloc(addr, db, descr, false, true); ++ raw_spin_unlock_irqrestore(&db->lock, flags); ++ if (likely(!IS_ERR_OR_NULL(obj))) ++ return; + +- obj = lookup_object(addr, db); ++ /* If NULL the allocation has hit OOM */ + if (!obj) { +- struct debug_obj o = { .object = addr, +- .state = ODEBUG_STATE_NOTAVAILABLE, +- .descr = descr }; +- +- raw_spin_unlock_irqrestore(&db->lock, flags); +- /* +- * Maybe the object is static, and we let the type specific +- * code confirm. Track this static object if true, else invoke +- * fixup. +- */ +- if (descr->is_static_object && descr->is_static_object(addr)) { +- /* Track this static object */ +- debug_object_init(addr, descr); +- } else { +- debug_print_object(&o, "assert_init"); +- debug_object_fixup(descr->fixup_assert_init, addr, +- ODEBUG_STATE_NOTAVAILABLE); +- } ++ debug_objects_oom(); + return; + } + +- raw_spin_unlock_irqrestore(&db->lock, flags); ++ /* Object is neither tracked nor static. It's not initialized. */ ++ debug_print_object(&o, "assert_init"); ++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE); + } + EXPORT_SYMBOL_GPL(debug_object_assert_init); + +-- +2.39.2 + diff --git a/queue-5.4/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch b/queue-5.4/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch new file mode 100644 index 00000000000..84756c55a4e --- /dev/null +++ b/queue-5.4/dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch @@ -0,0 +1,55 @@ +From c4f498c890ef43c0f9b70e9e4ba848bf13701e3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Feb 2023 17:18:25 +0200 +Subject: dmaengine: at_xdmac: do not enable all cyclic channels + +From: Claudiu Beznea + +[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ] + +Do not global enable all the cyclic channels in at_xdmac_resume(). Instead +save the global status in at_xdmac_suspend() and re-enable the cyclic +channel only if it was active before suspend. + +Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_xdmac.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index a406b3c0d170a..fdf3b5be2d50d 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -212,6 +212,7 @@ struct at_xdmac { + int irq; + struct clk *clk; + u32 save_gim; ++ u32 save_gs; + struct dma_pool *at_xdmac_desc_pool; + struct at_xdmac_chan chan[0]; + }; +@@ -1922,6 +1923,7 @@ static int atmel_xdmac_suspend(struct device *dev) + } + } + atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM); ++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS); + + at_xdmac_off(atxdmac); + clk_disable_unprepare(atxdmac->clk); +@@ -1958,7 +1960,8 @@ static int atmel_xdmac_resume(struct device *dev) + at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc); + at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim); + wmb(); +- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); ++ if (atxdmac->save_gs & atchan->mask) ++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask); + } + } + return 0; +-- +2.39.2 + diff --git a/queue-5.4/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch b/queue-5.4/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch new file mode 100644 index 00000000000..a856af38357 --- /dev/null +++ b/queue-5.4/dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch @@ -0,0 +1,90 @@ +From 7efc73b82b03b74392db3a780cdcd7e6b8f43dbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 19:17:57 +0900 +Subject: dmaengine: dw-edma: Fix to change for continuous transfer + +From: Shunsuke Mie + +[ Upstream commit a251994a441ee0a69ba7062c8cd2d08ead3db379 ] + +The dw-edma driver stops after processing a DMA request even if a request +remains in the issued queue, which is not the expected behavior. The DMA +engine API requires continuous processing. + +Add a trigger to start after one processing finished if there are requests +remain. + +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Signed-off-by: Shunsuke Mie +Link: https://lore.kernel.org/r/20230411101758.438472-1-mie@igel.co.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-core.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index afbd1a4590192..ff6e8cf641dbc 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -165,7 +165,7 @@ static void vchan_free_desc(struct virt_dma_desc *vdesc) + dw_edma_free_desc(vd2dw_edma_desc(vdesc)); + } + +-static void dw_edma_start_transfer(struct dw_edma_chan *chan) ++static int dw_edma_start_transfer(struct dw_edma_chan *chan) + { + struct dw_edma_chunk *child; + struct dw_edma_desc *desc; +@@ -173,16 +173,16 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan) + + vd = vchan_next_desc(&chan->vc); + if (!vd) +- return; ++ return 0; + + desc = vd2dw_edma_desc(vd); + if (!desc) +- return; ++ return 0; + + child = list_first_entry_or_null(&desc->chunk->list, + struct dw_edma_chunk, list); + if (!child) +- return; ++ return 0; + + dw_edma_v0_core_start(child, !desc->xfer_sz); + desc->xfer_sz += child->ll_region.sz; +@@ -190,6 +190,8 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan) + list_del(&child->list); + kfree(child); + desc->chunks_alloc--; ++ ++ return 1; + } + + static int dw_edma_device_config(struct dma_chan *dchan, +@@ -483,14 +485,14 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan) + switch (chan->request) { + case EDMA_REQ_NONE: + desc = vd2dw_edma_desc(vd); +- if (desc->chunks_alloc) { +- chan->status = EDMA_ST_BUSY; +- dw_edma_start_transfer(chan); +- } else { ++ if (!desc->chunks_alloc) { + list_del(&vd->node); + vchan_cookie_complete(vd); +- chan->status = EDMA_ST_IDLE; + } ++ ++ /* Continue transferring if there are remaining chunks or issued requests. ++ */ ++ chan->status = dw_edma_start_transfer(chan) ? EDMA_ST_BUSY : EDMA_ST_IDLE; + break; + + case EDMA_REQ_STOP: +-- +2.39.2 + diff --git a/queue-5.4/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch b/queue-5.4/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch new file mode 100644 index 00000000000..6c44ecf3478 --- /dev/null +++ b/queue-5.4/dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch @@ -0,0 +1,44 @@ +From 568bcbd78afe3fef6b221310d4387f592e070069 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 19:17:58 +0900 +Subject: dmaengine: dw-edma: Fix to enable to issue dma request on DMA + processing + +From: Shunsuke Mie + +[ Upstream commit 970b17dfe264a9085ba4e593730ecfd496b950ab ] + +The issue_pending request is ignored while driver is processing a DMA +request. Fix to issue the pending requests on any dma channel status. + +Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") +Signed-off-by: Shunsuke Mie +Link: https://lore.kernel.org/r/20230411101758.438472-2-mie@igel.co.jp +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw-edma/dw-edma-core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c +index ff6e8cf641dbc..25d65f64cd507 100644 +--- a/drivers/dma/dw-edma/dw-edma-core.c ++++ b/drivers/dma/dw-edma/dw-edma-core.c +@@ -275,9 +275,12 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan) + struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan); + unsigned long flags; + ++ if (!chan->configured) ++ return; ++ + spin_lock_irqsave(&chan->vc.lock, flags); +- if (chan->configured && chan->request == EDMA_REQ_NONE && +- chan->status == EDMA_ST_IDLE && vchan_issue_pending(&chan->vc)) { ++ if (vchan_issue_pending(&chan->vc) && chan->request == EDMA_REQ_NONE && ++ chan->status == EDMA_ST_IDLE) { + chan->status = EDMA_ST_BUSY; + dw_edma_start_transfer(chan); + } +-- +2.39.2 + diff --git a/queue-5.4/dmaengine-mv_xor_v2-fix-an-error-code.patch b/queue-5.4/dmaengine-mv_xor_v2-fix-an-error-code.patch new file mode 100644 index 00000000000..4cec21c91e2 --- /dev/null +++ b/queue-5.4/dmaengine-mv_xor_v2-fix-an-error-code.patch @@ -0,0 +1,37 @@ +From 9c05f0b9b3b1177e627b24ce3dd1b5d40cb4d813 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 09:06:37 +0200 +Subject: dmaengine: mv_xor_v2: Fix an error code. + +From: Christophe JAILLET + +[ Upstream commit 827026ae2e56ec05ef1155661079badbbfc0b038 ] + +If the probe is deferred, -EPROBE_DEFER should be returned, not ++EPROBE_DEFER. + +Fixes: 3cd2c313f1d6 ("dmaengine: mv_xor_v2: Fix clock resource by adding a register clock") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/201170dff832a3c496d125772e10070cd834ebf2.1679814350.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mv_xor_v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index 741b7270a9f5f..e27df4fed0368 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -751,7 +751,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev) + + xor_dev->clk = devm_clk_get(&pdev->dev, NULL); + if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) { +- ret = EPROBE_DEFER; ++ ret = -EPROBE_DEFER; + goto disable_reg_clk; + } + if (!IS_ERR(xor_dev->clk)) { +-- +2.39.2 + diff --git a/queue-5.4/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch b/queue-5.4/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch new file mode 100644 index 00000000000..707872ac6c5 --- /dev/null +++ b/queue-5.4/drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch @@ -0,0 +1,45 @@ +From 4aaa2d2b92adfcdfb60cc7b038f99847dacca183 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 22:27:11 -0700 +Subject: drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe() + +From: Harshit Mogalapalli + +[ Upstream commit c5647cae2704e58d1c4e5fedbf63f11bca6376c9 ] + +Smatch reports: +drivers/gpu/drm/lima/lima_drv.c:396 lima_pdev_probe() warn: + missing unwind goto? + +Store return value in err and goto 'err_out0' which has +lima_sched_slab_fini() before returning. + +Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs") +Signed-off-by: Harshit Mogalapalli +Signed-off-by: Qiang Yu +Link: https://patchwork.freedesktop.org/patch/msgid/20230314052711.4061652-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/lima/lima_drv.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/lima/lima_drv.c b/drivers/gpu/drm/lima/lima_drv.c +index 75ec703d22e03..89513c7c50d55 100644 +--- a/drivers/gpu/drm/lima/lima_drv.c ++++ b/drivers/gpu/drm/lima/lima_drv.c +@@ -300,8 +300,10 @@ static int lima_pdev_probe(struct platform_device *pdev) + + /* Allocate and initialize the DRM device. */ + ddev = drm_dev_alloc(&lima_drm_driver, &pdev->dev); +- if (IS_ERR(ddev)) +- return PTR_ERR(ddev); ++ if (IS_ERR(ddev)) { ++ err = PTR_ERR(ddev); ++ goto err_out0; ++ } + + ddev->dev_private = ldev; + ldev->ddev = ddev; +-- +2.39.2 + diff --git a/queue-5.4/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch b/queue-5.4/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch new file mode 100644 index 00000000000..d9bfb974935 --- /dev/null +++ b/queue-5.4/drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch @@ -0,0 +1,62 @@ +From 169b195cfab01b4767d2a955743ff0cb14ddee65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2022 11:20:30 -0700 +Subject: drm/msm/adreno: Defer enabling runpm until hw_init() + +From: Rob Clark + +[ Upstream commit 4b18299b33655fa9672b774b6df774dc03d6aee8 ] + +To avoid preventing the display from coming up before the rootfs is +mounted, without resorting to packing fw in the initrd, the GPU has +this limbo state where the device is probed, but we aren't ready to +start sending commands to it. This is particularly problematic for +a6xx, since the GMU (which requires fw to be loaded) is the one that +is controlling the power/clk/icc votes. + +So defer enabling runpm until we are ready to call gpu->hw_init(), +as that is a point where we know we have all the needed fw and are +ready to start sending commands to the coproc's. + +Signed-off-by: Rob Clark +Patchwork: https://patchwork.freedesktop.org/patch/489337/ +Link: https://lore.kernel.org/r/20220613182036.2567963-1-robdclark@gmail.com +Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_device.c | 6 ++++++ + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 - + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c +index 0888e0df660dd..6ad9d2de07ed6 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_device.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c +@@ -233,6 +233,12 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev) + if (ret) + return NULL; + ++ /* ++ * Now that we have firmware loaded, and are ready to begin ++ * booting the gpu, go ahead and enable runpm: ++ */ ++ pm_runtime_enable(&pdev->dev); ++ + /* Make sure pm runtime is active and reset any previous errors */ + pm_runtime_set_active(&pdev->dev); + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 0d9404d2afe4e..b472cbe6adff6 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -899,7 +899,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, + pm_runtime_set_autosuspend_delay(&pdev->dev, + adreno_gpu->info->inactive_period); + pm_runtime_use_autosuspend(&pdev->dev); +- pm_runtime_enable(&pdev->dev); + + return msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base, + adreno_gpu->info->name, &adreno_gpu_config); +-- +2.39.2 + diff --git a/queue-5.4/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch b/queue-5.4/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch new file mode 100644 index 00000000000..0f35f18458d --- /dev/null +++ b/queue-5.4/drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch @@ -0,0 +1,42 @@ +From d52725212577fe96a403d3abb373ee5577f97e67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 17:48:06 +0100 +Subject: drm/msm/adreno: drop bogus pm_runtime_set_active() + +From: Johan Hovold + +[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ] + +The runtime PM status can only be updated while runtime PM is disabled. + +Drop the bogus pm_runtime_set_active() call that was made after enabling +runtime PM and which (incidentally but correctly) left the runtime PM +status set to 'suspended'. + +Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware") +Signed-off-by: Johan Hovold +Patchwork: https://patchwork.freedesktop.org/patch/524972/ +Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_device.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c +index 6ad9d2de07ed6..2a727ab0faf75 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_device.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c +@@ -239,9 +239,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev) + */ + pm_runtime_enable(&pdev->dev); + +- /* Make sure pm runtime is active and reset any previous errors */ +- pm_runtime_set_active(&pdev->dev); +- + ret = pm_runtime_get_sync(&pdev->dev); + if (ret < 0) { + pm_runtime_put_sync(&pdev->dev); +-- +2.39.2 + diff --git a/queue-5.4/drm-msm-fix-unbalanced-pm_runtime_enable-in-adreno_g.patch b/queue-5.4/drm-msm-fix-unbalanced-pm_runtime_enable-in-adreno_g.patch new file mode 100644 index 00000000000..91f4911a92d --- /dev/null +++ b/queue-5.4/drm-msm-fix-unbalanced-pm_runtime_enable-in-adreno_g.patch @@ -0,0 +1,43 @@ +From 4c16e8b16b64768595e4c1e97e191eb0e18a8812 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2020 18:53:40 -0400 +Subject: drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init, + cleanup} + +From: Jonathan Marek + +[ Upstream commit 17e822f7591fb66162aca07685dc0b01468e5480 ] + +adreno_gpu_init calls pm_runtime_enable, so adreno_gpu_cleanup needs to +call pm_runtime_disable. + +Signed-off-by: Jonathan Marek +Signed-off-by: Rob Clark +Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 3802ad38c519c..0d9404d2afe4e 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -908,11 +908,14 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev, + void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu) + { + struct msm_gpu *gpu = &adreno_gpu->base; ++ struct msm_drm_private *priv = gpu->dev->dev_private; + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++) + release_firmware(adreno_gpu->fw[i]); + ++ pm_runtime_disable(&priv->gpu_pdev->dev); ++ + icc_put(gpu->icc_path); + + msm_gpu_cleanup(&adreno_gpu->base); +-- +2.39.2 + diff --git a/queue-5.4/drm-probe-helper-cancel-previous-job-before-starting.patch b/queue-5.4/drm-probe-helper-cancel-previous-job-before-starting.patch new file mode 100644 index 00000000000..6e08288a322 --- /dev/null +++ b/queue-5.4/drm-probe-helper-cancel-previous-job-before-starting.patch @@ -0,0 +1,52 @@ +From 627789fcb9ea3b8e98b74f0c8f347320f1569c71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Jan 2023 16:40:52 +0100 +Subject: drm/probe-helper: Cancel previous job before starting new one + +From: Dom Cobley + +[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ] + +Currently we schedule a call to output_poll_execute from +drm_kms_helper_poll_enable for 10s in future. Later we try to replace +that in drm_helper_probe_single_connector_modes with a 0s schedule with +delayed_event set. + +But as there is already a job in the queue this fails, and the immediate +job we wanted with delayed_event set doesn't occur until 10s later. + +And that call acts as if connector state has changed, reprobing modes. +This has a side effect of waking up a display that has been blanked. + +Make sure we cancel the old job before submitting the immediate one. + +Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event") +Acked-by: Daniel Vetter +Signed-off-by: Dom Cobley +[Maxime: Switched to mod_delayed_work] +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_probe_helper.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index d45f43feaf862..4c8bb93a89fb2 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -460,8 +460,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector, + */ + dev->mode_config.delayed_event = true; + if (dev->mode_config.poll_enabled) +- schedule_delayed_work(&dev->mode_config.output_poll_work, +- 0); ++ mod_delayed_work(system_wq, ++ &dev->mode_config.output_poll_work, ++ 0); + } + + /* Re-enable polling in case the global poll config changed. */ +-- +2.39.2 + diff --git a/queue-5.4/drm-rockchip-drop-unbalanced-obj-unref.patch b/queue-5.4/drm-rockchip-drop-unbalanced-obj-unref.patch new file mode 100644 index 00000000000..ff410d231bd --- /dev/null +++ b/queue-5.4/drm-rockchip-drop-unbalanced-obj-unref.patch @@ -0,0 +1,38 @@ +From 8a31f8aa4c23ad254dcdeb227f8e70356ad806f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jan 2023 15:17:34 -0800 +Subject: drm/rockchip: Drop unbalanced obj unref + +From: Rob Clark + +[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ] + +In the error path, rockchip_drm_gem_object_mmap() is dropping an obj +reference that it doesn't own. + +Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers") +Signed-off-by: Rob Clark +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +index 291e89b4045f3..96cc794147b5f 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +@@ -249,9 +249,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj, + else + ret = rockchip_drm_gem_object_mmap_dma(obj, vma); + +- if (ret) +- drm_gem_vm_close(vma); +- + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.4/drm-vgem-add-missing-mutex_destroy.patch b/queue-5.4/drm-vgem-add-missing-mutex_destroy.patch new file mode 100644 index 00000000000..14514e473e4 --- /dev/null +++ b/queue-5.4/drm-vgem-add-missing-mutex_destroy.patch @@ -0,0 +1,42 @@ +From 5ea113537c3ad63df94b93bcf76715bf128b26a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Feb 2023 09:55:17 -0300 +Subject: drm/vgem: add missing mutex_destroy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ] + +vgem_fence_open() instantiates a mutex for a particular fence +instance, but never destroys it by calling mutex_destroy() in +vgem_fence_close(). + +So, add the missing mutex_destroy() to guarantee proper resource +destruction. + +Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)") +Signed-off-by: Maíra Canal +Reviewed-by: Stanislaw Gruszka +Signed-off-by: Maíra Canal +Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vgem/vgem_fence.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c +index 9268f6fc3f662..92895937aba9b 100644 +--- a/drivers/gpu/drm/vgem/vgem_fence.c ++++ b/drivers/gpu/drm/vgem/vgem_fence.c +@@ -249,4 +249,5 @@ void vgem_fence_close(struct vgem_file *vfile) + { + idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile); + idr_destroy(&vfile->fence_idr); ++ mutex_destroy(&vfile->fence_mutex); + } +-- +2.39.2 + diff --git a/queue-5.4/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch b/queue-5.4/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch new file mode 100644 index 00000000000..e5b9cd14e26 --- /dev/null +++ b/queue-5.4/edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch @@ -0,0 +1,55 @@ +From bd14e421bfde4b8206cdc5583c233a31f5cd7efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 09:17:28 +0800 +Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays + +From: Qiuxu Zhuo + +[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ] + +The current DRAM row address mapping arrays skx_{open,close}_row[] +only support ranks with sizes up to 16G. Decoding a rank address +to a DRAM row address for a 32G rank by using either one of the +above arrays by the skx_edac driver, will result in an overflow on +the array. + +For a 32G rank, the most significant DRAM row address bit (the +bit17) is mapped from the bit34 of the rank address. Add this new +mapping item to both arrays to fix the overflow issue. + +Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake") +Reported-by: Feng Xu +Tested-by: Feng Xu +Signed-off-by: Qiuxu Zhuo +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/skx_base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/skx_base.c b/drivers/edac/skx_base.c +index b1d717cb8df9f..f382cc70f9aaa 100644 +--- a/drivers/edac/skx_base.c ++++ b/drivers/edac/skx_base.c +@@ -459,7 +459,7 @@ static bool skx_rir_decode(struct decoded_addr *res) + } + + static u8 skx_close_row[] = { +- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33 ++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34 + }; + + static u8 skx_close_column[] = { +@@ -467,7 +467,7 @@ static u8 skx_close_column[] = { + }; + + static u8 skx_open_row[] = { +- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33 ++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34 + }; + + static u8 skx_open_column[] = { +-- +2.39.2 + diff --git a/queue-5.4/erofs-fix-potential-overflow-calculating-xattr_isize.patch b/queue-5.4/erofs-fix-potential-overflow-calculating-xattr_isize.patch new file mode 100644 index 00000000000..fe8099bdd38 --- /dev/null +++ b/queue-5.4/erofs-fix-potential-overflow-calculating-xattr_isize.patch @@ -0,0 +1,42 @@ +From 134c3f0c64d2ab7f3da07ce6a3ae33a0a0796561 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 14:18:10 +0800 +Subject: erofs: fix potential overflow calculating xattr_isize + +From: Jingbo Xu + +[ Upstream commit 1b3567a1969b26f709d82a874498c0754ea841c3 ] + +Given on-disk i_xattr_icount is 16 bits and xattr_isize is calculated +from i_xattr_icount multiplying 4, xattr_isize has a theoretical maximum +of 256K (64K * 4). + +Thus declare xattr_isize as unsigned int to avoid the potential overflow. + +Fixes: bfb8674dc044 ("staging: erofs: add erofs in-memory stuffs") +Signed-off-by: Jingbo Xu +Reviewed-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20230414061810.6479-1-jefflexu@linux.alibaba.com +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h +index 544a453f3076c..cc7a42682814c 100644 +--- a/fs/erofs/internal.h ++++ b/fs/erofs/internal.h +@@ -226,7 +226,7 @@ struct erofs_inode { + + unsigned char datalayout; + unsigned char inode_isize; +- unsigned short xattr_isize; ++ unsigned int xattr_isize; + + unsigned int xattr_shared_count; + unsigned int *xattr_shared_xattrs; +-- +2.39.2 + diff --git a/queue-5.4/erofs-stop-parsing-non-compact-head-index-if-cluster.patch b/queue-5.4/erofs-stop-parsing-non-compact-head-index-if-cluster.patch new file mode 100644 index 00000000000..ceaa229cb45 --- /dev/null +++ b/queue-5.4/erofs-stop-parsing-non-compact-head-index-if-cluster.patch @@ -0,0 +1,65 @@ +From a342e4f65ab07d9e2f436f0f109f6be8c2edfa6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 01:37:14 +0800 +Subject: erofs: stop parsing non-compact HEAD index if clusterofs is invalid + +From: Gao Xiang + +[ Upstream commit cc4efd3dd2ac9f89143e5d881609747ecff04164 ] + +Syzbot generated a crafted image [1] with a non-compact HEAD index of +clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1, +which causes the following unexpected behavior as below: + + BUG: unable to handle page fault for address: fffff52101a3fff9 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 23ffed067 P4D 23ffed067 PUD 0 + Oops: 0000 [#1] PREEMPT SMP KASAN + CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 + Workqueue: erofs_worker z_erofs_decompressqueue_work + RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40 + ... + Call Trace: + + z_erofs_decompressqueue_work+0x99/0xe0 + process_one_work+0x8f6/0x1170 + worker_thread+0xa63/0x1210 + kthread+0x270/0x300 + ret_from_fork+0x1f/0x30 + +Note that normal images or images using compact indexes are not +impacted. Let's fix this now. + +[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com + +Reported-and-tested-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com +Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter") +Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") +Signed-off-by: Gao Xiang +Reviewed-by: Chao Yu +Link: https://lore.kernel.org/r/20230410173714.104604-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zmap.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c +index fff5741007214..b5ee58fdd82f3 100644 +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -179,6 +179,10 @@ static int vle_legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m, + case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN: + case Z_EROFS_VLE_CLUSTER_TYPE_HEAD: + m->clusterofs = le16_to_cpu(di->di_clusterofs); ++ if (m->clusterofs >= 1 << vi->z_logical_clusterbits) { ++ DBG_BUGON(1); ++ return -EFSCORRUPTED; ++ } + m->pblk = le32_to_cpu(di->di_u.blkaddr); + break; + default: +-- +2.39.2 + diff --git a/queue-5.4/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch b/queue-5.4/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch new file mode 100644 index 00000000000..b495d2395e5 --- /dev/null +++ b/queue-5.4/ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch @@ -0,0 +1,94 @@ +From c58676a3fdb2208fe55bea74b01e67c09b1c0f28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Apr 2023 11:16:27 +0000 +Subject: ext4: fix use-after-free read in ext4_find_extent for bigalloc + + inline + +From: Ye Bin + +[ Upstream commit 835659598c67907b98cd2aa57bb951dfaf675c69 ] + +Syzbot found the following issue: +loop0: detected capacity change from 0 to 2048 +EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. +================================================================== +BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] +BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 +Read of size 4 at addr ffff888073644750 by task syz-executor420/5067 + +CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 + print_address_description+0x74/0x340 mm/kasan/report.c:306 + print_report+0x107/0x1f0 mm/kasan/report.c:417 + kasan_report+0xcd/0x100 mm/kasan/report.c:517 + ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline] + ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931 + ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809 + ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline] + ext4_da_map_blocks fs/ext4/inode.c:1806 [inline] + ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870 + ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098 + ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082 + generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 + ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285 + ext4_file_write_iter+0x1d0/0x18f0 + call_write_iter include/linux/fs.h:2186 [inline] + new_sync_write fs/read_write.c:491 [inline] + vfs_write+0x7dc/0xc50 fs/read_write.c:584 + ksys_write+0x177/0x2a0 fs/read_write.c:637 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f4b7a9737b9 +RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9 +RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004 +RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000 +R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + + +Above issue is happens when enable bigalloc and inline data feature. As +commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for +bigalloc + inline. But it only resolved issue when has inline data, if +inline data has been converted to extent(ext4_da_convert_inline_data_to_extent) +before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However +i_data is still store inline data in this scene. Then will trigger UAF +when find extent. +To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)" +in ext4_clu_mapped(). + +Fixes: 131294c35ed6 ("ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline") +Reported-by: syzbot+bf4bb7731ef73b83a3b4@syzkaller.appspotmail.com +Reviewed-by: Jan Kara +Reviewed-by: Ye Bin +Reviewed-by: Tudor Ambarus +Tested-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20230406111627.1916759-1-tudor.ambarus@linaro.org +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 27760c39f70ec..478c35d453784 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -6027,7 +6027,8 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu) + * mapped - no physical clusters have been allocated, and the + * file has no extents + */ +- if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) ++ if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) || ++ ext4_has_inline_data(inode)) + return 0; + + /* search for the extent closest to the first block in the cluster */ +-- +2.39.2 + diff --git a/queue-5.4/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch b/queue-5.4/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch new file mode 100644 index 00000000000..72ddfea566e --- /dev/null +++ b/queue-5.4/f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch @@ -0,0 +1,50 @@ +From 6b377026264d7ddcd890775b34890f58b9ec36d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Feb 2023 22:45:50 +0800 +Subject: f2fs: handle dqget error in f2fs_transfer_project_quota() + +From: Yangtao Li + +[ Upstream commit 8051692f5f23260215bfe9a72e712d93606acc5f ] + +We should set the error code when dqget() failed. + +Fixes: 2c1d03056991 ("f2fs: support F2FS_IOC_FS{GET,SET}XATTR") +Signed-off-by: Yangtao Li +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index ef08ef0170306..8d4e66f36cf7e 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2821,15 +2821,16 @@ int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid) + struct dquot *transfer_to[MAXQUOTAS] = {}; + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct super_block *sb = sbi->sb; +- int err = 0; ++ int err; + + transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid)); +- if (!IS_ERR(transfer_to[PRJQUOTA])) { +- err = __dquot_transfer(inode, transfer_to); +- if (err) +- set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); +- dqput(transfer_to[PRJQUOTA]); +- } ++ if (IS_ERR(transfer_to[PRJQUOTA])) ++ return PTR_ERR(transfer_to[PRJQUOTA]); ++ ++ err = __dquot_transfer(inode, transfer_to); ++ if (err) ++ set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR); ++ dqput(transfer_to[PRJQUOTA]); + return err; + } + +-- +2.39.2 + diff --git a/queue-5.4/firmware-qcom_scm-clear-download-bit-during-reboot.patch b/queue-5.4/firmware-qcom_scm-clear-download-bit-during-reboot.patch new file mode 100644 index 00000000000..946c49c8840 --- /dev/null +++ b/queue-5.4/firmware-qcom_scm-clear-download-bit-during-reboot.patch @@ -0,0 +1,39 @@ +From 75e310c1aeac340b978aee05b5566b33b4b8dd01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 20:44:26 +0530 +Subject: firmware: qcom_scm: Clear download bit during reboot + +From: Mukesh Ojha + +[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ] + +During normal restart of a system download bit should +be cleared irrespective of whether download mode is +set or not. + +Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control") +Signed-off-by: Mukesh Ojha +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index b9fdc20b4eb9b..eda25d506059b 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -585,8 +585,7 @@ static int qcom_scm_probe(struct platform_device *pdev) + static void qcom_scm_shutdown(struct platform_device *pdev) + { + /* Clean shutdown, disable download mode to allow normal restart */ +- if (download_mode) +- qcom_scm_set_download_mode(false); ++ qcom_scm_set_download_mode(false); + } + + static const struct of_device_id qcom_scm_dt_match[] = { +-- +2.39.2 + diff --git a/queue-5.4/firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch b/queue-5.4/firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch new file mode 100644 index 00000000000..60038a5a993 --- /dev/null +++ b/queue-5.4/firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch @@ -0,0 +1,98 @@ +From 2c62d0b429114185a4f1465f38700e04cf804fe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 13:32:35 +0100 +Subject: firmware: raspberrypi: Introduce devm_rpi_firmware_get() + +From: Nicolas Saenz Julienne + +[ Upstream commit f663204c9a1f8d6fcc590667d9d7a9f44e064644 ] + +It'll simplify the firmware handling for most consumers. + +Suggested-by: Bartosz Golaszewski +Signed-off-by: Nicolas Saenz Julienne +Reviewed-by: Florian Fainelli +Reviewed-by: Bartosz Golaszewski +Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe") +Signed-off-by: Sasha Levin +--- + drivers/firmware/raspberrypi.c | 29 ++++++++++++++++++++++ + include/soc/bcm2835/raspberrypi-firmware.h | 8 ++++++ + 2 files changed, 37 insertions(+) + +diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c +index eb3b052a407ec..6a60b5bde0c98 100644 +--- a/drivers/firmware/raspberrypi.c ++++ b/drivers/firmware/raspberrypi.c +@@ -232,6 +232,13 @@ void rpi_firmware_put(struct rpi_firmware *fw) + } + EXPORT_SYMBOL_GPL(rpi_firmware_put); + ++static void devm_rpi_firmware_put(void *data) ++{ ++ struct rpi_firmware *fw = data; ++ ++ rpi_firmware_put(fw); ++} ++ + static int rpi_firmware_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -320,6 +327,28 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node) + } + EXPORT_SYMBOL_GPL(rpi_firmware_get); + ++/** ++ * devm_rpi_firmware_get - Get pointer to rpi_firmware structure. ++ * @firmware_node: Pointer to the firmware Device Tree node. ++ * ++ * Returns NULL is the firmware device is not ready. ++ */ ++struct rpi_firmware *devm_rpi_firmware_get(struct device *dev, ++ struct device_node *firmware_node) ++{ ++ struct rpi_firmware *fw; ++ ++ fw = rpi_firmware_get(firmware_node); ++ if (!fw) ++ return NULL; ++ ++ if (devm_add_action_or_reset(dev, devm_rpi_firmware_put, fw)) ++ return NULL; ++ ++ return fw; ++} ++EXPORT_SYMBOL_GPL(devm_rpi_firmware_get); ++ + static const struct of_device_id rpi_firmware_of_match[] = { + { .compatible = "raspberrypi,bcm2835-firmware", }, + {}, +diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h +index f11e9d3f6fd30..cf6e58fa5266b 100644 +--- a/include/soc/bcm2835/raspberrypi-firmware.h ++++ b/include/soc/bcm2835/raspberrypi-firmware.h +@@ -142,6 +142,8 @@ int rpi_firmware_property_list(struct rpi_firmware *fw, + void *data, size_t tag_size); + void rpi_firmware_put(struct rpi_firmware *fw); + struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node); ++struct rpi_firmware *devm_rpi_firmware_get(struct device *dev, ++ struct device_node *firmware_node); + #else + static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag, + void *data, size_t len) +@@ -160,6 +162,12 @@ static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware + { + return NULL; + } ++ ++static inline struct rpi_firmware *devm_rpi_firmware_get(struct device *dev, ++ struct device_node *firmware_node) ++{ ++ return NULL; ++} + #endif + + #endif /* __SOC_RASPBERRY_FIRMWARE_H__ */ +-- +2.39.2 + diff --git a/queue-5.4/firmware-raspberrypi-keep-count-of-all-consumers.patch b/queue-5.4/firmware-raspberrypi-keep-count-of-all-consumers.patch new file mode 100644 index 00000000000..955017b1805 --- /dev/null +++ b/queue-5.4/firmware-raspberrypi-keep-count-of-all-consumers.patch @@ -0,0 +1,155 @@ +From ae86726623c6dcf40b3489019ad5e905be7ee3aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 13:32:34 +0100 +Subject: firmware: raspberrypi: Keep count of all consumers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nicolas Saenz Julienne + +[ Upstream commit 1e7c57355a3bc617fc220234889e49fe722a6305 ] + +When unbinding the firmware device we need to make sure it has no +consumers left. Otherwise we'd leave them with a firmware handle +pointing at freed memory. + +Keep a reference count of all consumers and introduce rpi_firmware_put() +which will permit automatically decrease the reference count upon +unbinding consumer drivers. + +Suggested-by: Uwe Kleine-König +Signed-off-by: Nicolas Saenz Julienne +Reviewed-by: Florian Fainelli +Reviewed-by: Stephen Boyd +Reviewed-by: Bartosz Golaszewski +Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe") +Signed-off-by: Sasha Levin +--- + drivers/firmware/raspberrypi.c | 40 ++++++++++++++++++++-- + include/soc/bcm2835/raspberrypi-firmware.h | 2 ++ + 2 files changed, 39 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c +index da26a584dca06..eb3b052a407ec 100644 +--- a/drivers/firmware/raspberrypi.c ++++ b/drivers/firmware/raspberrypi.c +@@ -7,6 +7,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -27,6 +28,8 @@ struct rpi_firmware { + struct mbox_chan *chan; /* The property channel. */ + struct completion c; + u32 enabled; ++ ++ struct kref consumers; + }; + + static DEFINE_MUTEX(transaction_lock); +@@ -214,12 +217,31 @@ static void rpi_register_clk_driver(struct device *dev) + -1, NULL, 0); + } + ++static void rpi_firmware_delete(struct kref *kref) ++{ ++ struct rpi_firmware *fw = container_of(kref, struct rpi_firmware, ++ consumers); ++ ++ mbox_free_channel(fw->chan); ++ kfree(fw); ++} ++ ++void rpi_firmware_put(struct rpi_firmware *fw) ++{ ++ kref_put(&fw->consumers, rpi_firmware_delete); ++} ++EXPORT_SYMBOL_GPL(rpi_firmware_put); ++ + static int rpi_firmware_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; + struct rpi_firmware *fw; + +- fw = devm_kzalloc(dev, sizeof(*fw), GFP_KERNEL); ++ /* ++ * Memory will be freed by rpi_firmware_delete() once all users have ++ * released their firmware handles. Don't use devm_kzalloc() here. ++ */ ++ fw = kzalloc(sizeof(*fw), GFP_KERNEL); + if (!fw) + return -ENOMEM; + +@@ -236,6 +258,7 @@ static int rpi_firmware_probe(struct platform_device *pdev) + } + + init_completion(&fw->c); ++ kref_init(&fw->consumers); + + platform_set_drvdata(pdev, fw); + +@@ -264,7 +287,8 @@ static int rpi_firmware_remove(struct platform_device *pdev) + rpi_hwmon = NULL; + platform_device_unregister(rpi_clk); + rpi_clk = NULL; +- mbox_free_channel(fw->chan); ++ ++ rpi_firmware_put(fw); + + return 0; + } +@@ -273,16 +297,26 @@ static int rpi_firmware_remove(struct platform_device *pdev) + * rpi_firmware_get - Get pointer to rpi_firmware structure. + * @firmware_node: Pointer to the firmware Device Tree node. + * ++ * The reference to rpi_firmware has to be released with rpi_firmware_put(). ++ * + * Returns NULL is the firmware device is not ready. + */ + struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node) + { + struct platform_device *pdev = of_find_device_by_node(firmware_node); ++ struct rpi_firmware *fw; + + if (!pdev) + return NULL; + +- return platform_get_drvdata(pdev); ++ fw = platform_get_drvdata(pdev); ++ if (!fw) ++ return NULL; ++ ++ if (!kref_get_unless_zero(&fw->consumers)) ++ return NULL; ++ ++ return fw; + } + EXPORT_SYMBOL_GPL(rpi_firmware_get); + +diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h +index 7800e12ee042c..f11e9d3f6fd30 100644 +--- a/include/soc/bcm2835/raspberrypi-firmware.h ++++ b/include/soc/bcm2835/raspberrypi-firmware.h +@@ -140,6 +140,7 @@ int rpi_firmware_property(struct rpi_firmware *fw, + u32 tag, void *data, size_t len); + int rpi_firmware_property_list(struct rpi_firmware *fw, + void *data, size_t tag_size); ++void rpi_firmware_put(struct rpi_firmware *fw); + struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node); + #else + static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag, +@@ -154,6 +155,7 @@ static inline int rpi_firmware_property_list(struct rpi_firmware *fw, + return -ENOSYS; + } + ++static inline void rpi_firmware_put(struct rpi_firmware *fw) { } + static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node) + { + return NULL; +-- +2.39.2 + diff --git a/queue-5.4/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch b/queue-5.4/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch new file mode 100644 index 00000000000..c3a475da61c --- /dev/null +++ b/queue-5.4/firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch @@ -0,0 +1,39 @@ +From bb3075eeabd18803278697eac20d97bd3b09ca56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 17:27:03 +0300 +Subject: firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe + +From: Dan Carpenter + +[ Upstream commit e1d6ca042e62c2a69513235f8629eb6e62ca79c5 ] + +The svc_create_memory_pool() function returns error pointers. It never +returns NULL. Fix the check. + +Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/5f9a8cb4-5a4f-460b-9cdc-2fae6c5b7922@kili.mountain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/stratix10-svc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index 08c422380a00d..7122bc6ea796b 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -981,8 +981,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + return ret; + + genpool = svc_create_memory_pool(pdev, sh_memory); +- if (!genpool) +- return -ENOMEM; ++ if (IS_ERR(genpool)) ++ return PTR_ERR(genpool); + + /* allocate service controller and supporting channel */ + controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); +-- +2.39.2 + diff --git a/queue-5.4/fpga-bridge-fix-kernel-doc-parameter-description.patch b/queue-5.4/fpga-bridge-fix-kernel-doc-parameter-description.patch new file mode 100644 index 00000000000..74994ed00d9 --- /dev/null +++ b/queue-5.4/fpga-bridge-fix-kernel-doc-parameter-description.patch @@ -0,0 +1,39 @@ +From 1aa21e635d8ae9fd463051ac5d9c261817b82629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Mar 2023 15:03:08 +0100 +Subject: fpga: bridge: fix kernel-doc parameter description + +From: Marco Pagani + +[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ] + +Fix the kernel-doc description for the "struct fpga_image_info *info" +parameter of the fpga_bridge_get() function. + +Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes") +Signed-off-by: Marco Pagani +Reviewed-by: Tom Rix +Acked-by: Xu Yilun +Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fpga/fpga-bridge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c +index 4bab9028940a8..aea4ceeed5363 100644 +--- a/drivers/fpga/fpga-bridge.c ++++ b/drivers/fpga/fpga-bridge.c +@@ -115,7 +115,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data) + /** + * fpga_bridge_get - get an exclusive reference to a fpga bridge + * @dev: parent device that fpga bridge was registered with +- * @info: fpga manager info ++ * @info: fpga image specific information + * + * Given a device, get an exclusive reference to a fpga bridge. + * +-- +2.39.2 + diff --git a/queue-5.4/genirq-add-irqf_no_autoen-for-request_irq-nmi.patch b/queue-5.4/genirq-add-irqf_no_autoen-for-request_irq-nmi.patch new file mode 100644 index 00000000000..16ecf673bbb --- /dev/null +++ b/queue-5.4/genirq-add-irqf_no_autoen-for-request_irq-nmi.patch @@ -0,0 +1,107 @@ +From 2f2b33aa4f6f98bbe49c0a885c6db8b8c40170e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 11:49:15 +1300 +Subject: genirq: Add IRQF_NO_AUTOEN for request_irq/nmi() + +From: Barry Song + +[ Upstream commit cbe16f35bee6880becca6f20d2ebf6b457148552 ] + +Many drivers don't want interrupts enabled automatically via request_irq(). +So they are handling this issue by either way of the below two: + +(1) + irq_set_status_flags(irq, IRQ_NOAUTOEN); + request_irq(dev, irq...); + +(2) + request_irq(dev, irq...); + disable_irq(irq); + +The code in the second way is silly and unsafe. In the small time gap +between request_irq() and disable_irq(), interrupts can still come. + +The code in the first way is safe though it's subobtimal. + +Add a new IRQF_NO_AUTOEN flag which can be handed in by drivers to +request_irq() and request_nmi(). It prevents the automatic enabling of the +requested interrupt/nmi in the same safe way as #1 above. With that the +various usage sites of #1 and #2 above can be simplified and corrected. + +Signed-off-by: Barry Song +Signed-off-by: Thomas Gleixner +Signed-off-by: Ingo Molnar +Cc: dmitry.torokhov@gmail.com +Link: https://lore.kernel.org/r/20210302224916.13980-2-song.bao.hua@hisilicon.com +Stable-dep-of: 39db65a0a17b ("ASoC: es8316: Handle optional IRQ assignment") +Signed-off-by: Sasha Levin +--- + include/linux/interrupt.h | 4 ++++ + kernel/irq/manage.c | 11 +++++++++-- + 2 files changed, 13 insertions(+), 2 deletions(-) + +diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h +index 30e92536c78cc..01517747214a4 100644 +--- a/include/linux/interrupt.h ++++ b/include/linux/interrupt.h +@@ -61,6 +61,9 @@ + * interrupt handler after suspending interrupts. For system + * wakeup devices users need to implement wakeup detection in + * their interrupt handlers. ++ * IRQF_NO_AUTOEN - Don't enable IRQ or NMI automatically when users request it. ++ * Users will enable it explicitly by enable_irq() or enable_nmi() ++ * later. + */ + #define IRQF_SHARED 0x00000080 + #define IRQF_PROBE_SHARED 0x00000100 +@@ -74,6 +77,7 @@ + #define IRQF_NO_THREAD 0x00010000 + #define IRQF_EARLY_RESUME 0x00020000 + #define IRQF_COND_SUSPEND 0x00040000 ++#define IRQF_NO_AUTOEN 0x00080000 + + #define IRQF_TIMER (__IRQF_TIMER | IRQF_NO_SUSPEND | IRQF_NO_THREAD) + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 79214f9836243..2a8a5e1779c9c 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1610,7 +1610,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) + irqd_set(&desc->irq_data, IRQD_NO_BALANCING); + } + +- if (irq_settings_can_autoenable(desc)) { ++ if (!(new->flags & IRQF_NO_AUTOEN) && ++ irq_settings_can_autoenable(desc)) { + irq_startup(desc, IRQ_RESEND, IRQ_START_COND); + } else { + /* +@@ -2041,10 +2042,15 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler, + * which interrupt is which (messes up the interrupt freeing + * logic etc). + * ++ * Also shared interrupts do not go well with disabling auto enable. ++ * The sharing interrupt might request it while it's still disabled ++ * and then wait for interrupts forever. ++ * + * Also IRQF_COND_SUSPEND only makes sense for shared interrupts and + * it cannot be set along with IRQF_NO_SUSPEND. + */ + if (((irqflags & IRQF_SHARED) && !dev_id) || ++ ((irqflags & IRQF_SHARED) && (irqflags & IRQF_NO_AUTOEN)) || + (!(irqflags & IRQF_SHARED) && (irqflags & IRQF_COND_SUSPEND)) || + ((irqflags & IRQF_NO_SUSPEND) && (irqflags & IRQF_COND_SUSPEND))) + return -EINVAL; +@@ -2200,7 +2206,8 @@ int request_nmi(unsigned int irq, irq_handler_t handler, + + desc = irq_to_desc(irq); + +- if (!desc || irq_settings_can_autoenable(desc) || ++ if (!desc || (irq_settings_can_autoenable(desc) && ++ !(irqflags & IRQF_NO_AUTOEN)) || + !irq_settings_can_request(desc) || + WARN_ON(irq_settings_is_per_cpu_devid(desc)) || + !irq_supports_nmi(desc)) +-- +2.39.2 + diff --git a/queue-5.4/ia64-mm-contig-fix-section-mismatch-warning-error.patch b/queue-5.4/ia64-mm-contig-fix-section-mismatch-warning-error.patch new file mode 100644 index 00000000000..36932c070b5 --- /dev/null +++ b/queue-5.4/ia64-mm-contig-fix-section-mismatch-warning-error.patch @@ -0,0 +1,41 @@ +From 409f9c42b164cf2ff17081c2174438e15d390854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:42:58 -0800 +Subject: ia64: mm/contig: fix section mismatch warning/error + +From: Randy Dunlap + +[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ] + +alloc_per_cpu_data() is called by find_memory(), which is marked as +__init. Therefore alloc_per_cpu_data() can also be marked as __init to +remedy this modpost problem. + +WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text) + +Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org +Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/mm/contig.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c +index 5b00dc3898e19..f2b40bcd2495d 100644 +--- a/arch/ia64/mm/contig.c ++++ b/arch/ia64/mm/contig.c +@@ -81,7 +81,7 @@ void *per_cpu_init(void) + return __per_cpu_start + __per_cpu_offset[smp_processor_id()]; + } + +-static inline void ++static inline __init void + alloc_per_cpu_data(void) + { + size_t size = PERCPU_PAGE_SIZE * num_possible_cpus(); +-- +2.39.2 + diff --git a/queue-5.4/ia64-salinfo-placate-defined-but-not-used-warning.patch b/queue-5.4/ia64-salinfo-placate-defined-but-not-used-warning.patch new file mode 100644 index 00000000000..ff6f638d694 --- /dev/null +++ b/queue-5.4/ia64-salinfo-placate-defined-but-not-used-warning.patch @@ -0,0 +1,42 @@ +From e6112b523beac87bbcbb93309e5f05f414f924fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 19:43:09 -0800 +Subject: ia64: salinfo: placate defined-but-not-used warning + +From: Randy Dunlap + +[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ] + +When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used. Mark the +function as __maybe_unused to quieten the warning message. + +../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function] + 584 | static int proc_salinfo_show(struct seq_file *m, void *v) + | ^~~~~~~~~~~~~~~~~ + +Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org +Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}") +Signed-off-by: Randy Dunlap +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/salinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c +index b392c0a503468..0ec8b55b28ac0 100644 +--- a/arch/ia64/kernel/salinfo.c ++++ b/arch/ia64/kernel/salinfo.c +@@ -581,7 +581,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu) + * 'data' contains an integer that corresponds to the feature we're + * testing + */ +-static int proc_salinfo_show(struct seq_file *m, void *v) ++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v) + { + unsigned long data = (unsigned long)v; + seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n"); +-- +2.39.2 + diff --git a/queue-5.4/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch b/queue-5.4/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch new file mode 100644 index 00000000000..74a50feb92e --- /dev/null +++ b/queue-5.4/ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch @@ -0,0 +1,93 @@ +From f6a75872318bdc2d87b264093213801be18fd13a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Apr 2023 12:52:39 -0400 +Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order + +From: Patrick Kelsey + +[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ] + +hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in +mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node. + +As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly +least-recently used nodes. + +This could be a performance issue for an application when that +application: +- Uses some long-lived buffers frequently. +- Uses a large number of buffers once. +- Hits the mmu_rb_handler cache size or pinned-page limits, forcing + mmu_rb_handler cache entries to be evicted. + +In this case, the one-time use buffers cause the long-lived buffer +entries to eventually filter to the end of the LRU list where +hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived +entry instead of evicting one of the one-time use entries. + +Fix this by inserting new mmu_rb_node at the tail of +mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of +mmu_rb_handler->lru_list when the mmu_rb_node is a hit in +hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict +from the head of mmu_rb_handler->lru_list instead of the tail. + +Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list") +Signed-off-by: Brendan Cunningham +Signed-off-by: Patrick Kelsey +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c +index 14d2a90964c3c..a5631286c8e05 100644 +--- a/drivers/infiniband/hw/hfi1/mmu_rb.c ++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c +@@ -173,7 +173,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler, + goto unlock; + } + __mmu_int_rb_insert(mnode, &handler->root); +- list_add(&mnode->list, &handler->lru_list); ++ list_add_tail(&mnode->list, &handler->lru_list); + + ret = handler->ops->insert(handler->ops_arg, mnode); + if (ret) { +@@ -220,8 +220,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler, + spin_lock_irqsave(&handler->lock, flags); + node = __mmu_rb_search(handler, addr, len); + if (node) { +- if (node->addr == addr && node->len == len) ++ if (node->addr == addr && node->len == len) { ++ list_move_tail(&node->list, &handler->lru_list); + goto unlock; ++ } + __mmu_int_rb_remove(node, &handler->root); + list_del(&node->list); /* remove from LRU list */ + ret = true; +@@ -242,8 +244,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + INIT_LIST_HEAD(&del_list); + + spin_lock_irqsave(&handler->lock, flags); +- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list, +- list) { ++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) { + if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg, + &stop)) { + __mmu_int_rb_remove(rbnode, &handler->root); +@@ -255,9 +256,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg) + } + spin_unlock_irqrestore(&handler->lock, flags); + +- while (!list_empty(&del_list)) { +- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list); +- list_del(&rbnode->list); ++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) { + handler->ops->remove(handler->ops_arg, rbnode); + } + } +-- +2.39.2 + diff --git a/queue-5.4/iio-light-max44009-add-missing-of-device-matching.patch b/queue-5.4/iio-light-max44009-add-missing-of-device-matching.patch new file mode 100644 index 00000000000..454f1a739f7 --- /dev/null +++ b/queue-5.4/iio-light-max44009-add-missing-of-device-matching.patch @@ -0,0 +1,66 @@ +From fa11ab740d31699da60604908bb4482c6f66056b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Mar 2023 16:34:28 +0100 +Subject: iio: light: max44009: add missing OF device matching +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Kozlowski + +[ Upstream commit b29c49026c3c05a11f845dba17cad0b3ba06836d ] + +The driver currently matches only via i2c_device_id, but also has +of_device_id table: + + drivers/iio/light/max44009.c:545:34: error: ‘max44009_of_match’ defined but not used [-Werror=unused-const-variable=] + +Fixes: 6aef699a7d7e ("iio: light: add driver for MAX44009") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230312153429.371702-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/light/max44009.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/iio/light/max44009.c b/drivers/iio/light/max44009.c +index 00ba15499638d..5103b1061a77b 100644 +--- a/drivers/iio/light/max44009.c ++++ b/drivers/iio/light/max44009.c +@@ -529,6 +529,12 @@ static int max44009_probe(struct i2c_client *client, + return devm_iio_device_register(&client->dev, indio_dev); + } + ++static const struct of_device_id max44009_of_match[] = { ++ { .compatible = "maxim,max44009" }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, max44009_of_match); ++ + static const struct i2c_device_id max44009_id[] = { + { "max44009", 0 }, + { } +@@ -538,18 +544,13 @@ MODULE_DEVICE_TABLE(i2c, max44009_id); + static struct i2c_driver max44009_driver = { + .driver = { + .name = MAX44009_DRV_NAME, ++ .of_match_table = max44009_of_match, + }, + .probe = max44009_probe, + .id_table = max44009_id, + }; + module_i2c_driver(max44009_driver); + +-static const struct of_device_id max44009_of_match[] = { +- { .compatible = "maxim,max44009" }, +- { } +-}; +-MODULE_DEVICE_TABLE(of, max44009_of_match); +- + MODULE_AUTHOR("Robert Eshleman "); + MODULE_LICENSE("GPL v2"); + MODULE_DESCRIPTION("MAX44009 ambient light sensor driver"); +-- +2.39.2 + diff --git a/queue-5.4/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch b/queue-5.4/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch new file mode 100644 index 00000000000..0adb7d96333 --- /dev/null +++ b/queue-5.4/input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch @@ -0,0 +1,48 @@ +From dc471fc933f8b7ad22cd7f1883bdd16f30c89531 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 23:05:20 -0700 +Subject: Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe + +From: Miaoqian Lin + +[ Upstream commit 5bca3688bdbc3b58a2894b8671a8e2378efe28bd ] + +rpi_firmware_get() take reference, we need to release it in error paths +as well. Use devm_rpi_firmware_get() helper to handling the resources. +Also remove the existing rpi_firmware_put(). + +Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver") +Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed") +Signed-off-by: Miaoqian Lin +Reviewed-by: Mattijs Korpershoek +Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/raspberrypi-ts.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c +index 4740a7c412364..8135a80226fd6 100644 +--- a/drivers/input/touchscreen/raspberrypi-ts.c ++++ b/drivers/input/touchscreen/raspberrypi-ts.c +@@ -137,7 +137,7 @@ static int rpi_ts_probe(struct platform_device *pdev) + return -ENOENT; + } + +- fw = rpi_firmware_get(fw_node); ++ fw = devm_rpi_firmware_get(&pdev->dev, fw_node); + of_node_put(fw_node); + if (!fw) + return -EPROBE_DEFER; +@@ -164,7 +164,6 @@ static int rpi_ts_probe(struct platform_device *pdev) + touchbuf = (u32)ts->fw_regs_phys; + error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF, + &touchbuf, sizeof(touchbuf)); +- rpi_firmware_put(fw); + if (error || touchbuf != 0) { + dev_warn(dev, "Failed to set touchbuf, %d\n", error); + return error; +-- +2.39.2 + diff --git a/queue-5.4/input-raspberrypi-ts-release-firmware-handle-when-no.patch b/queue-5.4/input-raspberrypi-ts-release-firmware-handle-when-no.patch new file mode 100644 index 00000000000..c1997928826 --- /dev/null +++ b/queue-5.4/input-raspberrypi-ts-release-firmware-handle-when-no.patch @@ -0,0 +1,37 @@ +From c4cbafd9e5f95285b8cff238920e36a69e5023fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Jan 2021 13:32:41 +0100 +Subject: input: raspberrypi-ts: Release firmware handle when not needed + +From: Nicolas Saenz Julienne + +[ Upstream commit 3b8ddff780b7d12e99ae39177f84b9003097777a ] + +There is no use for the firmware interface after getting the touch +buffer address, so release it. + +Signed-off-by: Nicolas Saenz Julienne +Acked-by: Dmitry Torokhov +Reviewed-by: Florian Fainelli +Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe") +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/raspberrypi-ts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c +index 69881265d1218..4740a7c412364 100644 +--- a/drivers/input/touchscreen/raspberrypi-ts.c ++++ b/drivers/input/touchscreen/raspberrypi-ts.c +@@ -164,7 +164,7 @@ static int rpi_ts_probe(struct platform_device *pdev) + touchbuf = (u32)ts->fw_regs_phys; + error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF, + &touchbuf, sizeof(touchbuf)); +- ++ rpi_firmware_put(fw); + if (error || touchbuf != 0) { + dev_warn(dev, "Failed to set touchbuf, %d\n", error); + return error; +-- +2.39.2 + diff --git a/queue-5.4/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch b/queue-5.4/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch new file mode 100644 index 00000000000..6da536643f8 --- /dev/null +++ b/queue-5.4/ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch @@ -0,0 +1,56 @@ +From a163a09c4fc24945c4e7933f8134d7e4f760de0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 20:40:35 +0800 +Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb() + +From: Ziyang Xuan + +[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ] + +Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in +__ip6_make_skb()"). icmphdr does not in skb linear region under the +scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will +trigger the uninit variable access bug. + +Use a local variable icmp_type to carry the correct value in different +scenarios. + +Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)") +Reviewed-by: Willem de Bruijn +Signed-off-by: Ziyang Xuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_output.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 418e939878004..08ccb501ff0cc 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1559,9 +1559,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk, + cork->dst = NULL; + skb_dst_set(skb, &rt->dst); + +- if (iph->protocol == IPPROTO_ICMP) +- icmp_out_count(net, ((struct icmphdr *) +- skb_transport_header(skb))->type); ++ if (iph->protocol == IPPROTO_ICMP) { ++ u8 icmp_type; ++ ++ /* For such sockets, transhdrlen is zero when do ip_append_data(), ++ * so icmphdr does not in skb linear region and can not get icmp_type ++ * by icmp_hdr(skb)->type. ++ */ ++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl) ++ icmp_type = fl4->fl4_icmp_type; ++ else ++ icmp_type = icmp_hdr(skb)->type; ++ icmp_out_count(net, icmp_type); ++ } + + ip_cork_release(cork); + out: +-- +2.39.2 + diff --git a/queue-5.4/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch b/queue-5.4/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch new file mode 100644 index 00000000000..3c19c45e354 --- /dev/null +++ b/queue-5.4/ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch @@ -0,0 +1,68 @@ +From f4a5832dd7371a20bbe511cadbaba3ee98b569ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:22 +0000 +Subject: ixgbe: Allow flow hash to be set via ethtool + +From: Joe Damato + +[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ] + +ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool +because the ethtool code in the kernel passes a non-zero value for hfunc +that ixgbe should allow. + +When ethtool is called with `ETHTOOL_SRXFHINDIR`, +`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function +with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted. + +When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will +call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be +hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should +also be accepted. + +Before this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this patch: + +$ sudo ethtool -L eth1 combined 10 +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 + 24: 4 5 6 7 8 9 0 1 + ... + +Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index 7c52ae8ac005b..babe16ece5aa6 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -3008,8 +3008,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir, + int i; + u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter); + +- if (hfunc) +- return -EINVAL; ++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) ++ return -EOPNOTSUPP; + + /* Fill out the redirection table */ + if (indir) { +-- +2.39.2 + diff --git a/queue-5.4/ixgbe-enable-setting-rss-table-to-default-values.patch b/queue-5.4/ixgbe-enable-setting-rss-table-to-default-values.patch new file mode 100644 index 00000000000..1fbca2808fa --- /dev/null +++ b/queue-5.4/ixgbe-enable-setting-rss-table-to-default-values.patch @@ -0,0 +1,147 @@ +From fc8fe622bf70bcc74633122e13e567e1bbe3ec6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 19:12:23 +0000 +Subject: ixgbe: Enable setting RSS table to default values + +From: Joe Damato + +[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ] + +ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported +by RSS. The driver should return the smaller of either: + - The maximum number of RSS queues the device supports, OR + - The number of RX queues configured + +Prior to this change, running `ethtool -X $iface default` fails if the +number of queues configured is larger than the number supported by RSS, +even though changing the queue count correctly resets the flowhash to +use all supported queues. + +Other drivers (for example, i40e) will succeed but the flow hash will +reset to support the maximum number of queues supported by RSS, even if +that amount is smaller than the configured amount. + +Prior to this change: + +$ sudo ethtool -L eth1 combined 20 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 20 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 + 24: 8 9 10 11 12 13 14 15 + 32: 0 1 2 3 4 5 6 7 +... + +You can see that the flowhash was correctly set to use the maximum +number of queues supported by the driver (16). + +However, asking the NIC to reset to "default" fails: + +$ sudo ethtool -X eth1 default +Cannot set RX flow hash configuration: Invalid argument + +After this change, the flowhash can be reset to default which will use +all of the available RSS queues (16) or the configured queue count, +whichever is smaller. + +Starting with eth1 which has 10 queues and a flowhash distributing to +all 10 queues: + +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 10 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 0 1 2 3 4 5 + 16: 6 7 8 9 0 1 2 3 +... + +Increasing the queue count to 48 resets the flowhash to distribute to 16 +queues, as it did before this patch: + +$ sudo ethtool -L eth1 combined 48 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Due to the other bugfix in this series, the flowhash can be set to use +queues 0-5: + +$ sudo ethtool -X eth1 equal 5 +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 0 1 2 + 8: 3 4 0 1 2 3 4 0 + 16: 1 2 3 4 0 1 2 3 +... + +Due to this bugfix, the flowhash can be reset to default and use 16 +queues: + +$ sudo ethtool -X eth1 default +$ sudo ethtool -x eth1 +RX flow hash indirection table for eth1 with 16 RX ring(s): + 0: 0 1 2 3 4 5 6 7 + 8: 8 9 10 11 12 13 14 15 + 16: 0 1 2 3 4 5 6 7 +... + +Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls") +Signed-off-by: Joe Damato +Reviewed-by: Sridhar Samudrala +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +index babe16ece5aa6..a43cb7bfcccd7 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +@@ -2542,6 +2542,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter, + return 0; + } + ++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) ++{ ++ if (adapter->hw.mac.type < ixgbe_mac_X550) ++ return 16; ++ else ++ return 64; ++} ++ + static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + u32 *rule_locs) + { +@@ -2550,7 +2558,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd, + + switch (cmd->cmd) { + case ETHTOOL_GRXRINGS: +- cmd->data = adapter->num_rx_queues; ++ cmd->data = min_t(int, adapter->num_rx_queues, ++ ixgbe_rss_indir_tbl_max(adapter)); + ret = 0; + break; + case ETHTOOL_GRXCLSRLCNT: +@@ -2952,14 +2961,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd) + return ret; + } + +-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter) +-{ +- if (adapter->hw.mac.type < ixgbe_mac_X550) +- return 16; +- else +- return 64; +-} +- + static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev) + { + return IXGBE_RSS_KEY_SIZE; +-- +2.39.2 + diff --git a/queue-5.4/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch b/queue-5.4/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch new file mode 100644 index 00000000000..1078b43f266 --- /dev/null +++ b/queue-5.4/leds-ti_lmu_common-select-regmap-instead-of-dependin.patch @@ -0,0 +1,44 @@ +From 223c0d2a86a56a382d88e3c4f83c29a533478201 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Feb 2023 21:39:49 -0800 +Subject: leds: TI_LMU_COMMON: select REGMAP instead of depending on it + +From: Randy Dunlap + +[ Upstream commit a61079efc87888587e463afaed82417b162fbd69 ] + +REGMAP is a hidden (not user visible) symbol. Users cannot set it +directly thru "make *config", so drivers should select it instead of +depending on it if they need it. + +Consistently using "select" or "depends on" can also help reduce +Kconfig circular dependency issues. + +Therefore, change the use of "depends on REGMAP" to "select REGMAP". + +Fixes: 3fce8e1eb994 ("leds: TI LMU: Add common code for TI LMU devices") +Signed-off-by: Randy Dunlap +Acked-by: Pavel Machek +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20230226053953.4681-5-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/leds/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig +index 2cbf66d1c3000..34334adcad014 100644 +--- a/drivers/leds/Kconfig ++++ b/drivers/leds/Kconfig +@@ -802,7 +802,7 @@ config LEDS_SPI_BYTE + config LEDS_TI_LMU_COMMON + tristate "LED driver for TI LMU" + depends on LEDS_CLASS +- depends on REGMAP ++ select REGMAP + help + Say Y to enable the LED driver for TI LMU devices. + This supports common features between the TI LM3532, LM3631, LM3632, +-- +2.39.2 + diff --git a/queue-5.4/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch b/queue-5.4/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch new file mode 100644 index 00000000000..941ab16770a --- /dev/null +++ b/queue-5.4/linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch @@ -0,0 +1,58 @@ +From 8d7524152da0114cd36c3ba22937077f1f042e85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 19:15:29 -0700 +Subject: linux/vt_buffer.h: allow either builtin or modular for macros + +From: Randy Dunlap + +[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ] + +Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m. +This allows the ARCH macros to be the only ones defined. + +In file included from ../drivers/video/console/mdacon.c:37: +../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~ +../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew' + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^~~~ +../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token + 24 | #define scr_writew(val, addr) (*(addr) = (val)) + | ^ +../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew' + 17 | static inline void scr_writew(u16 val, volatile u16 *addr) + | ^~~~~~~~~~ +../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile' + 25 | static inline u16 scr_readw(volatile const u16 *addr) + | ^~~~~~~~ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Randy Dunlap +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: dri-devel@lists.freedesktop.org +Cc: linux-fbdev@vger.kernel.org +Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/vt_buffer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h +index 848db1b1569ff..919d999a8c1db 100644 +--- a/include/linux/vt_buffer.h ++++ b/include/linux/vt_buffer.h +@@ -16,7 +16,7 @@ + + #include + +-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE) ++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE) + #include + #endif + +-- +2.39.2 + diff --git a/queue-5.4/macintosh-via-pmu-led-requires-ata-to-be-set.patch b/queue-5.4/macintosh-via-pmu-led-requires-ata-to-be-set.patch new file mode 100644 index 00000000000..7c8dcfcbb83 --- /dev/null +++ b/queue-5.4/macintosh-via-pmu-led-requires-ata-to-be-set.patch @@ -0,0 +1,45 @@ +From 9abeac1c1c7a79c122951f02c553f90107db001f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 17:42:41 -0800 +Subject: macintosh: via-pmu-led: requires ATA to be set + +From: Randy Dunlap + +[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ] + +LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK +when ATA is not set/enabled causes a Kconfig warning: + +WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK + Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n] + Selected by [y]: + - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y] + +Fix this by making ADB_PMU_LED_DISK depend on ATA. + +Seen on both PPC32 and PPC64. + +Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/macintosh/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig +index b5a534206eddd..1605dcaa89e30 100644 +--- a/drivers/macintosh/Kconfig ++++ b/drivers/macintosh/Kconfig +@@ -86,6 +86,7 @@ config ADB_PMU_LED + + config ADB_PMU_LED_DISK + bool "Use front LED as DISK LED by default" ++ depends on ATA + depends on ADB_PMU_LED + depends on LEDS_CLASS + select LEDS_TRIGGERS +-- +2.39.2 + diff --git a/queue-5.4/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch b/queue-5.4/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch new file mode 100644 index 00000000000..2dddcc582c4 --- /dev/null +++ b/queue-5.4/macintosh-windfarm_smu_sat-add-missing-of_node_put.patch @@ -0,0 +1,36 @@ +From 880f04e4a98c5dc5a1fb481842cfa5a8c1fb882b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 11:35:58 +0800 +Subject: macintosh/windfarm_smu_sat: Add missing of_node_put() + +From: Liang He + +[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ] + +We call of_node_get() in wf_sat_probe() after sat is created, +so we need the of_node_put() before *kfree(sat)*. + +Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s") +Signed-off-by: Liang He +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com +Signed-off-by: Sasha Levin +--- + drivers/macintosh/windfarm_smu_sat.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c +index cb75dc0356167..30d53a535d55d 100644 +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -171,6 +171,7 @@ static void wf_sat_release(struct kref *ref) + + if (sat->nr >= 0) + sats[sat->nr] = NULL; ++ of_node_put(sat->node); + kfree(sat); + } + +-- +2.39.2 + diff --git a/queue-5.4/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch b/queue-5.4/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch new file mode 100644 index 00000000000..7e292ace22f --- /dev/null +++ b/queue-5.4/md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch @@ -0,0 +1,73 @@ +From 20d18187ba2bd949d0f37b4e1ac197f997c90286 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:53 +0800 +Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery + +From: Yu Kuai + +[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ] + +raid10_sync_request() will add 'r10bio->remaining' for both rdev and +replacement rdev. However, if the read io fails, recovery_request_write() +returns without issuing the write io, in this case, end_sync_request() +is only called once and 'remaining' is leaked, cause an io hang. + +Fix the problem by decreasing 'remaining' according to if 'bio' and +'repl_bio' is valid. + +Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 23 +++++++++++++---------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 9fcc141e1ad64..dd91385a3526f 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2229,11 +2229,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + { + struct r10conf *conf = mddev->private; + int d; +- struct bio *wbio, *wbio2; ++ struct bio *wbio = r10_bio->devs[1].bio; ++ struct bio *wbio2 = r10_bio->devs[1].repl_bio; ++ ++ /* Need to test wbio2->bi_end_io before we call ++ * generic_make_request as if the former is NULL, ++ * the latter is free to free wbio2. ++ */ ++ if (wbio2 && !wbio2->bi_end_io) ++ wbio2 = NULL; + + if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) { + fix_recovery_read_error(r10_bio); +- end_sync_request(r10_bio); ++ if (wbio->bi_end_io) ++ end_sync_request(r10_bio); ++ if (wbio2) ++ end_sync_request(r10_bio); + return; + } + +@@ -2242,14 +2253,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio) + * and submit the write request + */ + d = r10_bio->devs[1].devnum; +- wbio = r10_bio->devs[1].bio; +- wbio2 = r10_bio->devs[1].repl_bio; +- /* Need to test wbio2->bi_end_io before we call +- * generic_make_request as if the former is NULL, +- * the latter is free to free wbio2. +- */ +- if (wbio2 && !wbio2->bi_end_io) +- wbio2 = NULL; + if (wbio->bi_end_io) { + atomic_inc(&conf->mirrors[d].rdev->nr_pending); + md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio)); +-- +2.39.2 + diff --git a/queue-5.4/md-raid10-fix-memleak-for-conf-bio_split.patch b/queue-5.4/md-raid10-fix-memleak-for-conf-bio_split.patch new file mode 100644 index 00000000000..7b1bf83f24a --- /dev/null +++ b/queue-5.4/md-raid10-fix-memleak-for-conf-bio_split.patch @@ -0,0 +1,96 @@ +From a67c07267335575b9bb7fa265e47f78792963e85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:54 +0800 +Subject: md/raid10: fix memleak for 'conf->bio_split' + +From: Yu Kuai + +[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ] + +In the error path of raid10_run(), 'conf' need be freed, however, +'conf->bio_split' is missed and memory will be leaked. + +Since there are 3 places to free 'conf', factor out a helper to fix the +problem. + +Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 37 +++++++++++++++++-------------------- + 1 file changed, 17 insertions(+), 20 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index dd91385a3526f..68447e1525057 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3635,6 +3635,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new) + return nc*fc; + } + ++static void raid10_free_conf(struct r10conf *conf) ++{ ++ if (!conf) ++ return; ++ ++ mempool_exit(&conf->r10bio_pool); ++ kfree(conf->mirrors); ++ kfree(conf->mirrors_old); ++ kfree(conf->mirrors_new); ++ safe_put_page(conf->tmppage); ++ bioset_exit(&conf->bio_split); ++ kfree(conf); ++} ++ + static struct r10conf *setup_conf(struct mddev *mddev) + { + struct r10conf *conf = NULL; +@@ -3717,13 +3731,7 @@ static struct r10conf *setup_conf(struct mddev *mddev) + return conf; + + out: +- if (conf) { +- mempool_exit(&conf->r10bio_pool); +- kfree(conf->mirrors); +- safe_put_page(conf->tmppage); +- bioset_exit(&conf->bio_split); +- kfree(conf); +- } ++ raid10_free_conf(conf); + return ERR_PTR(err); + } + +@@ -3937,10 +3945,7 @@ static int raid10_run(struct mddev *mddev) + + out_free_conf: + md_unregister_thread(&mddev->thread); +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf); ++ raid10_free_conf(conf); + mddev->private = NULL; + out: + return -EIO; +@@ -3948,15 +3953,7 @@ static int raid10_run(struct mddev *mddev) + + static void raid10_free(struct mddev *mddev, void *priv) + { +- struct r10conf *conf = priv; +- +- mempool_exit(&conf->r10bio_pool); +- safe_put_page(conf->tmppage); +- kfree(conf->mirrors); +- kfree(conf->mirrors_old); +- kfree(conf->mirrors_new); +- bioset_exit(&conf->bio_split); +- kfree(conf); ++ raid10_free_conf(priv); + } + + static void raid10_quiesce(struct mddev *mddev, int quiesce) +-- +2.39.2 + diff --git a/queue-5.4/md-raid10-fix-memleak-of-md-thread.patch b/queue-5.4/md-raid10-fix-memleak-of-md-thread.patch new file mode 100644 index 00000000000..710160140d8 --- /dev/null +++ b/queue-5.4/md-raid10-fix-memleak-of-md-thread.patch @@ -0,0 +1,51 @@ +From 7dc5862542c131a72221eebbb2011921cc38fb55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 15:38:55 +0800 +Subject: md/raid10: fix memleak of md thread + +From: Yu Kuai + +[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ] + +In raid10_run(), if setup_conf() succeed and raid10_run() failed before +setting 'mddev->thread', then in the error path 'conf->thread' is not +freed. + +Fix the problem by setting 'mddev->thread' right after setup_conf(). + +Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported") +Signed-off-by: Yu Kuai +Signed-off-by: Song Liu +Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index b37e3cd4e3673..c792683a0dea2 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3769,6 +3769,9 @@ static int raid10_run(struct mddev *mddev) + if (!conf) + goto out; + ++ mddev->thread = conf->thread; ++ conf->thread = NULL; ++ + if (mddev_is_clustered(conf->mddev)) { + int fc, fo; + +@@ -3781,9 +3784,6 @@ static int raid10_run(struct mddev *mddev) + } + } + +- mddev->thread = conf->thread; +- conf->thread = NULL; +- + if (mddev->queue) { + blk_queue_max_discard_sectors(mddev->queue, + mddev->chunk_sectors); +-- +2.39.2 + diff --git a/queue-5.4/md-update-the-optimal-i-o-size-on-reshape.patch b/queue-5.4/md-update-the-optimal-i-o-size-on-reshape.patch new file mode 100644 index 00000000000..3c05264361f --- /dev/null +++ b/queue-5.4/md-update-the-optimal-i-o-size-on-reshape.patch @@ -0,0 +1,119 @@ +From 3a93f2758554317c08e90b520cd24ebffbe0ba82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 08:51:33 +0200 +Subject: md: update the optimal I/O size on reshape + +From: Christoph Hellwig + +[ Upstream commit 16ef510139315a2147ee7525796f8dbd4e4b7864 ] + +The raid5 and raid10 drivers currently update the read-ahead size, +but not the optimal I/O size on reshape. To prepare for deriving the +read-ahead size from the optimal I/O size make sure it is updated +as well. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Reviewed-by: Martin K. Petersen +Acked-by: Song Liu +Signed-off-by: Jens Axboe +Stable-dep-of: f0ddb83da3cb ("md/raid10: fix memleak of md thread") +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 22 ++++++++++++++-------- + drivers/md/raid5.c | 10 ++++++++-- + 2 files changed, 22 insertions(+), 10 deletions(-) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 68447e1525057..b37e3cd4e3673 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3735,10 +3735,20 @@ static struct r10conf *setup_conf(struct mddev *mddev) + return ERR_PTR(err); + } + ++static void raid10_set_io_opt(struct r10conf *conf) ++{ ++ int raid_disks = conf->geo.raid_disks; ++ ++ if (!(conf->geo.raid_disks % conf->geo.near_copies)) ++ raid_disks /= conf->geo.near_copies; ++ blk_queue_io_opt(conf->mddev->queue, (conf->mddev->chunk_sectors << 9) * ++ raid_disks); ++} ++ + static int raid10_run(struct mddev *mddev) + { + struct r10conf *conf; +- int i, disk_idx, chunk_size; ++ int i, disk_idx; + struct raid10_info *disk; + struct md_rdev *rdev; + sector_t size; +@@ -3774,18 +3784,13 @@ static int raid10_run(struct mddev *mddev) + mddev->thread = conf->thread; + conf->thread = NULL; + +- chunk_size = mddev->chunk_sectors << 9; + if (mddev->queue) { + blk_queue_max_discard_sectors(mddev->queue, + mddev->chunk_sectors); + blk_queue_max_write_same_sectors(mddev->queue, 0); + blk_queue_max_write_zeroes_sectors(mddev->queue, 0); +- blk_queue_io_min(mddev->queue, chunk_size); +- if (conf->geo.raid_disks % conf->geo.near_copies) +- blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks); +- else +- blk_queue_io_opt(mddev->queue, chunk_size * +- (conf->geo.raid_disks / conf->geo.near_copies)); ++ blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9); ++ raid10_set_io_opt(conf); + } + + rdev_for_each(rdev, mddev) { +@@ -4748,6 +4753,7 @@ static void end_reshape(struct r10conf *conf) + stripe /= conf->geo.near_copies; + if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe) + conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe; ++ raid10_set_io_opt(conf); + } + conf->fullsync = 0; + } +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index d0c3f49c8c162..113ba084fab45 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -7159,6 +7159,12 @@ static int only_parity(int raid_disk, int algo, int raid_disks, int max_degraded + return 0; + } + ++static void raid5_set_io_opt(struct r5conf *conf) ++{ ++ blk_queue_io_opt(conf->mddev->queue, (conf->chunk_sectors << 9) * ++ (conf->raid_disks - conf->max_degraded)); ++} ++ + static int raid5_run(struct mddev *mddev) + { + struct r5conf *conf; +@@ -7448,8 +7454,7 @@ static int raid5_run(struct mddev *mddev) + + chunk_size = mddev->chunk_sectors << 9; + blk_queue_io_min(mddev->queue, chunk_size); +- blk_queue_io_opt(mddev->queue, chunk_size * +- (conf->raid_disks - conf->max_degraded)); ++ raid5_set_io_opt(conf); + mddev->queue->limits.raid_partial_stripes_expensive = 1; + /* + * We can only discard a whole stripe. It doesn't make sense to +@@ -8043,6 +8048,7 @@ static void end_reshape(struct r5conf *conf) + / PAGE_SIZE); + if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe) + conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe; ++ raid5_set_io_opt(conf); + } + } + } +-- +2.39.2 + diff --git a/queue-5.4/media-av7110-prevent-underflow-in-write_ts_to_decode.patch b/queue-5.4/media-av7110-prevent-underflow-in-write_ts_to_decode.patch new file mode 100644 index 00000000000..900d9f54bac --- /dev/null +++ b/queue-5.4/media-av7110-prevent-underflow-in-write_ts_to_decode.patch @@ -0,0 +1,47 @@ +From 3e28baf39ea72c82bc8c707053879ee6a72e0e3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 11:00:23 +0100 +Subject: media: av7110: prevent underflow in write_ts_to_decoder() + +From: Dan Carpenter + +[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ] + +The buf[4] value comes from the user via ts_play(). It is a value in +the u8 range. The final length we pass to av7110_ipack_instant_repack() +is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is +not negative. It's not clear that passing a negative len value does +anything bad necessarily, but it's not best practice. + +With the new bounds checking the "if (!len)" condition is no longer +possible or required so remove that. + +Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ttpci/av7110_av.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c +index ea9f7d0058a21..e201d5a56bc65 100644 +--- a/drivers/media/pci/ttpci/av7110_av.c ++++ b/drivers/media/pci/ttpci/av7110_av.c +@@ -822,10 +822,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s + av7110_ipack_flush(ipack); + + if (buf[3] & ADAPT_FIELD) { ++ if (buf[4] > len - 1 - 4) ++ return 0; + len -= buf[4] + 1; + buf += buf[4] + 1; +- if (!len) +- return 0; + } + + av7110_ipack_instant_repack(buf + 4, len - 4, ipack); +-- +2.39.2 + diff --git a/queue-5.4/media-bdisp-add-missing-check-for-create_workqueue.patch b/queue-5.4/media-bdisp-add-missing-check-for-create_workqueue.patch new file mode 100644 index 00000000000..2186fe63366 --- /dev/null +++ b/queue-5.4/media-bdisp-add-missing-check-for-create_workqueue.patch @@ -0,0 +1,37 @@ +From 46b53a67dd4ff03b89b980594b5b761b7fda76bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Feb 2023 08:14:42 +0100 +Subject: media: bdisp: Add missing check for create_workqueue + +From: Jiasheng Jiang + +[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ] + +Add the check for the return value of the create_workqueue +in order to avoid NULL pointer dereference. + +Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index 16a097f93b423..2485a3657c891 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -1308,6 +1308,8 @@ static int bdisp_probe(struct platform_device *pdev) + init_waitqueue_head(&bdisp->irq_queue); + INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout); + bdisp->work_queue = create_workqueue(BDISP_NAME); ++ if (!bdisp->work_queue) ++ return -ENOMEM; + + spin_lock_init(&bdisp->slock); + mutex_init(&bdisp->lock); +-- +2.39.2 + diff --git a/queue-5.4/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch b/queue-5.4/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch new file mode 100644 index 00000000000..609adaf55d7 --- /dev/null +++ b/queue-5.4/media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch @@ -0,0 +1,56 @@ +From a7b9168c4ae9fb01f90d89b46835178a2467e0dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:15:06 +0800 +Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race + condition + +From: Zheng Wang + +[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ] + +In dm1105_probe, it called dm1105_ir_init and bound +&dm1105->ir.work with dm1105_emit_key. +When it handles IRQ request with dm1105_irq, +it may call schedule_work to start the work. + +When we call dm1105_remove to remove the driver, there +may be a sequence as follows: + +Fix it by finishing the work before cleanup in dm1105_remove + +CPU0 CPU1 + + |dm1105_emit_key +dm1105_remove | + dm1105_ir_exit | + rc_unregister_device | + rc_free_device | + rc_dev_release | + kfree(dev); | + | + | rc_keydown + | //use + +Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/dm1105/dm1105.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c +index bb3a8cc9de0cb..6dbd98a3e5b8f 100644 +--- a/drivers/media/pci/dm1105/dm1105.c ++++ b/drivers/media/pci/dm1105/dm1105.c +@@ -1179,6 +1179,7 @@ static void dm1105_remove(struct pci_dev *pdev) + struct dvb_demux *dvbdemux = &dev->demux; + struct dmx_demux *dmx = &dvbdemux->dmx; + ++ cancel_work_sync(&dev->ir.work); + dm1105_ir_exit(dev); + dmx->close(dmx); + dvb_net_release(&dev->dvbnet); +-- +2.39.2 + diff --git a/queue-5.4/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch b/queue-5.4/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch new file mode 100644 index 00000000000..41c5d72ae99 --- /dev/null +++ b/queue-5.4/media-rc-gpio-ir-recv-fix-support-for-wake-up.patch @@ -0,0 +1,43 @@ +From 659abf85aadfb02a68c2d565978e3b72c2aae2a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 13:38:33 -0700 +Subject: media: rc: gpio-ir-recv: Fix support for wake-up + +From: Florian Fainelli + +[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ] + +The driver was intended from the start to be a wake-up source for the +system, however due to the absence of a suitable call to +device_set_wakeup_capable(), the device_may_wakeup() call used to decide +whether to enable the GPIO interrupt as a wake-up source would never +happen. Lookup the DT standard "wakeup-source" property and call +device_init_wakeup() to ensure the device is flagged as being wakeup +capable. + +Reported-by: Matthew Lear +Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver") +Signed-off-by: Florian Fainelli +Signed-off-by: Sean Young +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/rc/gpio-ir-recv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c +index a20413008c3cb..f50398b3ed5f4 100644 +--- a/drivers/media/rc/gpio-ir-recv.c ++++ b/drivers/media/rc/gpio-ir-recv.c +@@ -83,6 +83,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev) + rcdev->map_name = RC_MAP_EMPTY; + + gpio_dev->rcdev = rcdev; ++ if (of_property_read_bool(np, "wakeup-source")) ++ device_init_wakeup(dev, true); + + rc = devm_rc_register_device(dev, rcdev); + if (rc < 0) { +-- +2.39.2 + diff --git a/queue-5.4/media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.4/media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..a65d4a5d278 --- /dev/null +++ b/queue-5.4/media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,76 @@ +From 00499aaeb6d792f88ac22563b59898d144ef9daf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 16:59:34 +0200 +Subject: media: rcar_fdp1: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit 45e75a8c6fa455a5909ac04db76a4b15d6bb8368 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +Also, right now, the driver is ignoring any troubles when +trying to do PM resume. So, add the proper error handling +for the code. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index d6eee66c8dd49..9caddc8387b46 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2139,7 +2139,9 @@ static int fdp1_open(struct file *file) + } + + /* Perform any power management required */ +- pm_runtime_get_sync(fdp1->dev); ++ ret = pm_runtime_resume_and_get(fdp1->dev); ++ if (ret < 0) ++ goto error_pm; + + v4l2_fh_add(&ctx->fh); + +@@ -2149,6 +2151,8 @@ static int fdp1_open(struct file *file) + mutex_unlock(&fdp1->dev_mutex); + return 0; + ++error_pm: ++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); + error_ctx: + v4l2_ctrl_handler_free(&ctx->hdl); + kfree(ctx); +@@ -2356,7 +2360,9 @@ static int fdp1_probe(struct platform_device *pdev) + + /* Power up the cells to read HW */ + pm_runtime_enable(&pdev->dev); +- pm_runtime_get_sync(fdp1->dev); ++ ret = pm_runtime_resume_and_get(fdp1->dev); ++ if (ret < 0) ++ goto disable_pm; + + hw_version = fdp1_read(fdp1, FD1_IP_INTDATA); + switch (hw_version) { +@@ -2385,6 +2391,9 @@ static int fdp1_probe(struct platform_device *pdev) + + return 0; + ++disable_pm: ++ pm_runtime_disable(fdp1->dev); ++ + release_m2m: + v4l2_m2m_release(fdp1->m2m_dev); + +-- +2.39.2 + diff --git a/queue-5.4/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch b/queue-5.4/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch new file mode 100644 index 00000000000..8187f7525fe --- /dev/null +++ b/queue-5.4/media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch @@ -0,0 +1,70 @@ +From eb5c29b1720c365a388c6e16f2a6c8e75865463c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Jan 2023 11:58:09 +0400 +Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function + +From: Miaoqian Lin + +[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ] + +rcar_fcp_get() take reference, which should be balanced with +rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and +the error paths of fdp1_probe() to fix this. + +Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver") +Signed-off-by: Miaoqian Lin +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +[hverkuil: resolve merge conflict, remove() is now void] +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 0967b10a459b1..af2408b4856e6 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2317,8 +2317,10 @@ static int fdp1_probe(struct platform_device *pdev) + + /* Determine our clock rate */ + clk = clk_get(&pdev->dev, NULL); +- if (IS_ERR(clk)) +- return PTR_ERR(clk); ++ if (IS_ERR(clk)) { ++ ret = PTR_ERR(clk); ++ goto put_dev; ++ } + + fdp1->clk_rate = clk_get_rate(clk); + clk_put(clk); +@@ -2327,7 +2329,7 @@ static int fdp1_probe(struct platform_device *pdev) + ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev); + if (ret) { + v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n"); +- return ret; ++ goto put_dev; + } + + /* M2M registration */ +@@ -2397,6 +2399,8 @@ static int fdp1_probe(struct platform_device *pdev) + unreg_dev: + v4l2_device_unregister(&fdp1->v4l2_dev); + ++put_dev: ++ rcar_fcp_put(fdp1->fcp); + return ret; + } + +@@ -2408,6 +2412,7 @@ static int fdp1_remove(struct platform_device *pdev) + video_unregister_device(&fdp1->vfd); + v4l2_device_unregister(&fdp1->v4l2_dev); + pm_runtime_disable(&pdev->dev); ++ rcar_fcp_put(fdp1->fcp); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.4/media-rcar_fdp1-fix-the-correct-variable-assignments.patch b/queue-5.4/media-rcar_fdp1-fix-the-correct-variable-assignments.patch new file mode 100644 index 00000000000..7f620559e53 --- /dev/null +++ b/queue-5.4/media-rcar_fdp1-fix-the-correct-variable-assignments.patch @@ -0,0 +1,48 @@ +From 7e45a8458685b7cbbfceb9bbfb1a390348baab4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Oct 2021 05:09:38 +0200 +Subject: media: rcar_fdp1: Fix the correct variable assignments + +From: Tang Bin + +[ Upstream commit af88c2adbb72a09ab1bb5c37ba388c98fecca69b ] + +In the function fdp1_probe(), when get irq failed, the +function platform_get_irq() log an error message, so +remove redundant message here. And the variable type +of "ret" is int, the "fdp1->irq" is unsigned int, when +irq failed, this place maybe wrong, thus fix it. + +Signed-off-by: Tang Bin +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 90575a58ad880..0967b10a459b1 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2291,11 +2291,10 @@ static int fdp1_probe(struct platform_device *pdev) + return PTR_ERR(fdp1->regs); + + /* Interrupt service routine registration */ +- fdp1->irq = ret = platform_get_irq(pdev, 0); +- if (ret < 0) { +- dev_err(&pdev->dev, "cannot find IRQ\n"); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) + return ret; +- } ++ fdp1->irq = ret; + + ret = devm_request_irq(&pdev->dev, fdp1->irq, fdp1_irq_handler, 0, + dev_name(&pdev->dev), fdp1); +-- +2.39.2 + diff --git a/queue-5.4/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch b/queue-5.4/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch new file mode 100644 index 00000000000..a742b065b3a --- /dev/null +++ b/queue-5.4/media-rcar_fdp1-make-use-of-the-helper-function-devm.patch @@ -0,0 +1,49 @@ +From 562b54437603e8a0c85e6aa9cbe88eb9a120ba33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 07:55:24 +0200 +Subject: media: rcar_fdp1: Make use of the helper function + devm_platform_ioremap_resource() + +From: Cai Huoqing + +[ Upstream commit 736cce12fa630e28705de06570d74f0513d948d5 ] + +Use the devm_platform_ioremap_resource() helper instead of +calling platform_get_resource() and devm_ioremap_resource() +separately + +Signed-off-by: Cai Huoqing +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 9caddc8387b46..90575a58ad880 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2260,7 +2260,6 @@ static int fdp1_probe(struct platform_device *pdev) + struct fdp1_dev *fdp1; + struct video_device *vfd; + struct device_node *fcp_node; +- struct resource *res; + struct clk *clk; + unsigned int i; + +@@ -2287,8 +2286,7 @@ static int fdp1_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, fdp1); + + /* Memory-mapped registers */ +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- fdp1->regs = devm_ioremap_resource(&pdev->dev, res); ++ fdp1->regs = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(fdp1->regs)) + return PTR_ERR(fdp1->regs); + +-- +2.39.2 + diff --git a/queue-5.4/media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch b/queue-5.4/media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch new file mode 100644 index 00000000000..8715ddc905e --- /dev/null +++ b/queue-5.4/media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch @@ -0,0 +1,62 @@ +From d3beecc6673368f6cded2200d2cd83e5a1402344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 16:59:34 +0200 +Subject: media: rcar_fdp1: simplify error check logic at fdp_open() + +From: Mauro Carvalho Chehab + +[ Upstream commit fa9f443f7c962d072d150472e2bb77de39817a9a ] + +Avoid some code duplication by moving the common error path +logic at fdp_open(). + +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function") +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_fdp1.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c +index 97bed45360f08..d6eee66c8dd49 100644 +--- a/drivers/media/platform/rcar_fdp1.c ++++ b/drivers/media/platform/rcar_fdp1.c +@@ -2121,9 +2121,7 @@ static int fdp1_open(struct file *file) + + if (ctx->hdl.error) { + ret = ctx->hdl.error; +- v4l2_ctrl_handler_free(&ctx->hdl); +- kfree(ctx); +- goto done; ++ goto error_ctx; + } + + ctx->fh.ctrl_handler = &ctx->hdl; +@@ -2137,10 +2135,7 @@ static int fdp1_open(struct file *file) + + if (IS_ERR(ctx->fh.m2m_ctx)) { + ret = PTR_ERR(ctx->fh.m2m_ctx); +- +- v4l2_ctrl_handler_free(&ctx->hdl); +- kfree(ctx); +- goto done; ++ goto error_ctx; + } + + /* Perform any power management required */ +@@ -2151,6 +2146,12 @@ static int fdp1_open(struct file *file) + dprintk(fdp1, "Created instance: %p, m2m_ctx: %p\n", + ctx, ctx->fh.m2m_ctx); + ++ mutex_unlock(&fdp1->dev_mutex); ++ return 0; ++ ++error_ctx: ++ v4l2_ctrl_handler_free(&ctx->hdl); ++ kfree(ctx); + done: + mutex_unlock(&fdp1->dev_mutex); + return ret; +-- +2.39.2 + diff --git a/queue-5.4/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch b/queue-5.4/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch new file mode 100644 index 00000000000..9aa11c669d6 --- /dev/null +++ b/queue-5.4/media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch @@ -0,0 +1,86 @@ +From 50aea31c68501b7b8db1ac437f36aa2ac884034c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 16:50:23 +0800 +Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race + condition + +From: Zheng Wang + +[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ] + +In saa7134_initdev, it will call saa7134_hwinit1. There are three +function invoking here: saa7134_video_init1, saa7134_ts_init1 +and saa7134_vbi_init1. + +All of them will init a timer with same function. Take +saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout +with saa7134_buffer_timeout. + +In buffer_activate, the timer funtcion is started. + +If we remove the module or device which will call saa7134_finidev +to make cleanup, there may be a unfinished work. The +possible sequence is as follows, which will cause a +typical UAF bug. + +Fix it by canceling the timer works accordingly before cleanup in +saa7134_finidev. + +CPU0 CPU1 + + |saa7134_buffer_timeout +saa7134_finidev | + kfree(dev); | + | + | saa7134_buffer_next + | //use dev + +Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()") +Signed-off-by: Zheng Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-ts.c | 1 + + drivers/media/pci/saa7134/saa7134-vbi.c | 1 + + drivers/media/pci/saa7134/saa7134-video.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c +index 6a5053126237f..437dbe5e75e29 100644 +--- a/drivers/media/pci/saa7134/saa7134-ts.c ++++ b/drivers/media/pci/saa7134/saa7134-ts.c +@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev) + + int saa7134_ts_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->ts_q.timeout); + saa7134_pgtable_free(dev->pci, &dev->ts_q.pt); + return 0; + } +diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c +index 3f0b0933eed69..3e773690468bd 100644 +--- a/drivers/media/pci/saa7134/saa7134-vbi.c ++++ b/drivers/media/pci/saa7134/saa7134-vbi.c +@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev) + int saa7134_vbi_fini(struct saa7134_dev *dev) + { + /* nothing */ ++ del_timer_sync(&dev->vbi_q.timeout); + return 0; + } + +diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c +index e454a288229b8..ea26c8c57494f 100644 +--- a/drivers/media/pci/saa7134/saa7134-video.c ++++ b/drivers/media/pci/saa7134/saa7134-video.c +@@ -2154,6 +2154,7 @@ int saa7134_video_init1(struct saa7134_dev *dev) + + void saa7134_video_fini(struct saa7134_dev *dev) + { ++ del_timer_sync(&dev->video_q.timeout); + /* free stuff */ + vb2_queue_release(&dev->video_vbq); + saa7134_pgtable_free(dev->pci, &dev->video_q.pt); +-- +2.39.2 + diff --git a/queue-5.4/media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch b/queue-5.4/media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch new file mode 100644 index 00000000000..08b8a535a9f --- /dev/null +++ b/queue-5.4/media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch @@ -0,0 +1,82 @@ +From 588d064914b56ea46dbeb922a73ddecbc650881a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 14:46:08 +0100 +Subject: media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format. + +From: Dafna Hirschfeld + +[ Upstream commit 6ad253cc3436269fc6bcff03d704c672f368da0a ] + +MEDIA_BUS_FMT_METADATA_FIXED should be used when +the same driver handles both sides of the link and +the bus format is a fixed metadata format that is +not configurable from userspace. +The width and height will be set to 0 for this format. + +Signed-off-by: Dafna Hirschfeld +Acked-by: Helen Koike +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Stable-dep-of: eed9496a0501 ("media: av7110: prevent underflow in write_ts_to_decoder()") +Signed-off-by: Sasha Levin +--- + .../media/uapi/v4l/subdev-formats.rst | 27 +++++++++++++++++++ + include/uapi/linux/media-bus-format.h | 8 ++++++ + 2 files changed, 35 insertions(+) + +diff --git a/Documentation/media/uapi/v4l/subdev-formats.rst b/Documentation/media/uapi/v4l/subdev-formats.rst +index 15e11f27b4c8f..b89a2f6c91552 100644 +--- a/Documentation/media/uapi/v4l/subdev-formats.rst ++++ b/Documentation/media/uapi/v4l/subdev-formats.rst +@@ -7794,3 +7794,30 @@ formats. + - 0x5001 + - Interleaved raw UYVY and JPEG image format with embedded meta-data + used by Samsung S3C73MX camera sensors. ++ ++.. _v4l2-mbus-metadata-fmts: ++ ++Metadata Formats ++^^^^^^^^^^^^^^^^ ++ ++This section lists all metadata formats. ++ ++The following table lists the existing metadata formats. ++ ++.. tabularcolumns:: |p{8.0cm}|p{1.4cm}|p{7.7cm}| ++ ++.. flat-table:: Metadata formats ++ :header-rows: 1 ++ :stub-columns: 0 ++ ++ * - Identifier ++ - Code ++ - Comments ++ * .. _MEDIA-BUS-FMT-METADATA-FIXED: ++ ++ - MEDIA_BUS_FMT_METADATA_FIXED ++ - 0x7001 ++ - This format should be used when the same driver handles ++ both sides of the link and the bus format is a fixed ++ metadata format that is not configurable from userspace. ++ Width and height will be set to 0 for this format. +diff --git a/include/uapi/linux/media-bus-format.h b/include/uapi/linux/media-bus-format.h +index 16c1fa2d89a42..052c8308b995c 100644 +--- a/include/uapi/linux/media-bus-format.h ++++ b/include/uapi/linux/media-bus-format.h +@@ -155,4 +155,12 @@ + /* HSV - next is 0x6002 */ + #define MEDIA_BUS_FMT_AHSV8888_1X32 0x6001 + ++/* ++ * This format should be used when the same driver handles ++ * both sides of the link and the bus format is a fixed ++ * metadata format that is not configurable from userspace. ++ * Width and height will be set to 0 for this format. ++ */ ++#define MEDIA_BUS_FMT_METADATA_FIXED 0x7001 ++ + #endif /* __LINUX_MEDIA_BUS_FORMAT_H */ +-- +2.39.2 + diff --git a/queue-5.4/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch b/queue-5.4/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch new file mode 100644 index 00000000000..e8ae877663d --- /dev/null +++ b/queue-5.4/mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch @@ -0,0 +1,82 @@ +From cac8fecd0f869f9f14619d9a28e6b746ce769cfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Mar 2023 23:37:15 +0300 +Subject: mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data + +From: Georgii Kruglov + +[ Upstream commit 0dd8316037a2a6d85b2be208bef9991de7b42170 ] + +If spec_reg is equal to 'SDHCI_PRESENT_STATE', esdhc_readl_fixup() +fixes up register value and returns it immediately. As a result, the +further block +(spec_reg == SDHCI_PRESENT_STATE) + &&(esdhc->quirk_ignore_data_inhibit == true), +is never executed. + +The patch merges the second block into the first one. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 1f1929f3f2fa ("mmc: sdhci-of-esdhc: add quirk to ignore command inhibit for data") +Signed-off-by: Georgii Kruglov +Acked-by: Adrian Hunter +Link: https://lore.kernel.org/r/20230321203715.3975-1-georgy.kruglov@yandex.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-esdhc.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 69c133e7ced05..48765208e2953 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -124,6 +124,7 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + return ret; + } + } ++ + /* + * The DAT[3:0] line signal levels and the CMD line signal level are + * not compatible with standard SDHC register. The line signal levels +@@ -135,6 +136,16 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + ret = value & 0x000fffff; + ret |= (value >> 4) & SDHCI_DATA_LVL_MASK; + ret |= (value << 1) & SDHCI_CMD_LVL; ++ ++ /* ++ * Some controllers have unreliable Data Line Active ++ * bit for commands with busy signal. This affects ++ * Command Inhibit (data) bit. Just ignore it since ++ * MMC core driver has already polled card status ++ * with CMD13 after any command with busy siganl. ++ */ ++ if (esdhc->quirk_ignore_data_inhibit) ++ ret &= ~SDHCI_DATA_INHIBIT; + return ret; + } + +@@ -149,19 +160,6 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host, + return ret; + } + +- /* +- * Some controllers have unreliable Data Line Active +- * bit for commands with busy signal. This affects +- * Command Inhibit (data) bit. Just ignore it since +- * MMC core driver has already polled card status +- * with CMD13 after any command with busy siganl. +- */ +- if ((spec_reg == SDHCI_PRESENT_STATE) && +- (esdhc->quirk_ignore_data_inhibit == true)) { +- ret = value & ~SDHCI_DATA_INHIBIT; +- return ret; +- } +- + ret = value; + return ret; + } +-- +2.39.2 + diff --git a/queue-5.4/mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch b/queue-5.4/mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch new file mode 100644 index 00000000000..638f88ea524 --- /dev/null +++ b/queue-5.4/mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch @@ -0,0 +1,39 @@ +From bfa9dce8c5ba9ddd6f20d5b60b238109d61ab987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:34:39 +0530 +Subject: mtd: spi-nor: cadence-quadspi: Don't initialize rx_dma_complete on + failure + +From: Vignesh Raghavendra + +[ Upstream commit 48aae57f0f9f57797772bd462b4d64902b1b4ae1 ] + +If driver fails to acquire DMA channel then don't initialize +rx_dma_complete struct as it won't be used. + +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Tudor Ambarus +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200601070444.16923-4-vigneshr@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 7e7736bbbfb3b..ad27d3e4c5dbc 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -1179,6 +1179,7 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi) + if (IS_ERR(cqspi->rx_chan)) { + dev_err(&cqspi->pdev->dev, "No Rx DMA available\n"); + cqspi->rx_chan = NULL; ++ return; + } + init_completion(&cqspi->rx_dma_complete); + } +-- +2.39.2 + diff --git a/queue-5.4/mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch b/queue-5.4/mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch new file mode 100644 index 00000000000..55d5b56c46a --- /dev/null +++ b/queue-5.4/mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch @@ -0,0 +1,76 @@ +From 53031171931595d07ef898b336111560d99a804c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:34:41 +0530 +Subject: mtd: spi-nor: cadence-quadspi: Handle probe deferral while requesting + DMA channel + +From: Vignesh Raghavendra + +[ Upstream commit 935da5e5100f57d843cac4781b21f1c235059aa0 ] + +dma_request_chan_by_mask() can throw EPROBE_DEFER if DMA provider +is not yet probed. Currently driver just falls back to using PIO mode +(which is less efficient) in this case. Instead return probe deferral +error as is so that driver will be re probed once DMA provider is +available. + +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Tudor Ambarus +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200601070444.16923-6-vigneshr@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index ad27d3e4c5dbc..2c5a6587f505e 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -1168,7 +1168,7 @@ static void cqspi_controller_init(struct cqspi_st *cqspi) + cqspi_controller_enable(cqspi, 1); + } + +-static void cqspi_request_mmap_dma(struct cqspi_st *cqspi) ++static int cqspi_request_mmap_dma(struct cqspi_st *cqspi) + { + dma_cap_mask_t mask; + +@@ -1177,11 +1177,16 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi) + + cqspi->rx_chan = dma_request_chan_by_mask(&mask); + if (IS_ERR(cqspi->rx_chan)) { +- dev_err(&cqspi->pdev->dev, "No Rx DMA available\n"); ++ int ret = PTR_ERR(cqspi->rx_chan); ++ ++ if (ret != -EPROBE_DEFER) ++ dev_err(&cqspi->pdev->dev, "No Rx DMA available\n"); + cqspi->rx_chan = NULL; +- return; ++ return ret; + } + init_completion(&cqspi->rx_dma_complete); ++ ++ return 0; + } + + static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np) +@@ -1265,8 +1270,11 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np) + dev_dbg(nor->dev, "using direct mode for %s\n", + mtd->name); + +- if (!cqspi->rx_chan) +- cqspi_request_mmap_dma(cqspi); ++ if (!cqspi->rx_chan) { ++ ret = cqspi_request_mmap_dma(cqspi); ++ if (ret == -EPROBE_DEFER) ++ goto err; ++ } + } + } + +-- +2.39.2 + diff --git a/queue-5.4/mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch b/queue-5.4/mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch new file mode 100644 index 00000000000..bf391b63b6c --- /dev/null +++ b/queue-5.4/mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch @@ -0,0 +1,101 @@ +From 19b8f14296e2b3273d9e0cf8565a69a35cccc045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:34:37 +0530 +Subject: mtd: spi-nor: cadence-quadspi: Make driver independent of flash + geometry + +From: Vignesh Raghavendra + +[ Upstream commit 834b4e8d344139ba64cda22099b2b2ef6c9a542d ] + +Drop configuration of Flash size, erase size and page size +configuration. Flash size is needed only if using AHB decoder (BIT 23 of +CONFIG_REG) which is not used by the driver. +Erase size and page size are needed if IP is configured to send WREN +automatically. But since SPI NOR layer takes care of sending WREN, there +is no need to configure these fields either. + +Therefore drop these in preparation to move the driver to spi-mem +framework where flash geometry is not visible to controller driver. + +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Tudor Ambarus +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200601070444.16923-2-vigneshr@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 36 +-------------------------- + 1 file changed, 1 insertion(+), 35 deletions(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 97a5e1eaeefdf..d680e4a272a13 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -77,9 +77,6 @@ struct cqspi_st { + dma_addr_t mmap_phys_base; + + int current_cs; +- int current_page_size; +- int current_erase_size; +- int current_addr_width; + unsigned long master_ref_clk_hz; + bool is_decoded_cs; + u32 fifo_depth; +@@ -736,32 +733,6 @@ static void cqspi_chipselect(struct spi_nor *nor) + writel(reg, reg_base + CQSPI_REG_CONFIG); + } + +-static void cqspi_configure_cs_and_sizes(struct spi_nor *nor) +-{ +- struct cqspi_flash_pdata *f_pdata = nor->priv; +- struct cqspi_st *cqspi = f_pdata->cqspi; +- void __iomem *iobase = cqspi->iobase; +- unsigned int reg; +- +- /* configure page size and block size. */ +- reg = readl(iobase + CQSPI_REG_SIZE); +- reg &= ~(CQSPI_REG_SIZE_PAGE_MASK << CQSPI_REG_SIZE_PAGE_LSB); +- reg &= ~(CQSPI_REG_SIZE_BLOCK_MASK << CQSPI_REG_SIZE_BLOCK_LSB); +- reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK; +- reg |= (nor->page_size << CQSPI_REG_SIZE_PAGE_LSB); +- reg |= (ilog2(nor->mtd.erasesize) << CQSPI_REG_SIZE_BLOCK_LSB); +- reg |= (nor->addr_width - 1); +- writel(reg, iobase + CQSPI_REG_SIZE); +- +- /* configure the chip select */ +- cqspi_chipselect(nor); +- +- /* Store the new configuration of the controller */ +- cqspi->current_page_size = nor->page_size; +- cqspi->current_erase_size = nor->mtd.erasesize; +- cqspi->current_addr_width = nor->addr_width; +-} +- + static unsigned int calculate_ticks_for_ns(const unsigned int ref_clk_hz, + const unsigned int ns_val) + { +@@ -867,18 +838,13 @@ static void cqspi_configure(struct spi_nor *nor) + int switch_cs = (cqspi->current_cs != f_pdata->cs); + int switch_ck = (cqspi->sclk != sclk); + +- if ((cqspi->current_page_size != nor->page_size) || +- (cqspi->current_erase_size != nor->mtd.erasesize) || +- (cqspi->current_addr_width != nor->addr_width)) +- switch_cs = 1; +- + if (switch_cs || switch_ck) + cqspi_controller_enable(cqspi, 0); + + /* Switch chip select. */ + if (switch_cs) { + cqspi->current_cs = f_pdata->cs; +- cqspi_configure_cs_and_sizes(nor); ++ cqspi_chipselect(nor); + } + + /* Setup baudrate divisor and delays */ +-- +2.39.2 + diff --git a/queue-5.4/mtd-spi-nor-cadence-quadspi-provide-a-way-to-disable.patch b/queue-5.4/mtd-spi-nor-cadence-quadspi-provide-a-way-to-disable.patch new file mode 100644 index 00000000000..509c41b093f --- /dev/null +++ b/queue-5.4/mtd-spi-nor-cadence-quadspi-provide-a-way-to-disable.patch @@ -0,0 +1,60 @@ +From ec929c05175da796f7acf0b05f6f29ffe61cefc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:34:38 +0530 +Subject: mtd: spi-nor: cadence-quadspi: Provide a way to disable DAC mode + +From: Vignesh Raghavendra + +[ Upstream commit a99705079a91e6373122bd0ca2fc129b688fc5b3 ] + +Currently direct access mode is used on platforms that have AHB window +(memory mapped window) larger than flash size. This feature is limited +to TI platforms as non TI platforms have < 1MB of AHB window. +Therefore introduce a driver quirk to disable DAC mode and set it for +non TI compatibles. This is in preparation to move to spi-mem framework +where flash geometry cannot be known. + +Signed-off-by: Vignesh Raghavendra +Reviewed-by: Tudor Ambarus +Acked-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200601070444.16923-3-vigneshr@ti.com +Signed-off-by: Mark Brown +Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations") +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index d680e4a272a13..7e7736bbbfb3b 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -34,6 +34,7 @@ + + /* Quirks */ + #define CQSPI_NEEDS_WR_DELAY BIT(0) ++#define CQSPI_DISABLE_DAC_MODE BIT(1) + + /* Capabilities mask */ + #define CQSPI_BASE_HWCAPS_MASK \ +@@ -1257,7 +1258,8 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np) + + f_pdata->registered = true; + +- if (mtd->size <= cqspi->ahb_size) { ++ if (mtd->size <= cqspi->ahb_size && ++ !(ddata->quirks & CQSPI_DISABLE_DAC_MODE)) { + f_pdata->use_direct_mode = true; + dev_dbg(nor->dev, "using direct mode for %s\n", + mtd->name); +@@ -1455,6 +1457,7 @@ static const struct dev_pm_ops cqspi__dev_pm_ops = { + + static const struct cqspi_driver_platdata cdns_qspi = { + .hwcaps_mask = CQSPI_BASE_HWCAPS_MASK, ++ .quirks = CQSPI_DISABLE_DAC_MODE, + }; + + static const struct cqspi_driver_platdata k2g_qspi = { +-- +2.39.2 + diff --git a/queue-5.4/net-amd-fix-link-leak-when-verifying-config-failed.patch b/queue-5.4/net-amd-fix-link-leak-when-verifying-config-failed.patch new file mode 100644 index 00000000000..bbb6cf3fce3 --- /dev/null +++ b/queue-5.4/net-amd-fix-link-leak-when-verifying-config-failed.patch @@ -0,0 +1,47 @@ +From bd4db9922482e05d50ee97e51b4cd2c3e25c2fa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 23:28:01 +0800 +Subject: net: amd: Fix link leak when verifying config failed + +From: Gencen Gan + +[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ] + +After failing to verify configuration, it returns directly without +releasing link, which may cause memory leak. + +Paolo Abeni thinks that the whole code of this driver is quite +"suboptimal" and looks unmainatained since at least ~15y, so he +suggests that we could simply remove the whole driver, please +take it into consideration. + +Simon Horman suggests that the fix label should be set to +"Linux-2.6.12-rc2" considering that the problem has existed +since the driver was introduced and the commit above doesn't +seem to exist in net/net-next. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Gan Gecen +Reviewed-by: Dongliang Mu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/nmclan_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c +index 9c152d85840d7..c9d2a6f150624 100644 +--- a/drivers/net/ethernet/amd/nmclan_cs.c ++++ b/drivers/net/ethernet/amd/nmclan_cs.c +@@ -652,7 +652,7 @@ static int nmclan_config(struct pcmcia_device *link) + } else { + pr_notice("mace id not found: %x %x should be 0x40 0x?9\n", + sig[0], sig[1]); +- return -ENODEV; ++ goto failed; + } + } + +-- +2.39.2 + diff --git a/queue-5.4/net-packet-annotate-accesses-to-po-xmit.patch b/queue-5.4/net-packet-annotate-accesses-to-po-xmit.patch new file mode 100644 index 00000000000..2fbb2da0320 --- /dev/null +++ b/queue-5.4/net-packet-annotate-accesses-to-po-xmit.patch @@ -0,0 +1,70 @@ +From 0bc730adaccd92d6f0863473de3fda23794538e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:06 +0000 +Subject: net/packet: annotate accesses to po->xmit + +From: Eric Dumazet + +[ Upstream commit b9d83ab8a708f23a4001d60e9d8d0b3be3d9f607 ] + +po->xmit can be set from setsockopt(PACKET_QDISC_BYPASS), +while read locklessly. + +Use READ_ONCE()/WRITE_ONCE() to avoid potential load/store +tearing issues. + +Fixes: d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 450dc03347725..8636e74557ec2 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -266,7 +266,8 @@ static void packet_cached_dev_reset(struct packet_sock *po) + + static bool packet_use_direct_xmit(const struct packet_sock *po) + { +- return po->xmit == packet_direct_xmit; ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ return READ_ONCE(po->xmit) == packet_direct_xmit; + } + + static u16 packet_pick_tx_queue(struct sk_buff *skb) +@@ -2799,7 +2800,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) + packet_inc_pending(&po->tx_ring); + + status = TP_STATUS_SEND_REQUEST; +- err = po->xmit(skb); ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ err = READ_ONCE(po->xmit)(skb); + if (unlikely(err != 0)) { + if (err > 0) + err = net_xmit_errno(err); +@@ -3002,7 +3004,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + virtio_net_hdr_set_proto(skb, &vnet_hdr); + } + +- err = po->xmit(skb); ++ /* Paired with WRITE_ONCE() in packet_setsockopt() */ ++ err = READ_ONCE(po->xmit)(skb); + if (unlikely(err != 0)) { + if (err > 0) + err = net_xmit_errno(err); +@@ -3949,7 +3952,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + +- po->xmit = val ? packet_direct_xmit : dev_queue_xmit; ++ /* Paired with all lockless reads of po->xmit */ ++ WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit); + return 0; + } + default: +-- +2.39.2 + diff --git a/queue-5.4/net-packet-convert-po-auxdata-to-an-atomic-flag.patch b/queue-5.4/net-packet-convert-po-auxdata-to-an-atomic-flag.patch new file mode 100644 index 00000000000..d282ec2fb15 --- /dev/null +++ b/queue-5.4/net-packet-convert-po-auxdata-to-an-atomic-flag.patch @@ -0,0 +1,95 @@ +From 3b04dee448a9219a13e788b77e06cd7df0232331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:08 +0000 +Subject: net/packet: convert po->auxdata to an atomic flag + +From: Eric Dumazet + +[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ] + +po->auxdata can be read while another thread +is changing its value, potentially raising KCSAN splat. + +Convert it to PACKET_SOCK_AUXDATA flag. + +Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 8 +++----- + net/packet/diag.c | 2 +- + net/packet/internal.h | 4 ++-- + 3 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 0e88a8dd4530f..13666fe787db7 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3456,7 +3456,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); + } + +- if (pkt_sk(sk)->auxdata) { ++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) { + struct tpacket_auxdata aux; + + aux.tp_status = TP_STATUS_USER; +@@ -3839,9 +3839,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->auxdata = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val); + return 0; + } + case PACKET_ORIGDEV: +@@ -4002,7 +4000,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + + break; + case PACKET_AUXDATA: +- val = po->auxdata; ++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA); + break; + case PACKET_ORIGDEV: + val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); +diff --git a/net/packet/diag.c b/net/packet/diag.c +index e1ac9bb375b31..d704c7bf51b20 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -23,7 +23,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags = 0; + if (po->running) + pinfo.pdi_flags |= PDI_RUNNING; +- if (po->auxdata) ++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA)) + pinfo.pdi_flags |= PDI_AUXDATA; + if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index 23649010e9586..2b2b85dadf8ea 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -117,8 +117,7 @@ struct packet_sock { + struct mutex pg_vec_lock; + unsigned long flags; + unsigned int running; /* bind_lock must be held */ +- unsigned int auxdata:1, /* writer must hold sock lock */ +- has_vnet_hdr:1, ++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */ + tp_loss:1, + tp_tx_has_off:1; + int pressure; +@@ -145,6 +144,7 @@ static struct packet_sock *pkt_sk(struct sock *sk) + + enum packet_sock_flags { + PACKET_SOCK_ORIGDEV, ++ PACKET_SOCK_AUXDATA, + }; + + static inline void packet_sock_flag_set(struct packet_sock *po, +-- +2.39.2 + diff --git a/queue-5.4/net-packet-convert-po-origdev-to-an-atomic-flag.patch b/queue-5.4/net-packet-convert-po-origdev-to-an-atomic-flag.patch new file mode 100644 index 00000000000..f622b4c40bd --- /dev/null +++ b/queue-5.4/net-packet-convert-po-origdev-to-an-atomic-flag.patch @@ -0,0 +1,126 @@ +From 2003e46057f9c8dae5a07c64e759ae98770285e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Mar 2023 01:10:07 +0000 +Subject: net/packet: convert po->origdev to an atomic flag + +From: Eric Dumazet + +[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ] + +syzbot/KCAN reported that po->origdev can be read +while another thread is changing its value. + +We can avoid this splat by converting this field +to an actual bit. + +Following patches will convert remaining 1bit fields. + +Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 10 ++++------ + net/packet/diag.c | 2 +- + net/packet/internal.h | 22 +++++++++++++++++++++- + 3 files changed, 26 insertions(+), 8 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 8636e74557ec2..0e88a8dd4530f 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2125,7 +2125,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, + sll = &PACKET_SKB_CB(skb)->sa.ll; + sll->sll_hatype = dev->type; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -2393,7 +2393,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + sll->sll_hatype = dev->type; + sll->sll_protocol = skb->protocol; + sll->sll_pkttype = skb->pkt_type; +- if (unlikely(po->origdev)) ++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV))) + sll->sll_ifindex = orig_dev->ifindex; + else + sll->sll_ifindex = dev->ifindex; +@@ -3853,9 +3853,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + +- lock_sock(sk); +- po->origdev = !!val; +- release_sock(sk); ++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val); + return 0; + } + case PACKET_VNET_HDR: +@@ -4007,7 +4005,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, + val = po->auxdata; + break; + case PACKET_ORIGDEV: +- val = po->origdev; ++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV); + break; + case PACKET_VNET_HDR: + val = po->has_vnet_hdr; +diff --git a/net/packet/diag.c b/net/packet/diag.c +index 07812ae5ca073..e1ac9bb375b31 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -25,7 +25,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb) + pinfo.pdi_flags |= PDI_RUNNING; + if (po->auxdata) + pinfo.pdi_flags |= PDI_AUXDATA; +- if (po->origdev) ++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV)) + pinfo.pdi_flags |= PDI_ORIGDEV; + if (po->has_vnet_hdr) + pinfo.pdi_flags |= PDI_VNETHDR; +diff --git a/net/packet/internal.h b/net/packet/internal.h +index 907f4cd2a7188..23649010e9586 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -115,9 +115,9 @@ struct packet_sock { + int copy_thresh; + spinlock_t bind_lock; + struct mutex pg_vec_lock; ++ unsigned long flags; + unsigned int running; /* bind_lock must be held */ + unsigned int auxdata:1, /* writer must hold sock lock */ +- origdev:1, + has_vnet_hdr:1, + tp_loss:1, + tp_tx_has_off:1; +@@ -143,4 +143,24 @@ static struct packet_sock *pkt_sk(struct sock *sk) + return (struct packet_sock *)sk; + } + ++enum packet_sock_flags { ++ PACKET_SOCK_ORIGDEV, ++}; ++ ++static inline void packet_sock_flag_set(struct packet_sock *po, ++ enum packet_sock_flags flag, ++ bool val) ++{ ++ if (val) ++ set_bit(flag, &po->flags); ++ else ++ clear_bit(flag, &po->flags); ++} ++ ++static inline bool packet_sock_flag(const struct packet_sock *po, ++ enum packet_sock_flags flag) ++{ ++ return test_bit(flag, &po->flags); ++} ++ + #endif +-- +2.39.2 + diff --git a/queue-5.4/netfilter-nf_tables-don-t-write-table-validation-sta.patch b/queue-5.4/netfilter-nf_tables-don-t-write-table-validation-sta.patch new file mode 100644 index 00000000000..5af8672da8c --- /dev/null +++ b/queue-5.4/netfilter-nf_tables-don-t-write-table-validation-sta.patch @@ -0,0 +1,87 @@ +From c861e501d544f65a7c35d5567024b4b5447d4edd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 17:13:19 +0200 +Subject: netfilter: nf_tables: don't write table validation state without + mutex + +From: Florian Westphal + +[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ] + +The ->cleanup callback needs to be removed, this doesn't work anymore as +the transaction mutex is already released in the ->abort function. + +Just do it after a successful validation pass, this either happens +from commit or abort phases where transaction mutex is held. + +Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/nfnetlink.h | 1 - + net/netfilter/nf_tables_api.c | 8 ++------ + net/netfilter/nfnetlink.c | 2 -- + 3 files changed, 2 insertions(+), 9 deletions(-) + +diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h +index f6267e2883f26..41de4156540a9 100644 +--- a/include/linux/netfilter/nfnetlink.h ++++ b/include/linux/netfilter/nfnetlink.h +@@ -39,7 +39,6 @@ struct nfnetlink_subsystem { + int (*commit)(struct net *net, struct sk_buff *skb); + int (*abort)(struct net *net, struct sk_buff *skb, + enum nfnl_abort_action action); +- void (*cleanup)(struct net *net); + bool (*valid_genid)(struct net *net, u32 genid); + }; + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 140c24f1b6c60..1a5294eb340c0 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6491,6 +6491,8 @@ static int nf_tables_validate(struct net *net) + if (nft_table_validate(net, table) < 0) + return -EAGAIN; + } ++ ++ nft_validate_state_update(net, NFT_VALIDATE_SKIP); + break; + } + +@@ -7172,11 +7174,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action) + return 0; + } + +-static void nf_tables_cleanup(struct net *net) +-{ +- nft_validate_state_update(net, NFT_VALIDATE_SKIP); +-} +- + static int nf_tables_abort(struct net *net, struct sk_buff *skb, + enum nfnl_abort_action action) + { +@@ -7208,7 +7205,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = { + .cb = nf_tables_cb, + .commit = nf_tables_commit, + .abort = nf_tables_abort, +- .cleanup = nf_tables_cleanup, + .valid_genid = nf_tables_valid_genid, + .owner = THIS_MODULE, + }; +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 81c86a156c6c0..e3f6e27a9a06d 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -512,8 +512,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, + goto replay_abort; + } + } +- if (ss->cleanup) +- ss->cleanup(net); + + nfnl_err_deliver(&err_list, oskb); + kfree_skb(skb); +-- +2.39.2 + diff --git a/queue-5.4/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch b/queue-5.4/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch new file mode 100644 index 00000000000..0809bc35261 --- /dev/null +++ b/queue-5.4/netlink-use-copy_to_user-for-optval-in-netlink_getso.patch @@ -0,0 +1,171 @@ +From e4edf7d23c6805c9038886c53987a6b01b8a0e66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 11:52:55 -0700 +Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt(). + +From: Kuniyuki Iwashima + +[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ] + +Brad Spencer provided a detailed report [0] that when calling getsockopt() +for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such +options require at least sizeof(int) as length. + +The options return a flag value that fits into 1 byte, but such behaviour +confuses users who do not initialise the variable before calling +getsockopt() and do not strictly check the returned value as char. + +Currently, netlink_getsockopt() uses put_user() to copy data to optlen and +optval, but put_user() casts the data based on the pointer, char *optval. +As a result, only 1 byte is set to optval. + +To avoid this behaviour, we need to use copy_to_user() or cast optval for +put_user(). + +Note that this changes the behaviour on big-endian systems, but we document +that the size of optval is int in the man page. + + $ man 7 netlink + ... + Socket options + To set or get a netlink socket option, call getsockopt(2) to read + or setsockopt(2) to write the option with the option level argument + set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to + an int. + +Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups") +Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option") +Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag") +Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option") +Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting") +Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps") +Reported-by: Brad Spencer +Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/ +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Johannes Berg +Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 75 ++++++++++++---------------------------- + 1 file changed, 23 insertions(+), 52 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index a232fcbd721c4..00f040fb46b9c 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1743,7 +1743,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + { + struct sock *sk = sock->sk; + struct netlink_sock *nlk = nlk_sk(sk); +- int len, val, err; ++ unsigned int flag; ++ int len, val; + + if (level != SOL_NETLINK) + return -ENOPROTOOPT; +@@ -1755,39 +1756,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + + switch (optname) { + case NETLINK_PKTINFO: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_PKTINFO; + break; + case NETLINK_BROADCAST_ERROR: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_BROADCAST_SEND_ERROR; + break; + case NETLINK_NO_ENOBUFS: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_RECV_NO_ENOBUFS; + break; + case NETLINK_LIST_MEMBERSHIPS: { +- int pos, idx, shift; ++ int pos, idx, shift, err = 0; + +- err = 0; + netlink_lock_table(); + for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) { + if (len - pos < sizeof(u32)) +@@ -1804,40 +1783,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, + if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen)) + err = -EFAULT; + netlink_unlock_table(); +- break; ++ return err; + } + case NETLINK_CAP_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0; +- if (put_user(len, optlen) || +- put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_CAP_ACK; + break; + case NETLINK_EXT_ACK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0; +- if (put_user(len, optlen) || put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_EXT_ACK; + break; + case NETLINK_GET_STRICT_CHK: +- if (len < sizeof(int)) +- return -EINVAL; +- len = sizeof(int); +- val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0; +- if (put_user(len, optlen) || put_user(val, optval)) +- return -EFAULT; +- err = 0; ++ flag = NETLINK_F_STRICT_CHK; + break; + default: +- err = -ENOPROTOOPT; ++ return -ENOPROTOOPT; + } +- return err; ++ ++ if (len < sizeof(int)) ++ return -EINVAL; ++ ++ len = sizeof(int); ++ val = nlk->flags & flag ? 1 : 0; ++ ++ if (put_user(len, optlen) || ++ copy_to_user(optval, &val, len)) ++ return -EFAULT; ++ ++ return 0; + } + + static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb) +-- +2.39.2 + diff --git a/queue-5.4/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch b/queue-5.4/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch new file mode 100644 index 00000000000..9496a9ee91c --- /dev/null +++ b/queue-5.4/nfsv4.1-always-send-a-reclaim_complete-after-establi.patch @@ -0,0 +1,45 @@ +From edf6643474d219d280abbd9c2f278c682510b8dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 18:45:53 -0400 +Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease + +From: Trond Myklebust + +[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ] + +The spec requires that we always at least send a RECLAIM_COMPLETE when +we're done establishing the lease and recovering any state. + +Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 2ee30ffeb6b97..01b1856705941 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -66,6 +66,8 @@ + + #define OPENOWNER_POOL_SIZE 8 + ++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp); ++ + const nfs4_stateid zero_stateid = { + { .data = { 0 } }, + .type = NFS4_SPECIAL_STATEID_TYPE, +@@ -329,6 +331,8 @@ int nfs41_init_clientid(struct nfs_client *clp, const struct cred *cred) + status = nfs4_proc_create_session(clp, cred); + if (status != 0) + goto out; ++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R)) ++ nfs4_state_start_reclaim_reboot(clp); + nfs41_finish_session_reset(clp); + nfs_mark_client_ready(clp, NFS_CS_READY); + out: +-- +2.39.2 + diff --git a/queue-5.4/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch b/queue-5.4/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch new file mode 100644 index 00000000000..656e6e55708 --- /dev/null +++ b/queue-5.4/nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch @@ -0,0 +1,206 @@ +From 5794f2107d20a408e17a4767dc02e754fbc9abda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 16:49:04 +0800 +Subject: nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} + usage" + +From: Ming Lei + +[ Upstream commit 4f86a6ff6fbd891232dda3ca97fd1b9630b59809 ] + +fcloop_fcp_op() could be called from flush request's ->end_io(flush_end_io) in +which the spinlock of fq->mq_flush_lock is grabbed with irq saved/disabled. + +So fcloop_fcp_op() can't call spin_unlock_irq(&tfcp_req->reqlock) simply +which enables irq unconditionally. + +Fixes the warning by switching to spin_lock_irqsave()/spin_unlock_irqrestore() + +Fixes: c38dbbfab1bc ("nvme-fcloop: fix inconsistent lock state warnings") +Reported-by: Yi Zhang +Signed-off-by: Ming Lei +Reviewed-by: Ewan D. Milne +Tested-by: Yi Zhang +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fcloop.c | 48 ++++++++++++++++++++---------------- + 1 file changed, 27 insertions(+), 21 deletions(-) + +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index b50b53db37462..34345c45a3e52 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -431,10 +431,11 @@ fcloop_fcp_recv_work(struct work_struct *work) + struct fcloop_fcpreq *tfcp_req = + container_of(work, struct fcloop_fcpreq, fcp_rcv_work); + struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq; ++ unsigned long flags; + int ret = 0; + bool aborted = false; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + switch (tfcp_req->inistate) { + case INI_IO_START: + tfcp_req->inistate = INI_IO_ACTIVE; +@@ -443,11 +444,11 @@ fcloop_fcp_recv_work(struct work_struct *work) + aborted = true; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(aborted)) + ret = -ECANCELED; +@@ -468,8 +469,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + container_of(work, struct fcloop_fcpreq, abort_rcv_work); + struct nvmefc_fcp_req *fcpreq; + bool completed = false; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + switch (tfcp_req->inistate) { + case INI_IO_ABORTED: +@@ -478,11 +480,11 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + completed = true; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(completed)) { + /* remove reference taken in original abort downcall */ +@@ -494,9 +496,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work) + nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport, + &tfcp_req->tgt_fcp_req); + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->fcpreq = NULL; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED); + /* call_host_done releases reference for abort downcall */ +@@ -512,11 +514,12 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work) + struct fcloop_fcpreq *tfcp_req = + container_of(work, struct fcloop_fcpreq, tio_done_work); + struct nvmefc_fcp_req *fcpreq; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + tfcp_req->inistate = INI_IO_COMPLETED; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + fcloop_call_host_done(fcpreq, tfcp_req, tfcp_req->status); + } +@@ -620,13 +623,14 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + u32 rsplen = 0, xfrlen = 0; + int fcp_err = 0, active, aborted; + u8 op = tgt_fcpreq->op; ++ unsigned long flags; + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + fcpreq = tfcp_req->fcpreq; + active = tfcp_req->active; + aborted = tfcp_req->aborted; + tfcp_req->active = true; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (unlikely(active)) + /* illegal - call while i/o active */ +@@ -634,9 +638,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + + if (unlikely(aborted)) { + /* target transport has aborted i/o prior */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->active = false; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + tgt_fcpreq->transferred_length = 0; + tgt_fcpreq->fcp_error = -ECANCELED; + tgt_fcpreq->done(tgt_fcpreq); +@@ -693,9 +697,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport, + break; + } + +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->active = false; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + tgt_fcpreq->transferred_length = xfrlen; + tgt_fcpreq->fcp_error = fcp_err; +@@ -709,15 +713,16 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport, + struct nvmefc_tgt_fcp_req *tgt_fcpreq) + { + struct fcloop_fcpreq *tfcp_req = tgt_fcp_req_to_fcpreq(tgt_fcpreq); ++ unsigned long flags; + + /* + * mark aborted only in case there were 2 threads in transport + * (one doing io, other doing abort) and only kills ops posted + * after the abort request + */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + tfcp_req->aborted = true; +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + tfcp_req->status = NVME_SC_INTERNAL; + +@@ -753,6 +758,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + struct fcloop_ini_fcpreq *inireq = fcpreq->private; + struct fcloop_fcpreq *tfcp_req; + bool abortio = true; ++ unsigned long flags; + + spin_lock(&inireq->inilock); + tfcp_req = inireq->tfcp_req; +@@ -765,7 +771,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + return; + + /* break initiator/target relationship for io */ +- spin_lock_irq(&tfcp_req->reqlock); ++ spin_lock_irqsave(&tfcp_req->reqlock, flags); + switch (tfcp_req->inistate) { + case INI_IO_START: + case INI_IO_ACTIVE: +@@ -775,11 +781,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + abortio = false; + break; + default: +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + WARN_ON(1); + return; + } +- spin_unlock_irq(&tfcp_req->reqlock); ++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags); + + if (abortio) + /* leave the reference while the work item is scheduled */ +-- +2.39.2 + diff --git a/queue-5.4/nvme-fix-async-event-trace-event.patch b/queue-5.4/nvme-fix-async-event-trace-event.patch new file mode 100644 index 00000000000..2bf8246b468 --- /dev/null +++ b/queue-5.4/nvme-fix-async-event-trace-event.patch @@ -0,0 +1,92 @@ +From 236c8cc5fc4089b54f6671ec3411b49f19d17e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Apr 2023 14:57:20 -0700 +Subject: nvme: fix async event trace event + +From: Keith Busch + +[ Upstream commit 6622b76fe922b94189499a90ccdb714a4a8d0773 ] + +Mixing AER Event Type and Event Info has masking clashes. Just print the +event type, but also include the event info of the AER result in the +trace. + +Fixes: 09bd1ff4b15143b ("nvme-core: add async event trace helper") +Reported-by: Nate Thornton +Reviewed-by: Sagi Grimberg +Reviewed-by: Minwoo Im +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +---- + drivers/nvme/host/trace.h | 15 ++++++--------- + 2 files changed, 7 insertions(+), 13 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index fa5753de56582..9144ed14b0741 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3990,8 +3990,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + { + u32 aer_notice_type = nvme_aer_subtype(result); + +- trace_nvme_async_event(ctrl, aer_notice_type); +- + switch (aer_notice_type) { + case NVME_AER_NOTICE_NS_CHANGED: + set_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events); +@@ -4023,7 +4021,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + + static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl) + { +- trace_nvme_async_event(ctrl, NVME_AER_ERROR); + dev_warn(ctrl->device, "resetting controller due to AER\n"); + nvme_reset_ctrl(ctrl); + } +@@ -4038,6 +4035,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS) + return; + ++ trace_nvme_async_event(ctrl, result); + switch (aer_type) { + case NVME_AER_NOTICE: + nvme_handle_aen_notice(ctrl, result); +@@ -4055,7 +4053,6 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + case NVME_AER_SMART: + case NVME_AER_CSS: + case NVME_AER_VS: +- trace_nvme_async_event(ctrl, aer_type); + ctrl->aen_result = result; + break; + default: +diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h +index 35bac7a254227..700fdce2ecf15 100644 +--- a/drivers/nvme/host/trace.h ++++ b/drivers/nvme/host/trace.h +@@ -127,15 +127,12 @@ TRACE_EVENT(nvme_async_event, + ), + TP_printk("nvme%d: NVME_AEN=%#08x [%s]", + __entry->ctrl_id, __entry->result, +- __print_symbolic(__entry->result, +- aer_name(NVME_AER_NOTICE_NS_CHANGED), +- aer_name(NVME_AER_NOTICE_ANA), +- aer_name(NVME_AER_NOTICE_FW_ACT_STARTING), +- aer_name(NVME_AER_NOTICE_DISC_CHANGED), +- aer_name(NVME_AER_ERROR), +- aer_name(NVME_AER_SMART), +- aer_name(NVME_AER_CSS), +- aer_name(NVME_AER_VS)) ++ __print_symbolic(__entry->result & 0x7, ++ aer_name(NVME_AER_ERROR), ++ aer_name(NVME_AER_SMART), ++ aer_name(NVME_AER_NOTICE), ++ aer_name(NVME_AER_CSS), ++ aer_name(NVME_AER_VS)) + ) + ); + +-- +2.39.2 + diff --git a/queue-5.4/nvme-handle-the-persistent-internal-error-aer.patch b/queue-5.4/nvme-handle-the-persistent-internal-error-aer.patch new file mode 100644 index 00000000000..a5c8203e704 --- /dev/null +++ b/queue-5.4/nvme-handle-the-persistent-internal-error-aer.patch @@ -0,0 +1,113 @@ +From 7971598401be4e45d41b5d5d206327afe010d874 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jun 2022 11:52:21 -0700 +Subject: nvme: handle the persistent internal error AER + +From: Michael Kelley + +[ Upstream commit 2c61c97fb12b806e1c8eb15f04c277ad097ec95e ] + +In the NVM Express Revision 1.4 spec, Figure 145 describes possible +values for an AER with event type "Error" (value 000b). For a +Persistent Internal Error (value 03h), the host should perform a +controller reset. + +Add support for this error using code that already exists for +doing a controller reset. As part of this support, introduce +two utility functions for parsing the AER type and subtype. + +This new support was tested in a lab environment where we can +generate the persistent internal error on demand, and observe +both the Linux side and NVMe controller side to see that the +controller reset has been done. + +Signed-off-by: Michael Kelley +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Stable-dep-of: 6622b76fe922 ("nvme: fix async event trace event") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 31 +++++++++++++++++++++++++++++-- + include/linux/nvme.h | 4 ++++ + 2 files changed, 33 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 029a89aead53e..fa5753de56582 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3976,9 +3976,19 @@ static void nvme_fw_act_work(struct work_struct *work) + nvme_get_fw_slot_info(ctrl); + } + ++static u32 nvme_aer_type(u32 result) ++{ ++ return result & 0x7; ++} ++ ++static u32 nvme_aer_subtype(u32 result) ++{ ++ return (result & 0xff00) >> 8; ++} ++ + static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + { +- u32 aer_notice_type = (result & 0xff00) >> 8; ++ u32 aer_notice_type = nvme_aer_subtype(result); + + trace_nvme_async_event(ctrl, aer_notice_type); + +@@ -4011,11 +4021,19 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result) + } + } + ++static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl) ++{ ++ trace_nvme_async_event(ctrl, NVME_AER_ERROR); ++ dev_warn(ctrl->device, "resetting controller due to AER\n"); ++ nvme_reset_ctrl(ctrl); ++} ++ + void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + volatile union nvme_result *res) + { + u32 result = le32_to_cpu(res->u32); +- u32 aer_type = result & 0x07; ++ u32 aer_type = nvme_aer_type(result); ++ u32 aer_subtype = nvme_aer_subtype(result); + + if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS) + return; +@@ -4025,6 +4043,15 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status, + nvme_handle_aen_notice(ctrl, result); + break; + case NVME_AER_ERROR: ++ /* ++ * For a persistent internal error, don't run async_event_work ++ * to submit a new AER. The controller reset will do it. ++ */ ++ if (aer_subtype == NVME_AER_ERROR_PERSIST_INT_ERR) { ++ nvme_handle_aer_persistent_error(ctrl); ++ return; ++ } ++ fallthrough; + case NVME_AER_SMART: + case NVME_AER_CSS: + case NVME_AER_VS: +diff --git a/include/linux/nvme.h b/include/linux/nvme.h +index ff0ee07b1e8f4..dd2801c28b99c 100644 +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -522,6 +522,10 @@ enum { + NVME_AER_VS = 7, + }; + ++enum { ++ NVME_AER_ERROR_PERSIST_INT_ERR = 0x03, ++}; ++ + enum { + NVME_AER_NOTICE_NS_CHANGED = 0x00, + NVME_AER_NOTICE_FW_ACT_STARTING = 0x01, +-- +2.39.2 + diff --git a/queue-5.4/of-fix-modalias-string-generation.patch b/queue-5.4/of-fix-modalias-string-generation.patch new file mode 100644 index 00000000000..3c3eed2e233 --- /dev/null +++ b/queue-5.4/of-fix-modalias-string-generation.patch @@ -0,0 +1,80 @@ +From 98e505fce42c58443bbb281db8c89525ba80ba1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 18:21:09 +0100 +Subject: of: Fix modalias string generation + +From: Miquel Raynal + +[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ] + +The helper generating an OF based modalias (of_device_get_modalias()) +works fine, but due to the use of snprintf() internally it needs a +buffer one byte longer than what should be needed just for the entire +string (excluding the '\0'). Most users of this helper are sysfs hooks +providing the modalias string to users. They all provide a PAGE_SIZE +buffer which is way above the number of bytes required to fit the +modalias string and hence do not suffer from this issue. + +There is another user though, of_device_request_module(), which is only +called by drivers/usb/common/ulpi.c. This request module function is +faulty, but maybe because in most cases there is an alternative, ULPI +driver users have not noticed it. + +In this function, of_device_get_modalias() is called twice. The first +time without buffer just to get the number of bytes required by the +modalias string (excluding the null byte), and a second time, after +buffer allocation, to fill the buffer. The allocation asks for an +additional byte, in order to store the trailing '\0'. However, the +buffer *length* provided to of_device_get_modalias() excludes this extra +byte. The internal use of snprintf() with a length that is exactly the +number of bytes to be written has the effect of using the last available +byte to store a '\0', which then smashes the last character of the +modalias string. + +Provide the actual size of the buffer to of_device_get_modalias() to fix +this issue. + +Note: the "str[size - 1] = '\0';" line is not really needed as snprintf +will anyway end the string with a null byte, but there is a possibility +that this function might be called on a struct device_node without +compatible, in this case snprintf() would not be executed. So we keep it +just to avoid possible unbounded strings. + +Cc: Stephen Boyd +Cc: Peter Chen +Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias") +Signed-off-by: Miquel Raynal +Reviewed-by: Rob Herring +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/of/device.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/device.c b/drivers/of/device.c +index da81583920103..7fb870097a849 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -246,12 +246,15 @@ int of_device_request_module(struct device *dev) + if (size < 0) + return size; + +- str = kmalloc(size + 1, GFP_KERNEL); ++ /* Reserve an additional byte for the trailing '\0' */ ++ size++; ++ ++ str = kmalloc(size, GFP_KERNEL); + if (!str) + return -ENOMEM; + + of_device_get_modalias(dev, str, size); +- str[size] = '\0'; ++ str[size - 1] = '\0'; + ret = request_module(str); + kfree(str); + +-- +2.39.2 + diff --git a/queue-5.4/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch b/queue-5.4/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch new file mode 100644 index 00000000000..f0f5ad6dfd1 --- /dev/null +++ b/queue-5.4/openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch @@ -0,0 +1,56 @@ +From 446d45209762924a7cf8bfb93c4163e20231f06f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Feb 2023 19:14:06 +0900 +Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions + +From: Stafford Horne + +[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ] + +In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on +exception") the unhandled exception path was changed to do an early +store of r30 instead of r31. The entry code was not updated and r31 is +not getting stored to pt_regs. + +This patch updates the entry handler to store r31 instead of r30. We +also remove some misleading commented out store r30 and r31 +instructrions. + +I noticed this while working on adding floating point exception +handling, This issue probably would never impact anything since we kill +the process or Oops right away on unhandled exceptions. + +Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception") +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/kernel/entry.S | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S +index 6b27cf4a0d786..8db433947d393 100644 +--- a/arch/openrisc/kernel/entry.S ++++ b/arch/openrisc/kernel/entry.S +@@ -173,7 +173,6 @@ handler: ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ + /* r30 already save */ ;\ +-/* l.sw PT_GPR30(r1),r30*/ ;\ + l.sw PT_GPR31(r1),r31 ;\ + TRACE_IRQS_OFF_ENTRY ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ +@@ -211,9 +210,8 @@ handler: ;\ + l.sw PT_GPR27(r1),r27 ;\ + l.sw PT_GPR28(r1),r28 ;\ + l.sw PT_GPR29(r1),r29 ;\ +- /* r31 already saved */ ;\ +- l.sw PT_GPR30(r1),r30 ;\ +-/* l.sw PT_GPR31(r1),r31 */ ;\ ++ /* r30 already saved */ ;\ ++ l.sw PT_GPR31(r1),r31 ;\ + /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\ + l.addi r30,r0,-1 ;\ + l.sw PT_ORIG_GPR11(r1),r30 ;\ +-- +2.39.2 + diff --git a/queue-5.4/pci-imx6-install-the-fault-handler-only-on-compatibl.patch b/queue-5.4/pci-imx6-install-the-fault-handler-only-on-compatibl.patch new file mode 100644 index 00000000000..abb8f5c0724 --- /dev/null +++ b/queue-5.4/pci-imx6-install-the-fault-handler-only-on-compatibl.patch @@ -0,0 +1,78 @@ +From 68d4695314cc9abe473a4b7415bf1b568c694a93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Mar 2023 17:56:31 +0100 +Subject: PCI: imx6: Install the fault handler only on compatible match + +From: H. Nikolaus Schaller + +[ Upstream commit 5f5ac460dfe7f4e11f99de9870f240e39189cf72 ] + +commit bb38919ec56e ("PCI: imx6: Add support for i.MX6 PCIe controller") +added a fault hook to this driver in the probe function. So it was only +installed if needed. + +commit bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO") +moved it from probe to driver init which installs the hook unconditionally +as soon as the driver is compiled into a kernel. + +When this driver is compiled as a module, the hook is not registered +until after the driver has been matched with a .compatible and +loaded. + +commit 415b6185c541 ("PCI: imx6: Fix config read timeout handling") +extended the fault handling code. + +commit 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ") +added some protection for non-ARM architectures, but this does not +protect non-i.MX ARM architectures. + +Since fault handlers can be triggered on any architecture for different +reasons, there is no guarantee that they will be triggered only for the +assumed situation, leading to improper error handling (i.MX6-specific +imx6q_pcie_abort_handler) on foreign systems. + +I had seen strange L3 imprecise external abort messages several times on +OMAP4 and OMAP5 devices and couldn't make sense of them until I realized +they were related to this unused imx6q driver because I had +CONFIG_PCI_IMX6=y. + +Note that CONFIG_PCI_IMX6=y is useful for kernel binaries that are designed +to run on different ARM SoC and be differentiated only by device tree +binaries. So turning off CONFIG_PCI_IMX6 is not a solution. + +Therefore we check the compatible in the init function before registering +the fault handler. + +Link: https://lore.kernel.org/r/e1bcfc3078c82b53aa9b78077a89955abe4ea009.1678380991.git.hns@goldelico.com +Fixes: bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO") +Fixes: 415b6185c541 ("PCI: imx6: Fix config read timeout handling") +Fixes: 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ") +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Richard Zhu +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index b34b52b364d5f..30c259f63239d 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -1295,6 +1295,13 @@ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, 0xabcd, + static int __init imx6_pcie_init(void) + { + #ifdef CONFIG_ARM ++ struct device_node *np; ++ ++ np = of_find_matching_node(NULL, imx6_pcie_of_match); ++ if (!np) ++ return -ENODEV; ++ of_node_put(np); ++ + /* + * Since probe() can be deferred we need to make sure that + * hook_fault_code is not called after __init memory is freed +-- +2.39.2 + diff --git a/queue-5.4/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch b/queue-5.4/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch new file mode 100644 index 00000000000..02189ed5aaf --- /dev/null +++ b/queue-5.4/perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch @@ -0,0 +1,51 @@ +From 59eb16693eece509d4a070529440dff26f8d4a7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 10:35:08 +0800 +Subject: perf/core: Fix hardlockup failure caused by perf throttle + +From: Yang Jihong + +[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ] + +commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling") +introduces a change in throttling threshold judgment. Before this, +compare hwc->interrupts and max_samples_per_tick, then increase +hwc->interrupts by 1, but this commit reverses order of these two +behaviors, causing the semantics of max_samples_per_tick to change. +In literal sense of "max_samples_per_tick", if hwc->interrupts == +max_samples_per_tick, it should not be throttled, therefore, the judgment +condition should be changed to "hwc->interrupts > max_samples_per_tick". + +In fact, this may cause the hardlockup to fail, The minimum value of +max_samples_per_tick may be 1, in this case, the return value of +__perf_event_account_interrupt function is 1. +As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86 +architecture as an example, see x86_pmu_handle_irq). + +Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling") +Signed-off-by: Yang Jihong +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 1ef924d6a385e..41a8a5f749409 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -8166,8 +8166,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle) + hwc->interrupts = 1; + } else { + hwc->interrupts++; +- if (unlikely(throttle +- && hwc->interrupts >= max_samples_per_tick)) { ++ if (unlikely(throttle && ++ hwc->interrupts > max_samples_per_tick)) { + __this_cpu_inc(perf_throttled_count); + tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS); + hwc->interrupts = MAX_INTERRUPTS; +-- +2.39.2 + diff --git a/queue-5.4/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch b/queue-5.4/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch new file mode 100644 index 00000000000..26add721c86 --- /dev/null +++ b/queue-5.4/phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch @@ -0,0 +1,47 @@ +From 2a7523904f7e958aa2b50770a46e0013043da1e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Nov 2022 19:16:34 +0800 +Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for + usb2_port and ulpi_port + +From: Gaosheng Cui + +[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ] + +The tegra_xusb_port_unregister should be called when usb2_port +and ulpi_port map fails in tegra_xusb_add_usb2_port() or in +tegra_xusb_add_ulpi_port(), fix it. + +Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support") +Signed-off-by: Gaosheng Cui +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/tegra/xusb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c +index bf5d80b97597b..efe7abf459fda 100644 +--- a/drivers/phy/tegra/xusb.c ++++ b/drivers/phy/tegra/xusb.c +@@ -606,6 +606,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl, + usb2->base.lane = usb2->base.ops->map(&usb2->base); + if (IS_ERR(usb2->base.lane)) { + err = PTR_ERR(usb2->base.lane); ++ tegra_xusb_port_unregister(&usb2->base); + goto out; + } + +@@ -658,6 +659,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl, + ulpi->base.lane = ulpi->base.ops->map(&ulpi->base); + if (IS_ERR(ulpi->base.lane)) { + err = PTR_ERR(ulpi->base.lane); ++ tegra_xusb_port_unregister(&ulpi->base); + goto out; + } + +-- +2.39.2 + diff --git a/queue-5.4/pm-domains-fix-up-terminology-with-parent-child.patch b/queue-5.4/pm-domains-fix-up-terminology-with-parent-child.patch new file mode 100644 index 00000000000..dcfbbe55dc8 --- /dev/null +++ b/queue-5.4/pm-domains-fix-up-terminology-with-parent-child.patch @@ -0,0 +1,565 @@ +From e5798cade24489d251923d9794914d0b23e4686b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 16:32:13 -0700 +Subject: PM: domains: Fix up terminology with parent/child + +From: Kees Cook + +[ Upstream commit 8d87ae48ced2dffd5e7247d19eb4c88be6f1c6f1 ] + +The genpd infrastructure uses the terms master/slave, but such uses have +no external exposures (not even in Documentation/driver-api/pm/*) and are +not mandated by nor associated with any external specifications. Change +the language used through-out to parent/child. + +There was one possible exception in the debugfs node +"pm_genpd/pm_genpd_summary" but its path has no hits outside of the +kernel itself when performing a code search[1], and it seems even this +single usage has been non-functional since it was introduced due to a +typo in the Python ("apend" instead of correct "append"). Fix the typo +while we're at it. + +Link: https://codesearch.debian.net/ # [1] +Signed-off-by: Kees Cook +Reviewed-by: Greg Kroah-Hartman +Reviewed-by: Kieran Bingham +Signed-off-by: Rafael J. Wysocki +Stable-dep-of: f19c3c2959e4 ("scripts/gdb: bail early if there are no generic PD") +Signed-off-by: Sasha Levin +--- + drivers/base/power/domain.c | 194 +++++++++++++-------------- + drivers/base/power/domain_governor.c | 12 +- + include/linux/pm_domain.h | 12 +- + scripts/gdb/linux/genpd.py | 12 +- + 4 files changed, 115 insertions(+), 115 deletions(-) + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 4f63a8bc72604..edb791354421b 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -263,18 +263,18 @@ static int _genpd_reeval_performance_state(struct generic_pm_domain *genpd, + /* + * Traverse all sub-domains within the domain. This can be + * done without any additional locking as the link->performance_state +- * field is protected by the master genpd->lock, which is already taken. ++ * field is protected by the parent genpd->lock, which is already taken. + * + * Also note that link->performance_state (subdomain's performance state +- * requirement to master domain) is different from +- * link->slave->performance_state (current performance state requirement ++ * requirement to parent domain) is different from ++ * link->child->performance_state (current performance state requirement + * of the devices/sub-domains of the subdomain) and so can have a + * different value. + * + * Note that we also take vote from powered-off sub-domains into account + * as the same is done for devices right now. + */ +- list_for_each_entry(link, &genpd->master_links, master_node) { ++ list_for_each_entry(link, &genpd->parent_links, parent_node) { + if (link->performance_state > state) + state = link->performance_state; + } +@@ -285,40 +285,40 @@ static int _genpd_reeval_performance_state(struct generic_pm_domain *genpd, + static int _genpd_set_performance_state(struct generic_pm_domain *genpd, + unsigned int state, int depth) + { +- struct generic_pm_domain *master; ++ struct generic_pm_domain *parent; + struct gpd_link *link; +- int master_state, ret; ++ int parent_state, ret; + + if (state == genpd->performance_state) + return 0; + +- /* Propagate to masters of genpd */ +- list_for_each_entry(link, &genpd->slave_links, slave_node) { +- master = link->master; ++ /* Propagate to parents of genpd */ ++ list_for_each_entry(link, &genpd->child_links, child_node) { ++ parent = link->parent; + +- if (!master->set_performance_state) ++ if (!parent->set_performance_state) + continue; + +- /* Find master's performance state */ ++ /* Find parent's performance state */ + ret = dev_pm_opp_xlate_performance_state(genpd->opp_table, +- master->opp_table, ++ parent->opp_table, + state); + if (unlikely(ret < 0)) + goto err; + +- master_state = ret; ++ parent_state = ret; + +- genpd_lock_nested(master, depth + 1); ++ genpd_lock_nested(parent, depth + 1); + + link->prev_performance_state = link->performance_state; +- link->performance_state = master_state; +- master_state = _genpd_reeval_performance_state(master, +- master_state); +- ret = _genpd_set_performance_state(master, master_state, depth + 1); ++ link->performance_state = parent_state; ++ parent_state = _genpd_reeval_performance_state(parent, ++ parent_state); ++ ret = _genpd_set_performance_state(parent, parent_state, depth + 1); + if (ret) + link->performance_state = link->prev_performance_state; + +- genpd_unlock(master); ++ genpd_unlock(parent); + + if (ret) + goto err; +@@ -333,26 +333,26 @@ static int _genpd_set_performance_state(struct generic_pm_domain *genpd, + + err: + /* Encountered an error, lets rollback */ +- list_for_each_entry_continue_reverse(link, &genpd->slave_links, +- slave_node) { +- master = link->master; ++ list_for_each_entry_continue_reverse(link, &genpd->child_links, ++ child_node) { ++ parent = link->parent; + +- if (!master->set_performance_state) ++ if (!parent->set_performance_state) + continue; + +- genpd_lock_nested(master, depth + 1); ++ genpd_lock_nested(parent, depth + 1); + +- master_state = link->prev_performance_state; +- link->performance_state = master_state; ++ parent_state = link->prev_performance_state; ++ link->performance_state = parent_state; + +- master_state = _genpd_reeval_performance_state(master, +- master_state); +- if (_genpd_set_performance_state(master, master_state, depth + 1)) { ++ parent_state = _genpd_reeval_performance_state(parent, ++ parent_state); ++ if (_genpd_set_performance_state(parent, parent_state, depth + 1)) { + pr_err("%s: Failed to roll back to %d performance state\n", +- master->name, master_state); ++ parent->name, parent_state); + } + +- genpd_unlock(master); ++ genpd_unlock(parent); + } + + return ret; +@@ -552,7 +552,7 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on, + + /* + * If sd_count > 0 at this point, one of the subdomains hasn't +- * managed to call genpd_power_on() for the master yet after ++ * managed to call genpd_power_on() for the parent yet after + * incrementing it. In that case genpd_power_on() will wait + * for us to drop the lock, so we can call .power_off() and let + * the genpd_power_on() restore power for us (this shouldn't +@@ -566,22 +566,22 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on, + genpd->status = GPD_STATE_POWER_OFF; + genpd_update_accounting(genpd); + +- list_for_each_entry(link, &genpd->slave_links, slave_node) { +- genpd_sd_counter_dec(link->master); +- genpd_lock_nested(link->master, depth + 1); +- genpd_power_off(link->master, false, depth + 1); +- genpd_unlock(link->master); ++ list_for_each_entry(link, &genpd->child_links, child_node) { ++ genpd_sd_counter_dec(link->parent); ++ genpd_lock_nested(link->parent, depth + 1); ++ genpd_power_off(link->parent, false, depth + 1); ++ genpd_unlock(link->parent); + } + + return 0; + } + + /** +- * genpd_power_on - Restore power to a given PM domain and its masters. ++ * genpd_power_on - Restore power to a given PM domain and its parents. + * @genpd: PM domain to power up. + * @depth: nesting count for lockdep. + * +- * Restore power to @genpd and all of its masters so that it is possible to ++ * Restore power to @genpd and all of its parents so that it is possible to + * resume a device belonging to it. + */ + static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth) +@@ -594,20 +594,20 @@ static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth) + + /* + * The list is guaranteed not to change while the loop below is being +- * executed, unless one of the masters' .power_on() callbacks fiddles ++ * executed, unless one of the parents' .power_on() callbacks fiddles + * with it. + */ +- list_for_each_entry(link, &genpd->slave_links, slave_node) { +- struct generic_pm_domain *master = link->master; ++ list_for_each_entry(link, &genpd->child_links, child_node) { ++ struct generic_pm_domain *parent = link->parent; + +- genpd_sd_counter_inc(master); ++ genpd_sd_counter_inc(parent); + +- genpd_lock_nested(master, depth + 1); +- ret = genpd_power_on(master, depth + 1); +- genpd_unlock(master); ++ genpd_lock_nested(parent, depth + 1); ++ ret = genpd_power_on(parent, depth + 1); ++ genpd_unlock(parent); + + if (ret) { +- genpd_sd_counter_dec(master); ++ genpd_sd_counter_dec(parent); + goto err; + } + } +@@ -623,12 +623,12 @@ static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth) + + err: + list_for_each_entry_continue_reverse(link, +- &genpd->slave_links, +- slave_node) { +- genpd_sd_counter_dec(link->master); +- genpd_lock_nested(link->master, depth + 1); +- genpd_power_off(link->master, false, depth + 1); +- genpd_unlock(link->master); ++ &genpd->child_links, ++ child_node) { ++ genpd_sd_counter_dec(link->parent); ++ genpd_lock_nested(link->parent, depth + 1); ++ genpd_power_off(link->parent, false, depth + 1); ++ genpd_unlock(link->parent); + } + + return ret; +@@ -943,13 +943,13 @@ static bool genpd_present(const struct generic_pm_domain *genpd) + #ifdef CONFIG_PM_SLEEP + + /** +- * genpd_sync_power_off - Synchronously power off a PM domain and its masters. ++ * genpd_sync_power_off - Synchronously power off a PM domain and its parents. + * @genpd: PM domain to power off, if possible. + * @use_lock: use the lock. + * @depth: nesting count for lockdep. + * + * Check if the given PM domain can be powered off (during system suspend or +- * hibernation) and do that if so. Also, in that case propagate to its masters. ++ * hibernation) and do that if so. Also, in that case propagate to its parents. + * + * This function is only called in "noirq" and "syscore" stages of system power + * transitions. The "noirq" callbacks may be executed asynchronously, thus in +@@ -974,21 +974,21 @@ static void genpd_sync_power_off(struct generic_pm_domain *genpd, bool use_lock, + + genpd->status = GPD_STATE_POWER_OFF; + +- list_for_each_entry(link, &genpd->slave_links, slave_node) { +- genpd_sd_counter_dec(link->master); ++ list_for_each_entry(link, &genpd->child_links, child_node) { ++ genpd_sd_counter_dec(link->parent); + + if (use_lock) +- genpd_lock_nested(link->master, depth + 1); ++ genpd_lock_nested(link->parent, depth + 1); + +- genpd_sync_power_off(link->master, use_lock, depth + 1); ++ genpd_sync_power_off(link->parent, use_lock, depth + 1); + + if (use_lock) +- genpd_unlock(link->master); ++ genpd_unlock(link->parent); + } + } + + /** +- * genpd_sync_power_on - Synchronously power on a PM domain and its masters. ++ * genpd_sync_power_on - Synchronously power on a PM domain and its parents. + * @genpd: PM domain to power on. + * @use_lock: use the lock. + * @depth: nesting count for lockdep. +@@ -1005,16 +1005,16 @@ static void genpd_sync_power_on(struct generic_pm_domain *genpd, bool use_lock, + if (genpd_status_on(genpd)) + return; + +- list_for_each_entry(link, &genpd->slave_links, slave_node) { +- genpd_sd_counter_inc(link->master); ++ list_for_each_entry(link, &genpd->child_links, child_node) { ++ genpd_sd_counter_inc(link->parent); + + if (use_lock) +- genpd_lock_nested(link->master, depth + 1); ++ genpd_lock_nested(link->parent, depth + 1); + +- genpd_sync_power_on(link->master, use_lock, depth + 1); ++ genpd_sync_power_on(link->parent, use_lock, depth + 1); + + if (use_lock) +- genpd_unlock(link->master); ++ genpd_unlock(link->parent); + } + + _genpd_power_on(genpd, false); +@@ -1454,12 +1454,12 @@ static void genpd_update_cpumask(struct generic_pm_domain *genpd, + if (!genpd_is_cpu_domain(genpd)) + return; + +- list_for_each_entry(link, &genpd->slave_links, slave_node) { +- struct generic_pm_domain *master = link->master; ++ list_for_each_entry(link, &genpd->child_links, child_node) { ++ struct generic_pm_domain *parent = link->parent; + +- genpd_lock_nested(master, depth + 1); +- genpd_update_cpumask(master, cpu, set, depth + 1); +- genpd_unlock(master); ++ genpd_lock_nested(parent, depth + 1); ++ genpd_update_cpumask(parent, cpu, set, depth + 1); ++ genpd_unlock(parent); + } + + if (set) +@@ -1647,17 +1647,17 @@ static int genpd_add_subdomain(struct generic_pm_domain *genpd, + goto out; + } + +- list_for_each_entry(itr, &genpd->master_links, master_node) { +- if (itr->slave == subdomain && itr->master == genpd) { ++ list_for_each_entry(itr, &genpd->parent_links, parent_node) { ++ if (itr->child == subdomain && itr->parent == genpd) { + ret = -EINVAL; + goto out; + } + } + +- link->master = genpd; +- list_add_tail(&link->master_node, &genpd->master_links); +- link->slave = subdomain; +- list_add_tail(&link->slave_node, &subdomain->slave_links); ++ link->parent = genpd; ++ list_add_tail(&link->parent_node, &genpd->parent_links); ++ link->child = subdomain; ++ list_add_tail(&link->child_node, &subdomain->child_links); + if (genpd_status_on(subdomain)) + genpd_sd_counter_inc(genpd); + +@@ -1671,7 +1671,7 @@ static int genpd_add_subdomain(struct generic_pm_domain *genpd, + + /** + * pm_genpd_add_subdomain - Add a subdomain to an I/O PM domain. +- * @genpd: Master PM domain to add the subdomain to. ++ * @genpd: Leader PM domain to add the subdomain to. + * @subdomain: Subdomain to be added. + */ + int pm_genpd_add_subdomain(struct generic_pm_domain *genpd, +@@ -1689,7 +1689,7 @@ EXPORT_SYMBOL_GPL(pm_genpd_add_subdomain); + + /** + * pm_genpd_remove_subdomain - Remove a subdomain from an I/O PM domain. +- * @genpd: Master PM domain to remove the subdomain from. ++ * @genpd: Leader PM domain to remove the subdomain from. + * @subdomain: Subdomain to be removed. + */ + int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd, +@@ -1704,19 +1704,19 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd, + genpd_lock(subdomain); + genpd_lock_nested(genpd, SINGLE_DEPTH_NESTING); + +- if (!list_empty(&subdomain->master_links) || subdomain->device_count) { ++ if (!list_empty(&subdomain->parent_links) || subdomain->device_count) { + pr_warn("%s: unable to remove subdomain %s\n", + genpd->name, subdomain->name); + ret = -EBUSY; + goto out; + } + +- list_for_each_entry_safe(link, l, &genpd->master_links, master_node) { +- if (link->slave != subdomain) ++ list_for_each_entry_safe(link, l, &genpd->parent_links, parent_node) { ++ if (link->child != subdomain) + continue; + +- list_del(&link->master_node); +- list_del(&link->slave_node); ++ list_del(&link->parent_node); ++ list_del(&link->child_node); + kfree(link); + if (genpd_status_on(subdomain)) + genpd_sd_counter_dec(genpd); +@@ -1781,8 +1781,8 @@ int pm_genpd_init(struct generic_pm_domain *genpd, + if (IS_ERR_OR_NULL(genpd)) + return -EINVAL; + +- INIT_LIST_HEAD(&genpd->master_links); +- INIT_LIST_HEAD(&genpd->slave_links); ++ INIT_LIST_HEAD(&genpd->parent_links); ++ INIT_LIST_HEAD(&genpd->child_links); + INIT_LIST_HEAD(&genpd->dev_list); + genpd_lock_init(genpd); + genpd->gov = gov; +@@ -1858,15 +1858,15 @@ static int genpd_remove(struct generic_pm_domain *genpd) + return -EBUSY; + } + +- if (!list_empty(&genpd->master_links) || genpd->device_count) { ++ if (!list_empty(&genpd->parent_links) || genpd->device_count) { + genpd_unlock(genpd); + pr_err("%s: unable to remove %s\n", __func__, genpd->name); + return -EBUSY; + } + +- list_for_each_entry_safe(link, l, &genpd->slave_links, slave_node) { +- list_del(&link->master_node); +- list_del(&link->slave_node); ++ list_for_each_entry_safe(link, l, &genpd->child_links, child_node) { ++ list_del(&link->parent_node); ++ list_del(&link->child_node); + kfree(link); + } + +@@ -2793,12 +2793,12 @@ static int genpd_summary_one(struct seq_file *s, + + /* + * Modifications on the list require holding locks on both +- * master and slave, so we are safe. ++ * parent and child, so we are safe. + * Also genpd->name is immutable. + */ +- list_for_each_entry(link, &genpd->master_links, master_node) { +- seq_printf(s, "%s", link->slave->name); +- if (!list_is_last(&link->master_node, &genpd->master_links)) ++ list_for_each_entry(link, &genpd->parent_links, parent_node) { ++ seq_printf(s, "%s", link->child->name); ++ if (!list_is_last(&link->parent_node, &genpd->parent_links)) + seq_puts(s, ", "); + } + +@@ -2826,7 +2826,7 @@ static int summary_show(struct seq_file *s, void *data) + struct generic_pm_domain *genpd; + int ret = 0; + +- seq_puts(s, "domain status slaves\n"); ++ seq_puts(s, "domain status children\n"); + seq_puts(s, " /device runtime status\n"); + seq_puts(s, "----------------------------------------------------------------------\n"); + +@@ -2881,8 +2881,8 @@ static int sub_domains_show(struct seq_file *s, void *data) + if (ret) + return -ERESTARTSYS; + +- list_for_each_entry(link, &genpd->master_links, master_node) +- seq_printf(s, "%s\n", link->slave->name); ++ list_for_each_entry(link, &genpd->parent_links, parent_node) ++ seq_printf(s, "%s\n", link->child->name); + + genpd_unlock(genpd); + return ret; +diff --git a/drivers/base/power/domain_governor.c b/drivers/base/power/domain_governor.c +index daa8c7689f7e6..490ed7deb99a7 100644 +--- a/drivers/base/power/domain_governor.c ++++ b/drivers/base/power/domain_governor.c +@@ -135,8 +135,8 @@ static bool __default_power_down_ok(struct dev_pm_domain *pd, + * + * All subdomains have been powered off already at this point. + */ +- list_for_each_entry(link, &genpd->master_links, master_node) { +- struct generic_pm_domain *sd = link->slave; ++ list_for_each_entry(link, &genpd->parent_links, parent_node) { ++ struct generic_pm_domain *sd = link->child; + s64 sd_max_off_ns = sd->max_off_time_ns; + + if (sd_max_off_ns < 0) +@@ -217,13 +217,13 @@ static bool default_power_down_ok(struct dev_pm_domain *pd) + } + + /* +- * We have to invalidate the cached results for the masters, so ++ * We have to invalidate the cached results for the parents, so + * use the observation that default_power_down_ok() is not +- * going to be called for any master until this instance ++ * going to be called for any parent until this instance + * returns. + */ +- list_for_each_entry(link, &genpd->slave_links, slave_node) +- link->master->max_off_time_changed = true; ++ list_for_each_entry(link, &genpd->child_links, child_node) ++ link->parent->max_off_time_changed = true; + + genpd->max_off_time_ns = -1; + genpd->max_off_time_changed = false; +diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h +index baf02ff91a31a..3dffbfa627082 100644 +--- a/include/linux/pm_domain.h ++++ b/include/linux/pm_domain.h +@@ -95,8 +95,8 @@ struct generic_pm_domain { + struct device dev; + struct dev_pm_domain domain; /* PM domain operations */ + struct list_head gpd_list_node; /* Node in the global PM domains list */ +- struct list_head master_links; /* Links with PM domain as a master */ +- struct list_head slave_links; /* Links with PM domain as a slave */ ++ struct list_head parent_links; /* Links with PM domain as a parent */ ++ struct list_head child_links;/* Links with PM domain as a child */ + struct list_head dev_list; /* List of devices */ + struct dev_power_governor *gov; + struct work_struct power_off_work; +@@ -151,10 +151,10 @@ static inline struct generic_pm_domain *pd_to_genpd(struct dev_pm_domain *pd) + } + + struct gpd_link { +- struct generic_pm_domain *master; +- struct list_head master_node; +- struct generic_pm_domain *slave; +- struct list_head slave_node; ++ struct generic_pm_domain *parent; ++ struct list_head parent_node; ++ struct generic_pm_domain *child; ++ struct list_head child_node; + + /* Sub-domain's per-master domain performance state */ + unsigned int performance_state; +diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py +index 6ca93bd2949e8..39cd1abd85590 100644 +--- a/scripts/gdb/linux/genpd.py ++++ b/scripts/gdb/linux/genpd.py +@@ -49,17 +49,17 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary''' + else: + status_string = 'off-{}'.format(genpd['state_idx']) + +- slave_names = [] ++ child_names = [] + for link in list_for_each_entry( +- genpd['master_links'], ++ genpd['parent_links'], + device_link_type.get_type().pointer(), +- 'master_node'): +- slave_names.apend(link['slave']['name']) ++ 'parent_node'): ++ child_names.append(link['child']['name']) + + gdb.write('%-30s %-15s %s\n' % ( + genpd['name'].string(), + status_string, +- ', '.join(slave_names))) ++ ', '.join(child_names))) + + # Print devices in domain + for pm_data in list_for_each_entry(genpd['dev_list'], +@@ -70,7 +70,7 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary''' + gdb.write(' %-50s %s\n' % (kobj_path, rtpm_status_str(dev))) + + def invoke(self, arg, from_tty): +- gdb.write('domain status slaves\n'); ++ gdb.write('domain status children\n'); + gdb.write(' /device runtime status\n'); + gdb.write('----------------------------------------------------------------------\n'); + for genpd in list_for_each_entry( +-- +2.39.2 + diff --git a/queue-5.4/power-supply-generic-adc-battery-fix-unit-scaling.patch b/queue-5.4/power-supply-generic-adc-battery-fix-unit-scaling.patch new file mode 100644 index 00000000000..dd71159cb75 --- /dev/null +++ b/queue-5.4/power-supply-generic-adc-battery-fix-unit-scaling.patch @@ -0,0 +1,42 @@ +From 7a052dd0fa455ccb8c0a48e3876ea3fb1a8f2327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 23:56:57 +0100 +Subject: power: supply: generic-adc-battery: fix unit scaling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sebastian Reichel + +[ Upstream commit 44263f50065969f2344808388bd589740f026167 ] + +power-supply properties are reported in µV, µA and µW. +The IIO API provides mV, mA, mW, so the values need to +be multiplied by 1000. + +Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO") +Reviewed-by: Linus Walleij +Reviewed-by: Matti Vaittinen +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/generic-adc-battery.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c +index 97b0e873e87d2..c2d6378bb897d 100644 +--- a/drivers/power/supply/generic-adc-battery.c ++++ b/drivers/power/supply/generic-adc-battery.c +@@ -138,6 +138,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp, + result); + if (ret < 0) + pr_err("read channel error\n"); ++ else ++ *result *= 1000; ++ + return ret; + } + +-- +2.39.2 + diff --git a/queue-5.4/powerpc-mpc512x-fix-resource-printk-format-warning.patch b/queue-5.4/powerpc-mpc512x-fix-resource-printk-format-warning.patch new file mode 100644 index 00000000000..5d3a4a2b6cf --- /dev/null +++ b/queue-5.4/powerpc-mpc512x-fix-resource-printk-format-warning.patch @@ -0,0 +1,46 @@ +From 7f648d83e6a78eb668282d4e4afc3dc333c10950 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:13 -0800 +Subject: powerpc/mpc512x: fix resource printk format warning + +From: Randy Dunlap + +[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + +../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat': +../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] + 989 | snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ + | ^~~~~~~~~ ~~~~~~~~~ + | | + | resource_size_t {aka long long unsigned int} + +Prevents 24 such warnings. + +Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/512x/clock-commonclk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c +index 30342b60aa63f..42c3d40355d90 100644 +--- a/arch/powerpc/platforms/512x/clock-commonclk.c ++++ b/arch/powerpc/platforms/512x/clock-commonclk.c +@@ -984,7 +984,7 @@ static void mpc5121_clk_provide_migration_support(void) + + #define NODE_PREP do { \ + of_address_to_resource(np, 0, &res); \ +- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \ ++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \ + } while (0) + + #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \ +-- +2.39.2 + diff --git a/queue-5.4/powerpc-rtas-use-memmove-for-potentially-overlapping.patch b/queue-5.4/powerpc-rtas-use-memmove-for-potentially-overlapping.patch new file mode 100644 index 00000000000..65cf4ae28b2 --- /dev/null +++ b/queue-5.4/powerpc-rtas-use-memmove-for-potentially-overlapping.patch @@ -0,0 +1,56 @@ +From 73e021bc793aaf1eb862de80b781233930ebc152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 15:33:41 -0600 +Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy + +From: Nathan Lynch + +[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ] + +Using memcpy() isn't safe when buf is identical to rtas_err_buf, which +can happen during boot before slab is up. Full context which may not +be obvious from the diff: + + if (altbuf) { + buf = altbuf; + } else { + buf = rtas_err_buf; + if (slab_is_available()) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) + memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + +This was found by inspection and I'm not aware of it causing problems +in practice. It appears to have been introduced by commit +033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the +old ppc64 version of this code did not have this problem. + +Use memmove() instead. + +Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel") +Signed-off-by: Nathan Lynch +Reviewed-by: Andrew Donnellan +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index ee810df7d522d..0793579f2bb9b 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -398,7 +398,7 @@ static char *__fetch_rtas_last_error(char *altbuf) + buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC); + } + if (buf) +- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); ++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX); + } + + return buf; +-- +2.39.2 + diff --git a/queue-5.4/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch b/queue-5.4/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch new file mode 100644 index 00000000000..9436716eeae --- /dev/null +++ b/queue-5.4/powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch @@ -0,0 +1,45 @@ +From 87b56281b8f030c1cad8ff3deac635154dec9237 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:16 -0800 +Subject: powerpc/sysdev/tsi108: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ] + +Use "%pa" format specifier for resource_size_t to avoid a compiler +printk format warning. + + arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci': + include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' + +Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree") +Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function") +Signed-off-by: Randy Dunlap +[mpe: Use pr_info() and unsplit string] +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/tsi108_pci.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c +index 49f9541954f8d..3664ffcbb313c 100644 +--- a/arch/powerpc/sysdev/tsi108_pci.c ++++ b/arch/powerpc/sysdev/tsi108_pci.c +@@ -216,9 +216,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary) + + (hose)->ops = &tsi108_direct_pci_ops; + +- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. " +- "Firmware bus number: %d->%d\n", +- rsrc.start, hose->first_busno, hose->last_busno); ++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n", ++ &rsrc.start, hose->first_busno, hose->last_busno); + + /* Interpret the "ranges" property */ + /* This also maps the I/O region and sets isa_io/mem_base */ +-- +2.39.2 + diff --git a/queue-5.4/powerpc-wii-fix-resource-printk-format-warnings.patch b/queue-5.4/powerpc-wii-fix-resource-printk-format-warnings.patch new file mode 100644 index 00000000000..60db38dc52c --- /dev/null +++ b/queue-5.4/powerpc-wii-fix-resource-printk-format-warnings.patch @@ -0,0 +1,87 @@ +From 0dd79f74c2d6dd2f1e8a2cd1cf68c3185811e463 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 23:01:14 -0800 +Subject: powerpc/wii: fix resource printk format warnings + +From: Randy Dunlap + +[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ] + +Use "%pa" format specifier for resource_size_t to avoid compiler +printk format warnings. + +../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info' + 148 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info' + 174 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); + | ^~~~~~~ + +../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs': +../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=] +../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info' + 77 | pr_info("%s at 0x%08x mapped to 0x%p\n", name, + | ^~~~~~~ + +Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support") +Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support") +Fixes: 5a7ee3198dfa ("powerpc: wii: platform support") +Signed-off-by: Randy Dunlap +Signed-off-by: Michael Ellerman +Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 2 +- + arch/powerpc/platforms/embedded6xx/wii.c | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +index d39a9213a3e69..7dd2e2f97aae5 100644 +--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c +@@ -144,7 +144,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np) + } + io_base = ioremap(res.start, resource_size(&res)); + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __flipper_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +index de10c13de15c6..c6b492ebb7662 100644 +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -173,7 +173,7 @@ static struct irq_domain *hlwd_pic_init(struct device_node *np) + return NULL; + } + +- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base); ++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base); + + __hlwd_quiesce(io_base); + +diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c +index 67e48b0a164e3..c691453dfd3fe 100644 +--- a/arch/powerpc/platforms/embedded6xx/wii.c ++++ b/arch/powerpc/platforms/embedded6xx/wii.c +@@ -89,8 +89,8 @@ static void __iomem *wii_ioremap_hw_regs(char *name, char *compatible) + + hw_regs = ioremap(res.start, resource_size(&res)); + if (hw_regs) { +- pr_info("%s at 0x%08x mapped to 0x%p\n", name, +- res.start, hw_regs); ++ pr_info("%s at 0x%pa mapped to 0x%p\n", name, ++ &res.start, hw_regs); + } + + out_put: +-- +2.39.2 + diff --git a/queue-5.4/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch b/queue-5.4/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch new file mode 100644 index 00000000000..7e09e5010e0 --- /dev/null +++ b/queue-5.4/pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch @@ -0,0 +1,100 @@ +From 95afb9d1d58013ec5a44930957c4567c47ca361a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Mar 2023 20:40:43 +0000 +Subject: pstore: Revert pmsg_lock back to a normal mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Stultz + +[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ] + +This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721. + +So while priority inversion on the pmsg_lock is an occasional +problem that an rt_mutex would help with, in uses where logging +is writing to pmsg heavily from multiple threads, the pmsg_lock +can be heavily contended. + +After this change landed, it was reported that cases where the +mutex locking overhead was commonly adding on the order of 10s +of usecs delay had suddenly jumped to ~msec delay with rtmutex. + +It seems the slight differences in the locks under this level +of contention causes the normal mutexes to utilize the spinning +optimizations, while the rtmutexes end up in the sleeping +slowpath (which allows additional threads to pile on trying +to take the lock). + +In this case, it devolves to a worse case senerio where the lock +acquisition and scheduling overhead dominates, and each thread +is waiting on the order of ~ms to do ~us of work. + +Obviously, having tons of threads all contending on a single +lock for logging is non-optimal, so the proper fix is probably +reworking pstore pmsg to have per-cpu buffers so we don't have +contention. + +Additionally, Steven Rostedt has provided some furhter +optimizations for rtmutexes that improves the rtmutex spinning +path, but at least in my testing, I still see the test tripping +into the sleeping path on rtmutexes while utilizing the spinning +path with mutexes. + +But in the short term, lets revert the change to the rt_mutex +and go back to normal mutexes to avoid a potentially major +performance regression. And we can work on optimizations to both +rtmutexes and finer-grained locking for pstore pmsg in the +future. + +Cc: Wei Wang +Cc: Midas Chien +Cc: "Chunhui Li (李春辉)" +Cc: Steven Rostedt +Cc: Kees Cook +Cc: Anton Vorontsov +Cc: "Guilherme G. Piccoli" +Cc: Tony Luck +Cc: kernel-team@android.com +Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion") +Reported-by: "Chunhui Li (李春辉)" +Signed-off-by: John Stultz +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com +Signed-off-by: Sasha Levin +--- + fs/pstore/pmsg.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c +index 18cf94b597e05..d8542ec2f38c6 100644 +--- a/fs/pstore/pmsg.c ++++ b/fs/pstore/pmsg.c +@@ -7,10 +7,9 @@ + #include + #include + #include +-#include + #include "internal.h" + +-static DEFINE_RT_MUTEX(pmsg_lock); ++static DEFINE_MUTEX(pmsg_lock); + + static ssize_t write_pmsg(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) +@@ -29,9 +28,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf, + if (!access_ok(buf, count)) + return -EFAULT; + +- rt_mutex_lock(&pmsg_lock); ++ mutex_lock(&pmsg_lock); + ret = psinfo->write_user(&record, buf); +- rt_mutex_unlock(&pmsg_lock); ++ mutex_unlock(&pmsg_lock); + return ret ? ret : count; + } + +-- +2.39.2 + diff --git a/queue-5.4/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch b/queue-5.4/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch new file mode 100644 index 00000000000..cb1b039e06f --- /dev/null +++ b/queue-5.4/pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch @@ -0,0 +1,198 @@ +From d81c59bcc6a7949d6fc8e0d36236d8688430fdab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 21:24:29 +0800 +Subject: pwm: mtk-disp: Adjust the clocks to avoid them mismatch + +From: Jitao Shi + +[ Upstream commit d7a4e582587d97a586b1f7709e3bddcf35928e96 ] + +The clks "main" and "mm" are prepared in .probe() (and unprepared in +.remove()). This results in the clocks being on during suspend which +results in unnecessarily increased power consumption. + +Remove the clock operations from .probe() and .remove(). Add the +clk_prepare_enable() in .enable() and the clk_disable_unprepare() in +.disable(). + +Signed-off-by: Jitao Shi +[thierry.reding@gmail.com: squashed in fixup patch] +Signed-off-by: Thierry Reding +Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 91 +++++++++++++++++--------------------- + 1 file changed, 41 insertions(+), 50 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index af63aaab8e153..a594a0fdddd7b 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -74,6 +74,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + u64 div, rate; + int err; + ++ err = clk_prepare_enable(mdp->clk_main); ++ if (err < 0) { ++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err)); ++ return err; ++ } ++ ++ err = clk_prepare_enable(mdp->clk_mm); ++ if (err < 0) { ++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err)); ++ clk_disable_unprepare(mdp->clk_main); ++ return err; ++ } ++ + /* + * Find period, high_width and clk_div to suit duty_ns and period_ns. + * Calculate proper div value to keep period value in the bound. +@@ -87,8 +100,11 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + rate = clk_get_rate(mdp->clk_main); + clk_div = div_u64(rate * period_ns, NSEC_PER_SEC) >> + PWM_PERIOD_BIT_WIDTH; +- if (clk_div > PWM_CLKDIV_MAX) ++ if (clk_div > PWM_CLKDIV_MAX) { ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + return -EINVAL; ++ } + + div = NSEC_PER_SEC * (clk_div + 1); + period = div64_u64(rate * period_ns, div); +@@ -98,16 +114,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + high_width = div64_u64(rate * duty_ns, div); + value = period | (high_width << PWM_HIGH_WIDTH_SHIFT); + +- err = clk_enable(mdp->clk_main); +- if (err < 0) +- return err; +- +- err = clk_enable(mdp->clk_mm); +- if (err < 0) { +- clk_disable(mdp->clk_main); +- return err; +- } +- + mtk_disp_pwm_update_bits(mdp, mdp->data->con0, + PWM_CLKDIV_MASK, + clk_div << PWM_CLKDIV_SHIFT); +@@ -122,10 +128,21 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + mtk_disp_pwm_update_bits(mdp, mdp->data->commit, + mdp->data->commit_mask, + 0x0); ++ } else { ++ /* ++ * For MT2701, disable double buffer before writing register ++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. ++ */ ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0, ++ mdp->data->con0_sel, ++ mdp->data->con0_sel); + } + +- clk_disable(mdp->clk_mm); +- clk_disable(mdp->clk_main); ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + + return 0; + } +@@ -135,13 +152,16 @@ static int mtk_disp_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + struct mtk_disp_pwm *mdp = to_mtk_disp_pwm(chip); + int err; + +- err = clk_enable(mdp->clk_main); +- if (err < 0) ++ err = clk_prepare_enable(mdp->clk_main); ++ if (err < 0) { ++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err)); + return err; ++ } + +- err = clk_enable(mdp->clk_mm); ++ err = clk_prepare_enable(mdp->clk_mm); + if (err < 0) { +- clk_disable(mdp->clk_main); ++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err)); ++ clk_disable_unprepare(mdp->clk_main); + return err; + } + +@@ -158,8 +178,8 @@ static void mtk_disp_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm) + mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask, + 0x0); + +- clk_disable(mdp->clk_mm); +- clk_disable(mdp->clk_main); ++ clk_disable_unprepare(mdp->clk_mm); ++ clk_disable_unprepare(mdp->clk_main); + } + + static const struct pwm_ops mtk_disp_pwm_ops = { +@@ -194,14 +214,6 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev) + if (IS_ERR(mdp->clk_mm)) + return PTR_ERR(mdp->clk_mm); + +- ret = clk_prepare(mdp->clk_main); +- if (ret < 0) +- return ret; +- +- ret = clk_prepare(mdp->clk_mm); +- if (ret < 0) +- goto disable_clk_main; +- + mdp->chip.dev = &pdev->dev; + mdp->chip.ops = &mtk_disp_pwm_ops; + mdp->chip.base = -1; +@@ -209,32 +221,13 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev) + + ret = pwmchip_add(&mdp->chip); + if (ret < 0) { +- dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret); +- goto disable_clk_mm; ++ dev_err(&pdev->dev, "pwmchip_add() failed: %pe\n", ERR_PTR(ret)); ++ return ret; + } + + platform_set_drvdata(pdev, mdp); + +- /* +- * For MT2701, disable double buffer before writing register +- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. +- */ +- if (!mdp->data->has_commit) { +- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, +- mdp->data->bls_debug_mask, +- mdp->data->bls_debug_mask); +- mtk_disp_pwm_update_bits(mdp, mdp->data->con0, +- mdp->data->con0_sel, +- mdp->data->con0_sel); +- } +- + return 0; +- +-disable_clk_mm: +- clk_unprepare(mdp->clk_mm); +-disable_clk_main: +- clk_unprepare(mdp->clk_main); +- return ret; + } + + static int mtk_disp_pwm_remove(struct platform_device *pdev) +@@ -242,8 +235,6 @@ static int mtk_disp_pwm_remove(struct platform_device *pdev) + struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev); + + pwmchip_remove(&mdp->chip); +- clk_unprepare(mdp->clk_mm); +- clk_unprepare(mdp->clk_main); + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.4/pwm-mtk-disp-disable-shadow-registers-before-setting.patch b/queue-5.4/pwm-mtk-disp-disable-shadow-registers-before-setting.patch new file mode 100644 index 00000000000..75a0f3296bb --- /dev/null +++ b/queue-5.4/pwm-mtk-disp-disable-shadow-registers-before-setting.patch @@ -0,0 +1,74 @@ +From d6c10c8d532ea3b5828458316e81399a00aff4c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Apr 2023 15:30:53 +0200 +Subject: pwm: mtk-disp: Disable shadow registers before setting backlight + values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: AngeloGioacchino Del Regno + +[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ] + +If shadow registers usage is not desired, disable that before performing +any write to CON0/1 registers in the .apply() callback, otherwise we may +lose clkdiv or period/width updates. + +Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support") +Signed-off-by: AngeloGioacchino Del Regno +Reviewed-by: Nícolas F. R. A. Prado +Tested-by: Nícolas F. R. A. Prado +Reviewed-by: Alexandre Mergnat +Tested-by: Alexandre Mergnat +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index a594a0fdddd7b..327c780d433da 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -114,6 +114,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + high_width = div64_u64(rate * duty_ns, div); + value = period | (high_width << PWM_HIGH_WIDTH_SHIFT); + ++ if (mdp->data->bls_debug && !mdp->data->has_commit) { ++ /* ++ * For MT2701, disable double buffer before writing register ++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. ++ */ ++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, ++ mdp->data->bls_debug_mask, ++ mdp->data->bls_debug_mask); ++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0, ++ mdp->data->con0_sel, ++ mdp->data->con0_sel); ++ } ++ + mtk_disp_pwm_update_bits(mdp, mdp->data->con0, + PWM_CLKDIV_MASK, + clk_div << PWM_CLKDIV_SHIFT); +@@ -128,17 +141,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + mtk_disp_pwm_update_bits(mdp, mdp->data->commit, + mdp->data->commit_mask, + 0x0); +- } else { +- /* +- * For MT2701, disable double buffer before writing register +- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH. +- */ +- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug, +- mdp->data->bls_debug_mask, +- mdp->data->bls_debug_mask); +- mtk_disp_pwm_update_bits(mdp, mdp->data->con0, +- mdp->data->con0_sel, +- mdp->data->con0_sel); + } + + clk_disable_unprepare(mdp->clk_mm); +-- +2.39.2 + diff --git a/queue-5.4/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch b/queue-5.4/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch new file mode 100644 index 00000000000..4fdc36f2676 --- /dev/null +++ b/queue-5.4/pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch @@ -0,0 +1,47 @@ +From a920c3b70bde7e3c51a8daee857e9da0d7b11a72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 18:28:27 +0200 +Subject: pwm: mtk-disp: Don't check the return code of pwmchip_remove() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 9b7b5736ffd5da6f8f6329ebe5f1829cbcf8afae ] + +pwmchip_remove() returns always 0. Don't use the value to make it +possible to eventually change the function to return void. Also the +driver core ignores the return value of mtk_disp_pwm_remove(). + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values") +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-mtk-disp.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c +index 83b8be0209b74..af63aaab8e153 100644 +--- a/drivers/pwm/pwm-mtk-disp.c ++++ b/drivers/pwm/pwm-mtk-disp.c +@@ -240,13 +240,12 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev) + static int mtk_disp_pwm_remove(struct platform_device *pdev) + { + struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev); +- int ret; + +- ret = pwmchip_remove(&mdp->chip); ++ pwmchip_remove(&mdp->chip); + clk_unprepare(mdp->clk_mm); + clk_unprepare(mdp->clk_main); + +- return ret; ++ return 0; + } + + static const struct mtk_pwm_data mt2701_pwm_data = { +-- +2.39.2 + diff --git a/queue-5.4/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch b/queue-5.4/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch new file mode 100644 index 00000000000..e8fe457552f --- /dev/null +++ b/queue-5.4/rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch @@ -0,0 +1,46 @@ +From f5b1c41b8e70b67136b265cff7813a7cfcb4c0a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 12:51:27 +0300 +Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() + +From: Dan Carpenter + +[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ] + +The ucmd->log_sq_bb_count variable is controlled by the user so this +shift can wrap. Fix it by using check_shl_overflow() in the same way +that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined +behavior in hns_roce_set_user_sq_size()"). + +Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/qp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index bca5358f3ef29..4523eb85ec698 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -438,9 +438,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev, + struct mlx4_ib_qp *qp, + struct mlx4_ib_create_qp *ucmd) + { ++ u32 cnt; ++ + /* Sanity check SQ size before proceeding */ +- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes || +- ucmd->log_sq_stride > ++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) || ++ cnt > dev->dev->caps.max_wqes) ++ return -EINVAL; ++ if (ucmd->log_sq_stride > + ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) || + ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE) + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.4/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch b/queue-5.4/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch new file mode 100644 index 00000000000..8fd7b671457 --- /dev/null +++ b/queue-5.4/rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch @@ -0,0 +1,39 @@ +From 363ad7f4e105ffde00bb59b85d5e195aad892d1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 04:39:06 +0300 +Subject: RDMA/mlx5: Use correct device num_ports when modify DC + +From: Mark Zhang + +[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ] + +Just like other QP types, when modify DC, the port_num should be compared +with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port +vHCA on DC may not work. + +Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP") +Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 6edd30c92156e..51623431b879a 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -3821,7 +3821,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr, + return -EINVAL; + + if (attr->port_num == 0 || +- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) { ++ attr->port_num > dev->num_ports) { + mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n", + attr->port_num, dev->num_ports); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.4/rdma-rdmavt-delete-unnecessary-null-check.patch b/queue-5.4/rdma-rdmavt-delete-unnecessary-null-check.patch new file mode 100644 index 00000000000..98358ce9f79 --- /dev/null +++ b/queue-5.4/rdma-rdmavt-delete-unnecessary-null-check.patch @@ -0,0 +1,41 @@ +From b0cece5e8974b6d086ff7fc18620b927947b14c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 15:44:08 +0300 +Subject: RDMA/rdmavt: Delete unnecessary NULL check + +From: Natalia Petrova + +[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ] + +There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev' +is created in rvt_register_device() which will fail if the 'qp_dev' +allocation fails in rvt_driver_qp_init(). Overwise this pointer +doesn't changed and passed to rvt_qp_exit() by the next step. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table") +Signed-off-by: Natalia Petrova +Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rdmavt/qp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c +index e97c13967174c..905e2eaed0951 100644 +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -505,8 +505,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi) + if (qps_inuse) + rvt_pr_err(rdi, "QP memory leak! %u still in use\n", + qps_inuse); +- if (!rdi->qp_dev) +- return; + + kfree(rdi->qp_dev->qp_table); + free_qpn_table(&rdi->qp_dev->qpn_table); +-- +2.39.2 + diff --git a/queue-5.4/rdma-siw-fix-potential-page_array-out-of-range-acces.patch b/queue-5.4/rdma-siw-fix-potential-page_array-out-of-range-acces.patch new file mode 100644 index 00000000000..f919f4ccc37 --- /dev/null +++ b/queue-5.4/rdma-siw-fix-potential-page_array-out-of-range-acces.patch @@ -0,0 +1,39 @@ +From 11ef2f6c63dc5b612254cee9de511c6cd2ab226c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 01:17:51 -0800 +Subject: RDMA/siw: Fix potential page_array out of range access + +From: Daniil Dulov + +[ Upstream commit 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 ] + +When seg is equal to MAX_ARRAY, the loop should break, otherwise +it will result in out of range access. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b9be6f18cf9e ("rdma/siw: transmit path") +Signed-off-by: Daniil Dulov +Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c +index 2b5120a13e376..42d03bd1622d5 100644 +--- a/drivers/infiniband/sw/siw/siw_qp_tx.c ++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c +@@ -548,7 +548,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s) + data_len -= plen; + fp_off = 0; + +- if (++seg > (int)MAX_ARRAY) { ++ if (++seg >= (int)MAX_ARRAY) { + siw_dbg_qp(tx_qp(c_tx), "to many fragments\n"); + siw_unmap_pages(page_array, kmap_mask); + wqe->processed -= c_tx->bytes_unsent; +-- +2.39.2 + diff --git a/queue-5.4/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch b/queue-5.4/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch new file mode 100644 index 00000000000..2f47b915e02 --- /dev/null +++ b/queue-5.4/rdma-siw-remove-namespace-check-from-siw_netdev_even.patch @@ -0,0 +1,44 @@ +From 6ac8f6d27ea75628077684596318a35098947d24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Apr 2023 14:10:13 +0900 +Subject: RDMA/siw: Remove namespace check from siw_netdev_event() + +From: Tetsuo Handa + +[ Upstream commit 266e9b3475ba82212062771fdbc40be0e3c06ec8 ] + +syzbot is reporting that siw_netdev_event(NETDEV_UNREGISTER) cannot destroy +siw_device created after unshare(CLONE_NEWNET) due to net namespace check. +It seems that this check was by error there and should be removed. + +Reported-by: syzbot +Link: https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b +Suggested-by: Jason Gunthorpe +Suggested-by: Leon Romanovsky +Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") +Signed-off-by: Tetsuo Handa +Link: https://lore.kernel.org/r/a44e9ac5-44e2-d575-9e30-02483cc7ffd1@I-love.SAKURA.ne.jp +Reviewed-by: Bernard Metzler +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/siw/siw_main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c +index dbbf8c6c16d38..a462c2fc6f311 100644 +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -472,9 +472,6 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event, + + dev_dbg(&netdev->dev, "siw: event %lu\n", event); + +- if (dev_net(netdev) != &init_net) +- return NOTIFY_OK; +- + base_dev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_SIW); + if (!base_dev) + return NOTIFY_OK; +-- +2.39.2 + diff --git a/queue-5.4/regulator-core-avoid-lockdep-reports-when-resolving-.patch b/queue-5.4/regulator-core-avoid-lockdep-reports-when-resolving-.patch new file mode 100644 index 00000000000..051d75f8ef1 --- /dev/null +++ b/queue-5.4/regulator-core-avoid-lockdep-reports-when-resolving-.patch @@ -0,0 +1,266 @@ +From fd1279bd6f0148f4822b78c76d22d458e5248be4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 14:33:54 -0700 +Subject: regulator: core: Avoid lockdep reports when resolving supplies + +From: Douglas Anderson + +[ Upstream commit cba6cfdc7c3f1516f0d08ddfb24e689af0932573 ] + +An automated bot told me that there was a potential lockdep problem +with regulators. This was on the chromeos-5.15 kernel, but I see +nothing that would be different downstream compared to upstream. The +bot said: + ============================================ + WARNING: possible recursive locking detected + 5.15.104-lockdep-17461-gc1e499ed6604 #1 Not tainted + -------------------------------------------- + kworker/u16:4/115 is trying to acquire lock: + ffffff8083110170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: create_regulator+0x398/0x7ec + + but task is already holding lock: + ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(regulator_ww_class_mutex); + lock(regulator_ww_class_mutex); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 4 locks held by kworker/u16:4/115: + #0: ffffff808006a948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x520/0x1348 + #1: ffffffc00e0a7cc0 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x55c/0x1348 + #2: ffffff80828a2260 (&dev->mutex){....}-{3:3}, at: __device_attach_async_helper+0xd0/0x2a4 + #3: ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8 + + stack backtrace: + CPU: 2 PID: 115 Comm: kworker/u16:4 Not tainted 5.15.104-lockdep-17461-gc1e499ed6604 #1 9292e52fa83c0e23762b2b3aa1bacf5787a4d5da + Hardware name: Google Quackingstick (rev0+) (DT) + Workqueue: events_unbound async_run_entry_fn + Call trace: + dump_backtrace+0x0/0x4ec + show_stack+0x34/0x50 + dump_stack_lvl+0xdc/0x11c + dump_stack+0x1c/0x48 + __lock_acquire+0x16d4/0x6c74 + lock_acquire+0x208/0x750 + __mutex_lock_common+0x11c/0x11f8 + ww_mutex_lock+0xc0/0x440 + create_regulator+0x398/0x7ec + regulator_resolve_supply+0x654/0x7c4 + regulator_register_resolve_supply+0x30/0x120 + class_for_each_device+0x1b8/0x230 + regulator_register+0x17a4/0x1f40 + devm_regulator_register+0x60/0xd0 + reg_fixed_voltage_probe+0x728/0xaec + platform_probe+0x150/0x1c8 + really_probe+0x274/0xa20 + __driver_probe_device+0x1dc/0x3f4 + driver_probe_device+0x78/0x1c0 + __device_attach_driver+0x1ac/0x2c8 + bus_for_each_drv+0x11c/0x190 + __device_attach_async_helper+0x1e4/0x2a4 + async_run_entry_fn+0xa0/0x3ac + process_one_work+0x638/0x1348 + worker_thread+0x4a8/0x9c4 + kthread+0x2e4/0x3a0 + ret_from_fork+0x10/0x20 + +The problem was first reported soon after we made many of the +regulators probe asynchronously, though nothing I've seen implies that +the problems couldn't have also happened even without that. + +I haven't personally been able to reproduce the lockdep issue, but the +issue does look somewhat legitimate. Specifically, it looks like in +regulator_resolve_supply() we are holding a "rdev" lock while calling +set_supply() -> create_regulator() which grabs the lock of a +_different_ "rdev" (the one for our supply). This is not necessarily +safe from a lockdep perspective since there is no documented ordering +between these two locks. + +In reality, we should always be locking a regulator before the +supplying regulator, so I don't expect there to be any real deadlocks +in practice. However, the regulator framework in general doesn't +express this to lockdep. + +Let's fix the issue by simply grabbing the two locks involved in the +same way we grab multiple locks elsewhere in the regulator framework: +using the "wound/wait" mechanisms. + +Fixes: eaa7995c529b ("regulator: core: avoid regulator_resolve_supply() race condition") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230329143317.RFC.v2.2.I30d8e1ca10cfbe5403884cdd192253a2e063eb9e@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 91 ++++++++++++++++++++++++++++++++++++---- + 1 file changed, 83 insertions(+), 8 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 1cdf924c0111b..06da271ad5dd3 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -217,6 +217,78 @@ void regulator_unlock(struct regulator_dev *rdev) + } + EXPORT_SYMBOL_GPL(regulator_unlock); + ++/** ++ * regulator_lock_two - lock two regulators ++ * @rdev1: first regulator ++ * @rdev2: second regulator ++ * @ww_ctx: w/w mutex acquire context ++ * ++ * Locks both rdevs using the regulator_ww_class. ++ */ ++static void regulator_lock_two(struct regulator_dev *rdev1, ++ struct regulator_dev *rdev2, ++ struct ww_acquire_ctx *ww_ctx) ++{ ++ struct regulator_dev *tmp; ++ int ret; ++ ++ ww_acquire_init(ww_ctx, ®ulator_ww_class); ++ ++ /* Try to just grab both of them */ ++ ret = regulator_lock_nested(rdev1, ww_ctx); ++ WARN_ON(ret); ++ ret = regulator_lock_nested(rdev2, ww_ctx); ++ if (ret != -EDEADLOCK) { ++ WARN_ON(ret); ++ goto exit; ++ } ++ ++ while (true) { ++ /* ++ * Start of loop: rdev1 was locked and rdev2 was contended. ++ * Need to unlock rdev1, slowly lock rdev2, then try rdev1 ++ * again. ++ */ ++ regulator_unlock(rdev1); ++ ++ ww_mutex_lock_slow(&rdev2->mutex, ww_ctx); ++ rdev2->ref_cnt++; ++ rdev2->mutex_owner = current; ++ ret = regulator_lock_nested(rdev1, ww_ctx); ++ ++ if (ret == -EDEADLOCK) { ++ /* More contention; swap which needs to be slow */ ++ tmp = rdev1; ++ rdev1 = rdev2; ++ rdev2 = tmp; ++ } else { ++ WARN_ON(ret); ++ break; ++ } ++ } ++ ++exit: ++ ww_acquire_done(ww_ctx); ++} ++ ++/** ++ * regulator_unlock_two - unlock two regulators ++ * @rdev1: first regulator ++ * @rdev2: second regulator ++ * @ww_ctx: w/w mutex acquire context ++ * ++ * The inverse of regulator_lock_two(). ++ */ ++ ++static void regulator_unlock_two(struct regulator_dev *rdev1, ++ struct regulator_dev *rdev2, ++ struct ww_acquire_ctx *ww_ctx) ++{ ++ regulator_unlock(rdev2); ++ regulator_unlock(rdev1); ++ ww_acquire_fini(ww_ctx); ++} ++ + static bool regulator_supply_is_couple(struct regulator_dev *rdev) + { + struct regulator_dev *c_rdev; +@@ -1419,8 +1491,8 @@ static int set_machine_constraints(struct regulator_dev *rdev) + + /** + * set_supply - set regulator supply regulator +- * @rdev: regulator name +- * @supply_rdev: supply regulator name ++ * @rdev: regulator (locked) ++ * @supply_rdev: supply regulator (locked)) + * + * Called by platform initialisation code to set the supply regulator for this + * regulator. This ensures that a regulators supply will also be enabled by the +@@ -1592,6 +1664,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + struct regulator *regulator; + int err = 0; + ++ lockdep_assert_held_once(&rdev->mutex.base); ++ + if (dev) { + char buf[REG_STR_SIZE]; + int size; +@@ -1619,9 +1693,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev, + regulator->rdev = rdev; + regulator->supply_name = supply_name; + +- regulator_lock(rdev); + list_add(®ulator->list, &rdev->consumer_list); +- regulator_unlock(rdev); + + if (dev) { + regulator->dev = dev; +@@ -1787,6 +1859,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) + { + struct regulator_dev *r; + struct device *dev = rdev->dev.parent; ++ struct ww_acquire_ctx ww_ctx; + int ret = 0; + + /* No supply to resolve? */ +@@ -1853,23 +1926,23 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) + * between rdev->supply null check and setting rdev->supply in + * set_supply() from concurrent tasks. + */ +- regulator_lock(rdev); ++ regulator_lock_two(rdev, r, &ww_ctx); + + /* Supply just resolved by a concurrent task? */ + if (rdev->supply) { +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + put_device(&r->dev); + goto out; + } + + ret = set_supply(rdev, r); + if (ret < 0) { +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + put_device(&r->dev); + goto out; + } + +- regulator_unlock(rdev); ++ regulator_unlock_two(rdev, r, &ww_ctx); + + /* + * In set_machine_constraints() we may have turned this regulator on +@@ -1984,7 +2057,9 @@ struct regulator *_regulator_get(struct device *dev, const char *id, + return regulator; + } + ++ regulator_lock(rdev); + regulator = create_regulator(rdev, dev, id); ++ regulator_unlock(rdev); + if (regulator == NULL) { + regulator = ERR_PTR(-ENOMEM); + module_put(rdev->owner); +-- +2.39.2 + diff --git a/queue-5.4/regulator-core-consistently-set-mutex_owner-when-usi.patch b/queue-5.4/regulator-core-consistently-set-mutex_owner-when-usi.patch new file mode 100644 index 00000000000..1e63849ebff --- /dev/null +++ b/queue-5.4/regulator-core-consistently-set-mutex_owner-when-usi.patch @@ -0,0 +1,54 @@ +From 064dc52130a2222faae19e7b286a5d40519cab7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 14:33:53 -0700 +Subject: regulator: core: Consistently set mutex_owner when using + ww_mutex_lock_slow() + +From: Douglas Anderson + +[ Upstream commit b83a1772be854f87602de14726737d3e5b06e1f4 ] + +When a codepath locks a rdev using ww_mutex_lock_slow() directly then +that codepath is responsible for incrementing the "ref_cnt" and also +setting the "mutex_owner" to "current". + +The regulator core consistently got that right for "ref_cnt" but +didn't always get it right for "mutex_owner". Let's fix this. + +It's unlikely that this truly matters because the "mutex_owner" is +only needed if we're going to do subsequent locking of the same +rdev. However, even though it's not truly needed it seems less +surprising if we consistently set "mutex_owner" properly. + +Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20230329143317.RFC.v2.1.I4e9d433ea26360c06dd1381d091c82bb1a4ce843@changeid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 0179716f74d74..1cdf924c0111b 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -344,6 +344,7 @@ static void regulator_lock_dependent(struct regulator_dev *rdev, + ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx); + old_contended_rdev = new_contended_rdev; + old_contended_rdev->ref_cnt++; ++ old_contended_rdev->mutex_owner = current; + } + + err = regulator_lock_recursive(rdev, +@@ -5659,6 +5660,7 @@ static void regulator_summary_lock(struct ww_acquire_ctx *ww_ctx) + ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx); + old_contended_rdev = new_contended_rdev; + old_contended_rdev->ref_cnt++; ++ old_contended_rdev->mutex_owner = current; + } + + err = regulator_summary_lock_all(ww_ctx, +-- +2.39.2 + diff --git a/queue-5.4/regulator-stm32-pwr-fix-of_iomap-leak.patch b/queue-5.4/regulator-stm32-pwr-fix-of_iomap-leak.patch new file mode 100644 index 00000000000..c4911bbec4a --- /dev/null +++ b/queue-5.4/regulator-stm32-pwr-fix-of_iomap-leak.patch @@ -0,0 +1,69 @@ +From cd1e13ccb49394ced4130d5ee829653b840a4916 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 11:35:29 +0800 +Subject: regulator: stm32-pwr: fix of_iomap leak + +From: YAN SHI + +[ Upstream commit c4a413e56d16a2ae84e6d8992f215c4dcc7fac20 ] + +Smatch reports: +drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: +'base' from of_iomap() not released on lines: 151,166. + +In stm32_pwr_regulator_probe(), base is not released +when devm_kzalloc() fails to allocate memory or +devm_regulator_register() fails to register a new regulator device, +which may cause a leak. + +To fix this issue, replace of_iomap() with +devm_platform_ioremap_resource(). devm_platform_ioremap_resource() +is a specialized function for platform devices. +It allows 'base' to be automatically released whether the probe +function succeeds or fails. + +Besides, use IS_ERR(base) instead of !base +as the return value of devm_platform_ioremap_resource() +can either be a pointer to the remapped memory or +an ERR_PTR() encoded error code if the operation fails. + +Fixes: dc62f951a6a8 ("regulator: stm32-pwr: Fix return value check in stm32_pwr_regulator_probe()") +Signed-off-by: YAN SHI +Reported-by: kernel test robot +Link: https://lore.kernel.org/oe-kbuild-all/202304111750.o2643eJN-lkp@intel.com/ +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230412033529.18890-1-m202071378@hust.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/stm32-pwr.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/regulator/stm32-pwr.c b/drivers/regulator/stm32-pwr.c +index e0e627b0106e0..b94da49923767 100644 +--- a/drivers/regulator/stm32-pwr.c ++++ b/drivers/regulator/stm32-pwr.c +@@ -129,17 +129,16 @@ static const struct regulator_desc stm32_pwr_desc[] = { + + static int stm32_pwr_regulator_probe(struct platform_device *pdev) + { +- struct device_node *np = pdev->dev.of_node; + struct stm32_pwr_reg *priv; + void __iomem *base; + struct regulator_dev *rdev; + struct regulator_config config = { }; + int i, ret = 0; + +- base = of_iomap(np, 0); +- if (!base) { ++ base = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(base)) { + dev_err(&pdev->dev, "Unable to map IO memory\n"); +- return -ENOMEM; ++ return PTR_ERR(base); + } + + config.dev = &pdev->dev; +-- +2.39.2 + diff --git a/queue-5.4/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch b/queue-5.4/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch new file mode 100644 index 00000000000..f6108f53fd4 --- /dev/null +++ b/queue-5.4/revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch @@ -0,0 +1,39 @@ +From 0a5005ead11b547f6023ede291af4c758ea55ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 18:30:06 +0800 +Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove + due to unfinished work" + +From: Liu Jian + +[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ] + +This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. + +This patch introduces a possible null-ptr-def problem. Revert it. And the +fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth: +btsdio: fix use after free bug in btsdio_remove due to race condition"). + +Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work") +Signed-off-by: Liu Jian +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btsdio.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c +index 81125fb180351..fd9571d5fdac9 100644 +--- a/drivers/bluetooth/btsdio.c ++++ b/drivers/bluetooth/btsdio.c +@@ -343,7 +343,6 @@ static void btsdio_remove(struct sdio_func *func) + + BT_DBG("func %p", func); + +- cancel_work_sync(&data->work); + if (!data) + return; + +-- +2.39.2 + diff --git a/queue-5.4/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch b/queue-5.4/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch new file mode 100644 index 00000000000..fbddf1c2c12 --- /dev/null +++ b/queue-5.4/rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch @@ -0,0 +1,60 @@ +From 757a4a731e6def744e125e06cb1817768502e42f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 22:21:42 +0100 +Subject: rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time + +From: Martin Blumenstingl + +[ Upstream commit 0e6255fa3f649170da6bd1a544680589cfae1131 ] + +The VRTC alarm register can be programmed with an amount of seconds +after which the SoC will be woken up by the VRTC timer again. We are +already converting the alarm time from meson_vrtc_set_alarm() to +"seconds since 1970". This means we also need to use "seconds since +1970" for the current time. + +This fixes a problem where setting the alarm to one minute in the future +results in the firmware (which handles wakeup) to output (on the serial +console) that the system will be woken up in billions of seconds. +ktime_get_raw_ts64() returns the time since boot, not since 1970. Switch +to ktime_get_real_ts64() to fix the calculation of the alarm time and to +make the SoC wake up at the specified date/time. Also the firmware +(which manages suspend) now prints either 59 or 60 seconds until wakeup +(depending on how long it takes for the system to enter suspend). + +Fixes: 6ef35398e827 ("rtc: Add Amlogic Virtual Wake RTC") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Reviewed-by: Kevin Hilman +Link: https://lore.kernel.org/r/20230320212142.2355062-1-martin.blumenstingl@googlemail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-meson-vrtc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-meson-vrtc.c b/drivers/rtc/rtc-meson-vrtc.c +index 89e5ba0dae69f..1cf98542578fc 100644 +--- a/drivers/rtc/rtc-meson-vrtc.c ++++ b/drivers/rtc/rtc-meson-vrtc.c +@@ -23,7 +23,7 @@ static int meson_vrtc_read_time(struct device *dev, struct rtc_time *tm) + struct timespec64 time; + + dev_dbg(dev, "%s\n", __func__); +- ktime_get_raw_ts64(&time); ++ ktime_get_real_ts64(&time); + rtc_time64_to_tm(time.tv_sec, tm); + + return 0; +@@ -101,7 +101,7 @@ static int __maybe_unused meson_vrtc_suspend(struct device *dev) + long alarm_secs; + struct timespec64 time; + +- ktime_get_raw_ts64(&time); ++ ktime_get_real_ts64(&time); + local_time = time.tv_sec; + + dev_dbg(dev, "alarm_time = %lus, local_time=%lus\n", +-- +2.39.2 + diff --git a/queue-5.4/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch b/queue-5.4/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch new file mode 100644 index 00000000000..0013a5c631e --- /dev/null +++ b/queue-5.4/rtc-omap-include-header-for-omap_rtc_power_off_progr.patch @@ -0,0 +1,40 @@ +From 28426b625504035c48bb3b523fcd367aca5118e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Mar 2023 10:40:21 +0100 +Subject: rtc: omap: include header for omap_rtc_power_off_program prototype +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Kozlowski + +[ Upstream commit f69c2b5420497b7a54181ce170d682cbeb1f119f ] + +Non-static functions should have a prototype: + + drivers/rtc/rtc-omap.c:410:5: error: no previous prototype for ‘omap_rtc_power_off_program’ [-Werror=missing-prototypes] + +Fixes: 6256f7f7f217 ("rtc: OMAP: Add support for rtc-only mode") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230311094021.79730-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-omap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c +index a2941c875a064..bf502fcd60772 100644 +--- a/drivers/rtc/rtc-omap.c ++++ b/drivers/rtc/rtc-omap.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + /* + * The OMAP RTC is a year/month/day/hours/minutes/seconds BCD clock +-- +2.39.2 + diff --git a/queue-5.4/rtlwifi-replace-rt_trace-with-rtl_dbg.patch b/queue-5.4/rtlwifi-replace-rt_trace-with-rtl_dbg.patch new file mode 100644 index 00000000000..650a31ae223 --- /dev/null +++ b/queue-5.4/rtlwifi-replace-rt_trace-with-rtl_dbg.patch @@ -0,0 +1,2301 @@ +From 60a9dea6a3eb5d60066f379e88be058adf7aad61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 15:42:31 -0500 +Subject: rtlwifi: Replace RT_TRACE with rtl_dbg + +From: Larry Finger + +[ Upstream commit f108a420e50a62e0bc5cdcd7d4a2440986b526e3 ] + +The macro name RT_TRACE makes it seem that it is used for tracing, when +is actually used for debugging. Change the name to rtl_dbg. Any Sparse +errors exposed by this change were also fixed. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200723204244.24457-3-Larry.Finger@lwfinger.net +Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/base.c | 144 +++++----- + drivers/net/wireless/realtek/rtlwifi/cam.c | 82 +++--- + drivers/net/wireless/realtek/rtlwifi/core.c | 259 ++++++++--------- + drivers/net/wireless/realtek/rtlwifi/debug.c | 4 +- + drivers/net/wireless/realtek/rtlwifi/efuse.c | 72 ++--- + drivers/net/wireless/realtek/rtlwifi/pci.c | 282 +++++++++---------- + drivers/net/wireless/realtek/rtlwifi/ps.c | 98 +++---- + drivers/net/wireless/realtek/rtlwifi/regd.c | 18 +- + drivers/net/wireless/realtek/rtlwifi/usb.c | 18 +- + 9 files changed, 488 insertions(+), 489 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index c9ad6761032ae..8fb0b54738ca9 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -195,8 +195,8 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw, + } else { + if (get_rf_type(rtlphy) == RF_1T2R || + get_rf_type(rtlphy) == RF_2T2R) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "1T2R or 2T2R\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "1T2R or 2T2R\n"); + ht_cap->mcs.rx_mask[0] = 0xFF; + ht_cap->mcs.rx_mask[1] = 0xFF; + ht_cap->mcs.rx_mask[4] = 0x01; +@@ -204,7 +204,7 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw, + ht_cap->mcs.rx_highest = + cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS15); + } else if (get_rf_type(rtlphy) == RF_1T1R) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n"); + + ht_cap->mcs.rx_mask[0] = 0xFF; + ht_cap->mcs.rx_mask[1] = 0x00; +@@ -1324,7 +1324,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb) + rtlpriv->cfg->ops->chk_switch_dmdp(hw); + } + if (ieee80211_is_auth(fc)) { +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); + + mac->link_state = MAC80211_LINKING; + /* Dul mac */ +@@ -1385,7 +1385,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) + if (mac->act_scanning) + return false; + +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, + "%s ACT_ADDBAREQ From :%pM\n", + is_tx ? "Tx" : "Rx", hdr->addr2); + RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, "req\n", +@@ -1400,8 +1400,8 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) + rcu_read_lock(); + sta = rtl_find_sta(hw, hdr->addr3); + if (sta == NULL) { +- RT_TRACE(rtlpriv, COMP_SEND | COMP_RECV, +- DBG_DMESG, "sta is NULL\n"); ++ rtl_dbg(rtlpriv, COMP_SEND | COMP_RECV, ++ DBG_DMESG, "sta is NULL\n"); + rcu_read_unlock(); + return true; + } +@@ -1428,13 +1428,13 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx) + } + break; + case ACT_ADDBARSP: +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, +- "%s ACT_ADDBARSP From :%pM\n", +- is_tx ? "Tx" : "Rx", hdr->addr2); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ "%s ACT_ADDBARSP From :%pM\n", ++ is_tx ? "Tx" : "Rx", hdr->addr2); + break; + case ACT_DELBA: +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, +- "ACT_ADDBADEL From :%pM\n", hdr->addr2); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ "ACT_ADDBADEL From :%pM\n", hdr->addr2); + break; + } + break; +@@ -1519,9 +1519,9 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx, + /* 68 : UDP BOOTP client + * 67 : UDP BOOTP server + */ +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), +- DBG_DMESG, "dhcp %s !!\n", +- (is_tx) ? "Tx" : "Rx"); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), ++ DBG_DMESG, "dhcp %s !!\n", ++ (is_tx) ? "Tx" : "Rx"); + + if (is_tx) + setup_special_tx(rtlpriv, ppsc, +@@ -1540,8 +1540,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx, + rtlpriv->btcoexist.btc_info.in_4way = true; + rtlpriv->btcoexist.btc_info.in_4way_ts = jiffies; + +- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, +- "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx"); ++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG, ++ "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx"); + + if (is_tx) { + rtlpriv->ra.is_special_data = true; +@@ -1583,12 +1583,12 @@ static void rtl_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb, + info = IEEE80211_SKB_CB(skb); + ieee80211_tx_info_clear_status(info); + if (ack) { +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD, +- "tx report: ack\n"); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD, ++ "tx report: ack\n"); + info->flags |= IEEE80211_TX_STAT_ACK; + } else { +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD, +- "tx report: not ack\n"); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD, ++ "tx report: not ack\n"); + info->flags &= ~IEEE80211_TX_STAT_ACK; + } + ieee80211_tx_status_irqsafe(hw, skb); +@@ -1626,8 +1626,8 @@ static u16 rtl_get_tx_report_sn(struct ieee80211_hw *hw, + tx_report->last_sent_time = jiffies; + tx_info->sn = sn; + tx_info->send_time = tx_report->last_sent_time; +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG, +- "Send TX-Report sn=0x%X\n", sn); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG, ++ "Send TX-Report sn=0x%X\n", sn); + + return sn; + } +@@ -1674,9 +1674,9 @@ void rtl_tx_report_handler(struct ieee80211_hw *hw, u8 *tmp_buf, u8 c2h_cmd_len) + break; + } + } +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG, +- "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n", +- st, sn, retry); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG, ++ "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n", ++ st, sn, retry); + } + EXPORT_SYMBOL_GPL(rtl_tx_report_handler); + +@@ -1689,9 +1689,9 @@ bool rtl_check_tx_report_acked(struct ieee80211_hw *hw) + return true; + + if (time_before(tx_report->last_sent_time + 3 * HZ, jiffies)) { +- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_WARNING, +- "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n", +- tx_report->last_sent_sn, tx_report->last_recv_sn); ++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_WARNING, ++ "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n", ++ tx_report->last_sent_sn, tx_report->last_recv_sn); + return true; /* 3 sec. (timeout) seen as acked */ + } + +@@ -1707,8 +1707,8 @@ void rtl_wait_tx_report_acked(struct ieee80211_hw *hw, u32 wait_ms) + if (rtl_check_tx_report_acked(hw)) + break; + usleep_range(1000, 2000); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms); + } + } + +@@ -1770,9 +1770,9 @@ int rtl_tx_agg_start(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + return -ENXIO; + tid_data = &sta_entry->tids[tid]; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d seq:%d\n", sta->addr, tid, +- *ssn); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d seq:%d\n", sta->addr, tid, ++ *ssn); + + tid_data->agg.agg_state = RTL_AGG_START; + +@@ -1789,8 +1789,8 @@ int rtl_tx_agg_stop(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + if (sta == NULL) + return -EINVAL; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + if (unlikely(tid >= MAX_TID_COUNT)) + return -EINVAL; +@@ -1829,8 +1829,8 @@ int rtl_rx_agg_start(struct ieee80211_hw *hw, + return -ENXIO; + tid_data = &sta_entry->tids[tid]; + +- RT_TRACE(rtlpriv, COMP_RECV, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_RECV, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + tid_data->agg.rx_agg_state = RTL_RX_AGG_START; + return 0; +@@ -1845,8 +1845,8 @@ int rtl_rx_agg_stop(struct ieee80211_hw *hw, + if (sta == NULL) + return -EINVAL; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + if (unlikely(tid >= MAX_TID_COUNT)) + return -EINVAL; +@@ -1866,8 +1866,8 @@ int rtl_tx_agg_oper(struct ieee80211_hw *hw, + if (sta == NULL) + return -EINVAL; + +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, +- "on ra = %pM tid = %d\n", sta->addr, tid); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, ++ "on ra = %pM tid = %d\n", sta->addr, tid); + + if (unlikely(tid >= MAX_TID_COUNT)) + return -EINVAL; +@@ -1887,9 +1887,9 @@ void rtl_rx_ampdu_apply(struct rtl_priv *rtlpriv) + btc_ops->btc_get_ampdu_cfg(rtlpriv, &reject_agg, + &ctrl_agg_size, &agg_size); + +- RT_TRACE(rtlpriv, COMP_BT_COEXIST, DBG_DMESG, +- "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d", +- reject_agg, ctrl_agg_size, agg_size); ++ rtl_dbg(rtlpriv, COMP_BT_COEXIST, DBG_DMESG, ++ "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d", ++ reject_agg, ctrl_agg_size, agg_size); + + rtlpriv->hw->max_rx_aggregation_subframes = + (ctrl_agg_size ? agg_size : IEEE80211_MAX_AMPDU_BUF_HT); +@@ -1977,9 +1977,9 @@ void rtl_scan_list_expire(struct ieee80211_hw *hw) + list_del(&entry->list); + rtlpriv->scan_list.num--; + +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, +- "BSSID=%pM is expire in scan list (total=%d)\n", +- entry->bssid, rtlpriv->scan_list.num); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, ++ "BSSID=%pM is expire in scan list (total=%d)\n", ++ entry->bssid, rtlpriv->scan_list.num); + kfree(entry); + } + +@@ -2013,9 +2013,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) { + list_del_init(&entry->list); + entry_found = true; +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, +- "Update BSSID=%pM to scan list (total=%d)\n", +- hdr->addr3, rtlpriv->scan_list.num); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, ++ "Update BSSID=%pM to scan list (total=%d)\n", ++ hdr->addr3, rtlpriv->scan_list.num); + break; + } + } +@@ -2029,9 +2029,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb) + memcpy(entry->bssid, hdr->addr3, ETH_ALEN); + rtlpriv->scan_list.num++; + +- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD, +- "Add BSSID=%pM to scan list (total=%d)\n", +- hdr->addr3, rtlpriv->scan_list.num); ++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD, ++ "Add BSSID=%pM to scan list (total=%d)\n", ++ hdr->addr3, rtlpriv->scan_list.num); + } + + entry->age = jiffies; +@@ -2191,8 +2191,8 @@ void rtl_watchdog_wq_callback(void *data) + if ((rtlpriv->link_info.bcn_rx_inperiod + + rtlpriv->link_info.num_rx_inperiod) == 0) { + rtlpriv->link_info.roam_times++; +- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, +- "AP off for %d s\n", ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, ++ "AP off for %d s\n", + (rtlpriv->link_info.roam_times * 2)); + + /* if we can't recv beacon for 10s, +@@ -2305,11 +2305,11 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw, + + switch (cmd_id) { + case C2H_DBG: +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n"); + break; + case C2H_TXBF: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], C2H_TXBF!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], C2H_TXBF!!\n"); + break; + case C2H_TX_REPORT: + rtl_tx_report_handler(hw, cmd_buf, cmd_len); +@@ -2319,20 +2319,20 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw, + hal_ops->c2h_ra_report_handler(hw, cmd_buf, cmd_len); + break; + case C2H_BT_INFO: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], C2H_BT_INFO!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], C2H_BT_INFO!!\n"); + if (rtlpriv->cfg->ops->get_btc_status()) + btc_ops->btc_btinfo_notify(rtlpriv, cmd_buf, cmd_len); + break; + case C2H_BT_MP: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], C2H_BT_MP!!\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], C2H_BT_MP!!\n"); + if (rtlpriv->cfg->ops->get_btc_status()) + btc_ops->btc_btmpinfo_notify(rtlpriv, cmd_buf, cmd_len); + break; + default: +- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE, +- "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE, ++ "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id); + break; + } + } +@@ -2356,8 +2356,8 @@ void rtl_c2hcmd_launcher(struct ieee80211_hw *hw, int exec) + if (!skb) + break; + +- RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n", +- *((u8 *)skb->cb)); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n", ++ *((u8 *)skb->cb)); + RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_DMESG, + "C2H data: ", skb->data, skb->len); + +@@ -2702,29 +2702,29 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len) + (memcmp(mac->bssid, ap5_6, 3) == 0) || + vendor == PEER_ATH) { + vendor = PEER_ATH; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n"); + } else if ((memcmp(mac->bssid, ap4_4, 3) == 0) || + (memcmp(mac->bssid, ap4_5, 3) == 0) || + (memcmp(mac->bssid, ap4_1, 3) == 0) || + (memcmp(mac->bssid, ap4_2, 3) == 0) || + (memcmp(mac->bssid, ap4_3, 3) == 0) || + vendor == PEER_RAL) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n"); + vendor = PEER_RAL; + } else if (memcmp(mac->bssid, ap6_1, 3) == 0 || + vendor == PEER_CISCO) { + vendor = PEER_CISCO; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n"); + } else if ((memcmp(mac->bssid, ap3_1, 3) == 0) || + (memcmp(mac->bssid, ap3_2, 3) == 0) || + (memcmp(mac->bssid, ap3_3, 3) == 0) || + vendor == PEER_BROAD) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n"); + vendor = PEER_BROAD; + } else if (memcmp(mac->bssid, ap7_1, 3) == 0 || + vendor == PEER_MARV) { + vendor = PEER_MARV; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n"); + } + + mac->vendor = vendor; +diff --git a/drivers/net/wireless/realtek/rtlwifi/cam.c b/drivers/net/wireless/realtek/rtlwifi/cam.c +index bf0e0bb1f99ba..7aa28da39409b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/cam.c ++++ b/drivers/net/wireless/realtek/rtlwifi/cam.c +@@ -43,14 +43,14 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], + target_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE %x: %x\n", +- rtlpriv->cfg->maps[WCAMI], target_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "The Key ID is %d\n", entry_no); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE %x: %x\n", +- rtlpriv->cfg->maps[RWCAM], target_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE %x: %x\n", ++ rtlpriv->cfg->maps[WCAMI], target_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "The Key ID is %d\n", entry_no); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE %x: %x\n", ++ rtlpriv->cfg->maps[RWCAM], target_command); + + } else if (entry_i == 1) { + +@@ -64,10 +64,10 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], + target_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A4: %x\n", target_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A0: %x\n", target_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A4: %x\n", target_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A0: %x\n", target_command); + + } else { + +@@ -83,15 +83,15 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], + target_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A4: %x\n", target_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "WRITE A0: %x\n", target_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A4: %x\n", target_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "WRITE A0: %x\n", target_command); + } + } + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "after set key, usconfig:%x\n", us_config); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "after set key, usconfig:%x\n", us_config); + } + + u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr, +@@ -101,14 +101,14 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr, + u32 us_config; + struct rtl_priv *rtlpriv = rtl_priv(hw); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n", +- ul_entry_idx, ul_key_id, ul_enc_alg, +- ul_default_key, mac_addr); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n", ++ ul_entry_idx, ul_key_id, ul_enc_alg, ++ ul_default_key, mac_addr); + + if (ul_key_id == TOTAL_CAM_ENTRY) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "ulKeyId exceed!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "ulKeyId exceed!\n"); + return 0; + } + +@@ -120,7 +120,7 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr, + rtl_cam_program_entry(hw, ul_entry_idx, mac_addr, + (u8 *)key_content, us_config); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "end\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "end\n"); + + return 1; + +@@ -133,7 +133,7 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw, + u32 ul_command; + struct rtl_priv *rtlpriv = rtl_priv(hw); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id); + + ul_command = ul_key_id * CAM_CONTENT_COUNT; + ul_command = ul_command | BIT(31) | BIT(16); +@@ -141,10 +141,10 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw, + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], 0); + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_delete_one_entry(): WRITE A4: %x\n", 0); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_delete_one_entry(): WRITE A0: %x\n", ul_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A4: %x\n", __func__, 0); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A0: %x\n", __func__, ul_command); + + return 0; + +@@ -195,10 +195,10 @@ void rtl_cam_mark_invalid(struct ieee80211_hw *hw, u8 uc_index) + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content); + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_mark_invalid(): WRITE A4: %x\n", ul_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "rtl_cam_mark_invalid(): WRITE A0: %x\n", ul_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A4: %x\n", __func__, ul_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s: WRITE A0: %x\n", __func__, ul_command); + } + EXPORT_SYMBOL(rtl_cam_mark_invalid); + +@@ -245,12 +245,10 @@ void rtl_cam_empty_entry(struct ieee80211_hw *hw, u8 uc_index) + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content); + rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command); + +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "rtl_cam_empty_entry(): WRITE A4: %x\n", +- ul_content); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, +- "rtl_cam_empty_entry(): WRITE A0: %x\n", +- ul_command); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "%s: WRITE A4: %x\n", __func__, ul_content); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, ++ "%s: WRITE A0: %x\n", __func__, ul_command); + } + + } +@@ -313,8 +311,8 @@ void rtl_cam_del_entry(struct ieee80211_hw *hw, u8 *sta_addr) + /* Remove from HW Security CAM */ + eth_zero_addr(rtlpriv->sec.hwsec_cam_sta_addr[i]); + rtlpriv->sec.hwsec_cam_bitmap &= ~(BIT(0) << i); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "&&&&&&&&&del entry %d\n", i); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "&&&&&&&&&del entry %d\n", i); + } + } + return; +diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c +index f73e690bbe8e0..c4c89aade8fbc 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -76,8 +76,8 @@ static void rtl_fw_do_work(const struct firmware *firmware, void *context, + struct rtl_priv *rtlpriv = rtl_priv(hw); + int err; + +- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD, +- "Firmware callback routine entered!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, ++ "Firmware callback routine entered!\n"); + complete(&rtlpriv->firmware_loading_complete); + if (!firmware) { + if (rtlpriv->cfg->alt_fw_name) { +@@ -214,8 +214,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + u8 retry_limit = 0x30; + + if (mac->vif) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "vif has been set!! mac->vif = 0x%p\n", mac->vif); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "vif has been set!! mac->vif = 0x%p\n", mac->vif); + return -EOPNOTSUPP; + } + +@@ -230,16 +230,16 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + /*fall through*/ + case NL80211_IFTYPE_STATION: + if (mac->beacon_enabled == 1) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_STATION\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_STATION\n"); + mac->beacon_enabled = 0; + rtlpriv->cfg->ops->update_interrupt_mask(hw, 0, + rtlpriv->cfg->maps[RTL_IBSS_INT_MASKS]); + } + break; + case NL80211_IFTYPE_ADHOC: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_ADHOC\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_ADHOC\n"); + + mac->link_state = MAC80211_LINKED; + rtlpriv->cfg->ops->set_bcn_reg(hw); +@@ -256,8 +256,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + mac->p2p = P2P_ROLE_GO; + /*fall through*/ + case NL80211_IFTYPE_AP: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_AP\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_AP\n"); + + mac->link_state = MAC80211_LINKED; + rtlpriv->cfg->ops->set_bcn_reg(hw); +@@ -271,8 +271,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + retry_limit = 0x07; + break; + case NL80211_IFTYPE_MESH_POINT: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "NL80211_IFTYPE_MESH_POINT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "NL80211_IFTYPE_MESH_POINT\n"); + + mac->link_state = MAC80211_LINKED; + rtlpriv->cfg->ops->set_bcn_reg(hw); +@@ -293,8 +293,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw, + } + + if (mac->p2p) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "p2p role %x\n", vif->type); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "p2p role %x\n", vif->type); + mac->basic_rates = 0xff0;/*disable cck rate for p2p*/ + rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE, + (u8 *)(&mac->basic_rates)); +@@ -360,8 +360,8 @@ static int rtl_op_change_interface(struct ieee80211_hw *hw, + vif->type = new_type; + vif->p2p = p2p; + ret = rtl_op_add_interface(hw, vif); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "p2p %x\n", p2p); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "p2p %x\n", p2p); + return ret; + } + +@@ -435,8 +435,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw, + memset(mask, 0, MAX_WOL_BIT_MASK_SIZE); + if (patterns[i].pattern_len < 0 || + patterns[i].pattern_len > MAX_WOL_PATTERN_SIZE) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_WARNING, +- "Pattern[%d] is too long\n", i); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_WARNING, ++ "Pattern[%d] is too long\n", i); + continue; + } + pattern_os = patterns[i].pattern; +@@ -515,8 +515,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw, + "pattern to hw\n", content, len); + /* 3. calculate crc */ + rtl_pattern.crc = _calculate_wol_pattern_crc(content, len); +- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE, +- "CRC_Remainder = 0x%x\n", rtl_pattern.crc); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE, ++ "CRC_Remainder = 0x%x\n", rtl_pattern.crc); + + /* 4. write crc & mask_for_hw to hw */ + rtlpriv->cfg->ops->add_wowlan_pattern(hw, &rtl_pattern, i); +@@ -531,7 +531,7 @@ static int rtl_op_suspend(struct ieee80211_hw *hw, + struct rtl_hal *rtlhal = rtl_hal(rtlpriv); + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); + if (WARN_ON(!wow)) + return -EINVAL; + +@@ -557,7 +557,7 @@ static int rtl_op_resume(struct ieee80211_hw *hw) + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + time64_t now; + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n"); + rtlhal->driver_is_goingto_unload = false; + rtlhal->enter_pnp_sleep = false; + rtlhal->wake_from_pnp_sleep = true; +@@ -588,8 +588,8 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed) + + mutex_lock(&rtlpriv->locks.conf_mutex); + if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) { /* BIT(2)*/ +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n"); + } + + /*For IPS */ +@@ -632,9 +632,9 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed) + } + + if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n", +- hw->conf.long_frame_max_tx_count); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n", ++ hw->conf.long_frame_max_tx_count); + /* brought up everything changes (changed == ~0) indicates first + * open, so use our default value instead of that of wiphy. + */ +@@ -809,13 +809,13 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (*new_flags & FIF_ALLMULTI) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AM] | + rtlpriv->cfg->maps[MAC_RCR_AB]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive multicast frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive multicast frame\n"); + } else { + mac->rx_conf &= ~(rtlpriv->cfg->maps[MAC_RCR_AM] | + rtlpriv->cfg->maps[MAC_RCR_AB]); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive multicast frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive multicast frame\n"); + } + update_rcr = true; + } +@@ -823,12 +823,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (changed_flags & FIF_FCSFAIL) { + if (*new_flags & FIF_FCSFAIL) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACRC32]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive FCS error frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive FCS error frame\n"); + } else { + mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACRC32]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive FCS error frame\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive FCS error frame\n"); + } + if (!update_rcr) + update_rcr = true; +@@ -855,12 +855,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (*new_flags & FIF_CONTROL) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACF]; + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive control frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive control frame.\n"); + } else { + mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACF]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive control frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive control frame.\n"); + } + if (!update_rcr) + update_rcr = true; +@@ -869,12 +869,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw, + if (changed_flags & FIF_OTHER_BSS) { + if (*new_flags & FIF_OTHER_BSS) { + mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AAP]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Enable receive other BSS's frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Enable receive other BSS's frame.\n"); + } else { + mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_AAP]; +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "Disable receive other BSS's frame.\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "Disable receive other BSS's frame.\n"); + } + if (!update_rcr) + update_rcr = true; +@@ -923,7 +923,7 @@ static int rtl_op_sta_add(struct ieee80211_hw *hw, + sta->supp_rates[0] &= 0xfffffff0; + + memcpy(sta_entry->mac_addr, sta->addr, ETH_ALEN); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, + "Add sta addr is %pM\n", sta->addr); + rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0, true); + } +@@ -939,8 +939,8 @@ static int rtl_op_sta_remove(struct ieee80211_hw *hw, + struct rtl_sta_info *sta_entry; + + if (sta) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "Remove sta addr is %pM\n", sta->addr); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "Remove sta addr is %pM\n", sta->addr); + sta_entry = (struct rtl_sta_info *)sta->drv_priv; + sta_entry->wireless_mode = 0; + sta_entry->ratr_index = 0; +@@ -988,8 +988,8 @@ static int rtl_op_conf_tx(struct ieee80211_hw *hw, + int aci; + + if (queue >= AC_MAX) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "queue number %d is incorrect!\n", queue); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "queue number %d is incorrect!\n", queue); + return -EINVAL; + } + +@@ -1034,8 +1034,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + (changed & BSS_CHANGED_BEACON_ENABLED && + bss_conf->enable_beacon)) { + if (mac->beacon_enabled == 0) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "BSS_CHANGED_BEACON_ENABLED\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "BSS_CHANGED_BEACON_ENABLED\n"); + + /*start hw beacon interrupt. */ + /*rtlpriv->cfg->ops->set_bcn_reg(hw); */ +@@ -1052,8 +1052,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + if ((changed & BSS_CHANGED_BEACON_ENABLED && + !bss_conf->enable_beacon)) { + if (mac->beacon_enabled == 1) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "ADHOC DISABLE BEACON\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "ADHOC DISABLE BEACON\n"); + + mac->beacon_enabled = 0; + rtlpriv->cfg->ops->update_interrupt_mask(hw, 0, +@@ -1062,8 +1062,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } + } + if (changed & BSS_CHANGED_BEACON_INT) { +- RT_TRACE(rtlpriv, COMP_BEACON, DBG_TRACE, +- "BSS_CHANGED_BEACON_INT\n"); ++ rtl_dbg(rtlpriv, COMP_BEACON, DBG_TRACE, ++ "BSS_CHANGED_BEACON_INT\n"); + mac->beacon_interval = bss_conf->beacon_int; + rtlpriv->cfg->ops->set_bcn_intv(hw); + } +@@ -1102,8 +1102,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + rcu_read_unlock(); + goto out; + } +- RT_TRACE(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD, +- "send PS STATIC frame\n"); ++ rtl_dbg(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD, ++ "send PS STATIC frame\n"); + if (rtlpriv->dm.supp_phymode_switch) { + if (sta->ht_cap.ht_supported) + rtl_send_smps_action(hw, sta, +@@ -1143,8 +1143,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + HW_VAR_KEEP_ALIVE, + (u8 *)(&keep_alive)); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "BSS_CHANGED_ASSOC\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "BSS_CHANGED_ASSOC\n"); + } else { + struct cfg80211_bss *bss = NULL; + +@@ -1161,14 +1161,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + IEEE80211_BSS_TYPE_ESS, + IEEE80211_PRIVACY_OFF); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "bssid = %pMF\n", mac->bssid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "bssid = %pMF\n", mac->bssid); + + if (bss) { + cfg80211_unlink_bss(hw->wiphy, bss); + cfg80211_put_bss(hw->wiphy, bss); +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "cfg80211_unlink !!\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "cfg80211_unlink !!\n"); + } + + eth_zero_addr(mac->bssid); +@@ -1179,8 +1179,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + if (rtlpriv->cfg->ops->chk_switch_dmdp) + rtlpriv->cfg->ops->chk_switch_dmdp(hw); + } +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "BSS_CHANGED_UN_ASSOC\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "BSS_CHANGED_UN_ASSOC\n"); + } + rtlpriv->cfg->ops->set_network_type(hw, vif->type); + /* For FW LPS: +@@ -1198,14 +1198,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } + + if (changed & BSS_CHANGED_ERP_CTS_PROT) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "BSS_CHANGED_ERP_CTS_PROT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "BSS_CHANGED_ERP_CTS_PROT\n"); + mac->use_cts_protect = bss_conf->use_cts_prot; + } + + if (changed & BSS_CHANGED_ERP_PREAMBLE) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, +- "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n", ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, ++ "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n", + bss_conf->use_short_preamble); + + mac->short_preamble = bss_conf->use_short_preamble; +@@ -1214,8 +1214,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + } + + if (changed & BSS_CHANGED_ERP_SLOT) { +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "BSS_CHANGED_ERP_SLOT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "BSS_CHANGED_ERP_SLOT\n"); + + if (bss_conf->use_short_slot) + mac->slot_time = RTL_SLOT_TIME_9; +@@ -1229,8 +1229,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + if (changed & BSS_CHANGED_HT) { + struct ieee80211_sta *sta = NULL; + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "BSS_CHANGED_HT\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "BSS_CHANGED_HT\n"); + + rcu_read_lock(); + sta = ieee80211_find_sta(vif, (u8 *)bss_conf->bssid); +@@ -1261,8 +1261,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, + rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BSSID, + (u8 *)bss_conf->bssid); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG, +- "bssid: %pM\n", bss_conf->bssid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG, ++ "bssid: %pM\n", bss_conf->bssid); + + mac->vendor = PEER_UNKNOWN; + memcpy(mac->bssid, bss_conf->bssid, ETH_ALEN); +@@ -1393,27 +1393,27 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw, + + switch (action) { + case IEEE80211_AMPDU_TX_START: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_TX_START: TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_TX_START: TID:%d\n", tid); + return rtl_tx_agg_start(hw, vif, sta, tid, ssn); + case IEEE80211_AMPDU_TX_STOP_CONT: + case IEEE80211_AMPDU_TX_STOP_FLUSH: + case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid); + return rtl_tx_agg_stop(hw, vif, sta, tid); + case IEEE80211_AMPDU_TX_OPERATIONAL: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid); + rtl_tx_agg_oper(hw, sta, tid); + break; + case IEEE80211_AMPDU_RX_START: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_RX_START:TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_RX_START:TID:%d\n", tid); + return rtl_rx_agg_start(hw, sta, tid); + case IEEE80211_AMPDU_RX_STOP: +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE, +- "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE, ++ "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid); + return rtl_rx_agg_stop(hw, sta, tid); + default: + pr_err("IEEE80211_AMPDU_ERR!!!!:\n"); +@@ -1429,7 +1429,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw, + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); + mac->act_scanning = true; + if (rtlpriv->link_info.higher_busytraffic) { + mac->skip_scan = true; +@@ -1467,7 +1467,7 @@ static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw, + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); + +- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n"); + mac->act_scanning = false; + mac->skip_scan = false; + +@@ -1517,8 +1517,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + rtlpriv->btcoexist.btc_info.in_4way = false; + + if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "not open hw encryption\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "not open hw encryption\n"); + return -ENOSPC; /*User disabled HW-crypto */ + } + /* To support IBSS, use sw-crypto for GTK */ +@@ -1526,10 +1526,10 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + vif->type == NL80211_IFTYPE_MESH_POINT) && + !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) + return -ENOSPC; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "%s hardware based encryption for keyidx: %d, mac: %pM\n", +- cmd == SET_KEY ? "Using" : "Disabling", key->keyidx, +- sta ? sta->addr : bcast_addr); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "%s hardware based encryption for keyidx: %d, mac: %pM\n", ++ cmd == SET_KEY ? "Using" : "Disabling", key->keyidx, ++ sta ? sta->addr : bcast_addr); + rtlpriv->sec.being_setkey = true; + rtl_ips_nic_on(hw); + mutex_lock(&rtlpriv->locks.conf_mutex); +@@ -1538,28 +1538,28 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + switch (key->cipher) { + case WLAN_CIPHER_SUITE_WEP40: + key_type = WEP40_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n"); + break; + case WLAN_CIPHER_SUITE_WEP104: +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n"); + key_type = WEP104_ENCRYPTION; + break; + case WLAN_CIPHER_SUITE_TKIP: + key_type = TKIP_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n"); + break; + case WLAN_CIPHER_SUITE_CCMP: + key_type = AESCCMP_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n"); + break; + case WLAN_CIPHER_SUITE_AES_CMAC: + /* HW don't support CMAC encryption, + * use software CMAC encryption + */ + key_type = AESCMAC_ENCRYPTION; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n"); +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "HW don't support CMAC encryption, use software CMAC encryption\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "HW don't support CMAC encryption, use software CMAC encryption\n"); + err = -EOPNOTSUPP; + goto out_unlock; + default: +@@ -1605,9 +1605,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + key_type == WEP104_ENCRYPTION)) + wep_only = true; + rtlpriv->sec.pairwise_enc_algorithm = key_type; +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n", +- key_type); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n", ++ key_type); + rtlpriv->cfg->ops->enable_hw_sec(hw); + } + } +@@ -1615,8 +1615,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + switch (cmd) { + case SET_KEY: + if (wep_only) { +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set WEP(group/pairwise) key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set WEP(group/pairwise) key\n"); + /* Pairwise key with an assigned MAC address. */ + rtlpriv->sec.pairwise_enc_algorithm = key_type; + rtlpriv->sec.group_enc_algorithm = key_type; +@@ -1626,8 +1626,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + rtlpriv->sec.key_len[key_idx] = key->keylen; + eth_zero_addr(mac_addr); + } else if (group_key) { /* group key */ +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set group key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set group key\n"); + /* group key */ + rtlpriv->sec.group_enc_algorithm = key_type; + /*set local buf about group key. */ +@@ -1636,8 +1636,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + rtlpriv->sec.key_len[key_idx] = key->keylen; + memcpy(mac_addr, bcast_addr, ETH_ALEN); + } else { /* pairwise key */ +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "set pairwise key\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "set pairwise key\n"); + if (!sta) { + WARN_ONCE(true, + "rtlwifi: pairwise key without mac_addr\n"); +@@ -1669,8 +1669,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX; + break; + case DISABLE_KEY: +- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, +- "disable key delete one entry\n"); ++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, ++ "disable key delete one entry\n"); + /*set local buf about wep key. */ + if (vif->type == NL80211_IFTYPE_AP || + vif->type == NL80211_IFTYPE_MESH_POINT) { +@@ -1718,9 +1718,9 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw) + if (unlikely(radio_state != rtlpriv->rfkill.rfkill_state)) { + rtlpriv->rfkill.rfkill_state = radio_state; + +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "wireless radio switch turned %s\n", +- radio_state ? "on" : "off"); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "wireless radio switch turned %s\n", ++ radio_state ? "on" : "off"); + + blocked = (rtlpriv->rfkill.rfkill_state == 1) ? 0 : 1; + wiphy_rfkill_set_hw_state(hw->wiphy, blocked); +@@ -1765,26 +1765,27 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + + do { + cfg_cmd = pwrcfgcmd[ary_idx]; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "rtl_hal_pwrseqcmdparsing(): offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n", +- GET_PWR_CFG_OFFSET(cfg_cmd), +- GET_PWR_CFG_CUT_MASK(cfg_cmd), +- GET_PWR_CFG_FAB_MASK(cfg_cmd), +- GET_PWR_CFG_INTF_MASK(cfg_cmd), +- GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd), +- GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd)); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s: offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n", ++ __func__, ++ GET_PWR_CFG_OFFSET(cfg_cmd), ++ GET_PWR_CFG_CUT_MASK(cfg_cmd), ++ GET_PWR_CFG_FAB_MASK(cfg_cmd), ++ GET_PWR_CFG_INTF_MASK(cfg_cmd), ++ GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd), ++ GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd)); + + if ((GET_PWR_CFG_FAB_MASK(cfg_cmd)&faversion) && + (GET_PWR_CFG_CUT_MASK(cfg_cmd)&cut_version) && + (GET_PWR_CFG_INTF_MASK(cfg_cmd)&interface_type)) { + switch (GET_PWR_CFG_CMD(cfg_cmd)) { + case PWR_CMD_READ: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, + "rtl_hal_pwrseqcmdparsing(): PWR_CMD_READ\n"); + break; + case PWR_CMD_WRITE: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "%s(): PWR_CMD_WRITE\n", __func__); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s(): PWR_CMD_WRITE\n", __func__); + offset = GET_PWR_CFG_OFFSET(cfg_cmd); + + /*Read the value from system register*/ +@@ -1797,7 +1798,7 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + rtl_write_byte(rtlpriv, offset, value); + break; + case PWR_CMD_POLLING: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, + "rtl_hal_pwrseqcmdparsing(): PWR_CMD_POLLING\n"); + polling_bit = false; + offset = GET_PWR_CFG_OFFSET(cfg_cmd); +@@ -1818,8 +1819,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + } while (!polling_bit); + break; + case PWR_CMD_DELAY: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_DELAY\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s: PWR_CMD_DELAY\n", __func__); + if (GET_PWR_CFG_VALUE(cfg_cmd) == + PWRSEQ_DELAY_US) + udelay(GET_PWR_CFG_OFFSET(cfg_cmd)); +@@ -1827,8 +1828,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version, + mdelay(GET_PWR_CFG_OFFSET(cfg_cmd)); + break; + case PWR_CMD_END: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, +- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_END\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, ++ "%s: PWR_CMD_END\n", __func__); + return true; + default: + WARN_ONCE(true, +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index ec0da33da4f89..a7a5d8fa3cc0c 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -404,8 +404,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + &path, &addr, &bitmask, &data); + + if (num != 4) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, +- "Format is \n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, ++ "Format is \n"); + return count; + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c +index 264667203f6f1..305d438180187 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c ++++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c +@@ -120,8 +120,8 @@ void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value) + const u32 efuse_len = + rtlpriv->cfg->maps[EFUSE_REAL_CONTENT_SIZE]; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n", +- address, value); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n", ++ address, value); + + if (address < efuse_len) { + rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL], value); +@@ -211,9 +211,9 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf) + u8 efuse_usage; + + if ((_offset + _size_byte) > rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]) { +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "read_efuse(): Invalid offset(%#x) with read bytes(%#x)!!\n", +- _offset, _size_byte); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "%s: Invalid offset(%#x) with read bytes(%#x)!!\n", ++ __func__, _offset, _size_byte); + return; + } + +@@ -376,9 +376,9 @@ bool efuse_shadow_update_chk(struct ieee80211_hw *hw) + (EFUSE_MAX_SIZE - rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) + result = false; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "efuse_shadow_update_chk(): totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n", +- totalbytes, hdr_num, words_need, efuse_used); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "%s: totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n", ++ __func__, totalbytes, hdr_num, words_need, efuse_used); + + return result; + } +@@ -416,7 +416,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + u8 word_en = 0x0F; + u8 first_pg = false; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); + + if (!efuse_shadow_update_chk(hw)) { + efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]); +@@ -424,8 +424,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + &rtlefuse->efuse_map[EFUSE_INIT_MAP][0], + rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]); + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "efuse out of capacity!!\n"); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "efuse out of capacity!!\n"); + return false; + } + efuse_power_switch(hw, true, true); +@@ -464,8 +464,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + + if (!efuse_pg_packet_write(hw, (u8) offset, word_en, + tmpdata)) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "PG section(%#x) fail!!\n", offset); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "PG section(%#x) fail!!\n", offset); + break; + } + } +@@ -478,7 +478,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw) + &rtlefuse->efuse_map[EFUSE_INIT_MAP][0], + rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]); + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n"); + return true; + } + +@@ -616,8 +616,8 @@ static int efuse_one_byte_write(struct ieee80211_hw *hw, u16 addr, u8 data) + struct rtl_priv *rtlpriv = rtl_priv(hw); + u8 tmpidx = 0; + +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "Addr = %x Data=%x\n", addr, data); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "Addr = %x Data=%x\n", addr, data); + + rtl_write_byte(rtlpriv, + rtlpriv->cfg->maps[EFUSE_CTRL] + 1, (u8) (addr & 0xff)); +@@ -997,8 +997,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw, + + if (efuse_addr >= (EFUSE_MAX_SIZE - + rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) { +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "efuse_addr(%#x) Out of size!!\n", efuse_addr); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "efuse_addr(%#x) Out of size!!\n", efuse_addr); + } + + return true; +@@ -1038,8 +1038,8 @@ static u8 enable_efuse_data_write(struct ieee80211_hw *hw, + u8 tmpdata[8]; + + memset(tmpdata, 0xff, PGPKT_DATA_SIZE); +- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, +- "word_en = %x efuse_addr=%x\n", word_en, efuse_addr); ++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, ++ "word_en = %x efuse_addr=%x\n", word_en, efuse_addr); + + if (!(word_en & BIT(0))) { + tmpaddr = start_addr; +@@ -1242,11 +1242,11 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv, + + eeprom_id = *((u16 *)&hwinfo[0]); + if (eeprom_id != params[0]) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "EEPROM ID(%#x) is invalid!!\n", eeprom_id); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "EEPROM ID(%#x) is invalid!!\n", eeprom_id); + rtlefuse->autoload_failflag = true; + } else { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n"); + rtlefuse->autoload_failflag = false; + } + +@@ -1257,30 +1257,30 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv, + rtlefuse->eeprom_did = *(u16 *)&hwinfo[params[2]]; + rtlefuse->eeprom_svid = *(u16 *)&hwinfo[params[3]]; + rtlefuse->eeprom_smid = *(u16 *)&hwinfo[params[4]]; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROMId = 0x%4x\n", eeprom_id); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROMId = 0x%4x\n", eeprom_id); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid); + + for (i = 0; i < 6; i += 2) { + usvalue = *(u16 *)&hwinfo[params[5] + i]; + *((u16 *)(&rtlefuse->dev_addr[i])) = usvalue; + } +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr); + + rtlefuse->eeprom_channelplan = *&hwinfo[params[6]]; + rtlefuse->eeprom_version = *(u16 *)&hwinfo[params[7]]; + rtlefuse->txpwr_fromeprom = true; + rtlefuse->eeprom_oemid = *&hwinfo[params[8]]; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid); + + /* set channel plan to world wide 13 */ + rtlefuse->channel_plan = params[9]; +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 25335bd2873b6..9006aa4446b3b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -204,8 +204,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw) + return; + + if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE, +- "PCI(Bridge) UNKNOWN\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE, ++ "PCI(Bridge) UNKNOWN\n"); + + return; + } +@@ -254,8 +254,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) + return; + + if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE, +- "PCI(Bridge) UNKNOWN\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE, ++ "PCI(Bridge) UNKNOWN\n"); + return; + } + +@@ -271,10 +271,10 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw) + pci_write_config_byte(rtlpci->pdev, (num4bytes << 2), + u_pcibridge_aspmsetting); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "PlatformEnableASPM(): Write reg[%x] = %x\n", +- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10), +- u_pcibridge_aspmsetting); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "PlatformEnableASPM(): Write reg[%x] = %x\n", ++ (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10), ++ u_pcibridge_aspmsetting); + + udelay(50); + +@@ -331,11 +331,11 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list, + list) { + tpcipriv = (struct rtl_pci_priv *)tpriv->priv; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "pcipriv->ndis_adapter.funcnumber %x\n", ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "pcipriv->ndis_adapter.funcnumber %x\n", + pcipriv->ndis_adapter.funcnumber); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "tpcipriv->ndis_adapter.funcnumber %x\n", ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "tpcipriv->ndis_adapter.funcnumber %x\n", + tpcipriv->ndis_adapter.funcnumber); + + if (pcipriv->ndis_adapter.busnumber == +@@ -350,8 +350,8 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw, + } + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "find_buddy_priv %d\n", find_buddy_priv); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "find_buddy_priv %d\n", find_buddy_priv); + + if (find_buddy_priv) + *buddy_priv = tpriv; +@@ -388,8 +388,8 @@ static void rtl_pci_parse_configuration(struct pci_dev *pdev, + pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &linkctrl_reg); + pcipriv->ndis_adapter.linkctrl_reg = (u8)linkctrl_reg; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n", +- pcipriv->ndis_adapter.linkctrl_reg); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n", ++ pcipriv->ndis_adapter.linkctrl_reg); + + pci_read_config_byte(pdev, 0x98, &tmp); + tmp |= BIT(4); +@@ -557,11 +557,11 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio) + if (rtlpriv->rtlhal.earlymode_enable) + skb_pull(skb, EM_HDR_LEN); + +- RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE, +- "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n", +- ring->idx, +- skb_queue_len(&ring->queue), +- *(u16 *)(skb->data + 22)); ++ rtl_dbg(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE, ++ "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n", ++ ring->idx, ++ skb_queue_len(&ring->queue), ++ *(u16 *)(skb->data + 22)); + + if (prio == TXCMD_QUEUE) { + dev_kfree_skb(skb); +@@ -608,10 +608,10 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio) + } + + if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG, +- "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n", +- prio, ring->idx, +- skb_queue_len(&ring->queue)); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, ++ "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n", ++ prio, ring->idx, ++ skb_queue_len(&ring->queue)); + + ieee80211_wake_queue(hw, skb_get_queue_mapping(skb)); + } +@@ -801,9 +801,9 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw) + skb_reserve(skb, stats.rx_drvinfo_size + + stats.rx_bufshift); + } else { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "skb->end - skb->tail = %d, len is %d\n", +- skb->end - skb->tail, len); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "skb->end - skb->tail = %d, len is %d\n", ++ skb->end - skb->tail, len); + dev_kfree_skb_any(skb); + goto new_trx_end; + } +@@ -925,67 +925,67 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + + /*<1> beacon related */ + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDOK]) +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "beacon ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "beacon ok interrupt!\n"); + + if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDER])) +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "beacon err interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "beacon err interrupt!\n"); + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BDOK]) +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n"); + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BCNINT]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "prepare beacon for interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "prepare beacon for interrupt!\n"); + tasklet_schedule(&rtlpriv->works.irq_prepare_bcn_tasklet); + } + + /*<2> Tx related */ + if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_TXFOVW])) +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n"); + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_MGNTDOK]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "Manage ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "Manage ok interrupt!\n"); + _rtl_pci_tx_isr(hw, MGNT_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_HIGHDOK]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "HIGH_QUEUE ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "HIGH_QUEUE ok interrupt!\n"); + _rtl_pci_tx_isr(hw, HIGH_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BKDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "BK Tx OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "BK Tx OK interrupt!\n"); + _rtl_pci_tx_isr(hw, BK_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BEDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "BE TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "BE TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, BE_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VIDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "VI TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "VI TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, VI_QUEUE); + } + + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VODOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "Vo TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "Vo TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, VO_QUEUE); + } + +@@ -993,8 +993,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + if (intvec.intd & rtlpriv->cfg->maps[RTL_IMR_H2CDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "H2C TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "H2C TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, H2C_QUEUE); + } + } +@@ -1003,34 +1003,34 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_COMDOK]) { + rtlpriv->link_info.num_tx_inperiod++; + +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "CMD TX OK interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "CMD TX OK interrupt!\n"); + _rtl_pci_tx_isr(hw, TXCMD_QUEUE); + } + } + + /*<3> Rx related */ + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_ROK]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n"); + _rtl_pci_rx_interrupt(hw); + } + + if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_RDU])) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "rx descriptor unavailable!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "rx descriptor unavailable!\n"); + _rtl_pci_rx_interrupt(hw); + } + + if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_RXFOVW])) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n"); + _rtl_pci_rx_interrupt(hw); + } + + /*<4> fw related*/ + if (rtlhal->hw_type == HARDWARE_TYPE_RTL8723AE) { + if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_C2HCMD]) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "firmware interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "firmware interrupt!\n"); + queue_delayed_work(rtlpriv->works.rtl_wq, + &rtlpriv->works.fwevt_wq, 0); + } +@@ -1046,8 +1046,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id) + rtlhal->hw_type == HARDWARE_TYPE_RTL8723BE) { + if (unlikely(intvec.inta & + rtlpriv->cfg->maps[RTL_IMR_HSISR_IND])) { +- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, +- "hsisr interrupt!\n"); ++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, ++ "hsisr interrupt!\n"); + _rtl_pci_hs_interrupt(hw); + } + } +@@ -1251,8 +1251,8 @@ static int _rtl_pci_init_tx_ring(struct ieee80211_hw *hw, + rtlpci->tx_ring[prio].entries = entries; + skb_queue_head_init(&rtlpci->tx_ring[prio].queue); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n", +- prio, desc); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n", ++ prio, desc); + + /* init every desc in this ring */ + if (!rtlpriv->use_new_trx_flow) { +@@ -1649,10 +1649,10 @@ static int rtl_pci_tx(struct ieee80211_hw *hw, + true, HW_DESC_OWN); + + if (own == 1 && hw_queue != BEACON_QUEUE) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", +- hw_queue, ring->idx, idx, +- skb_queue_len(&ring->queue)); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", ++ hw_queue, ring->idx, idx, ++ skb_queue_len(&ring->queue)); + + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, + flags); +@@ -1662,8 +1662,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw, + + if (rtlpriv->cfg->ops->get_available_desc && + rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "get_available_desc fail\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "get_available_desc fail\n"); + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); + return skb->len; + } +@@ -1686,8 +1686,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw, + + if ((ring->entries - skb_queue_len(&ring->queue)) < 2 && + hw_queue != BEACON_QUEUE) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD, +- "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD, ++ "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n", + hw_queue, ring->idx, idx, + skb_queue_len(&ring->queue)); + +@@ -1794,8 +1794,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw) + + err = rtlpriv->cfg->ops->hw_init(hw); + if (err) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "Failed to config hardware!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "Failed to config hardware!\n"); + kfree(rtlpriv->btcoexist.btc_context); + kfree(rtlpriv->btcoexist.wifi_only_context); + return err; +@@ -1804,7 +1804,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw) + &rtlmac->retry_long); + + rtlpriv->cfg->ops->enable_interrupt(hw); +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n"); + + rtl_init_rx_config(hw); + +@@ -1815,7 +1815,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw) + + rtlpci->up_first_time = false; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__); + return 0; + } + +@@ -1909,71 +1909,71 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + deviceid == RTL_PCI_8171_DID) { + switch (revisionid) { + case RTL_PCI_REVISION_ID_8192PCIE: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192 PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192 PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + rtlhal->hw_type = HARDWARE_TYPE_RTL8192E; + return false; + case RTL_PCI_REVISION_ID_8192SE: +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192SE is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192SE is found - vid/did=%x/%x\n", ++ venderid, deviceid); + rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE; + break; + default: +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "Err: Unknown device - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "Err: Unknown device - vid/did=%x/%x\n", ++ venderid, deviceid); + rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE; + break; + } + } else if (deviceid == RTL_PCI_8723AE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8723AE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8723AE PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8723AE PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + } else if (deviceid == RTL_PCI_8192CET_DID || + deviceid == RTL_PCI_8192CE_DID || + deviceid == RTL_PCI_8191CE_DID || + deviceid == RTL_PCI_8188CE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8192CE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192C PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192C PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + } else if (deviceid == RTL_PCI_8192DE_DID || + deviceid == RTL_PCI_8192DE_DID2) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8192DE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "8192D PCI-E is found - vid/did=%x/%x\n", +- venderid, deviceid); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "8192D PCI-E is found - vid/did=%x/%x\n", ++ venderid, deviceid); + } else if (deviceid == RTL_PCI_8188EE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8188EE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8188EE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8188EE\n"); + } else if (deviceid == RTL_PCI_8723BE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8723BE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8723BE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8723BE\n"); + } else if (deviceid == RTL_PCI_8192EE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8192EE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8192EE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8192EE\n"); + } else if (deviceid == RTL_PCI_8821AE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8821AE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8821AE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8821AE\n"); + } else if (deviceid == RTL_PCI_8812AE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8812AE; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8812AE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8812AE\n"); + } else if (deviceid == RTL_PCI_8822BE_DID) { + rtlhal->hw_type = HARDWARE_TYPE_RTL8822BE; + rtlhal->bandset = BAND_ON_BOTH; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find adapter, Hardware type is 8822BE\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find adapter, Hardware type is 8822BE\n"); + } else { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "Err: Unknown device - vid/did=%x/%x\n", ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "Err: Unknown device - vid/did=%x/%x\n", + venderid, deviceid); + + rtlhal->hw_type = RTL_DEFAULT_HARDWARE_TYPE; +@@ -1982,17 +1982,17 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192DE) { + if (revisionid == 0 || revisionid == 1) { + if (revisionid == 0) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find 92DE MAC0\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find 92DE MAC0\n"); + rtlhal->interfaceindex = 0; + } else if (revisionid == 1) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Find 92DE MAC1\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Find 92DE MAC1\n"); + rtlhal->interfaceindex = 1; + } + } else { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n", ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n", + venderid, deviceid, revisionid); + rtlhal->interfaceindex = 0; + } +@@ -2026,9 +2026,9 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) { + if (bridge_pdev->vendor == pcibridge_vendors[tmp]) { + pcipriv->ndis_adapter.pcibridge_vendor = tmp; +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "Pci Bridge Vendor is found index: %d\n", +- tmp); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "Pci Bridge Vendor is found index: %d\n", ++ tmp); + break; + } + } +@@ -2056,22 +2056,22 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev, + } + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n", +- pcipriv->ndis_adapter.busnumber, +- pcipriv->ndis_adapter.devnumber, +- pcipriv->ndis_adapter.funcnumber, +- pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n", ++ pcipriv->ndis_adapter.busnumber, ++ pcipriv->ndis_adapter.devnumber, ++ pcipriv->ndis_adapter.funcnumber, ++ pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg); + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n", +- pcipriv->ndis_adapter.pcibridge_busnum, +- pcipriv->ndis_adapter.pcibridge_devnum, +- pcipriv->ndis_adapter.pcibridge_funcnum, +- pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor], +- pcipriv->ndis_adapter.pcibridge_pciehdr_offset, +- pcipriv->ndis_adapter.pcibridge_linkctrlreg, +- pcipriv->ndis_adapter.amd_l1_patch); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n", ++ pcipriv->ndis_adapter.pcibridge_busnum, ++ pcipriv->ndis_adapter.pcibridge_devnum, ++ pcipriv->ndis_adapter.pcibridge_funcnum, ++ pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor], ++ pcipriv->ndis_adapter.pcibridge_pciehdr_offset, ++ pcipriv->ndis_adapter.pcibridge_linkctrlreg, ++ pcipriv->ndis_adapter.amd_l1_patch); + + rtl_pci_parse_configuration(pdev, hw); + list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list); +@@ -2099,8 +2099,8 @@ static int rtl_pci_intr_mode_msi(struct ieee80211_hw *hw) + + rtlpci->using_msi = true; + +- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, +- "MSI Interrupt Mode!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, ++ "MSI Interrupt Mode!\n"); + return 0; + } + +@@ -2117,8 +2117,8 @@ static int rtl_pci_intr_mode_legacy(struct ieee80211_hw *hw) + return ret; + + rtlpci->using_msi = false; +- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, +- "Pin-based Interrupt Mode!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG, ++ "Pin-based Interrupt Mode!\n"); + return 0; + } + +@@ -2245,10 +2245,10 @@ int rtl_pci_probe(struct pci_dev *pdev, + goto fail2; + } + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n", +- pmem_start, pmem_len, pmem_flags, +- rtlpriv->io.pci_mem_start); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n", ++ pmem_start, pmem_len, pmem_flags, ++ rtlpriv->io.pci_mem_start); + + /* Disable Clk Request */ + pci_write_config_byte(pdev, 0x81, 0); +@@ -2310,9 +2310,9 @@ int rtl_pci_probe(struct pci_dev *pdev, + rtlpci = rtl_pcidev(pcipriv); + err = rtl_pci_intr_mode_decide(hw); + if (err) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "%s: failed to register IRQ handler\n", +- wiphy_name(hw->wiphy)); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "%s: failed to register IRQ handler\n", ++ wiphy_name(hw->wiphy)); + goto fail3; + } + rtlpci->irq_alloc = 1; +diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c +index fff8dda140238..9a4601a71eae0 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/ps.c ++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c +@@ -19,8 +19,8 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw) + rtlpriv->intf_ops->reset_trx_ring(hw); + + if (is_hal_stop(rtlhal)) +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "Driver is already down!\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "Driver is already down!\n"); + + /*<2> Enable Adapter */ + if (rtlpriv->cfg->ops->hw_init(hw)) +@@ -81,9 +81,9 @@ static bool rtl_ps_set_rf_state(struct ieee80211_hw *hw, + if (ppsc->rfchange_inprogress) { + spin_unlock(&rtlpriv->locks.rf_ps_lock); + +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "RF Change in progress! Wait to set..state_toset(%d).\n", +- state_toset); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "RF Change in progress! Wait to set..state_toset(%d).\n", ++ state_toset); + + /* Set RF after the previous action is done. */ + while (ppsc->rfchange_inprogress) { +@@ -195,8 +195,8 @@ void rtl_ips_nic_off_wq_callback(void *data) + enum rf_pwrstate rtstate; + + if (mac->opmode != NL80211_IFTYPE_STATION) { +- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, +- "not station return\n"); ++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, ++ "not station return\n"); + return; + } + +@@ -232,8 +232,8 @@ void rtl_ips_nic_off_wq_callback(void *data) + !ppsc->swrf_processing && + (mac->link_state == MAC80211_NOLINK) && + !mac->act_scanning) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, +- "IPSEnter(): Turn off RF\n"); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, ++ "IPSEnter(): Turn off RF\n"); + + ppsc->inactive_pwrstate = ERFOFF; + ppsc->in_powersavemode = true; +@@ -311,8 +311,8 @@ static bool rtl_get_fwlps_doze(struct ieee80211_hw *hw) + ppsc->last_delaylps_stamp_jiffies); + + if (ps_timediff < 2000) { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n"); + return false; + } + +@@ -357,9 +357,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode) + + if ((ppsc->fwctrl_lps) && ppsc->report_linked) { + if (ppsc->dot11_psmode == EACTIVE) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "FW LPS leave ps_mode:%x\n", +- FW_PS_ACTIVE_MODE); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "FW LPS leave ps_mode:%x\n", ++ FW_PS_ACTIVE_MODE); + enter_fwlps = false; + ppsc->pwr_mode = FW_PS_ACTIVE_MODE; + ppsc->smart_ps = 0; +@@ -372,9 +372,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode) + rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode); + } else { + if (rtl_get_fwlps_doze(hw)) { +- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG, +- "FW LPS enter ps_mode:%x\n", +- ppsc->fwctrl_psmode); ++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG, ++ "FW LPS enter ps_mode:%x\n", ++ ppsc->fwctrl_psmode); + if (rtlpriv->cfg->ops->get_btc_status()) + rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode); + enter_fwlps = true; +@@ -424,8 +424,8 @@ static void rtl_lps_enter_core(struct ieee80211_hw *hw) + * bt_ccoexist may ask to enter lps. + * In normal case, this constraint move to rtl_lps_set_psmode(). + */ +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Enter 802.11 power save mode...\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Enter 802.11 power save mode...\n"); + rtl_lps_set_psmode(hw, EAUTOPS); + + mutex_unlock(&rtlpriv->locks.lps_mutex); +@@ -453,8 +453,8 @@ static void rtl_lps_leave_core(struct ieee80211_hw *hw) + RT_CLEAR_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM); + } + +- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, +- "Busy Traffic,Leave 802.11 power save..\n"); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, ++ "Busy Traffic,Leave 802.11 power save..\n"); + + rtl_lps_set_psmode(hw, EACTIVE); + } +@@ -538,8 +538,8 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len) + queue_delayed_work(rtlpriv->works.rtl_wq, + &rtlpriv->works.ps_work, MSECS(5)); + } else { +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, +- "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, ++ "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed); + } + } + EXPORT_SYMBOL_GPL(rtl_swlps_beacon); +@@ -634,9 +634,9 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw) + /* this print should always be dtim_conter = 0 & + * sleep = dtim_period, that meaons, we should + * awake before every dtim */ +- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, +- "dtim_counter:%x will sleep :%d beacon_intv\n", +- rtlpriv->psc.dtim_counter, sleep_intv); ++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, ++ "dtim_counter:%x will sleep :%d beacon_intv\n", ++ rtlpriv->psc.dtim_counter, sleep_intv); + + /* we tested that 40ms is enough for sw & hw sw delay */ + queue_delayed_work(rtlpriv->works.rtl_wq, &rtlpriv->works.ps_rfon_wq, +@@ -748,9 +748,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data, + if (ie[0] == 12) { + find_p2p_ps_ie = true; + if ((noa_len - 2) % 13 != 0) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, +- "P2P notice of absence: invalid length.%d\n", +- noa_len); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, ++ "P2P notice of absence: invalid length.%d\n", ++ noa_len); + return; + } else { + noa_num = (noa_len - 2) / 13; +@@ -761,8 +761,8 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data, + noa_index = ie[3]; + if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode == + P2P_PS_NONE || noa_index != p2pinfo->noa_index) { +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "update NOA ie.\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "update NOA ie.\n"); + p2pinfo->noa_index = noa_index; + p2pinfo->opp_ps = (ie[4] >> 7); + p2pinfo->ctwindow = ie[4] & 0x7F; +@@ -833,7 +833,7 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data, + if (ie == NULL) + return; + +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n"); + /*to find noa ie*/ + while (ie + 1 < end) { + noa_len = READEF2BYTE((__le16 *)&ie[1]); +@@ -841,13 +841,13 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data, + return; + + if (ie[0] == 12) { +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n"); + RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_LOUD, "noa ie ", + ie, noa_len); + if ((noa_len - 2) % 13 != 0) { +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "P2P notice of absence: invalid length.%d\n", +- noa_len); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "P2P notice of absence: invalid length.%d\n", ++ noa_len); + return; + } else { + noa_num = (noa_len - 2) / 13; +@@ -905,7 +905,7 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state) + struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw)); + struct rtl_p2p_ps_info *p2pinfo = &(rtlpriv->psc.p2p_ps_info); + +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n" , p2p_ps_state); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n", p2p_ps_state); + switch (p2p_ps_state) { + case P2P_PS_DISABLE: + p2pinfo->p2p_ps_state = p2p_ps_state; +@@ -957,18 +957,18 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state) + default: + break; + } +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "ctwindow %x oppps %x\n", +- p2pinfo->ctwindow , p2pinfo->opp_ps); +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, +- "count %x duration %x index %x interval %x start time %x noa num %x\n", +- p2pinfo->noa_count_type[0], +- p2pinfo->noa_duration[0], +- p2pinfo->noa_index, +- p2pinfo->noa_interval[0], +- p2pinfo->noa_start_time[0], +- p2pinfo->noa_num); +- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "end\n"); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "ctwindow %x oppps %x\n", ++ p2pinfo->ctwindow, p2pinfo->opp_ps); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, ++ "count %x duration %x index %x interval %x start time %x noa num %x\n", ++ p2pinfo->noa_count_type[0], ++ p2pinfo->noa_duration[0], ++ p2pinfo->noa_index, ++ p2pinfo->noa_interval[0], ++ p2pinfo->noa_start_time[0], ++ p2pinfo->noa_num); ++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "end\n"); + } + + void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len) +diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c +index 8be31e0ad8788..4cf8face0bbd1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/regd.c ++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c +@@ -393,13 +393,13 @@ int rtl_regd_init(struct ieee80211_hw *hw, + rtlpriv->regd.country_code = + channel_plan_to_country_code(rtlpriv->efuse.channel_plan); + +- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG, +- "rtl: EEPROM regdomain: 0x%0x country code: %d\n", +- rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG, ++ "rtl: EEPROM regdomain: 0x%0x country code: %d\n", ++ rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code); + + if (rtlpriv->regd.country_code >= COUNTRY_CODE_MAX) { +- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG, +- "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n"); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG, ++ "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n"); + + rtlpriv->regd.country_code = COUNTRY_CODE_WORLD_WIDE_13; + } +@@ -414,9 +414,9 @@ int rtl_regd_init(struct ieee80211_hw *hw, + rtlpriv->regd.alpha2[1] = '0'; + } + +- RT_TRACE(rtlpriv, COMP_REGD, DBG_TRACE, +- "rtl: Country alpha2 being used: %c%c\n", +- rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_TRACE, ++ "rtl: Country alpha2 being used: %c%c\n", ++ rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]); + + _rtl_regd_init_wiphy(&rtlpriv->regd, wiphy, reg_notifier); + +@@ -428,7 +428,7 @@ void rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request) + struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy); + struct rtl_priv *rtlpriv = rtl_priv(hw); + +- RT_TRACE(rtlpriv, COMP_REGD, DBG_LOUD, "\n"); ++ rtl_dbg(rtlpriv, COMP_REGD, DBG_LOUD, "\n"); + + _rtl_reg_notifier_apply(wiphy, request, &rtlpriv->regd); + } +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 9bcb187d37dcd..fc1548ad434f6 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -259,15 +259,15 @@ static int _rtl_usb_init_tx(struct ieee80211_hw *hw) + ? USB_HIGH_SPEED_BULK_SIZE + : USB_FULL_SPEED_BULK_SIZE; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n", +- rtlusb->max_bulk_out_size); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n", ++ rtlusb->max_bulk_out_size); + + for (i = 0; i < __RTL_TXQ_NUM; i++) { + u32 ep_num = rtlusb->ep_map.ep_mapping[i]; + + if (!ep_num) { +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "Invalid endpoint map setting!\n"); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "Invalid endpoint map setting!\n"); + return -EINVAL; + } + } +@@ -337,10 +337,10 @@ static int _rtl_usb_init(struct ieee80211_hw *hw) + else if (usb_endpoint_dir_out(pep_desc)) + rtlusb->out_ep_nums++; + +- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, +- "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n", +- pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize, +- pep_desc->bInterval); ++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, ++ "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n", ++ pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize, ++ pep_desc->bInterval); + } + if (rtlusb->in_ep_nums < rtlpriv->cfg->usb_interface_cfg->in_ep_num) { + pr_err("Too few input end points found\n"); +@@ -931,7 +931,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, + + memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc)); + if (ieee80211_is_auth(fc)) { +- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); ++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n"); + } + + if (rtlpriv->psc.sw_ps_enabled) { +-- +2.39.2 + diff --git a/queue-5.4/rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch b/queue-5.4/rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch new file mode 100644 index 00000000000..3a9461dff92 --- /dev/null +++ b/queue-5.4/rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch @@ -0,0 +1,56 @@ +From a71d97039f704bd291729c180e79d40d556defae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 15:42:30 -0500 +Subject: rtlwifi: Start changing RT_TRACE into rtl_dbg + +From: Larry Finger + +[ Upstream commit 78a7245d84300cd616dbce26e6fc42a039a62279 ] + +The macro name RT_TRACE makes it seem that it is used for tracing, when +is actually used for debugging. Change the name to RT_DEBUG. + +This step creates the new macro while keeping the old RT_TRACE to allow +building. It will be removed at the end of the patch series. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200723204244.24457-2-Larry.Finger@lwfinger.net +Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()") +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.h b/drivers/net/wireless/realtek/rtlwifi/debug.h +index 69f169d4d4aec..dbfb4d67ca31f 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.h ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.h +@@ -160,6 +160,10 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level, + const char *titlestring, + const void *hexdata, int hexdatalen); + ++#define rtl_dbg(rtlpriv, comp, level, fmt, ...) \ ++ _rtl_dbg_trace(rtlpriv, comp, level, \ ++ fmt, ##__VA_ARGS__) ++ + #define RT_TRACE(rtlpriv, comp, level, fmt, ...) \ + _rtl_dbg_trace(rtlpriv, comp, level, \ + fmt, ##__VA_ARGS__) +@@ -176,6 +180,13 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level, + + struct rtl_priv; + ++__printf(4, 5) ++static inline void rtl_dbg(struct rtl_priv *rtlpriv, ++ u64 comp, int level, ++ const char *fmt, ...) ++{ ++} ++ + __printf(4, 5) + static inline void RT_TRACE(struct rtl_priv *rtlpriv, + u64 comp, int level, +-- +2.39.2 + diff --git a/queue-5.4/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch b/queue-5.4/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch new file mode 100644 index 00000000000..11a7b883ac6 --- /dev/null +++ b/queue-5.4/scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch @@ -0,0 +1,77 @@ +From 3553e5c35c78a2d528eaa78af46a5f814d986e94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 12:32:11 +0100 +Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC + +From: Alexander Mikhalitsyn + +[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ] + +Currently, kernel would set MSG_CTRUNC flag if msg_control buffer +wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS. + +For some reason we have no corresponding check for SO_PASSSEC. + +In the recvmsg(2) doc we have: + MSG_CTRUNC + indicates that some control data was discarded due to lack + of space in the buffer for ancillary data. + +So, we need to set MSG_CTRUNC flag for all types of SCM. + +This change can break applications those don't check MSG_CTRUNC flag. + +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Leon Romanovsky +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Alexander Mikhalitsyn + +v2: +- commit message was rewritten according to Eric's suggestion +Acked-by: Paul Moore + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/scm.h | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/include/net/scm.h b/include/net/scm.h +index 1ce365f4c2560..585adc1346bd0 100644 +--- a/include/net/scm.h ++++ b/include/net/scm.h +@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc + } + } + } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return test_bit(SOCK_PASSSEC, &sock->flags); ++} + #else + static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) + { } ++ ++static inline bool scm_has_secdata(struct socket *sock) ++{ ++ return false; ++} + #endif /* CONFIG_SECURITY_NETWORK */ + + static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, + struct scm_cookie *scm, int flags) + { + if (!msg->msg_control) { +- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) ++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp || ++ scm_has_secdata(sock)) + msg->msg_flags |= MSG_CTRUNC; + scm_destroy(scm); + return; +-- +2.39.2 + diff --git a/queue-5.4/scripts-gdb-bail-early-if-there-are-no-clocks.patch b/queue-5.4/scripts-gdb-bail-early-if-there-are-no-clocks.patch new file mode 100644 index 00000000000..c71400987e9 --- /dev/null +++ b/queue-5.4/scripts-gdb-bail-early-if-there-are-no-clocks.patch @@ -0,0 +1,48 @@ +From 46cc4c2d5c50c7648d2ddae2abfd62ba7cfa134d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 15:52:45 -0700 +Subject: scripts/gdb: bail early if there are no clocks + +From: Florian Fainelli + +[ Upstream commit 1d7adbc74c009057ed9dc3112f388e91a9c79acc ] + +Avoid generating an exception if there are no clocks registered: + +(gdb) lx-clk-summary + enable prepare protect + clock count count count rate +------------------------------------------------------------------------ +Python Exception : No symbol "clk_root_list" in +current context. +Error occurred in Python: No symbol "clk_root_list" in current context. + +Link: https://lkml.kernel.org/r/20230323225246.3302977-1-f.fainelli@gmail.com +Fixes: d1e9710b63d8 ("scripts/gdb: initial clk support: lx-clk-summary") +Signed-off-by: Florian Fainelli +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Leonard Crestez +Cc: Stephen Boyd +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/clk.py | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/gdb/linux/clk.py b/scripts/gdb/linux/clk.py +index 061aecfa294e6..7a01fdc3e8446 100644 +--- a/scripts/gdb/linux/clk.py ++++ b/scripts/gdb/linux/clk.py +@@ -41,6 +41,8 @@ are cached and potentially out of date""" + self.show_subtree(child, level + 1) + + def invoke(self, arg, from_tty): ++ if utils.gdb_eval_or_none("clk_root_list") is None: ++ raise gdb.GdbError("No clocks registered") + gdb.write(" enable prepare protect \n") + gdb.write(" clock count count count rate \n") + gdb.write("------------------------------------------------------------------------\n") +-- +2.39.2 + diff --git a/queue-5.4/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch b/queue-5.4/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch new file mode 100644 index 00000000000..e794758fba9 --- /dev/null +++ b/queue-5.4/scripts-gdb-bail-early-if-there-are-no-generic-pd.patch @@ -0,0 +1,60 @@ +From d35af9c340be6a55d7444359ff7bf0998e9fe1f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 16:16:57 -0700 +Subject: scripts/gdb: bail early if there are no generic PD + +From: Florian Fainelli + +[ Upstream commit f19c3c2959e465209ade1a7a699e6cbf4359ce78 ] + +Avoid generating an exception if there are no generic power domain(s) +registered: + +(gdb) lx-genpd-summary +domain status children + /device runtime status +---------------------------------------------------------------------- +Python Exception : No symbol "gpd_list" in current context. +Error occurred in Python: No symbol "gpd_list" in current context. +(gdb) quit + +[f.fainelli@gmail.com: correctly invoke gdb_eval_or_none] + Link: https://lkml.kernel.org/r/20230327185746.3856407-1-f.fainelli@gmail.com +Link: https://lkml.kernel.org/r/20230323231659.3319941-1-f.fainelli@gmail.com +Fixes: 8207d4a88e1e ("scripts/gdb: add lx-genpd-summary command") +Signed-off-by: Florian Fainelli +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Leonard Crestez +Cc: Stephen Boyd +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/genpd.py | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py +index 39cd1abd85590..b53649c0a77a6 100644 +--- a/scripts/gdb/linux/genpd.py ++++ b/scripts/gdb/linux/genpd.py +@@ -5,7 +5,7 @@ + import gdb + import sys + +-from linux.utils import CachedType ++from linux.utils import CachedType, gdb_eval_or_none + from linux.lists import list_for_each_entry + + generic_pm_domain_type = CachedType('struct generic_pm_domain') +@@ -70,6 +70,8 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary''' + gdb.write(' %-50s %s\n' % (kobj_path, rtpm_status_str(dev))) + + def invoke(self, arg, from_tty): ++ if gdb_eval_or_none("&gpd_list") is None: ++ raise gdb.GdbError("No power domain(s) registered") + gdb.write('domain status children\n'); + gdb.write(' /device runtime status\n'); + gdb.write('----------------------------------------------------------------------\n'); +-- +2.39.2 + diff --git a/queue-5.4/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch b/queue-5.4/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch new file mode 100644 index 00000000000..679f5a77d94 --- /dev/null +++ b/queue-5.4/scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch @@ -0,0 +1,70 @@ +From c21aea6c9ea58cb00e1e0532e021963e97745411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2023 15:21:32 +0800 +Subject: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() + +From: Shuchang Li + +[ Upstream commit 91a0c0c1413239d0548b5aac4c82f38f6d53a91e ] + +When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4) +returns false, drbl_regs_memmap_p is not remapped. This passes a NULL +pointer to iounmap(), which can trigger a WARN() on certain arches. + +When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4) +returns true, drbl_regs_memmap_p may has been remapped and +ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a +NULL pointer to iounmap(). + +To fix these issues, we need to add null checks before iounmap(), and +change some goto labels. + +Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4") +Signed-off-by: Shuchang Li +Link: https://lore.kernel.org/r/20230404072133.1022-1-lishuchang@hust.edu.cn +Reviewed-by: Justin Tee +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_init.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 8930696021fbd..af5238ab63094 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -10226,7 +10226,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + goto out_iounmap_all; + } else { + error = -ENOMEM; +- goto out_iounmap_all; ++ goto out_iounmap_ctrl; + } + } + +@@ -10244,7 +10244,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + dev_err(&pdev->dev, + "ioremap failed for SLI4 HBA dpp registers.\n"); + error = -ENOMEM; +- goto out_iounmap_ctrl; ++ goto out_iounmap_all; + } + phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p; + } +@@ -10269,9 +10269,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba) + return 0; + + out_iounmap_all: +- iounmap(phba->sli4_hba.drbl_regs_memmap_p); ++ if (phba->sli4_hba.drbl_regs_memmap_p) ++ iounmap(phba->sli4_hba.drbl_regs_memmap_p); + out_iounmap_ctrl: +- iounmap(phba->sli4_hba.ctrl_regs_memmap_p); ++ if (phba->sli4_hba.ctrl_regs_memmap_p) ++ iounmap(phba->sli4_hba.ctrl_regs_memmap_p); + out_iounmap_conf: + iounmap(phba->sli4_hba.conf_regs_memmap_p); + +-- +2.39.2 + diff --git a/queue-5.4/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch b/queue-5.4/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch new file mode 100644 index 00000000000..4795f917c88 --- /dev/null +++ b/queue-5.4/scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch @@ -0,0 +1,38 @@ +From a26ad1e50ce256d7f50ad74f19d4714d51c9215a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 17:51:09 +0000 +Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS + +From: Danila Chernetsov + +[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ] + +When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is +dereferenced below. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling") +Signed-off-by: Danila Chernetsov +Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c +index 8b1ba690039b7..8c88190673c2a 100644 +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -1439,6 +1439,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status) + */ + if (cmdid == CMDID_INT_CMDS) { + scb = &adapter->int_scb; ++ cmd = scb->cmd; + + list_del_init(&scb->list); + scb->state = SCB_FREE; +-- +2.39.2 + diff --git a/queue-5.4/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch b/queue-5.4/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch new file mode 100644 index 00000000000..7b110e51324 --- /dev/null +++ b/queue-5.4/scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch @@ -0,0 +1,67 @@ +From 974ad31dfdb432abe99900601f65b5aa699ce726 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Mar 2023 20:56:19 -0500 +Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup + +From: Mike Christie + +[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ] + +Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort +fabric stop race"). + +If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the +last put on the cmd and free it, because the connection is down and we will +not up sending the response and doing the put from the normal I/O +path. + +Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now +detect this case and run iscsit_free_cmd(). + +Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race") +Signed-off-by: Mike Christie +Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/iscsi/iscsi_target.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 3403667a9592f..8b8afa95fbbae 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -4084,9 +4084,12 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) { + struct se_cmd *se_cmd = &cmd->se_cmd; + +- if (se_cmd->se_tfo != NULL) { +- spin_lock_irq(&se_cmd->t_state_lock); +- if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!se_cmd->se_tfo) ++ continue; ++ ++ spin_lock_irq(&se_cmd->t_state_lock); ++ if (se_cmd->transport_state & CMD_T_ABORTED) { ++ if (!(se_cmd->transport_state & CMD_T_TAS)) + /* + * LIO's abort path owns the cleanup for this, + * so put it back on the list and let +@@ -4094,11 +4097,10 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn) + */ + list_move_tail(&cmd->i_conn_node, + &conn->conn_cmd_list); +- } else { +- se_cmd->transport_state |= CMD_T_FABRIC_STOP; +- } +- spin_unlock_irq(&se_cmd->t_state_lock); ++ } else { ++ se_cmd->transport_state |= CMD_T_FABRIC_STOP; + } ++ spin_unlock_irq(&se_cmd->t_state_lock); + } + spin_unlock_bh(&conn->cmd_lock); + +-- +2.39.2 + diff --git a/queue-5.4/selinux-ensure-av_permissions.h-is-built-when-needed.patch b/queue-5.4/selinux-ensure-av_permissions.h-is-built-when-needed.patch new file mode 100644 index 00000000000..73d1ab55950 --- /dev/null +++ b/queue-5.4/selinux-ensure-av_permissions.h-is-built-when-needed.patch @@ -0,0 +1,36 @@ +From 1917433b422bd7e893b6adff1e031485cc218ea6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:29:11 -0400 +Subject: selinux: ensure av_permissions.h is built when needed + +From: Paul Moore + +[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ] + +The Makefile rule responsible for building flask.h and +av_permissions.h only lists flask.h as a target which means that +av_permissions.h is only generated when flask.h needs to be +generated. This patch fixes this by adding av_permissions.h as a +target to the rule. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index c0dfb9f3db692..c371634f35a3b 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -22,5 +22,5 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h + cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE ++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-5.4/selinux-fix-makefile-dependencies-of-flask.h.patch b/queue-5.4/selinux-fix-makefile-dependencies-of-flask.h.patch new file mode 100644 index 00000000000..a41605717cd --- /dev/null +++ b/queue-5.4/selinux-fix-makefile-dependencies-of-flask.h.patch @@ -0,0 +1,43 @@ +From a8287e8247951cf3146bdcd6e1480f8a9a2165a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 15:59:19 +0200 +Subject: selinux: fix Makefile dependencies of flask.h + +From: Ondrej Mosnacek + +[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ] + +Make the flask.h target depend on the genheaders binary instead of +classmap.h to ensure that it is rebuilt if any of the dependencies of +genheaders are changed. + +Notably this fixes flask.h not being rebuilt when +initial_sid_to_string.h is modified. + +Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build") +Signed-off-by: Ondrej Mosnacek +Acked-by: Stephen Smalley +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/security/selinux/Makefile b/security/selinux/Makefile +index ccf9504093841..c0dfb9f3db692 100644 +--- a/security/selinux/Makefile ++++ b/security/selinux/Makefile +@@ -19,8 +19,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include + $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h + + quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h +- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h ++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h + + targets += flask.h av_permissions.h +-$(obj)/flask.h: $(src)/include/classmap.h FORCE ++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE + $(call if_changed,flask) +-- +2.39.2 + diff --git a/queue-5.4/serial-8250-add-missing-wakeup-event-reporting.patch b/queue-5.4/serial-8250-add-missing-wakeup-event-reporting.patch new file mode 100644 index 00000000000..f46fb01f2af --- /dev/null +++ b/queue-5.4/serial-8250-add-missing-wakeup-event-reporting.patch @@ -0,0 +1,53 @@ +From 4c04db012894c16fcbff609c34807e99d2c93942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Apr 2023 10:02:39 -0700 +Subject: serial: 8250: Add missing wakeup event reporting + +From: Florian Fainelli + +[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ] + +An 8250 UART configured as a wake-up source would not have reported +itself through sysfs as being the source of wake-up, correct that. + +Fixes: b3b708fa2780 ("wake up from a serial port") +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 907130244e1f5..3d369481d4db1 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1840,6 +1841,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + unsigned char status; + unsigned long flags; + struct uart_8250_port *up = up_to_u8250p(port); ++ struct tty_port *tport = &port->state->port; + bool skip_rx = false; + + if (iir & UART_IIR_NO_INT) +@@ -1863,6 +1865,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + skip_rx = true; + + if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) { ++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) ++ pm_wakeup_event(tport->tty->dev, 0); + if (!up->dma || handle_rx_dma(up, iir)) + status = serial8250_rx_chars(up, status); + } +-- +2.39.2 + diff --git a/queue-5.4/series b/queue-5.4/series index a3d89ab4e01..1dc5ec3d975 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -30,3 +30,167 @@ revert-ubifs-dirty_cow_znode-fix-memleak-in-error-handling-path.patch ubifs-fix-memleak-when-insert_old_idx-failed.patch ubi-fix-return-value-overwrite-issue-in-try_write_vid_and_data.patch ubifs-free-memory-for-tmpfile-name.patch +selinux-fix-makefile-dependencies-of-flask.h.patch +selinux-ensure-av_permissions.h-is-built-when-needed.patch +tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch +erofs-stop-parsing-non-compact-head-index-if-cluster.patch +erofs-fix-potential-overflow-calculating-xattr_isize.patch +drm-rockchip-drop-unbalanced-obj-unref.patch +drm-vgem-add-missing-mutex_destroy.patch +drm-probe-helper-cancel-previous-job-before-starting.patch +arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch +arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch +edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch +arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch +arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch +arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch +media-bdisp-add-missing-check-for-create_workqueue.patch +media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch +media-av7110-prevent-underflow-in-write_ts_to_decode.patch +firmware-qcom_scm-clear-download-bit-during-reboot.patch +drm-msm-fix-unbalanced-pm_runtime_enable-in-adreno_g.patch +drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch +drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch +mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch +drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch +regulator-core-consistently-set-mutex_owner-when-usi.patch +regulator-core-avoid-lockdep-reports-when-resolving-.patch +x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch +media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch +media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch +media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch +media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch +media-rcar_fdp1-make-use-of-the-helper-function-devm.patch +media-rcar_fdp1-fix-the-correct-variable-assignments.patch +media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch +media-rc-gpio-ir-recv-fix-support-for-wake-up.patch +regulator-stm32-pwr-fix-of_iomap-leak.patch +x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch +arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch +debugobject-prevent-init-race-with-static-objects.patch +timekeeping-split-jiffies-seqlock.patch +tick-sched-use-tick_next_period-for-lockless-quick-c.patch +tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch +tick-sched-optimize-tick_do_update_jiffies64-further.patch +tick-get-rid-of-tick_period.patch +tick-common-align-tick-period-with-the-hz-tick.patch +wifi-ath6kl-minor-fix-for-allocation-size.patch +wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch +wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch +wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch +tools-bpftool-remove-invalid-json-escape.patch +wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch +wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch +scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch +vlan-partially-enable-siocshwtstamp-in-container.patch +net-packet-annotate-accesses-to-po-xmit.patch +net-packet-convert-po-origdev-to-an-atomic-flag.patch +net-packet-convert-po-auxdata-to-an-atomic-flag.patch +scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch +scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch +f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch +rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch +rtlwifi-replace-rt_trace-with-rtl_dbg.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch +wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-16446 +bpftool-fix-bug-for-long-instructions-in-program-cfg.patch +crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch +crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch +scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch +bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch +nvme-handle-the-persistent-internal-error-aer.patch +nvme-fix-async-event-trace-event.patch +nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch +bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch +md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch +md-raid10-fix-memleak-for-conf-bio_split.patch +md-update-the-optimal-i-o-size-on-reshape.patch +md-raid10-fix-memleak-of-md-thread.patch +wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch +wifi-iwlwifi-mvm-check-firmware-response-size.patch +ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch +ixgbe-enable-setting-rss-table-to-default-values.patch +bpf-don-t-efault-for-getsockopt-with-optval-null.patch +netfilter-nf_tables-don-t-write-table-validation-sta.patch +ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch +revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch +netlink-use-copy_to_user-for-optval-in-netlink_getso.patch +net-amd-fix-link-leak-when-verifying-config-failed.patch +tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch +pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch +usb-host-xhci-rcar-remove-leftover-quirk-handling.patch +fpga-bridge-fix-kernel-doc-parameter-description.patch +iio-light-max44009-add-missing-of-device-matching.patch +spi-imx-fsl-lpspi-convert-to-gpio-descriptors.patch +spi-imx-enable-runtime-pm-support.patch +spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch +spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch +usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch +pci-imx6-install-the-fault-handler-only-on-compatibl.patch +genirq-add-irqf_no_autoen-for-request_irq-nmi.patch +asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch +asoc-es8316-handle-optional-irq-assignment.patch +linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch +spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch +spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch +vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch +of-fix-modalias-string-generation.patch +ia64-mm-contig-fix-section-mismatch-warning-error.patch +ia64-salinfo-placate-defined-but-not-used-warning.patch +scripts-gdb-bail-early-if-there-are-no-clocks.patch +pm-domains-fix-up-terminology-with-parent-child.patch +scripts-gdb-bail-early-if-there-are-no-generic-pd.patch +mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch +mtd-spi-nor-cadence-quadspi-provide-a-way-to-disable.patch +mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch +mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch +spi-cadence-quadspi-fix-suspend-resume-implementatio.patch +uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch +sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch +usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch +usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch +firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch +tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch +serial-8250-add-missing-wakeup-event-reporting.patch +staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch +spmi-add-a-check-for-remove-callback-when-removing-a.patch +spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch +macintosh-windfarm_smu_sat-add-missing-of_node_put.patch +powerpc-mpc512x-fix-resource-printk-format-warning.patch +powerpc-wii-fix-resource-printk-format-warnings.patch +powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch +macintosh-via-pmu-led-requires-ata-to-be-set.patch +powerpc-rtas-use-memmove-for-potentially-overlapping.patch +perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch +rdma-siw-fix-potential-page_array-out-of-range-acces.patch +rdma-rdmavt-delete-unnecessary-null-check.patch +rtc-omap-include-header-for-omap_rtc_power_off_progr.patch +rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch +rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch +power-supply-generic-adc-battery-fix-unit-scaling.patch +clk-add-missing-of_node_put-in-assigned-clocks-prope.patch +rdma-siw-remove-namespace-check-from-siw_netdev_even.patch +ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch +nfsv4.1-always-send-a-reclaim_complete-after-establi.patch +firmware-raspberrypi-keep-count-of-all-consumers.patch +firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch +input-raspberrypi-ts-release-firmware-handle-when-no.patch +input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch +sunrpc-remove-the-maximum-number-of-retries-in-call_.patch +rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch +clocksource-drivers-davinci-avoid-trailing-n-hidden-.patch +clocksource-davinci-axe-a-pointless-__gfp_nofail.patch +clocksource-drivers-davinci-fix-memory-leak-in-davin.patch +openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch +ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch +leds-ti_lmu_common-select-regmap-instead-of-dependin.patch +treewide-remove-redundant-is_err-before-error-code-c.patch +dmaengine-mv_xor_v2-fix-an-error-code.patch +pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch +pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch +pwm-mtk-disp-disable-shadow-registers-before-setting.patch +phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch +dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch +dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch +dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch +afs-fix-updating-of-i_size-with-dv-jump-from-server.patch diff --git a/queue-5.4/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch b/queue-5.4/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch new file mode 100644 index 00000000000..2dc3d04b5de --- /dev/null +++ b/queue-5.4/sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch @@ -0,0 +1,44 @@ +From 29279e4cd25a185e2392da28bf22051f333d0438 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Apr 2023 13:48:52 +0200 +Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer + +From: John Paul Adrian Glaubitz + +[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ] + +The Store Queue code allocates a bitmap buffer with the size of +multiple of sizeof(long) in sq_api_init(). While the buffer size +is calculated correctly, the code uses the wrong element size to +allocate the buffer which results in the allocated bitmap buffer +being too small. + +Fix this by allocating the buffer with kcalloc() with element size +sizeof(long) instead of kzalloc() whose elements size defaults to +sizeof(char). + +Fixes: d7c30c682a27 ("sh: Store Queue API rework.") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: John Paul Adrian Glaubitz +Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh4/sq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c +index 934ff84844fa0..c633fe4d70398 100644 +--- a/arch/sh/kernel/cpu/sh4/sq.c ++++ b/arch/sh/kernel/cpu/sh4/sq.c +@@ -380,7 +380,7 @@ static int __init sq_api_init(void) + if (unlikely(!sq_cache)) + return ret; + +- sq_bitmap = kzalloc(size, GFP_KERNEL); ++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL); + if (unlikely(!sq_bitmap)) + goto out; + +-- +2.39.2 + diff --git a/queue-5.4/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch b/queue-5.4/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch new file mode 100644 index 00000000000..c8baeff18fd --- /dev/null +++ b/queue-5.4/spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch @@ -0,0 +1,48 @@ +From 0b751c26b7553edd5a4c8a85e53ee87ee95192af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Apr 2023 17:46:15 +0530 +Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation + +From: Dhruva Gole + +[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ] + +Get rid of conditional compilation based on CONFIG_PM_SLEEP because +it may introduce build issues with certain configs where it maybe disabled +This is because if above config is not enabled the suspend-resume +functions are never part of the code but the bcm63xx_spi_pm_ops struct +still inits them to non-existent suspend-resume functions. + +Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver") + +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c +index fdd7eaa0b8ede..7628987e11a7c 100644 +--- a/drivers/spi/spi-bcm63xx.c ++++ b/drivers/spi/spi-bcm63xx.c +@@ -614,7 +614,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev) + return 0; + } + +-#ifdef CONFIG_PM_SLEEP + static int bcm63xx_spi_suspend(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); +@@ -641,7 +640,6 @@ static int bcm63xx_spi_resume(struct device *dev) + + return 0; + } +-#endif + + static const struct dev_pm_ops bcm63xx_spi_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume) +-- +2.39.2 + diff --git a/queue-5.4/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch b/queue-5.4/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch new file mode 100644 index 00000000000..4f5c0a89b45 --- /dev/null +++ b/queue-5.4/spi-cadence-quadspi-fix-suspend-resume-implementatio.patch @@ -0,0 +1,68 @@ +From 0c94a130f13247eb1697a96b68604c55223328d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 14:40:27 +0530 +Subject: spi: cadence-quadspi: fix suspend-resume implementations + +From: Dhruva Gole + +[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ] + +The cadence QSPI driver misbehaves after performing a full system suspend +resume: +... +spi-nor spi0.0: resume() failed +... +This results in a flash connected via OSPI interface after system suspend- +resume to be unusable. +fix these suspend and resume functions. + +Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller") +Signed-off-by: Dhruva Gole +Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/mtd/spi-nor/cadence-quadspi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 2c5a6587f505e..7bdc558d85601 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -1441,17 +1441,30 @@ static int cqspi_remove(struct platform_device *pdev) + static int cqspi_suspend(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); ++ int ret; + ++ ret = spi_master_suspend(master); + cqspi_controller_enable(cqspi, 0); +- return 0; ++ ++ clk_disable_unprepare(cqspi->clk); ++ ++ return ret; + } + + static int cqspi_resume(struct device *dev) + { + struct cqspi_st *cqspi = dev_get_drvdata(dev); ++ struct spi_master *master = dev_get_drvdata(dev); + +- cqspi_controller_enable(cqspi, 1); +- return 0; ++ clk_prepare_enable(cqspi->clk); ++ cqspi_wait_idle(cqspi); ++ cqspi_controller_init(cqspi); ++ ++ cqspi->current_cs = -1; ++ cqspi->sclk = 0; ++ ++ return spi_master_resume(master); + } + + static const struct dev_pm_ops cqspi__dev_pm_ops = { +-- +2.39.2 + diff --git a/queue-5.4/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch b/queue-5.4/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch new file mode 100644 index 00000000000..a8d0a671151 --- /dev/null +++ b/queue-5.4/spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch @@ -0,0 +1,71 @@ +From ee5d5fc09b2a9bf2294a5b2d14277c429b447761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Apr 2023 19:59:46 +0200 +Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian + +From: Christophe Leroy + +[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ] + +CPM has the same problem as QE so for CPM also use the fix added +by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"): + + CPM mode uses Little Endian so words > 8 bits are byte swapped. + Workaround this by always enforcing wordsize 8 for 16 and 32 bits + words. Unfortunately this will not work for LSB transfers + where wordsize is > 8 bits so disable these for now. + +Also limit the workaround to 16 and 32 bits words because it can +only work for multiples of 8-bits. + +Signed-off-by: Christophe Leroy +Cc: Joakim Tjernlund +Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian") +Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-spi.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 02b999d48ca19..ae805f91eafa5 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -208,8 +208,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + struct spi_device *spi, + int bits_per_word) + { +- /* QE uses Little Endian for words > 8 +- * so transform all words > 8 into 8 bits ++ /* CPM/QE uses Little Endian for words > 8 ++ * so transform 16 and 32 bits words into 8 bits + * Unfortnatly that doesn't work for LSB so + * reject these for now */ + /* Note: 32 bits word, LSB works iff +@@ -217,9 +217,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs, + if (spi->mode & SPI_LSB_FIRST && + bits_per_word > 8) + return -EINVAL; +- if (bits_per_word > 8) ++ if (bits_per_word <= 8) ++ return bits_per_word; ++ if (bits_per_word == 16 || bits_per_word == 32) + return 8; /* pretend its 8 bits */ +- return bits_per_word; ++ return -EINVAL; + } + + static int fsl_spi_setup_transfer(struct spi_device *spi, +@@ -249,7 +251,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi, + bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi, + mpc8xxx_spi, + bits_per_word); +- else if (mpc8xxx_spi->flags & SPI_QE) ++ else + bits_per_word = mspi_apply_qe_mode_quirks(cs, spi, + bits_per_word); + +-- +2.39.2 + diff --git a/queue-5.4/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-5.4/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch new file mode 100644 index 00000000000..fe4436ffde8 --- /dev/null +++ b/queue-5.4/spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch @@ -0,0 +1,52 @@ +From ca27eb15976c4e9cc19355dcc1b41b4f39d4479e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 07:57:32 +0100 +Subject: spi: imx: Don't skip cleanup in remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 11951c9e3f364d7ae3b568a0e52c8335d43066b5 ] + +Returning early in a platform driver's remove callback is wrong. In this +case the dma resources are not released in the error path. this is never +retried later and so this is a permanent leak. To fix this, only skip +hardware disabling if waking the device fails. + +Fixes: d593574aff0a ("spi: imx: do not access registers while clocks disabled") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230306065733.2170662-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 780c234257ca8..ffd370abdab35 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1737,13 +1737,11 @@ static int spi_imx_remove(struct platform_device *pdev) + + spi_bitbang_stop(&spi_imx->bitbang); + +- ret = pm_runtime_resume_and_get(spi_imx->dev); +- if (ret < 0) { +- dev_err(spi_imx->dev, "failed to enable clock\n"); +- return ret; +- } +- +- writel(0, spi_imx->base + MXC_CSPICTRL); ++ ret = pm_runtime_get_sync(spi_imx->dev); ++ if (ret >= 0) ++ writel(0, spi_imx->base + MXC_CSPICTRL); ++ else ++ dev_warn(spi_imx->dev, "failed to enable clock, skip hw disable\n"); + + pm_runtime_dont_use_autosuspend(spi_imx->dev); + pm_runtime_put_sync(spi_imx->dev); +-- +2.39.2 + diff --git a/queue-5.4/spi-imx-enable-runtime-pm-support.patch b/queue-5.4/spi-imx-enable-runtime-pm-support.patch new file mode 100644 index 00000000000..c8e3d4fb193 --- /dev/null +++ b/queue-5.4/spi-imx-enable-runtime-pm-support.patch @@ -0,0 +1,233 @@ +From 7516b7ec64e1fc1ae822d99e2b36c9ca74bc2dda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jul 2020 14:33:54 +0800 +Subject: spi: imx: enable runtime pm support + +From: Clark Wang + +[ Upstream commit 525c9e5a32bd7951eae3f06d9d077fea51718a6c ] + +Enable runtime pm support for spi-imx driver. + +Signed-off-by: Clark Wang +Link: https://lore.kernel.org/r/20200727063354.17031-1-xiaoning.wang@nxp.com +Signed-off-by: Mark Brown +Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 121 ++++++++++++++++++++++++++++++------------ + 1 file changed, 88 insertions(+), 33 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 90793fc321358..95f1746a85d9d 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -13,7 +13,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + #include + #include +@@ -30,6 +32,8 @@ static bool use_dma = true; + module_param(use_dma, bool, 0644); + MODULE_PARM_DESC(use_dma, "Enable usage of DMA when available (default)"); + ++#define MXC_RPM_TIMEOUT 2000 /* 2000ms */ ++ + #define MXC_CSPIRXDATA 0x00 + #define MXC_CSPITXDATA 0x04 + #define MXC_CSPICTRL 0x08 +@@ -1532,20 +1536,16 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg) + struct spi_imx_data *spi_imx = spi_master_get_devdata(master); + int ret; + +- ret = clk_enable(spi_imx->clk_per); +- if (ret) +- return ret; +- +- ret = clk_enable(spi_imx->clk_ipg); +- if (ret) { +- clk_disable(spi_imx->clk_per); ++ ret = pm_runtime_get_sync(spi_imx->dev); ++ if (ret < 0) { ++ dev_err(spi_imx->dev, "failed to enable clock\n"); + return ret; + } + + ret = spi_imx->devtype_data->prepare_message(spi_imx, msg); + if (ret) { +- clk_disable(spi_imx->clk_ipg); +- clk_disable(spi_imx->clk_per); ++ pm_runtime_mark_last_busy(spi_imx->dev); ++ pm_runtime_put_autosuspend(spi_imx->dev); + } + + return ret; +@@ -1556,8 +1556,8 @@ spi_imx_unprepare_message(struct spi_master *master, struct spi_message *msg) + { + struct spi_imx_data *spi_imx = spi_master_get_devdata(master); + +- clk_disable(spi_imx->clk_ipg); +- clk_disable(spi_imx->clk_per); ++ pm_runtime_mark_last_busy(spi_imx->dev); ++ pm_runtime_put_autosuspend(spi_imx->dev); + return 0; + } + +@@ -1676,13 +1676,15 @@ static int spi_imx_probe(struct platform_device *pdev) + goto out_master_put; + } + +- ret = clk_prepare_enable(spi_imx->clk_per); +- if (ret) +- goto out_master_put; ++ pm_runtime_enable(spi_imx->dev); ++ pm_runtime_set_autosuspend_delay(spi_imx->dev, MXC_RPM_TIMEOUT); ++ pm_runtime_use_autosuspend(spi_imx->dev); + +- ret = clk_prepare_enable(spi_imx->clk_ipg); +- if (ret) +- goto out_put_per; ++ ret = pm_runtime_get_sync(spi_imx->dev); ++ if (ret < 0) { ++ dev_err(spi_imx->dev, "failed to enable clock\n"); ++ goto out_runtime_pm_put; ++ } + + spi_imx->spi_clk = clk_get_rate(spi_imx->clk_per); + /* +@@ -1692,7 +1694,7 @@ static int spi_imx_probe(struct platform_device *pdev) + if (spi_imx->devtype_data->has_dmamode) { + ret = spi_imx_sdma_init(&pdev->dev, spi_imx, master); + if (ret == -EPROBE_DEFER) +- goto out_clk_put; ++ goto out_runtime_pm_put; + + if (ret < 0) + dev_err(&pdev->dev, "dma setup error %d, use pio\n", +@@ -1707,19 +1709,20 @@ static int spi_imx_probe(struct platform_device *pdev) + ret = spi_bitbang_start(&spi_imx->bitbang); + if (ret) { + dev_err(&pdev->dev, "bitbang start failed with %d\n", ret); +- goto out_clk_put; ++ goto out_runtime_pm_put; + } + + dev_info(&pdev->dev, "probed\n"); + +- clk_disable(spi_imx->clk_ipg); +- clk_disable(spi_imx->clk_per); ++ pm_runtime_mark_last_busy(spi_imx->dev); ++ pm_runtime_put_autosuspend(spi_imx->dev); ++ + return ret; + +-out_clk_put: +- clk_disable_unprepare(spi_imx->clk_ipg); +-out_put_per: +- clk_disable_unprepare(spi_imx->clk_per); ++out_runtime_pm_put: ++ pm_runtime_dont_use_autosuspend(spi_imx->dev); ++ pm_runtime_put_sync(spi_imx->dev); ++ pm_runtime_disable(spi_imx->dev); + out_master_put: + spi_master_put(master); + +@@ -1734,30 +1737,82 @@ static int spi_imx_remove(struct platform_device *pdev) + + spi_bitbang_stop(&spi_imx->bitbang); + +- ret = clk_enable(spi_imx->clk_per); ++ ret = pm_runtime_get_sync(spi_imx->dev); ++ if (ret < 0) { ++ dev_err(spi_imx->dev, "failed to enable clock\n"); ++ return ret; ++ } ++ ++ writel(0, spi_imx->base + MXC_CSPICTRL); ++ ++ pm_runtime_dont_use_autosuspend(spi_imx->dev); ++ pm_runtime_put_sync(spi_imx->dev); ++ pm_runtime_disable(spi_imx->dev); ++ ++ spi_imx_sdma_exit(spi_imx); ++ spi_master_put(master); ++ ++ return 0; ++} ++ ++static int __maybe_unused spi_imx_runtime_resume(struct device *dev) ++{ ++ struct spi_master *master = dev_get_drvdata(dev); ++ struct spi_imx_data *spi_imx; ++ int ret; ++ ++ spi_imx = spi_master_get_devdata(master); ++ ++ ret = clk_prepare_enable(spi_imx->clk_per); + if (ret) + return ret; + +- ret = clk_enable(spi_imx->clk_ipg); ++ ret = clk_prepare_enable(spi_imx->clk_ipg); + if (ret) { +- clk_disable(spi_imx->clk_per); ++ clk_disable_unprepare(spi_imx->clk_per); + return ret; + } + +- writel(0, spi_imx->base + MXC_CSPICTRL); +- clk_disable_unprepare(spi_imx->clk_ipg); ++ return 0; ++} ++ ++static int __maybe_unused spi_imx_runtime_suspend(struct device *dev) ++{ ++ struct spi_master *master = dev_get_drvdata(dev); ++ struct spi_imx_data *spi_imx; ++ ++ spi_imx = spi_master_get_devdata(master); ++ + clk_disable_unprepare(spi_imx->clk_per); +- spi_imx_sdma_exit(spi_imx); +- spi_master_put(master); ++ clk_disable_unprepare(spi_imx->clk_ipg); ++ ++ return 0; ++} + ++static int __maybe_unused spi_imx_suspend(struct device *dev) ++{ ++ pinctrl_pm_select_sleep_state(dev); + return 0; + } + ++static int __maybe_unused spi_imx_resume(struct device *dev) ++{ ++ pinctrl_pm_select_default_state(dev); ++ return 0; ++} ++ ++static const struct dev_pm_ops imx_spi_pm = { ++ SET_RUNTIME_PM_OPS(spi_imx_runtime_suspend, ++ spi_imx_runtime_resume, NULL) ++ SET_SYSTEM_SLEEP_PM_OPS(spi_imx_suspend, spi_imx_resume) ++}; ++ + static struct platform_driver spi_imx_driver = { + .driver = { + .name = DRIVER_NAME, + .of_match_table = spi_imx_dt_ids, +- }, ++ .pm = &imx_spi_pm, ++ }, + .id_table = spi_imx_devtype, + .probe = spi_imx_probe, + .remove = spi_imx_remove, +-- +2.39.2 + diff --git a/queue-5.4/spi-imx-fsl-lpspi-convert-to-gpio-descriptors.patch b/queue-5.4/spi-imx-fsl-lpspi-convert-to-gpio-descriptors.patch new file mode 100644 index 00000000000..11ef9d5a1a1 --- /dev/null +++ b/queue-5.4/spi-imx-fsl-lpspi-convert-to-gpio-descriptors.patch @@ -0,0 +1,811 @@ +From 7704957f62ff7625f79205362f543662d486f93e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 22:02:52 +0200 +Subject: spi: imx/fsl-lpspi: Convert to GPIO descriptors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Walleij + +[ Upstream commit 8cdcd8aeee2819199ec7f68114b77b04c10611d3 ] + +This converts the two Freescale i.MX SPI drivers +Freescale i.MX (CONFIG_SPI_IMX) and Freescale i.MX LPSPI +(CONFIG_SPI_FSL_LPSPI) to use GPIO descriptors handled in +the SPI core for GPIO chip selects whether defined in +the device tree or a board file. + +The reason why both are converted at the same time is +that they were both using the same platform data and +platform device population helpers when using +board files intertwining the code so this gives a cleaner +cut. + +The platform device creation was passing a platform data +container from each boardfile down to the driver using +struct spi_imx_master from , +but this was only conveying the number of chipselects and +an int * array of the chipselect GPIO numbers. + +The imx27 and imx31 platforms had code passing the +now-unused platform data when creating the platform devices, +this has been repurposed to pass around GPIO descriptor +tables. The platform data struct that was just passing an +array of integers and number of chip selects for the GPIO +lines has been removed. + +The number of chipselects used to be passed from the board +file, because this number also limits the number of native +chipselects that the platform can use. To deal with this we +just augment the i.MX (CONFIG_SPI_IMX) driver to support 3 +chipselects if the platform does not define "num-cs" as a +device property (such as from the device tree). This covers +all the legacy boards as these use <= 3 native chip selects +(or GPIO lines, and in that case the number of chip selects +is determined by the core from the number of available +GPIO lines). Any new boards should use device tree, so +this is a reasonable simplification to cover all old +boards. + +The LPSPI driver never assigned the number of chipselects +and thus always fall back to the core default of 1 chip +select if no GPIOs are defined in the device tree. + +The Freescale i.MX driver was already partly utilizing +the SPI core to obtain the GPIO numbers from the device tree, +so this completes the transtion to let the core handle all +of it. + +All board files and the core i.MX boardfile registration +code is augmented to account for these changes. + +This has been compile-tested with the imx_v4_v5_defconfig +and the imx_v6_v7_defconfig. + +Signed-off-by: Linus Walleij +Acked-by: Shawn Guo +Cc: Uwe Kleine-König +Cc: Robin Gong +Cc: Trent Piepho +Cc: Clark Wang +Cc: Shawn Guo +Cc: Sascha Hauer +Cc: Pengutronix Kernel Team +Cc: Fabio Estevam +Cc: NXP Linux Team +Link: https://lore.kernel.org/r/20200625200252.207614-1-linus.walleij@linaro.org +Signed-off-by: Mark Brown +Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path") +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/devices-imx27.h | 10 +-- + arch/arm/mach-imx/devices-imx31.h | 10 +-- + arch/arm/mach-imx/devices/devices-common.h | 5 +- + arch/arm/mach-imx/devices/platform-spi_imx.c | 9 +- + arch/arm/mach-imx/mach-mx27_3ds.c | 40 ++++++--- + arch/arm/mach-imx/mach-mx31_3ds.c | 13 +-- + arch/arm/mach-imx/mach-mx31lilly.c | 14 +-- + arch/arm/mach-imx/mach-mx31lite.c | 19 +--- + arch/arm/mach-imx/mach-mx31moboard.c | 12 +-- + arch/arm/mach-imx/mach-pca100.c | 21 +++-- + arch/arm/mach-imx/mach-pcm037_eet.c | 7 +- + drivers/spi/spi-fsl-lpspi.c | 47 +--------- + drivers/spi/spi-imx.c | 92 ++++---------------- + include/linux/platform_data/spi-imx.h | 33 ------- + 14 files changed, 88 insertions(+), 244 deletions(-) + delete mode 100644 include/linux/platform_data/spi-imx.h + +diff --git a/arch/arm/mach-imx/devices-imx27.h b/arch/arm/mach-imx/devices-imx27.h +index f89f4ae0e1ca6..583a1d773d682 100644 +--- a/arch/arm/mach-imx/devices-imx27.h ++++ b/arch/arm/mach-imx/devices-imx27.h +@@ -75,11 +75,11 @@ extern const struct imx_mxc_w1_data imx27_mxc_w1_data; + imx_add_mxc_w1(&imx27_mxc_w1_data) + + extern const struct imx_spi_imx_data imx27_cspi_data[]; +-#define imx27_add_cspi(id, pdata) \ +- imx_add_spi_imx(&imx27_cspi_data[id], pdata) +-#define imx27_add_spi_imx0(pdata) imx27_add_cspi(0, pdata) +-#define imx27_add_spi_imx1(pdata) imx27_add_cspi(1, pdata) +-#define imx27_add_spi_imx2(pdata) imx27_add_cspi(2, pdata) ++#define imx27_add_cspi(id, gtable) \ ++ imx_add_spi_imx(&imx27_cspi_data[id], gtable) ++#define imx27_add_spi_imx0(gtable) imx27_add_cspi(0, gtable) ++#define imx27_add_spi_imx1(gtable) imx27_add_cspi(1, gtable) ++#define imx27_add_spi_imx2(gtable) imx27_add_cspi(2, gtable) + + extern const struct imx_pata_imx_data imx27_pata_imx_data; + #define imx27_add_pata_imx() \ +diff --git a/arch/arm/mach-imx/devices-imx31.h b/arch/arm/mach-imx/devices-imx31.h +index 5a4ba35a47ed0..f7cc623725322 100644 +--- a/arch/arm/mach-imx/devices-imx31.h ++++ b/arch/arm/mach-imx/devices-imx31.h +@@ -69,11 +69,11 @@ extern const struct imx_mxc_w1_data imx31_mxc_w1_data; + imx_add_mxc_w1(&imx31_mxc_w1_data) + + extern const struct imx_spi_imx_data imx31_cspi_data[]; +-#define imx31_add_cspi(id, pdata) \ +- imx_add_spi_imx(&imx31_cspi_data[id], pdata) +-#define imx31_add_spi_imx0(pdata) imx31_add_cspi(0, pdata) +-#define imx31_add_spi_imx1(pdata) imx31_add_cspi(1, pdata) +-#define imx31_add_spi_imx2(pdata) imx31_add_cspi(2, pdata) ++#define imx31_add_cspi(id, gtable) \ ++ imx_add_spi_imx(&imx31_cspi_data[id], gtable) ++#define imx31_add_spi_imx0(gtable) imx31_add_cspi(0, gtable) ++#define imx31_add_spi_imx1(gtable) imx31_add_cspi(1, gtable) ++#define imx31_add_spi_imx2(gtable) imx31_add_cspi(2, gtable) + + extern const struct imx_pata_imx_data imx31_pata_imx_data; + #define imx31_add_pata_imx() \ +diff --git a/arch/arm/mach-imx/devices/devices-common.h b/arch/arm/mach-imx/devices/devices-common.h +index 2a685adec1df7..f8f3e4967c31f 100644 +--- a/arch/arm/mach-imx/devices/devices-common.h ++++ b/arch/arm/mach-imx/devices/devices-common.h +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + + extern struct device mxc_aips_bus; +@@ -276,7 +277,6 @@ struct platform_device *__init imx_add_sdhci_esdhc_imx( + const struct imx_sdhci_esdhc_imx_data *data, + const struct esdhc_platform_data *pdata); + +-#include + struct imx_spi_imx_data { + const char *devid; + int id; +@@ -285,8 +285,7 @@ struct imx_spi_imx_data { + int irq; + }; + struct platform_device *__init imx_add_spi_imx( +- const struct imx_spi_imx_data *data, +- const struct spi_imx_master *pdata); ++ const struct imx_spi_imx_data *data, struct gpiod_lookup_table *gtable); + + struct platform_device *imx_add_imx_dma(char *name, resource_size_t iobase, + int irq, int irq_err); +diff --git a/arch/arm/mach-imx/devices/platform-spi_imx.c b/arch/arm/mach-imx/devices/platform-spi_imx.c +index f2cafa52c1872..27747bf628a31 100644 +--- a/arch/arm/mach-imx/devices/platform-spi_imx.c ++++ b/arch/arm/mach-imx/devices/platform-spi_imx.c +@@ -3,6 +3,7 @@ + * Copyright (C) 2009-2010 Pengutronix + * Uwe Kleine-Koenig + */ ++#include + #include "../hardware.h" + #include "devices-common.h" + +@@ -57,8 +58,7 @@ const struct imx_spi_imx_data imx35_cspi_data[] __initconst = { + #endif /* ifdef CONFIG_SOC_IMX35 */ + + struct platform_device *__init imx_add_spi_imx( +- const struct imx_spi_imx_data *data, +- const struct spi_imx_master *pdata) ++ const struct imx_spi_imx_data *data, struct gpiod_lookup_table *gtable) + { + struct resource res[] = { + { +@@ -71,7 +71,8 @@ struct platform_device *__init imx_add_spi_imx( + .flags = IORESOURCE_IRQ, + }, + }; +- ++ if (gtable) ++ gpiod_add_lookup_table(gtable); + return imx_add_platform_device(data->devid, data->id, +- res, ARRAY_SIZE(res), pdata, sizeof(*pdata)); ++ res, ARRAY_SIZE(res), NULL, 0); + } +diff --git a/arch/arm/mach-imx/mach-mx27_3ds.c b/arch/arm/mach-imx/mach-mx27_3ds.c +index 7b8325fb5b413..51204521b903b 100644 +--- a/arch/arm/mach-imx/mach-mx27_3ds.c ++++ b/arch/arm/mach-imx/mach-mx27_3ds.c +@@ -304,18 +304,34 @@ static struct imx_ssi_platform_data mx27_3ds_ssi_pdata = { + }; + + /* SPI */ +-static int spi1_chipselect[] = {SPI1_SS0}; +- +-static const struct spi_imx_master spi1_pdata __initconst = { +- .chipselect = spi1_chipselect, +- .num_chipselect = ARRAY_SIZE(spi1_chipselect), ++static struct gpiod_lookup_table mx27_spi1_gpiod_table = { ++ .dev_id = "imx27-cspi.0", /* Actual device name for spi1 */ ++ .table = { ++ /* ++ * The i.MX27 has the i.MX21 GPIO controller, the SPI1 CS GPIO ++ * SPI1_SS0 is numbered IMX_GPIO_NR(4, 28). ++ * ++ * This is in "bank 4" which is subtracted by one in the macro ++ * so this is actually bank 3 on "imx21-gpio.3". ++ */ ++ GPIO_LOOKUP_IDX("imx21-gpio.3", 28, "cs", 0, GPIO_ACTIVE_LOW), ++ { }, ++ }, + }; + +-static int spi2_chipselect[] = {SPI2_SS0}; +- +-static const struct spi_imx_master spi2_pdata __initconst = { +- .chipselect = spi2_chipselect, +- .num_chipselect = ARRAY_SIZE(spi2_chipselect), ++static struct gpiod_lookup_table mx27_spi2_gpiod_table = { ++ .dev_id = "imx27-cspi.1", /* Actual device name for spi2 */ ++ .table = { ++ /* ++ * The i.MX27 has the i.MX21 GPIO controller, the SPI2 CS GPIO ++ * SPI2_SS0 is numbered IMX_GPIO_NR(4, 21). ++ * ++ * This is in "bank 4" which is subtracted by one in the macro ++ * so this is actually bank 3 on "imx21-gpio.3". ++ */ ++ GPIO_LOOKUP_IDX("imx21-gpio.3", 21, "cs", 0, GPIO_ACTIVE_LOW), ++ { }, ++ }, + }; + + static struct imx_fb_videomode mx27_3ds_modes[] = { +@@ -389,8 +405,8 @@ static void __init mx27pdk_init(void) + imx27_add_imx_keypad(&mx27_3ds_keymap_data); + imx27_add_imx2_wdt(); + +- imx27_add_spi_imx1(&spi2_pdata); +- imx27_add_spi_imx0(&spi1_pdata); ++ imx27_add_spi_imx1(&mx27_spi2_gpiod_table); ++ imx27_add_spi_imx0(&mx27_spi1_gpiod_table); + + imx27_add_imx_i2c(0, &mx27_3ds_i2c0_data); + imx27_add_imx_fb(&mx27_3ds_fb_data); +diff --git a/arch/arm/mach-imx/mach-mx31_3ds.c b/arch/arm/mach-imx/mach-mx31_3ds.c +index 716d2ad511035..99295ce8d0549 100644 +--- a/arch/arm/mach-imx/mach-mx31_3ds.c ++++ b/arch/arm/mach-imx/mach-mx31_3ds.c +@@ -364,15 +364,6 @@ static struct imx_ssi_platform_data mx31_3ds_ssi_pdata = { + .flags = IMX_SSI_DMA | IMX_SSI_NET, + }; + +-/* SPI */ +-static const struct spi_imx_master spi0_pdata __initconst = { +- .num_chipselect = 3, +-}; +- +-static const struct spi_imx_master spi1_pdata __initconst = { +- .num_chipselect = 3, +-}; +- + static struct spi_board_info mx31_3ds_spi_devs[] __initdata = { + { + .modalias = "mc13783", +@@ -548,14 +539,14 @@ static void __init mx31_3ds_init(void) + imx31_add_imx_uart0(&uart_pdata); + imx31_add_mxc_nand(&mx31_3ds_nand_board_info); + +- imx31_add_spi_imx1(&spi1_pdata); ++ imx31_add_spi_imx1(NULL); + + imx31_add_imx_keypad(&mx31_3ds_keymap_data); + + imx31_add_imx2_wdt(); + imx31_add_imx_i2c0(&mx31_3ds_i2c0_data); + +- imx31_add_spi_imx0(&spi0_pdata); ++ imx31_add_spi_imx0(NULL); + imx31_add_ipu_core(); + imx31_add_mx3_sdc_fb(&mx3fb_pdata); + +diff --git a/arch/arm/mach-imx/mach-mx31lilly.c b/arch/arm/mach-imx/mach-mx31lilly.c +index 8f725248299e1..4b955ccc92cdc 100644 +--- a/arch/arm/mach-imx/mach-mx31lilly.c ++++ b/arch/arm/mach-imx/mach-mx31lilly.c +@@ -215,16 +215,6 @@ static void __init lilly1131_usb_init(void) + imx31_add_mxc_ehci_hs(2, &usbh2_pdata); + } + +-/* SPI */ +- +-static const struct spi_imx_master spi0_pdata __initconst = { +- .num_chipselect = 3, +-}; +- +-static const struct spi_imx_master spi1_pdata __initconst = { +- .num_chipselect = 3, +-}; +- + static struct mc13xxx_platform_data mc13783_pdata __initdata = { + .flags = MC13XXX_USE_RTC | MC13XXX_USE_TOUCHSCREEN, + }; +@@ -281,8 +271,8 @@ static void __init mx31lilly_board_init(void) + mxc_iomux_alloc_pin(MX31_PIN_CSPI2_SS1__SS1, "SPI2_SS1"); + mxc_iomux_alloc_pin(MX31_PIN_CSPI2_SS2__SS2, "SPI2_SS2"); + +- imx31_add_spi_imx0(&spi0_pdata); +- imx31_add_spi_imx1(&spi1_pdata); ++ imx31_add_spi_imx0(NULL); ++ imx31_add_spi_imx1(NULL); + + regulator_register_fixed(0, dummy_supplies, ARRAY_SIZE(dummy_supplies)); + } +diff --git a/arch/arm/mach-imx/mach-mx31lite.c b/arch/arm/mach-imx/mach-mx31lite.c +index c0055f57c02dd..aaccf52f7ac16 100644 +--- a/arch/arm/mach-imx/mach-mx31lite.c ++++ b/arch/arm/mach-imx/mach-mx31lite.c +@@ -73,11 +73,6 @@ static const struct imxuart_platform_data uart_pdata __initconst = { + .flags = IMXUART_HAVE_RTSCTS, + }; + +-/* SPI */ +-static const struct spi_imx_master spi0_pdata __initconst = { +- .num_chipselect = 3, +-}; +- + static const struct mxc_nand_platform_data + mx31lite_nand_board_info __initconst = { + .width = 1, +@@ -111,16 +106,6 @@ static struct platform_device smsc911x_device = { + }, + }; + +-/* +- * SPI +- * +- * The MC13783 is the only hard-wired SPI device on the module. +- */ +- +-static const struct spi_imx_master spi1_pdata __initconst = { +- .num_chipselect = 1, +-}; +- + static struct mc13xxx_platform_data mc13783_pdata __initdata = { + .flags = MC13XXX_USE_RTC, + }; +@@ -246,13 +231,13 @@ static void __init mx31lite_init(void) + "mx31lite"); + + imx31_add_imx_uart0(&uart_pdata); +- imx31_add_spi_imx0(&spi0_pdata); ++ imx31_add_spi_imx0(NULL); + + /* NOR and NAND flash */ + platform_device_register(&physmap_flash_device); + imx31_add_mxc_nand(&mx31lite_nand_board_info); + +- imx31_add_spi_imx1(&spi1_pdata); ++ imx31_add_spi_imx1(NULL); + + regulator_register_fixed(0, dummy_supplies, ARRAY_SIZE(dummy_supplies)); + } +diff --git a/arch/arm/mach-imx/mach-mx31moboard.c b/arch/arm/mach-imx/mach-mx31moboard.c +index 36f08f45b0cad..96845a4eaf57e 100644 +--- a/arch/arm/mach-imx/mach-mx31moboard.c ++++ b/arch/arm/mach-imx/mach-mx31moboard.c +@@ -143,10 +143,6 @@ static const struct imxi2c_platform_data moboard_i2c1_data __initconst = { + .bitrate = 100000, + }; + +-static const struct spi_imx_master moboard_spi1_pdata __initconst = { +- .num_chipselect = 3, +-}; +- + static struct regulator_consumer_supply sdhc_consumers[] = { + { + .dev_name = "imx31-mmc.0", +@@ -287,10 +283,6 @@ static struct spi_board_info moboard_spi_board_info[] __initdata = { + }, + }; + +-static const struct spi_imx_master moboard_spi2_pdata __initconst = { +- .num_chipselect = 2, +-}; +- + #define SDHC1_CD IOMUX_TO_GPIO(MX31_PIN_ATA_CS0) + #define SDHC1_WP IOMUX_TO_GPIO(MX31_PIN_ATA_CS1) + +@@ -514,8 +506,8 @@ static void __init mx31moboard_init(void) + imx31_add_imx_i2c0(&moboard_i2c0_data); + imx31_add_imx_i2c1(&moboard_i2c1_data); + +- imx31_add_spi_imx1(&moboard_spi1_pdata); +- imx31_add_spi_imx2(&moboard_spi2_pdata); ++ imx31_add_spi_imx1(NULL); ++ imx31_add_spi_imx2(NULL); + + mx31moboard_init_cam(); + +diff --git a/arch/arm/mach-imx/mach-pca100.c b/arch/arm/mach-imx/mach-pca100.c +index 2e28e1b5cddfd..27a3678e0658a 100644 +--- a/arch/arm/mach-imx/mach-pca100.c ++++ b/arch/arm/mach-imx/mach-pca100.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -188,11 +189,19 @@ static struct spi_board_info pca100_spi_board_info[] __initdata = { + }, + }; + +-static int pca100_spi_cs[] = {SPI1_SS0, SPI1_SS1}; +- +-static const struct spi_imx_master pca100_spi0_data __initconst = { +- .chipselect = pca100_spi_cs, +- .num_chipselect = ARRAY_SIZE(pca100_spi_cs), ++static struct gpiod_lookup_table pca100_spi0_gpiod_table = { ++ .dev_id = "imx27-cspi.0", /* Actual device name for spi0 */ ++ .table = { ++ /* ++ * The i.MX27 has the i.MX21 GPIO controller, port D is ++ * bank 3 and thus named "imx21-gpio.3". ++ * SPI1_SS0 is GPIO_PORTD + 28 ++ * SPI1_SS1 is GPIO_PORTD + 27 ++ */ ++ GPIO_LOOKUP_IDX("imx21-gpio.3", 28, "cs", 0, GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP_IDX("imx21-gpio.3", 27, "cs", 1, GPIO_ACTIVE_LOW), ++ { }, ++ }, + }; + + static void pca100_ac97_warm_reset(struct snd_ac97 *ac97) +@@ -362,7 +371,7 @@ static void __init pca100_init(void) + mxc_gpio_mode(GPIO_PORTD | 27 | GPIO_GPIO | GPIO_IN); + spi_register_board_info(pca100_spi_board_info, + ARRAY_SIZE(pca100_spi_board_info)); +- imx27_add_spi_imx0(&pca100_spi0_data); ++ imx27_add_spi_imx0(&pca100_spi0_gpiod_table); + + imx27_add_imx_fb(&pca100_fb_data); + +diff --git a/arch/arm/mach-imx/mach-pcm037_eet.c b/arch/arm/mach-imx/mach-pcm037_eet.c +index 51f5142920cf5..8b0e03a595c19 100644 +--- a/arch/arm/mach-imx/mach-pcm037_eet.c ++++ b/arch/arm/mach-imx/mach-pcm037_eet.c +@@ -52,11 +52,6 @@ static struct spi_board_info pcm037_spi_dev[] = { + }, + }; + +-/* Platform Data for MXC CSPI */ +-static const struct spi_imx_master pcm037_spi1_pdata __initconst = { +- .num_chipselect = 2, +-}; +- + /* GPIO-keys input device */ + static struct gpio_keys_button pcm037_gpio_keys[] = { + { +@@ -163,7 +158,7 @@ int __init pcm037_eet_init_devices(void) + + /* SPI */ + spi_register_board_info(pcm037_spi_dev, ARRAY_SIZE(pcm037_spi_dev)); +- imx31_add_spi_imx0(&pcm037_spi1_pdata); ++ imx31_add_spi_imx0(NULL); + + imx_add_gpio_keys(&pcm037_gpio_keys_platform_data); + +diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c +index 58b2da91be1c0..a813c192a018d 100644 +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -11,7 +11,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -19,11 +18,9 @@ + #include + #include + #include +-#include + #include + #include + #include +-#include + #include + #include + #include +@@ -227,20 +224,6 @@ static int lpspi_unprepare_xfer_hardware(struct spi_controller *controller) + return 0; + } + +-static int fsl_lpspi_prepare_message(struct spi_controller *controller, +- struct spi_message *msg) +-{ +- struct fsl_lpspi_data *fsl_lpspi = +- spi_controller_get_devdata(controller); +- struct spi_device *spi = msg->spi; +- int gpio = fsl_lpspi->chipselect[spi->chip_select]; +- +- if (gpio_is_valid(gpio)) +- gpio_direction_output(gpio, spi->mode & SPI_CS_HIGH ? 0 : 1); +- +- return 0; +-} +- + static void fsl_lpspi_write_tx_fifo(struct fsl_lpspi_data *fsl_lpspi) + { + u8 txfifo_cnt; +@@ -835,13 +818,10 @@ static int fsl_lpspi_init_rpm(struct fsl_lpspi_data *fsl_lpspi) + + static int fsl_lpspi_probe(struct platform_device *pdev) + { +- struct device_node *np = pdev->dev.of_node; + struct fsl_lpspi_data *fsl_lpspi; + struct spi_controller *controller; +- struct spi_imx_master *lpspi_platform_info = +- dev_get_platdata(&pdev->dev); + struct resource *res; +- int i, ret, irq; ++ int ret, irq; + u32 temp; + bool is_slave; + +@@ -871,6 +851,8 @@ static int fsl_lpspi_probe(struct platform_device *pdev) + controller->dev.of_node = pdev->dev.of_node; + controller->bus_num = pdev->id; + controller->slave_abort = fsl_lpspi_slave_abort; ++ if (!fsl_lpspi->is_slave) ++ controller->use_gpio_descriptors = true; + + ret = devm_spi_register_controller(&pdev->dev, controller); + if (ret < 0) { +@@ -878,29 +860,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev) + goto out_controller_put; + } + +- if (!fsl_lpspi->is_slave) { +- for (i = 0; i < controller->num_chipselect; i++) { +- int cs_gpio = of_get_named_gpio(np, "cs-gpios", i); +- +- if (!gpio_is_valid(cs_gpio) && lpspi_platform_info) +- cs_gpio = lpspi_platform_info->chipselect[i]; +- +- fsl_lpspi->chipselect[i] = cs_gpio; +- if (!gpio_is_valid(cs_gpio)) +- continue; +- +- ret = devm_gpio_request(&pdev->dev, +- fsl_lpspi->chipselect[i], +- DRIVER_NAME); +- if (ret) { +- dev_err(&pdev->dev, "can't get cs gpios\n"); +- goto out_controller_put; +- } +- } +- controller->cs_gpios = fsl_lpspi->chipselect; +- controller->prepare_message = fsl_lpspi_prepare_message; +- } +- + init_completion(&fsl_lpspi->xfer_done); + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 9d593675257e0..90793fc321358 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -8,7 +8,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -21,10 +20,9 @@ + #include + #include + #include +-#include ++#include + + #include +-#include + + #define DRIVER_NAME "spi_imx" + +@@ -727,7 +725,7 @@ static int mx31_prepare_transfer(struct spi_imx_data *spi_imx, + reg |= MX31_CSPICTRL_POL; + if (spi->mode & SPI_CS_HIGH) + reg |= MX31_CSPICTRL_SSPOL; +- if (!gpio_is_valid(spi->cs_gpio)) ++ if (!spi->cs_gpiod) + reg |= (spi->chip_select) << + (is_imx35_cspi(spi_imx) ? MX35_CSPICTRL_CS_SHIFT : + MX31_CSPICTRL_CS_SHIFT); +@@ -827,7 +825,7 @@ static int mx21_prepare_transfer(struct spi_imx_data *spi_imx, + reg |= MX21_CSPICTRL_POL; + if (spi->mode & SPI_CS_HIGH) + reg |= MX21_CSPICTRL_SSPOL; +- if (!gpio_is_valid(spi->cs_gpio)) ++ if (!spi->cs_gpiod) + reg |= spi->chip_select << MX21_CSPICTRL_CS_SHIFT; + + writel(reg, spi_imx->base + MXC_CSPICTRL); +@@ -1056,20 +1054,6 @@ static const struct of_device_id spi_imx_dt_ids[] = { + }; + MODULE_DEVICE_TABLE(of, spi_imx_dt_ids); + +-static void spi_imx_chipselect(struct spi_device *spi, int is_active) +-{ +- int active = is_active != BITBANG_CS_INACTIVE; +- int dev_is_lowactive = !(spi->mode & SPI_CS_HIGH); +- +- if (spi->mode & SPI_NO_CS) +- return; +- +- if (!gpio_is_valid(spi->cs_gpio)) +- return; +- +- gpio_set_value(spi->cs_gpio, dev_is_lowactive ^ active); +-} +- + static void spi_imx_set_burst_len(struct spi_imx_data *spi_imx, int n_bits) + { + u32 ctrl; +@@ -1535,15 +1519,6 @@ static int spi_imx_setup(struct spi_device *spi) + dev_dbg(&spi->dev, "%s: mode %d, %u bpw, %d hz\n", __func__, + spi->mode, spi->bits_per_word, spi->max_speed_hz); + +- if (spi->mode & SPI_NO_CS) +- return 0; +- +- if (gpio_is_valid(spi->cs_gpio)) +- gpio_direction_output(spi->cs_gpio, +- spi->mode & SPI_CS_HIGH ? 0 : 1); +- +- spi_imx_chipselect(spi, BITBANG_CS_INACTIVE); +- + return 0; + } + +@@ -1601,20 +1576,14 @@ static int spi_imx_probe(struct platform_device *pdev) + struct device_node *np = pdev->dev.of_node; + const struct of_device_id *of_id = + of_match_device(spi_imx_dt_ids, &pdev->dev); +- struct spi_imx_master *mxc_platform_info = +- dev_get_platdata(&pdev->dev); + struct spi_master *master; + struct spi_imx_data *spi_imx; + struct resource *res; +- int i, ret, irq, spi_drctl; ++ int ret, irq, spi_drctl; + const struct spi_imx_devtype_data *devtype_data = of_id ? of_id->data : + (struct spi_imx_devtype_data *)pdev->id_entry->driver_data; + bool slave_mode; +- +- if (!np && !mxc_platform_info) { +- dev_err(&pdev->dev, "can't get the platform data\n"); +- return -EINVAL; +- } ++ u32 val; + + slave_mode = devtype_data->has_slavemode && + of_property_read_bool(np, "spi-slave"); +@@ -1637,6 +1606,7 @@ static int spi_imx_probe(struct platform_device *pdev) + + master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32); + master->bus_num = np ? -1 : pdev->id; ++ master->use_gpio_descriptors = true; + + spi_imx = spi_master_get_devdata(master); + spi_imx->bitbang.master = master; +@@ -1645,28 +1615,17 @@ static int spi_imx_probe(struct platform_device *pdev) + + spi_imx->devtype_data = devtype_data; + +- /* Get number of chip selects, either platform data or OF */ +- if (mxc_platform_info) { +- master->num_chipselect = mxc_platform_info->num_chipselect; +- if (mxc_platform_info->chipselect) { +- master->cs_gpios = devm_kcalloc(&master->dev, +- master->num_chipselect, sizeof(int), +- GFP_KERNEL); +- if (!master->cs_gpios) +- return -ENOMEM; +- +- for (i = 0; i < master->num_chipselect; i++) +- master->cs_gpios[i] = mxc_platform_info->chipselect[i]; +- } +- } else { +- u32 num_cs; +- +- if (!of_property_read_u32(np, "num-cs", &num_cs)) +- master->num_chipselect = num_cs; +- /* If not preset, default value of 1 is used */ +- } ++ /* ++ * Get number of chip selects from device properties. This can be ++ * coming from device tree or boardfiles, if it is not defined, ++ * a default value of 3 chip selects will be used, as all the legacy ++ * board files have <= 3 chip selects. ++ */ ++ if (!device_property_read_u32(&pdev->dev, "num-cs", &val)) ++ master->num_chipselect = val; ++ else ++ master->num_chipselect = 3; + +- spi_imx->bitbang.chipselect = spi_imx_chipselect; + spi_imx->bitbang.setup_transfer = spi_imx_setupxfer; + spi_imx->bitbang.txrx_bufs = spi_imx_transfer; + spi_imx->bitbang.master->setup = spi_imx_setup; +@@ -1751,31 +1710,12 @@ static int spi_imx_probe(struct platform_device *pdev) + goto out_clk_put; + } + +- /* Request GPIO CS lines, if any */ +- if (!spi_imx->slave_mode && master->cs_gpios) { +- for (i = 0; i < master->num_chipselect; i++) { +- if (!gpio_is_valid(master->cs_gpios[i])) +- continue; +- +- ret = devm_gpio_request(&pdev->dev, +- master->cs_gpios[i], +- DRIVER_NAME); +- if (ret) { +- dev_err(&pdev->dev, "Can't get CS GPIO %i\n", +- master->cs_gpios[i]); +- goto out_spi_bitbang; +- } +- } +- } +- + dev_info(&pdev->dev, "probed\n"); + + clk_disable(spi_imx->clk_ipg); + clk_disable(spi_imx->clk_per); + return ret; + +-out_spi_bitbang: +- spi_bitbang_stop(&spi_imx->bitbang); + out_clk_put: + clk_disable_unprepare(spi_imx->clk_ipg); + out_put_per: +diff --git a/include/linux/platform_data/spi-imx.h b/include/linux/platform_data/spi-imx.h +deleted file mode 100644 +index 328f670d10bd7..0000000000000 +--- a/include/linux/platform_data/spi-imx.h ++++ /dev/null +@@ -1,33 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +- +-#ifndef __MACH_SPI_H_ +-#define __MACH_SPI_H_ +- +-/* +- * struct spi_imx_master - device.platform_data for SPI controller devices. +- * @chipselect: Array of chipselects for this master or NULL. Numbers >= 0 +- * mean GPIO pins, -ENOENT means internal CSPI chipselect +- * matching the position in the array. E.g., if chipselect[1] = +- * -ENOENT then a SPI slave using chip select 1 will use the +- * native SS1 line of the CSPI. Omitting the array will use +- * all native chip selects. +- +- * Normally you want to use gpio based chip selects as the CSPI +- * module tries to be intelligent about when to assert the +- * chipselect: The CSPI module deasserts the chipselect once it +- * runs out of input data. The other problem is that it is not +- * possible to mix between high active and low active chipselects +- * on one single bus using the internal chipselects. +- * Unfortunately, on some SoCs, Freescale decided to put some +- * chipselects on dedicated pins which are not usable as gpios, +- * so we have to support the internal chipselects. +- * +- * @num_chipselect: If @chipselect is specified, ARRAY_SIZE(chipselect), +- * otherwise the number of native chip selects. +- */ +-struct spi_imx_master { +- int *chipselect; +- int num_chipselect; +-}; +- +-#endif /* __MACH_SPI_H_*/ +-- +2.39.2 + diff --git a/queue-5.4/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch b/queue-5.4/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch new file mode 100644 index 00000000000..1e3d617a195 --- /dev/null +++ b/queue-5.4/spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch @@ -0,0 +1,65 @@ +From 5ea0abf830a8b0d195255eca54f6af7f788f6217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Mar 2023 23:03:40 +0200 +Subject: spi: qup: Don't skip cleanup in remove's error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ] + +Returning early in a platform driver's remove callback is wrong. In this +case the dma resources are not released in the error path. this is never +retried later and so this is a permanent leak. To fix this, only skip +hardware disabling if waking the device fails. + +Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-qup.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c +index ead6c211047d5..ebcf9f4d5679e 100644 +--- a/drivers/spi/spi-qup.c ++++ b/drivers/spi/spi-qup.c +@@ -1276,18 +1276,22 @@ static int spi_qup_remove(struct platform_device *pdev) + struct spi_qup *controller = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_resume_and_get(&pdev->dev); +- if (ret < 0) +- return ret; ++ ret = pm_runtime_get_sync(&pdev->dev); + +- ret = spi_qup_set_state(controller, QUP_STATE_RESET); +- if (ret) +- return ret; ++ if (ret >= 0) { ++ ret = spi_qup_set_state(controller, QUP_STATE_RESET); ++ if (ret) ++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n", ++ ERR_PTR(ret)); + +- spi_qup_release_dma(master); ++ clk_disable_unprepare(controller->cclk); ++ clk_disable_unprepare(controller->iclk); ++ } else { ++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n", ++ ERR_PTR(ret)); ++ } + +- clk_disable_unprepare(controller->cclk); +- clk_disable_unprepare(controller->iclk); ++ spi_qup_release_dma(master); + + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); +-- +2.39.2 + diff --git a/queue-5.4/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch b/queue-5.4/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch new file mode 100644 index 00000000000..deb91937f86 --- /dev/null +++ b/queue-5.4/spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch @@ -0,0 +1,49 @@ +From af1684e36a6be041fe0556a931486ad55ad2b692 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Apr 2022 08:53:42 +0000 +Subject: spi: spi-imx: using pm_runtime_resume_and_get instead of + pm_runtime_get_sync + +From: Minghao Chi + +[ Upstream commit 7d34ff58f35c82207698f43af79817a05e1342e5 ] + +Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and +pm_runtime_put_noidle. This change is just to simplify the code, no +actual functional changes. + +Reported-by: Zeal Robot +Signed-off-by: Minghao Chi +Link: https://lore.kernel.org/r/20220414085343.2541608-1-chi.minghao@zte.com.cn +Signed-off-by: Mark Brown +Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 95f1746a85d9d..780c234257ca8 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -1536,7 +1536,7 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg) + struct spi_imx_data *spi_imx = spi_master_get_devdata(master); + int ret; + +- ret = pm_runtime_get_sync(spi_imx->dev); ++ ret = pm_runtime_resume_and_get(spi_imx->dev); + if (ret < 0) { + dev_err(spi_imx->dev, "failed to enable clock\n"); + return ret; +@@ -1737,7 +1737,7 @@ static int spi_imx_remove(struct platform_device *pdev) + + spi_bitbang_stop(&spi_imx->bitbang); + +- ret = pm_runtime_get_sync(spi_imx->dev); ++ ret = pm_runtime_resume_and_get(spi_imx->dev); + if (ret < 0) { + dev_err(spi_imx->dev, "failed to enable clock\n"); + return ret; +-- +2.39.2 + diff --git a/queue-5.4/spmi-add-a-check-for-remove-callback-when-removing-a.patch b/queue-5.4/spmi-add-a-check-for-remove-callback-when-removing-a.patch new file mode 100644 index 00000000000..0c3d961d40b --- /dev/null +++ b/queue-5.4/spmi-add-a-check-for-remove-callback-when-removing-a.patch @@ -0,0 +1,65 @@ +From 23d7d8b3605d4e60103afffe9112c9c4420d9c08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Apr 2023 15:38:34 -0700 +Subject: spmi: Add a check for remove callback when removing a SPMI driver + +From: Jishnu Prakash + +[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ] + +When removing a SPMI driver, there can be a crash due to NULL pointer +dereference if it does not have a remove callback defined. This is +one such call trace observed when removing the QCOM SPMI PMIC driver: + + dump_backtrace.cfi_jt+0x0/0x8 + dump_stack_lvl+0xd8/0x16c + panic+0x188/0x498 + __cfi_slowpath+0x0/0x214 + __cfi_slowpath+0x1dc/0x214 + spmi_drv_remove+0x16c/0x1e0 + device_release_driver_internal+0x468/0x79c + driver_detach+0x11c/0x1a0 + bus_remove_driver+0xc4/0x124 + driver_unregister+0x58/0x84 + cleanup_module+0x1c/0xc24 [qcom_spmi_pmic] + __do_sys_delete_module+0x3ec/0x53c + __arm64_sys_delete_module+0x18/0x28 + el0_svc_common+0xdc/0x294 + el0_svc+0x38/0x9c + el0_sync_handler+0x8c/0xf0 + el0_sync+0x1b4/0x1c0 + +If a driver has all its resources allocated through devm_() APIs and +does not need any other explicit cleanup, it would not require a +remove callback to be defined. Hence, add a check for remove callback +presence before calling it when removing a SPMI driver. + +Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com +Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()") +Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI") +Signed-off-by: Jishnu Prakash +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/spmi/spmi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c +index c16b60f645a4d..8ca7e004a53dc 100644 +--- a/drivers/spmi/spmi.c ++++ b/drivers/spmi/spmi.c +@@ -348,7 +348,8 @@ static int spmi_drv_remove(struct device *dev) + const struct spmi_driver *sdrv = to_spmi_driver(dev->driver); + + pm_runtime_get_sync(dev); +- sdrv->remove(to_spmi_device(dev)); ++ if (sdrv->remove) ++ sdrv->remove(to_spmi_device(dev)); + pm_runtime_put_noidle(dev); + + pm_runtime_disable(dev); +-- +2.39.2 + diff --git a/queue-5.4/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch b/queue-5.4/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch new file mode 100644 index 00000000000..293d33e4c86 --- /dev/null +++ b/queue-5.4/staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch @@ -0,0 +1,44 @@ +From cbc1d883348434b9773450e349e23393e9e36b80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 22:02:01 +0200 +Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start + +From: Philipp Hortmann + +[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ] + +When loading the driver for rtl8192e, the W_DISABLE# switch is working as +intended. But when the WLAN is turned off in software and then turned on +again the W_DISABLE# does not work anymore. Reason for this is that in +the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is +checked and returned when true. bfirst_after_down is set true when +switching the WLAN off in software. But it is not set to false again +when WLAN is turned on again. + +Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix +above described bug. + +Fixes: 94a799425eee ("From: wlanfae [PATCH 1/8] rtl8192e: Import new version of driver from realtek") +Signed-off-by: Philipp Hortmann +Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710 +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +index bcbf0c8cd4209..be377e75703bf 100644 +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -767,6 +767,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset) + else + netif_wake_queue(dev); + ++ priv->bfirst_after_down = false; + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.4/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch b/queue-5.4/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch new file mode 100644 index 00000000000..88fd2bcb82b --- /dev/null +++ b/queue-5.4/sunrpc-remove-the-maximum-number-of-retries-in-call_.patch @@ -0,0 +1,74 @@ +From 4ba883895e8f0973abf0a904d0eedfc2adbafb95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 13:19:02 -0700 +Subject: SUNRPC: remove the maximum number of retries in call_bind_status + +From: Dai Ngo + +[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ] + +Currently call_bind_status places a hard limit of 3 to the number of +retries on EACCES error. This limit was done to prevent NLM unlock +requests from being hang forever when the server keeps returning garbage. +However this change causes problem for cases when NLM service takes +longer than 9 seconds to register with the port mapper after a restart. + +This patch removes this hard coded limit and let the RPC handles +the retry based on the standard hard/soft task semantics. + +Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests") +Reported-by: Helen Chao +Tested-by: Helen Chao +Signed-off-by: Dai Ngo +Reviewed-by: Jeff Layton +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 3 +-- + net/sunrpc/clnt.c | 3 --- + net/sunrpc/sched.c | 1 - + 3 files changed, 1 insertion(+), 6 deletions(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index a6ef35184ef13..5c37fabdec103 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -90,8 +90,7 @@ struct rpc_task { + #endif + unsigned char tk_priority : 2,/* Task priority */ + tk_garb_retry : 2, +- tk_cred_retry : 2, +- tk_rebind_retry : 2; ++ tk_cred_retry : 2; + }; + + typedef void (*rpc_action)(struct rpc_task *); +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 012b0504264de..629c05ff1f3e6 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -2003,9 +2003,6 @@ call_bind_status(struct rpc_task *task) + status = -EOPNOTSUPP; + break; + } +- if (task->tk_rebind_retry == 0) +- break; +- task->tk_rebind_retry--; + rpc_delay(task, 3*HZ); + goto retry_timeout; + case -ENOBUFS: +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 32ffa801a5b97..a5c6a3d05741a 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -827,7 +827,6 @@ rpc_init_task_statistics(struct rpc_task *task) + /* Initialize retry counters */ + task->tk_garb_retry = 2; + task->tk_cred_retry = 2; +- task->tk_rebind_retry = 2; + + /* starting timestamp */ + task->tk_start = ktime_get(); +-- +2.39.2 + diff --git a/queue-5.4/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch b/queue-5.4/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch new file mode 100644 index 00000000000..c4662236ff4 --- /dev/null +++ b/queue-5.4/tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch @@ -0,0 +1,125 @@ +From db3bee3028c8375de8ac39715ba0b37a01c3e09e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Apr 2023 15:20:22 -0700 +Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. + +From: Kuniyuki Iwashima + +[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ] + +syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY +skbs. We can reproduce the problem with these sequences: + + sk = socket(AF_INET, SOCK_DGRAM, 0) + sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE) + sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1) + sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53)) + sk.close() + +sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets +skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct +ubuf_info_msgzc indirectly holds a refcnt of the socket. When the +skb is sent, __skb_tstamp_tx() clones it and puts the clone into +the socket's error queue with the TX timestamp. + +When the original skb is received locally, skb_copy_ubufs() calls +skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt. +This additional count is decremented while freeing the skb, but struct +ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is +not called. + +The last refcnt is not released unless we retrieve the TX timestamped +skb by recvmsg(). Since we clear the error queue in inet_sock_destruct() +after the socket's refcnt reaches 0, there is a circular dependency. +If we close() the socket holding such skbs, we never call sock_put() +and leak the count, sk, and skb. + +TCP has the same problem, and commit e0c8bccd40fc ("net: stream: +purge sk_error_queue in sk_stream_kill_queues()") tried to fix it +by calling skb_queue_purge() during close(). However, there is a +small chance that skb queued in a qdisc or device could be put +into the error queue after the skb_queue_purge() call. + +In __skb_tstamp_tx(), the cloned skb should not have a reference +to the ubuf to remove the circular dependency, but skb_clone() does +not call skb_copy_ubufs() for zerocopy skb. So, we need to call +skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs(). + +[0]: +BUG: memory leak +unreferenced object 0xffff88800c6d2d00 (size 1152): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................ + 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ + backtrace: + [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024 + [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083 + [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline] + [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245 + [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515 + [<00000000b9b11231>] sock_create net/socket.c:1566 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline] + [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline] + [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636 + [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline] + [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline] + [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +BUG: memory leak +unreferenced object 0xffff888017633a00 (size 240): + comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m..... + backtrace: + [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497 + [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline] + [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596 + [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline] + [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370 + [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037 + [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652 + [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253 + [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819 + [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline] + [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734 + [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117 + [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline] + [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline] + [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125 + [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY") +Fixes: b5947e5d1e71 ("udp: msg_zerocopy") +Reported-by: syzbot +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skbuff.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 0547aa2c8b131..291d7a9e04839 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4632,6 +4632,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb, + skb = alloc_skb(0, GFP_ATOMIC); + } else { + skb = skb_clone(orig_skb, GFP_ATOMIC); ++ ++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC)) ++ return; + } + if (!skb) + return; +-- +2.39.2 + diff --git a/queue-5.4/tick-common-align-tick-period-with-the-hz-tick.patch b/queue-5.4/tick-common-align-tick-period-with-the-hz-tick.patch new file mode 100644 index 00000000000..c03b24009d0 --- /dev/null +++ b/queue-5.4/tick-common-align-tick-period-with-the-hz-tick.patch @@ -0,0 +1,67 @@ +From 073de093cb136b303b3fb6309bdd4d4f5a2eea8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Apr 2023 14:26:39 +0200 +Subject: tick/common: Align tick period with the HZ tick. + +From: Sebastian Andrzej Siewior + +[ Upstream commit e9523a0d81899361214d118ad60ef76f0e92f71d ] + +With HIGHRES enabled tick_sched_timer() is programmed every jiffy to +expire the timer_list timers. This timer is programmed accurate in +respect to CLOCK_MONOTONIC so that 0 seconds and nanoseconds is the +first tick and the next one is 1000/CONFIG_HZ ms later. For HZ=250 it is +every 4 ms and so based on the current time the next tick can be +computed. + +This accuracy broke since the commit mentioned below because the jiffy +based clocksource is initialized with higher accuracy in +read_persistent_wall_and_boot_offset(). This higher accuracy is +inherited during the setup in tick_setup_device(). The timer still fires +every 4ms with HZ=250 but timer is no longer aligned with +CLOCK_MONOTONIC with 0 as it origin but has an offset in the us/ns part +of the timestamp. The offset differs with every boot and makes it +impossible for user land to align with the tick. + +Align the tick period with CLOCK_MONOTONIC ensuring that it is always a +multiple of 1000/CONFIG_HZ ms. + +Fixes: 857baa87b6422 ("sched/clock: Enable sched clock early") +Reported-by: Gusenleitner Klaus +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/20230406095735.0_14edn3@linutronix.de +Link: https://lore.kernel.org/r/20230418122639.ikgfvu3f@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/time/tick-common.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index 92bf99d558b48..2b7448ae5b478 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -216,9 +216,19 @@ static void tick_setup_device(struct tick_device *td, + * this cpu: + */ + if (tick_do_timer_cpu == TICK_DO_TIMER_BOOT) { ++ ktime_t next_p; ++ u32 rem; ++ + tick_do_timer_cpu = cpu; + +- tick_next_period = ktime_get(); ++ next_p = ktime_get(); ++ div_u64_rem(next_p, TICK_NSEC, &rem); ++ if (rem) { ++ next_p -= rem; ++ next_p += TICK_NSEC; ++ } ++ ++ tick_next_period = next_p; + #ifdef CONFIG_NO_HZ_FULL + /* + * The boot CPU may be nohz_full, in which case set +-- +2.39.2 + diff --git a/queue-5.4/tick-get-rid-of-tick_period.patch b/queue-5.4/tick-get-rid-of-tick_period.patch new file mode 100644 index 00000000000..065203f296f --- /dev/null +++ b/queue-5.4/tick-get-rid-of-tick_period.patch @@ -0,0 +1,192 @@ +From f786046c8d8283c1e30b7d3b775822010000fa10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:19:49 +0100 +Subject: tick: Get rid of tick_period + +From: Thomas Gleixner + +[ Upstream commit b996544916429946bf4934c1c01a306d1690972c ] + +The variable tick_period is initialized to NSEC_PER_TICK / HZ during boot +and never updated again. + +If NSEC_PER_TICK is not an integer multiple of HZ this computation is less +accurate than TICK_NSEC which has proper rounding in place. + +Aside of the inaccuracy there is no reason for having this variable at +all. It's just a pointless indirection and all usage sites can just use the +TICK_NSEC constant. + +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201117132006.766643526@linutronix.de +Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.") +Signed-off-by: Sasha Levin +--- + kernel/time/tick-broadcast.c | 2 +- + kernel/time/tick-common.c | 8 +++----- + kernel/time/tick-internal.h | 1 - + kernel/time/tick-sched.c | 22 +++++++++++----------- + 4 files changed, 15 insertions(+), 18 deletions(-) + +diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c +index e51778c312f1c..ce7339ff10d22 100644 +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -331,7 +331,7 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev) + bc_local = tick_do_periodic_broadcast(); + + if (clockevent_state_oneshot(dev)) { +- ktime_t next = ktime_add(dev->next_event, tick_period); ++ ktime_t next = ktime_add_ns(dev->next_event, TICK_NSEC); + + clockevents_program_event(dev, next, true); + } +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index 6c9c342dd0e53..92bf99d558b48 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -30,7 +30,6 @@ DEFINE_PER_CPU(struct tick_device, tick_cpu_device); + * Tick next event: keeps track of the tick time + */ + ktime_t tick_next_period; +-ktime_t tick_period; + + /* + * tick_do_timer_cpu is a timer core internal variable which holds the CPU NR +@@ -88,7 +87,7 @@ static void tick_periodic(int cpu) + write_seqcount_begin(&jiffies_seq); + + /* Keep track of the next tick event */ +- tick_next_period = ktime_add(tick_next_period, tick_period); ++ tick_next_period = ktime_add_ns(tick_next_period, TICK_NSEC); + + do_timer(1); + write_seqcount_end(&jiffies_seq); +@@ -127,7 +126,7 @@ void tick_handle_periodic(struct clock_event_device *dev) + * Setup the next period for devices, which do not have + * periodic mode: + */ +- next = ktime_add(next, tick_period); ++ next = ktime_add_ns(next, TICK_NSEC); + + if (!clockevents_program_event(dev, next, false)) + return; +@@ -173,7 +172,7 @@ void tick_setup_periodic(struct clock_event_device *dev, int broadcast) + for (;;) { + if (!clockevents_program_event(dev, next, false)) + return; +- next = ktime_add(next, tick_period); ++ next = ktime_add_ns(next, TICK_NSEC); + } + } + } +@@ -220,7 +219,6 @@ static void tick_setup_device(struct tick_device *td, + tick_do_timer_cpu = cpu; + + tick_next_period = ktime_get(); +- tick_period = NSEC_PER_SEC / HZ; + #ifdef CONFIG_NO_HZ_FULL + /* + * The boot CPU may be nohz_full, in which case set +diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h +index 5294f5b1f9550..e61c1244e7d46 100644 +--- a/kernel/time/tick-internal.h ++++ b/kernel/time/tick-internal.h +@@ -15,7 +15,6 @@ + + DECLARE_PER_CPU(struct tick_device, tick_cpu_device); + extern ktime_t tick_next_period; +-extern ktime_t tick_period; + extern int tick_do_timer_cpu __read_mostly; + + extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast); +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 3b00167656d78..1b5037ba4ec40 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -92,17 +92,17 @@ static void tick_do_update_jiffies64(ktime_t now) + write_seqcount_begin(&jiffies_seq); + + delta = ktime_sub(now, tick_next_period); +- if (unlikely(delta >= tick_period)) { ++ if (unlikely(delta >= TICK_NSEC)) { + /* Slow path for long idle sleep times */ +- s64 incr = ktime_to_ns(tick_period); ++ s64 incr = TICK_NSEC; + + ticks += ktime_divns(delta, incr); + + last_jiffies_update = ktime_add_ns(last_jiffies_update, + incr * ticks); + } else { +- last_jiffies_update = ktime_add(last_jiffies_update, +- tick_period); ++ last_jiffies_update = ktime_add_ns(last_jiffies_update, ++ TICK_NSEC); + } + + do_timer(ticks); +@@ -112,7 +112,7 @@ static void tick_do_update_jiffies64(ktime_t now) + * pairs with the READ_ONCE() in the lockless quick check above. + */ + WRITE_ONCE(tick_next_period, +- ktime_add(last_jiffies_update, tick_period)); ++ ktime_add_ns(last_jiffies_update, TICK_NSEC)); + + write_seqcount_end(&jiffies_seq); + raw_spin_unlock(&jiffies_lock); +@@ -659,7 +659,7 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now) + hrtimer_set_expires(&ts->sched_timer, ts->last_tick); + + /* Forward the time to expire in the future */ +- hrtimer_forward(&ts->sched_timer, now, tick_period); ++ hrtimer_forward(&ts->sched_timer, now, TICK_NSEC); + + if (ts->nohz_mode == NOHZ_MODE_HIGHRES) { + hrtimer_start_expires(&ts->sched_timer, +@@ -1221,7 +1221,7 @@ static void tick_nohz_handler(struct clock_event_device *dev) + if (unlikely(ts->tick_stopped)) + return; + +- hrtimer_forward(&ts->sched_timer, now, tick_period); ++ hrtimer_forward(&ts->sched_timer, now, TICK_NSEC); + tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1); + } + +@@ -1258,7 +1258,7 @@ static void tick_nohz_switch_to_nohz(void) + next = tick_init_jiffy_update(); + + hrtimer_set_expires(&ts->sched_timer, next); +- hrtimer_forward_now(&ts->sched_timer, tick_period); ++ hrtimer_forward_now(&ts->sched_timer, TICK_NSEC); + tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1); + tick_nohz_activate(ts, NOHZ_MODE_LOWRES); + } +@@ -1324,7 +1324,7 @@ static enum hrtimer_restart tick_sched_timer(struct hrtimer *timer) + if (unlikely(ts->tick_stopped)) + return HRTIMER_NORESTART; + +- hrtimer_forward(timer, now, tick_period); ++ hrtimer_forward(timer, now, TICK_NSEC); + + return HRTIMER_RESTART; + } +@@ -1358,13 +1358,13 @@ void tick_setup_sched_timer(void) + + /* Offset the tick to avert jiffies_lock contention. */ + if (sched_skew_tick) { +- u64 offset = ktime_to_ns(tick_period) >> 1; ++ u64 offset = TICK_NSEC >> 1; + do_div(offset, num_possible_cpus()); + offset *= smp_processor_id(); + hrtimer_add_expires_ns(&ts->sched_timer, offset); + } + +- hrtimer_forward(&ts->sched_timer, now, tick_period); ++ hrtimer_forward(&ts->sched_timer, now, TICK_NSEC); + hrtimer_start_expires(&ts->sched_timer, HRTIMER_MODE_ABS_PINNED_HARD); + tick_nohz_activate(ts, NOHZ_MODE_HIGHRES); + } +-- +2.39.2 + diff --git a/queue-5.4/tick-sched-optimize-tick_do_update_jiffies64-further.patch b/queue-5.4/tick-sched-optimize-tick_do_update_jiffies64-further.patch new file mode 100644 index 00000000000..123ef1b29d9 --- /dev/null +++ b/queue-5.4/tick-sched-optimize-tick_do_update_jiffies64-further.patch @@ -0,0 +1,62 @@ +From 0259d65a05de18da3dc82eab1030aab889f12714 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:19:47 +0100 +Subject: tick/sched: Optimize tick_do_update_jiffies64() further + +From: Thomas Gleixner + +[ Upstream commit 7a35bf2a6a871cd0252cd371d741e7d070b53af9 ] + +Now that it's clear that there is always one tick to account, simplify the +calculations some more. + +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201117132006.565663056@linutronix.de +Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.") +Signed-off-by: Sasha Levin +--- + kernel/time/tick-sched.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index eaeeb4bb1f8ab..3b00167656d78 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -53,7 +53,7 @@ static ktime_t last_jiffies_update; + */ + static void tick_do_update_jiffies64(ktime_t now) + { +- unsigned long ticks = 0; ++ unsigned long ticks = 1; + ktime_t delta; + + /* +@@ -91,20 +91,21 @@ static void tick_do_update_jiffies64(ktime_t now) + + write_seqcount_begin(&jiffies_seq); + +- last_jiffies_update = ktime_add(last_jiffies_update, tick_period); +- + delta = ktime_sub(now, tick_next_period); + if (unlikely(delta >= tick_period)) { + /* Slow path for long idle sleep times */ + s64 incr = ktime_to_ns(tick_period); + +- ticks = ktime_divns(delta, incr); ++ ticks += ktime_divns(delta, incr); + + last_jiffies_update = ktime_add_ns(last_jiffies_update, + incr * ticks); ++ } else { ++ last_jiffies_update = ktime_add(last_jiffies_update, ++ tick_period); + } + +- do_timer(++ticks); ++ do_timer(ticks); + + /* + * Keep the tick_next_period variable up to date. WRITE_ONCE() +-- +2.39.2 + diff --git a/queue-5.4/tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch b/queue-5.4/tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch new file mode 100644 index 00000000000..32e908fecfd --- /dev/null +++ b/queue-5.4/tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch @@ -0,0 +1,95 @@ +From 6b3839e771988366f333ad251c4c4474deae7a4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:19:46 +0100 +Subject: tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64() + +From: Yunfeng Ye + +[ Upstream commit 94ad2e3cedb82af034f6d97c58022f162b669f9b ] + +If jiffies are up to date already (caller lost the race against another +CPU) there is no point to change the sequence count. Doing that just forces +other CPUs into the seqcount retry loop in tick_nohz_next_event() for +nothing. + +Just bail out early. + +[ tglx: Rewrote most of it ] + +Signed-off-by: Yunfeng Ye +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201117132006.462195901@linutronix.de +Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.") +Signed-off-by: Sasha Levin +--- + kernel/time/tick-sched.c | 47 +++++++++++++++++++--------------------- + 1 file changed, 22 insertions(+), 25 deletions(-) + +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 1dfa53494164a..eaeeb4bb1f8ab 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -84,38 +84,35 @@ static void tick_do_update_jiffies64(ktime_t now) + + /* Reevaluate with jiffies_lock held */ + raw_spin_lock(&jiffies_lock); ++ if (ktime_before(now, tick_next_period)) { ++ raw_spin_unlock(&jiffies_lock); ++ return; ++ } ++ + write_seqcount_begin(&jiffies_seq); + +- delta = ktime_sub(now, last_jiffies_update); +- if (delta >= tick_period) { ++ last_jiffies_update = ktime_add(last_jiffies_update, tick_period); + +- delta = ktime_sub(delta, tick_period); +- last_jiffies_update = ktime_add(last_jiffies_update, +- tick_period); ++ delta = ktime_sub(now, tick_next_period); ++ if (unlikely(delta >= tick_period)) { ++ /* Slow path for long idle sleep times */ ++ s64 incr = ktime_to_ns(tick_period); + +- /* Slow path for long timeouts */ +- if (unlikely(delta >= tick_period)) { +- s64 incr = ktime_to_ns(tick_period); ++ ticks = ktime_divns(delta, incr); + +- ticks = ktime_divns(delta, incr); ++ last_jiffies_update = ktime_add_ns(last_jiffies_update, ++ incr * ticks); ++ } + +- last_jiffies_update = ktime_add_ns(last_jiffies_update, +- incr * ticks); +- } +- do_timer(++ticks); ++ do_timer(++ticks); ++ ++ /* ++ * Keep the tick_next_period variable up to date. WRITE_ONCE() ++ * pairs with the READ_ONCE() in the lockless quick check above. ++ */ ++ WRITE_ONCE(tick_next_period, ++ ktime_add(last_jiffies_update, tick_period)); + +- /* +- * Keep the tick_next_period variable up to date. +- * WRITE_ONCE() pairs with the READ_ONCE() in the lockless +- * quick check above. +- */ +- WRITE_ONCE(tick_next_period, +- ktime_add(last_jiffies_update, tick_period)); +- } else { +- write_seqcount_end(&jiffies_seq); +- raw_spin_unlock(&jiffies_lock); +- return; +- } + write_seqcount_end(&jiffies_seq); + raw_spin_unlock(&jiffies_lock); + update_wall_time(); +-- +2.39.2 + diff --git a/queue-5.4/tick-sched-use-tick_next_period-for-lockless-quick-c.patch b/queue-5.4/tick-sched-use-tick_next_period-for-lockless-quick-c.patch new file mode 100644 index 00000000000..a3fc962bde6 --- /dev/null +++ b/queue-5.4/tick-sched-use-tick_next_period-for-lockless-quick-c.patch @@ -0,0 +1,105 @@ +From 2d3926c506fee9e8c9708a6f6d0c073b181d8168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:19:45 +0100 +Subject: tick/sched: Use tick_next_period for lockless quick check + +From: Thomas Gleixner + +[ Upstream commit 372acbbaa80940189593f9d69c7c069955f24f7a ] + +No point in doing calculations. + + tick_next_period = last_jiffies_update + tick_period + +Just check whether now is before tick_next_period to figure out whether +jiffies need an update. + +Add a comment why the intentional data race in the quick check is safe or +not so safe in a 32bit corner case and why we don't worry about it. + +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201117132006.337366695@linutronix.de +Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.") +Signed-off-by: Sasha Levin +--- + kernel/time/tick-sched.c | 46 ++++++++++++++++++++++++++++------------ + 1 file changed, 33 insertions(+), 13 deletions(-) + +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 88a508cc89255..1dfa53494164a 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -57,11 +57,29 @@ static void tick_do_update_jiffies64(ktime_t now) + ktime_t delta; + + /* +- * Do a quick check without holding jiffies_lock: +- * The READ_ONCE() pairs with two updates done later in this function. ++ * Do a quick check without holding jiffies_lock. The READ_ONCE() ++ * pairs with the update done later in this function. ++ * ++ * This is also an intentional data race which is even safe on ++ * 32bit in theory. If there is a concurrent update then the check ++ * might give a random answer. It does not matter because if it ++ * returns then the concurrent update is already taking care, if it ++ * falls through then it will pointlessly contend on jiffies_lock. ++ * ++ * Though there is one nasty case on 32bit due to store tearing of ++ * the 64bit value. If the first 32bit store makes the quick check ++ * return on all other CPUs and the writing CPU context gets ++ * delayed to complete the second store (scheduled out on virt) ++ * then jiffies can become stale for up to ~2^32 nanoseconds ++ * without noticing. After that point all CPUs will wait for ++ * jiffies lock. ++ * ++ * OTOH, this is not any different than the situation with NOHZ=off ++ * where one CPU is responsible for updating jiffies and ++ * timekeeping. If that CPU goes out for lunch then all other CPUs ++ * will operate on stale jiffies until it decides to come back. + */ +- delta = ktime_sub(now, READ_ONCE(last_jiffies_update)); +- if (delta < tick_period) ++ if (ktime_before(now, READ_ONCE(tick_next_period))) + return; + + /* Reevaluate with jiffies_lock held */ +@@ -72,9 +90,8 @@ static void tick_do_update_jiffies64(ktime_t now) + if (delta >= tick_period) { + + delta = ktime_sub(delta, tick_period); +- /* Pairs with the lockless read in this function. */ +- WRITE_ONCE(last_jiffies_update, +- ktime_add(last_jiffies_update, tick_period)); ++ last_jiffies_update = ktime_add(last_jiffies_update, ++ tick_period); + + /* Slow path for long timeouts */ + if (unlikely(delta >= tick_period)) { +@@ -82,15 +99,18 @@ static void tick_do_update_jiffies64(ktime_t now) + + ticks = ktime_divns(delta, incr); + +- /* Pairs with the lockless read in this function. */ +- WRITE_ONCE(last_jiffies_update, +- ktime_add_ns(last_jiffies_update, +- incr * ticks)); ++ last_jiffies_update = ktime_add_ns(last_jiffies_update, ++ incr * ticks); + } + do_timer(++ticks); + +- /* Keep the tick_next_period variable up to date */ +- tick_next_period = ktime_add(last_jiffies_update, tick_period); ++ /* ++ * Keep the tick_next_period variable up to date. ++ * WRITE_ONCE() pairs with the READ_ONCE() in the lockless ++ * quick check above. ++ */ ++ WRITE_ONCE(tick_next_period, ++ ktime_add(last_jiffies_update, tick_period)); + } else { + write_seqcount_end(&jiffies_seq); + raw_spin_unlock(&jiffies_lock); +-- +2.39.2 + diff --git a/queue-5.4/timekeeping-split-jiffies-seqlock.patch b/queue-5.4/timekeeping-split-jiffies-seqlock.patch new file mode 100644 index 00000000000..ebc0045fdd7 --- /dev/null +++ b/queue-5.4/timekeeping-split-jiffies-seqlock.patch @@ -0,0 +1,189 @@ +From f239a846198a9ce30df505599ef702ae81d10328 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Mar 2020 12:25:58 +0100 +Subject: timekeeping: Split jiffies seqlock + +From: Thomas Gleixner + +[ Upstream commit e5d4d1756b07d9490a0269a9e68c1e05ee1feb9b ] + +seqlock consists of a sequence counter and a spinlock_t which is used to +serialize the writers. spinlock_t is substituted by a "sleeping" spinlock +on PREEMPT_RT enabled kernels which breaks the usage in the timekeeping +code as the writers are executed in hard interrupt and therefore +non-preemptible context even on PREEMPT_RT. + +The spinlock in seqlock cannot be unconditionally replaced by a +raw_spinlock_t as many seqlock users have nesting spinlock sections or +other code which is not suitable to run in truly atomic context on RT. + +Instead of providing a raw_seqlock API for a single use case, open code the +seqlock for the jiffies use case and implement it with a raw_spinlock_t and +a sequence counter. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20200321113242.120587764@linutronix.de +Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.") +Signed-off-by: Sasha Levin +--- + kernel/time/jiffies.c | 7 ++++--- + kernel/time/tick-common.c | 10 ++++++---- + kernel/time/tick-sched.c | 19 ++++++++++++------- + kernel/time/timekeeping.c | 6 ++++-- + kernel/time/timekeeping.h | 3 ++- + 5 files changed, 28 insertions(+), 17 deletions(-) + +diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c +index d23b434c2ca7b..eddcf49704445 100644 +--- a/kernel/time/jiffies.c ++++ b/kernel/time/jiffies.c +@@ -58,7 +58,8 @@ static struct clocksource clocksource_jiffies = { + .max_cycles = 10, + }; + +-__cacheline_aligned_in_smp DEFINE_SEQLOCK(jiffies_lock); ++__cacheline_aligned_in_smp DEFINE_RAW_SPINLOCK(jiffies_lock); ++__cacheline_aligned_in_smp seqcount_t jiffies_seq; + + #if (BITS_PER_LONG < 64) + u64 get_jiffies_64(void) +@@ -67,9 +68,9 @@ u64 get_jiffies_64(void) + u64 ret; + + do { +- seq = read_seqbegin(&jiffies_lock); ++ seq = read_seqcount_begin(&jiffies_seq); + ret = jiffies_64; +- } while (read_seqretry(&jiffies_lock, seq)); ++ } while (read_seqcount_retry(&jiffies_seq, seq)); + return ret; + } + EXPORT_SYMBOL(get_jiffies_64); +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index 7e5d3524e924d..6c9c342dd0e53 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -84,13 +84,15 @@ int tick_is_oneshot_available(void) + static void tick_periodic(int cpu) + { + if (tick_do_timer_cpu == cpu) { +- write_seqlock(&jiffies_lock); ++ raw_spin_lock(&jiffies_lock); ++ write_seqcount_begin(&jiffies_seq); + + /* Keep track of the next tick event */ + tick_next_period = ktime_add(tick_next_period, tick_period); + + do_timer(1); +- write_sequnlock(&jiffies_lock); ++ write_seqcount_end(&jiffies_seq); ++ raw_spin_unlock(&jiffies_lock); + update_wall_time(); + } + +@@ -162,9 +164,9 @@ void tick_setup_periodic(struct clock_event_device *dev, int broadcast) + ktime_t next; + + do { +- seq = read_seqbegin(&jiffies_lock); ++ seq = read_seqcount_begin(&jiffies_seq); + next = tick_next_period; +- } while (read_seqretry(&jiffies_lock, seq)); ++ } while (read_seqcount_retry(&jiffies_seq, seq)); + + clockevents_switch_state(dev, CLOCK_EVT_STATE_ONESHOT); + +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 5eb04bb598026..88a508cc89255 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -65,7 +65,8 @@ static void tick_do_update_jiffies64(ktime_t now) + return; + + /* Reevaluate with jiffies_lock held */ +- write_seqlock(&jiffies_lock); ++ raw_spin_lock(&jiffies_lock); ++ write_seqcount_begin(&jiffies_seq); + + delta = ktime_sub(now, last_jiffies_update); + if (delta >= tick_period) { +@@ -91,10 +92,12 @@ static void tick_do_update_jiffies64(ktime_t now) + /* Keep the tick_next_period variable up to date */ + tick_next_period = ktime_add(last_jiffies_update, tick_period); + } else { +- write_sequnlock(&jiffies_lock); ++ write_seqcount_end(&jiffies_seq); ++ raw_spin_unlock(&jiffies_lock); + return; + } +- write_sequnlock(&jiffies_lock); ++ write_seqcount_end(&jiffies_seq); ++ raw_spin_unlock(&jiffies_lock); + update_wall_time(); + } + +@@ -105,12 +108,14 @@ static ktime_t tick_init_jiffy_update(void) + { + ktime_t period; + +- write_seqlock(&jiffies_lock); ++ raw_spin_lock(&jiffies_lock); ++ write_seqcount_begin(&jiffies_seq); + /* Did we start the jiffies update yet ? */ + if (last_jiffies_update == 0) + last_jiffies_update = tick_next_period; + period = last_jiffies_update; +- write_sequnlock(&jiffies_lock); ++ write_seqcount_end(&jiffies_seq); ++ raw_spin_unlock(&jiffies_lock); + return period; + } + +@@ -665,10 +670,10 @@ static ktime_t tick_nohz_next_event(struct tick_sched *ts, int cpu) + + /* Read jiffies and the time when jiffies were updated last */ + do { +- seq = read_seqbegin(&jiffies_lock); ++ seq = read_seqcount_begin(&jiffies_seq); + basemono = last_jiffies_update; + basejiff = jiffies; +- } while (read_seqretry(&jiffies_lock, seq)); ++ } while (read_seqcount_retry(&jiffies_seq, seq)); + ts->last_jiffies = basejiff; + ts->timer_expires_base = basemono; + +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 2bc278dd98546..105dd0b663291 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -2415,8 +2415,10 @@ EXPORT_SYMBOL(hardpps); + */ + void xtime_update(unsigned long ticks) + { +- write_seqlock(&jiffies_lock); ++ raw_spin_lock(&jiffies_lock); ++ write_seqcount_begin(&jiffies_seq); + do_timer(ticks); +- write_sequnlock(&jiffies_lock); ++ write_seqcount_end(&jiffies_seq); ++ raw_spin_unlock(&jiffies_lock); + update_wall_time(); + } +diff --git a/kernel/time/timekeeping.h b/kernel/time/timekeeping.h +index 141ab3ab0354f..099737f6f10c7 100644 +--- a/kernel/time/timekeeping.h ++++ b/kernel/time/timekeeping.h +@@ -25,7 +25,8 @@ static inline void sched_clock_resume(void) { } + extern void do_timer(unsigned long ticks); + extern void update_wall_time(void); + +-extern seqlock_t jiffies_lock; ++extern raw_spinlock_t jiffies_lock; ++extern seqcount_t jiffies_seq; + + #define CS_NAME_LEN 32 + +-- +2.39.2 + diff --git a/queue-5.4/tools-bpftool-remove-invalid-json-escape.patch b/queue-5.4/tools-bpftool-remove-invalid-json-escape.patch new file mode 100644 index 00000000000..9dcc64a051a --- /dev/null +++ b/queue-5.4/tools-bpftool-remove-invalid-json-escape.patch @@ -0,0 +1,53 @@ +From f1f36e031cc2f3836546097ba33b427ea1b68595 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 16:08:54 +0100 +Subject: tools: bpftool: Remove invalid \' json escape + +From: Luis Gerhorst + +[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ] + +RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange +Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid +two-character escape sequences. This does not include \', which is not +required in JSON because it exclusively uses double quotes as string +separators. + +Solidus (/) may be escaped, but does not have to. Only reverse +solidus (\), double quotes ("), and the control characters have to be +escaped. Therefore, with this fix, bpftool correctly supports all valid +two-character escape sequences (but still does not support characters +that require multi-character escape sequences). + +Witout this fix, attempting to load a JSON file generated by bpftool +using Python 3.10.6's default json.load() may fail with the error +"Invalid \escape" if the file contains the invalid escaped single +quote (\'). + +Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository") +Signed-off-by: Luis Gerhorst +Signed-off-by: Andrii Nakryiko +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/json_writer.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c +index 86501cd3c763e..f2be9ef2c2d50 100644 +--- a/tools/bpf/bpftool/json_writer.c ++++ b/tools/bpf/bpftool/json_writer.c +@@ -80,9 +80,6 @@ static void jsonw_puts(json_writer_t *self, const char *str) + case '"': + fputs("\\\"", self->out); + break; +- case '\'': +- fputs("\\\'", self->out); +- break; + default: + putc(*str, self->out); + } +-- +2.39.2 + diff --git a/queue-5.4/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch b/queue-5.4/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch new file mode 100644 index 00000000000..4836c1aadf5 --- /dev/null +++ b/queue-5.4/tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch @@ -0,0 +1,113 @@ +From 1381f6f0b2bf47f70af0f37a00a5da51747faa4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Nov 2022 14:55:28 +0100 +Subject: tpm, tpm_tis: Do not skip reset of original interrupt vector + +From: Lino Sanfilippo + +[ Upstream commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 ] + +If in tpm_tis_probe_irq_single() an error occurs after the original +interrupt vector has been read, restore the interrupts before the error is +returned. + +Since the caller does not check the error value, return -1 in any case that +the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function +tpm_tis_gen_interrupt() is not longer used, make it a void function. + +Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access") +Signed-off-by: Lino Sanfilippo +Tested-by: Jarkko Sakkinen +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 29 +++++++++++------------------ + 1 file changed, 11 insertions(+), 18 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 70f7859942287..cb0660304e480 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -613,7 +613,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id) + return IRQ_HANDLED; + } + +-static int tpm_tis_gen_interrupt(struct tpm_chip *chip) ++static void tpm_tis_gen_interrupt(struct tpm_chip *chip) + { + const char *desc = "attempting to generate an interrupt"; + u32 cap2; +@@ -622,7 +622,7 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + + ret = request_locality(chip, 0); + if (ret < 0) +- return ret; ++ return; + + if (chip->flags & TPM_CHIP_FLAG_TPM2) + ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc); +@@ -630,8 +630,6 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip) + ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0); + + release_locality(chip, 0); +- +- return ret; + } + + /* Register the IRQ and issue a command that will cause an interrupt. If an +@@ -661,42 +659,37 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask, + + rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + rc = tpm_tis_read32(priv, TPM_INT_STATUS(priv->locality), &int_status); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + /* Clear all existing */ + rc = tpm_tis_write32(priv, TPM_INT_STATUS(priv->locality), int_status); + if (rc < 0) +- return rc; +- ++ goto restore_irqs; + /* Turn on */ + rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), + intmask | TPM_GLOBAL_INT_ENABLE); + if (rc < 0) +- return rc; ++ goto restore_irqs; + + priv->irq_tested = false; + + /* Generate an interrupt by having the core call through to + * tpm_tis_send + */ +- rc = tpm_tis_gen_interrupt(chip); +- if (rc < 0) +- return rc; ++ tpm_tis_gen_interrupt(chip); + ++restore_irqs: + /* tpm_tis_send will either confirm the interrupt is working or it + * will call disable_irq which undoes all of the above. + */ + if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) { +- rc = tpm_tis_write8(priv, original_int_vec, +- TPM_INT_VECTOR(priv->locality)); +- if (rc < 0) +- return rc; +- +- return 1; ++ tpm_tis_write8(priv, original_int_vec, ++ TPM_INT_VECTOR(priv->locality)); ++ return -1; + } + + return 0; +-- +2.39.2 + diff --git a/queue-5.4/treewide-remove-redundant-is_err-before-error-code-c.patch b/queue-5.4/treewide-remove-redundant-is_err-before-error-code-c.patch new file mode 100644 index 00000000000..dbbe0e2c9ae --- /dev/null +++ b/queue-5.4/treewide-remove-redundant-is_err-before-error-code-c.patch @@ -0,0 +1,488 @@ +From ad5bc285754907f70d1dd8145caded48cc66441c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Feb 2020 17:37:45 -0800 +Subject: treewide: remove redundant IS_ERR() before error code check + +From: Masahiro Yamada + +[ Upstream commit 45586c7078d42b932c5399953d21746800083691 ] + +'PTR_ERR(p) == -E*' is a stronger condition than IS_ERR(p). +Hence, IS_ERR(p) is unneeded. + +The semantic patch that generates this commit is as follows: + +// +@@ +expression ptr; +constant error_code; +@@ +-IS_ERR(ptr) && (PTR_ERR(ptr) == - error_code) ++PTR_ERR(ptr) == - error_code +// + +Link: http://lkml.kernel.org/r/20200106045833.1725-1-masahiroy@kernel.org +Signed-off-by: Masahiro Yamada +Cc: Julia Lawall +Acked-by: Stephen Boyd [drivers/clk/clk.c] +Acked-by: Bartosz Golaszewski [GPIO] +Acked-by: Wolfram Sang [drivers/i2c] +Acked-by: Rafael J. Wysocki [acpi/scan.c] +Acked-by: Rob Herring +Cc: Eric Biggers +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Stable-dep-of: 827026ae2e56 ("dmaengine: mv_xor_v2: Fix an error code.") +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 2 +- + drivers/acpi/scan.c | 2 +- + drivers/char/hw_random/bcm2835-rng.c | 2 +- + drivers/char/hw_random/omap-rng.c | 4 ++-- + drivers/clk/clk.c | 2 +- + drivers/dma/mv_xor_v2.c | 2 +- + drivers/gpio/gpiolib-devres.c | 2 +- + drivers/gpio/gpiolib-of.c | 8 ++++---- + drivers/gpio/gpiolib.c | 2 +- + drivers/i2c/busses/i2c-mv64xxx.c | 5 ++--- + drivers/i2c/busses/i2c-synquacer.c | 2 +- + drivers/mtd/ubi/build.c | 2 +- + drivers/of/device.c | 2 +- + drivers/pci/controller/pci-tegra.c | 2 +- + drivers/phy/phy-core.c | 4 ++-- + drivers/spi/spi-orion.c | 3 +-- + drivers/video/fbdev/imxfb.c | 2 +- + fs/ext4/super.c | 2 +- + fs/f2fs/node.c | 2 +- + fs/ocfs2/suballoc.c | 2 +- + fs/sysfs/group.c | 2 +- + net/core/dev.c | 2 +- + net/core/filter.c | 2 +- + net/xfrm/xfrm_policy.c | 2 +- + sound/soc/codecs/ak4104.c | 3 +-- + sound/soc/codecs/cs4270.c | 3 +-- + sound/soc/codecs/tlv320aic32x4.c | 6 ++---- + sound/soc/sunxi/sun4i-spdif.c | 2 +- + 28 files changed, 35 insertions(+), 41 deletions(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index 4a2e91baabdef..bb13acef2cb95 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -170,7 +170,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + sa->salg_name[addr_len - sizeof(*sa) - 1] = 0; + + type = alg_get_type(sa->salg_type); +- if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) { ++ if (PTR_ERR(type) == -ENOENT) { + request_module("algif-%s", sa->salg_type); + type = alg_get_type(sa->salg_type); + } +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 5d4be80ee6cb4..0c40e1098064a 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -1506,7 +1506,7 @@ int acpi_dma_configure(struct device *dev, enum dev_dma_attr attr) + iort_dma_setup(dev, &dma_addr, &size); + + iommu = iort_iommu_configure(dev); +- if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER) ++ if (PTR_ERR(iommu) == -EPROBE_DEFER) + return -EPROBE_DEFER; + + arch_setup_dma_ops(dev, dma_addr, size, +diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c +index f759790c3cdb6..b40601b3127e3 100644 +--- a/drivers/char/hw_random/bcm2835-rng.c ++++ b/drivers/char/hw_random/bcm2835-rng.c +@@ -160,7 +160,7 @@ static int bcm2835_rng_probe(struct platform_device *pdev) + + /* Clock is optional on most platforms */ + priv->clk = devm_clk_get(dev, NULL); +- if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER) ++ if (PTR_ERR(priv->clk) == -EPROBE_DEFER) + return -EPROBE_DEFER; + + priv->rng.name = pdev->name; +diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c +index e329f82c0467f..9ad3e12430c3c 100644 +--- a/drivers/char/hw_random/omap-rng.c ++++ b/drivers/char/hw_random/omap-rng.c +@@ -478,7 +478,7 @@ static int omap_rng_probe(struct platform_device *pdev) + } + + priv->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER) ++ if (PTR_ERR(priv->clk) == -EPROBE_DEFER) + return -EPROBE_DEFER; + if (!IS_ERR(priv->clk)) { + ret = clk_prepare_enable(priv->clk); +@@ -490,7 +490,7 @@ static int omap_rng_probe(struct platform_device *pdev) + } + + priv->clk_reg = devm_clk_get(&pdev->dev, "reg"); +- if (IS_ERR(priv->clk_reg) && PTR_ERR(priv->clk_reg) == -EPROBE_DEFER) ++ if (PTR_ERR(priv->clk_reg) == -EPROBE_DEFER) + return -EPROBE_DEFER; + if (!IS_ERR(priv->clk_reg)) { + ret = clk_prepare_enable(priv->clk_reg); +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 1c73668b43755..fb7b49521646a 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -444,7 +444,7 @@ static void clk_core_fill_parent_index(struct clk_core *core, u8 index) + parent = ERR_PTR(-EPROBE_DEFER); + } else { + parent = clk_core_get(core, index); +- if (IS_ERR(parent) && PTR_ERR(parent) == -ENOENT && entry->name) ++ if (PTR_ERR(parent) == -ENOENT && entry->name) + parent = clk_core_lookup(entry->name); + } + +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index 3fa884145eb1e..741b7270a9f5f 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -750,7 +750,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev) + } + + xor_dev->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) { ++ if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) { + ret = EPROBE_DEFER; + goto disable_reg_clk; + } +diff --git a/drivers/gpio/gpiolib-devres.c b/drivers/gpio/gpiolib-devres.c +index 98e3c20d9730e..3fc5b86e03faa 100644 +--- a/drivers/gpio/gpiolib-devres.c ++++ b/drivers/gpio/gpiolib-devres.c +@@ -323,7 +323,7 @@ devm_gpiod_get_array_optional(struct device *dev, const char *con_id, + struct gpio_descs *descs; + + descs = devm_gpiod_get_array(dev, con_id, flags); +- if (IS_ERR(descs) && (PTR_ERR(descs) == -ENOENT)) ++ if (PTR_ERR(descs) == -ENOENT) + return NULL; + + return descs; +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index 73807c897391c..34e0c3f106566 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -498,24 +498,24 @@ struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id, + break; + } + +- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT) { ++ if (PTR_ERR(desc) == -ENOENT) { + /* Special handling for SPI GPIOs if used */ + desc = of_find_spi_gpio(dev, con_id, &of_flags); + } + +- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT) { ++ if (PTR_ERR(desc) == -ENOENT) { + /* This quirk looks up flags and all */ + desc = of_find_spi_cs_gpio(dev, con_id, idx, flags); + if (!IS_ERR(desc)) + return desc; + } + +- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT) { ++ if (PTR_ERR(desc) == -ENOENT) { + /* Special handling for regulator GPIOs if used */ + desc = of_find_regulator_gpio(dev, con_id, &of_flags); + } + +- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT) ++ if (PTR_ERR(desc) == -ENOENT) + desc = of_find_arizona_gpio(dev, con_id, &of_flags); + + if (IS_ERR(desc)) +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index abdf448b11a3d..06aeb75db6c68 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -4894,7 +4894,7 @@ struct gpio_descs *__must_check gpiod_get_array_optional(struct device *dev, + struct gpio_descs *descs; + + descs = gpiod_get_array(dev, con_id, flags); +- if (IS_ERR(descs) && (PTR_ERR(descs) == -ENOENT)) ++ if (PTR_ERR(descs) == -ENOENT) + return NULL; + + return descs; +diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c +index a5a95ea5b81a7..febb7c7ea72ba 100644 +--- a/drivers/i2c/busses/i2c-mv64xxx.c ++++ b/drivers/i2c/busses/i2c-mv64xxx.c +@@ -901,14 +901,13 @@ mv64xxx_i2c_probe(struct platform_device *pd) + + /* Not all platforms have clocks */ + drv_data->clk = devm_clk_get(&pd->dev, NULL); +- if (IS_ERR(drv_data->clk) && PTR_ERR(drv_data->clk) == -EPROBE_DEFER) ++ if (PTR_ERR(drv_data->clk) == -EPROBE_DEFER) + return -EPROBE_DEFER; + if (!IS_ERR(drv_data->clk)) + clk_prepare_enable(drv_data->clk); + + drv_data->reg_clk = devm_clk_get(&pd->dev, "reg"); +- if (IS_ERR(drv_data->reg_clk) && +- PTR_ERR(drv_data->reg_clk) == -EPROBE_DEFER) ++ if (PTR_ERR(drv_data->reg_clk) == -EPROBE_DEFER) + return -EPROBE_DEFER; + if (!IS_ERR(drv_data->reg_clk)) + clk_prepare_enable(drv_data->reg_clk); +diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c +index 39762f0611b18..86026798b4f76 100644 +--- a/drivers/i2c/busses/i2c-synquacer.c ++++ b/drivers/i2c/busses/i2c-synquacer.c +@@ -553,7 +553,7 @@ static int synquacer_i2c_probe(struct platform_device *pdev) + &i2c->pclkrate); + + i2c->pclk = devm_clk_get(&pdev->dev, "pclk"); +- if (IS_ERR(i2c->pclk) && PTR_ERR(i2c->pclk) == -EPROBE_DEFER) ++ if (PTR_ERR(i2c->pclk) == -EPROBE_DEFER) + return -EPROBE_DEFER; + if (!IS_ERR_OR_NULL(i2c->pclk)) { + dev_dbg(&pdev->dev, "clock source %p\n", i2c->pclk); +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index f29ed9102ce91..1c036356d6d3f 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -1168,7 +1168,7 @@ static struct mtd_info * __init open_mtd_device(const char *mtd_dev) + * MTD device name. + */ + mtd = get_mtd_device_nm(mtd_dev); +- if (IS_ERR(mtd) && PTR_ERR(mtd) == -ENODEV) ++ if (PTR_ERR(mtd) == -ENODEV) + /* Probably this is an MTD character device node path */ + mtd = open_mtd_by_chdev(mtd_dev); + } else +diff --git a/drivers/of/device.c b/drivers/of/device.c +index 7fb870097a849..aba1510f5d039 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -160,7 +160,7 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) + coherent ? " " : " not "); + + iommu = of_iommu_configure(dev, np); +- if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER) ++ if (PTR_ERR(iommu) == -EPROBE_DEFER) + return -EPROBE_DEFER; + + dev_dbg(dev, "device is%sbehind an iommu\n", +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index 99d505a85067b..b051130e45414 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -1381,7 +1381,7 @@ static struct phy *devm_of_phy_optional_get_index(struct device *dev, + phy = devm_of_phy_get(dev, np, name); + kfree(name); + +- if (IS_ERR(phy) && PTR_ERR(phy) == -ENODEV) ++ if (PTR_ERR(phy) == -ENODEV) + phy = NULL; + + return phy; +diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c +index b04f4fe85ac2d..48d355cf02105 100644 +--- a/drivers/phy/phy-core.c ++++ b/drivers/phy/phy-core.c +@@ -690,7 +690,7 @@ struct phy *phy_optional_get(struct device *dev, const char *string) + { + struct phy *phy = phy_get(dev, string); + +- if (IS_ERR(phy) && (PTR_ERR(phy) == -ENODEV)) ++ if (PTR_ERR(phy) == -ENODEV) + phy = NULL; + + return phy; +@@ -744,7 +744,7 @@ struct phy *devm_phy_optional_get(struct device *dev, const char *string) + { + struct phy *phy = devm_phy_get(dev, string); + +- if (IS_ERR(phy) && (PTR_ERR(phy) == -ENODEV)) ++ if (PTR_ERR(phy) == -ENODEV) + phy = NULL; + + return phy; +diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c +index 6643ccdc25085..989aa053471d3 100644 +--- a/drivers/spi/spi-orion.c ++++ b/drivers/spi/spi-orion.c +@@ -648,8 +648,7 @@ static int orion_spi_probe(struct platform_device *pdev) + + /* The following clock is only used by some SoCs */ + spi->axi_clk = devm_clk_get(&pdev->dev, "axi"); +- if (IS_ERR(spi->axi_clk) && +- PTR_ERR(spi->axi_clk) == -EPROBE_DEFER) { ++ if (PTR_ERR(spi->axi_clk) == -EPROBE_DEFER) { + status = -EPROBE_DEFER; + goto out_rel_clk; + } +diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c +index ffde3107104bc..4de59807e0c88 100644 +--- a/drivers/video/fbdev/imxfb.c ++++ b/drivers/video/fbdev/imxfb.c +@@ -1017,7 +1017,7 @@ static int imxfb_probe(struct platform_device *pdev) + } + + fbi->lcd_pwr = devm_regulator_get(&pdev->dev, "lcd"); +- if (IS_ERR(fbi->lcd_pwr) && (PTR_ERR(fbi->lcd_pwr) == -EPROBE_DEFER)) { ++ if (PTR_ERR(fbi->lcd_pwr) == -EPROBE_DEFER) { + ret = -EPROBE_DEFER; + goto failed_lcd; + } +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 789a9f6a2ec6e..8b564e40f736b 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -6172,7 +6172,7 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type, + bh = ext4_bread(handle, inode, blk, + EXT4_GET_BLOCKS_CREATE | + EXT4_GET_BLOCKS_METADATA_NOFAIL); +- } while (IS_ERR(bh) && (PTR_ERR(bh) == -ENOSPC) && ++ } while (PTR_ERR(bh) == -ENOSPC && + ext4_should_retry_alloc(inode->i_sb, &retries)); + if (IS_ERR(bh)) + return PTR_ERR(bh); +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index b080d5c58f6cb..dde8a99189899 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -879,7 +879,7 @@ static int truncate_dnode(struct dnode_of_data *dn) + + /* get direct node */ + page = f2fs_get_node_page(F2FS_I_SB(dn->inode), dn->nid); +- if (IS_ERR(page) && PTR_ERR(page) == -ENOENT) ++ if (PTR_ERR(page) == -ENOENT) + return 1; + else if (IS_ERR(page)) + return PTR_ERR(page); +diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c +index 5e0eaea474055..9e79fc6308da5 100644 +--- a/fs/ocfs2/suballoc.c ++++ b/fs/ocfs2/suballoc.c +@@ -696,7 +696,7 @@ static int ocfs2_block_group_alloc(struct ocfs2_super *osb, + + bg_bh = ocfs2_block_group_alloc_contig(osb, handle, alloc_inode, + ac, cl); +- if (IS_ERR(bg_bh) && (PTR_ERR(bg_bh) == -ENOSPC)) ++ if (PTR_ERR(bg_bh) == -ENOSPC) + bg_bh = ocfs2_block_group_alloc_discontig(handle, + alloc_inode, + ac, cl); +diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c +index d41c21fef1388..c4ab045926b7c 100644 +--- a/fs/sysfs/group.c ++++ b/fs/sysfs/group.c +@@ -449,7 +449,7 @@ int __compat_only_sysfs_link_entry_to_kobj(struct kobject *kobj, + } + + link = kernfs_create_link(kobj->sd, target_name, entry); +- if (IS_ERR(link) && PTR_ERR(link) == -EEXIST) ++ if (PTR_ERR(link) == -EEXIST) + sysfs_warn_dup(kobj->sd, target_name); + + kernfs_put(entry); +diff --git a/net/core/dev.c b/net/core/dev.c +index 1a4e20c4ba053..ddc6ae844c0a8 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5552,7 +5552,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff + if (&ptype->list == head) + goto normal; + +- if (IS_ERR(pp) && PTR_ERR(pp) == -EINPROGRESS) { ++ if (PTR_ERR(pp) == -EINPROGRESS) { + ret = GRO_CONSUMED; + goto ok; + } +diff --git a/net/core/filter.c b/net/core/filter.c +index d866e1c5970cc..135e65754d8d8 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1573,7 +1573,7 @@ int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk) + return -EPERM; + + prog = bpf_prog_get_type(ufd, BPF_PROG_TYPE_SOCKET_FILTER); +- if (IS_ERR(prog) && PTR_ERR(prog) == -EINVAL) ++ if (PTR_ERR(prog) == -EINVAL) + prog = bpf_prog_get_type(ufd, BPF_PROG_TYPE_SK_REUSEPORT); + if (IS_ERR(prog)) + return PTR_ERR(prog); +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 6f58be5a17711..5f8f3d880e3d5 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -3191,7 +3191,7 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig, + flags | XFRM_LOOKUP_QUEUE | + XFRM_LOOKUP_KEEP_DST_REF); + +- if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE) ++ if (PTR_ERR(dst) == -EREMOTE) + return make_blackhole(net, dst_orig->ops->family, dst_orig); + + if (IS_ERR(dst)) +diff --git a/sound/soc/codecs/ak4104.c b/sound/soc/codecs/ak4104.c +index e8c5fda82e085..979cfb165eed4 100644 +--- a/sound/soc/codecs/ak4104.c ++++ b/sound/soc/codecs/ak4104.c +@@ -295,8 +295,7 @@ static int ak4104_spi_probe(struct spi_device *spi) + + reset_gpiod = devm_gpiod_get_optional(&spi->dev, "reset", + GPIOD_OUT_HIGH); +- if (IS_ERR(reset_gpiod) && +- PTR_ERR(reset_gpiod) == -EPROBE_DEFER) ++ if (PTR_ERR(reset_gpiod) == -EPROBE_DEFER) + return -EPROBE_DEFER; + + /* read the 'reserved' register - according to the datasheet, it +diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c +index 793a14d586672..5f25b9f872bdf 100644 +--- a/sound/soc/codecs/cs4270.c ++++ b/sound/soc/codecs/cs4270.c +@@ -681,8 +681,7 @@ static int cs4270_i2c_probe(struct i2c_client *i2c_client, + + reset_gpiod = devm_gpiod_get_optional(&i2c_client->dev, "reset", + GPIOD_OUT_HIGH); +- if (IS_ERR(reset_gpiod) && +- PTR_ERR(reset_gpiod) == -EPROBE_DEFER) ++ if (PTR_ERR(reset_gpiod) == -EPROBE_DEFER) + return -EPROBE_DEFER; + + cs4270->regmap = devm_regmap_init_i2c(i2c_client, &cs4270_regmap); +diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c +index 7a1ffbaf48be5..f2948fe3f590e 100644 +--- a/sound/soc/codecs/tlv320aic32x4.c ++++ b/sound/soc/codecs/tlv320aic32x4.c +@@ -1098,11 +1098,9 @@ static int aic32x4_setup_regulators(struct device *dev, + return PTR_ERR(aic32x4->supply_av); + } + } else { +- if (IS_ERR(aic32x4->supply_dv) && +- PTR_ERR(aic32x4->supply_dv) == -EPROBE_DEFER) ++ if (PTR_ERR(aic32x4->supply_dv) == -EPROBE_DEFER) + return -EPROBE_DEFER; +- if (IS_ERR(aic32x4->supply_av) && +- PTR_ERR(aic32x4->supply_av) == -EPROBE_DEFER) ++ if (PTR_ERR(aic32x4->supply_av) == -EPROBE_DEFER) + return -EPROBE_DEFER; + } + +diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c +index cbe598b0fb107..98a9fe6455213 100644 +--- a/sound/soc/sunxi/sun4i-spdif.c ++++ b/sound/soc/sunxi/sun4i-spdif.c +@@ -555,7 +555,7 @@ static int sun4i_spdif_probe(struct platform_device *pdev) + if (quirks->has_reset) { + host->rst = devm_reset_control_get_optional_exclusive(&pdev->dev, + NULL); +- if (IS_ERR(host->rst) && PTR_ERR(host->rst) == -EPROBE_DEFER) { ++ if (PTR_ERR(host->rst) == -EPROBE_DEFER) { + ret = -EPROBE_DEFER; + dev_err(&pdev->dev, "Failed to get reset: %d\n", ret); + return ret; +-- +2.39.2 + diff --git a/queue-5.4/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch b/queue-5.4/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch new file mode 100644 index 00000000000..2ebd1281e3c --- /dev/null +++ b/queue-5.4/tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch @@ -0,0 +1,39 @@ +From 5a449c441bd9d91fd06b690fe0fa043a56aca85d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Apr 2023 14:55:55 -0500 +Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size + +From: Shenwei Wang + +[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ] + +Based on the fls function definition provided below, we should not +subtract 1 to obtain the correct buffer length: + +fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32. + +Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx") +Signed-off-by: Shenwei Wang +Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index b722ab9415285..0b57973e7c658 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1172,7 +1172,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport) + * 10ms at any baud rate. + */ + sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2; +- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1)); ++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len)); + if (sport->rx_dma_rng_buf_len < 16) + sport->rx_dma_rng_buf_len = 16; + +-- +2.39.2 + diff --git a/queue-5.4/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch b/queue-5.4/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch new file mode 100644 index 00000000000..1a422e45ee5 --- /dev/null +++ b/queue-5.4/uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch @@ -0,0 +1,65 @@ +From 44801935777b01e7401dbeb537a00bd893a026f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 10:27:47 +0100 +Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__ + +From: Kevin Brodsky + +[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ] + +typeof is (still) a GNU extension, which means that it cannot be used when +building ISO C (e.g. -std=c99). It should therefore be avoided in uapi +headers in favour of the ISO-friendly __typeof__. + +Unfortunately this issue could not be detected by +CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in +any uapi header. + +This matters from a userspace perspective, not a kernel one. uapi +headers and their contents are expected to be usable in a variety of +situations, and in particular when building ISO C applications (with +-std=c99 or similar). + +This particular problem can be reproduced by trying to use the +__ALIGN_KERNEL macro directly in application code, say: + +#include + +int align(int x, int a) +{ + return __KERNEL_ALIGN(x, a); +} + +and trying to build that with -std=c99. + +Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com +Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()") +Signed-off-by: Kevin Brodsky +Reported-by: Ruben Ayrapetyan +Tested-by: Ruben Ayrapetyan +Reviewed-by: Petr Vorel +Tested-by: Petr Vorel +Reviewed-by: Masahiro Yamada +Cc: Sam Ravnborg +Signed-off-by: Andrew Morton +Signed-off-by: Sasha Levin +--- + include/uapi/linux/const.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h +index af2a44c08683d..a429381e7ca50 100644 +--- a/include/uapi/linux/const.h ++++ b/include/uapi/linux/const.h +@@ -28,7 +28,7 @@ + #define _BITUL(x) (_UL(1) << (x)) + #define _BITULL(x) (_ULL(1) << (x)) + +-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) ++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1) + #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask)) + + #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d)) +-- +2.39.2 + diff --git a/queue-5.4/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch b/queue-5.4/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch new file mode 100644 index 00000000000..5a61c7f9978 --- /dev/null +++ b/queue-5.4/usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch @@ -0,0 +1,42 @@ +From 391ecfe8888765a14160035bd3cbce39a0050a2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Apr 2023 13:58:52 +0800 +Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe` + +From: Yinhao Hu + +[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ] + +From the comment of ci_usb_phy_init, it returns an error code if +usb_phy_init has failed, and it should do some clean up, not just +return directly. + +Fix this by goto the error handling. + +Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core") +Reviewed-by: Dongliang Mu +Acked-by: Peter Chen +Signed-off-by: Yinhao Hu +Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c +index 7a86979cf1406..27298ca083d14 100644 +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -1084,7 +1084,7 @@ static int ci_hdrc_probe(struct platform_device *pdev) + ret = ci_usb_phy_init(ci); + if (ret) { + dev_err(dev, "unable to init phy: %d\n", ret); +- return ret; ++ goto ulpi_exit; + } + + ci->hw_bank.phys = res->start; +-- +2.39.2 + diff --git a/queue-5.4/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch b/queue-5.4/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch new file mode 100644 index 00000000000..19b36c40065 --- /dev/null +++ b/queue-5.4/usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch @@ -0,0 +1,62 @@ +From 915aaded6a2c190a0f54342d967b5d472052f66f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 14:29:31 +0800 +Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in + renesas_usb3_remove due to race condition + +From: Zheng Wang + +[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ] + +In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work. +renesas_usb3_start will be called to start the work. + +If we remove the driver which will call usbhs_remove, there may be +an unfinished work. The possible sequence is as follows: + +CPU0 CPU1 + + renesas_usb3_role_work +renesas_usb3_remove +usb_role_switch_unregister +device_unregister +kfree(sw) +//free usb3->role_sw + usb_role_switch_set_role + //use usb3->role_sw + +The usb3->role_sw could be freed under such circumstance and then +used in usb_role_switch_set_role. + +This bug was found by static analysis. And note that removing a +driver is a root-only operation, and should never happen in normal +case. But the root user may directly remove the device which +will also trigger the remove function. + +Fix it by canceling the work before cleanup in the renesas_usb3_remove. + +Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") +Signed-off-by: Zheng Wang +Reviewed-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/renesas_usb3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index 0bbd180022aa7..e04acf2dfa65d 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -2553,6 +2553,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) + debugfs_remove_recursive(usb3->dentry); + device_remove_file(&pdev->dev, &dev_attr_role); + ++ cancel_work_sync(&usb3->role_work); + usb_role_switch_unregister(usb3->role_sw); + + usb_del_gadget_udc(&usb3->gadget); +-- +2.39.2 + diff --git a/queue-5.4/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch b/queue-5.4/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch new file mode 100644 index 00000000000..83be05a17f9 --- /dev/null +++ b/queue-5.4/usb-host-xhci-rcar-remove-leftover-quirk-handling.patch @@ -0,0 +1,46 @@ +From 84096d47a446a55f766db3fc8016ad1fb52d8714 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Mar 2023 17:30:37 +0100 +Subject: usb: host: xhci-rcar: remove leftover quirk handling + +From: Wolfram Sang + +[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ] + +Loading V3 firmware does not need a quirk anymore, remove the leftover +code. + +Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-rcar.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c +index 3da75b367f952..5d78352992454 100644 +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -74,7 +74,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3); + + /* For soc_device_attribute */ + #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */ +-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */ + + static const struct soc_device_attribute rcar_quirks_match[] = { + { +@@ -147,8 +146,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd) + + if (quirks & RCAR_XHCI_FIRMWARE_V2) + firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2; +- else if (quirks & RCAR_XHCI_FIRMWARE_V3) +- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3; + else + firmware_name = priv->firmware_name; + +-- +2.39.2 + diff --git a/queue-5.4/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch b/queue-5.4/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch new file mode 100644 index 00000000000..3f313ffd931 --- /dev/null +++ b/queue-5.4/usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch @@ -0,0 +1,73 @@ +From 9b7e624218a15e74909022746045bd0c54936294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 10:51:59 +0800 +Subject: usb: mtu3: fix kernel panic at qmu transfer done irq handler + +From: Chunfeng Yun + +[ Upstream commit d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 ] + +When handle qmu transfer irq, it will unlock @mtu->lock before give back +request, if another thread handle disconnect event at the same time, and +try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu +irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before +handling it. + +e.g. +qmu done irq on cpu0 thread running on cpu1 + +qmu_done_tx() + handle gpd [0] + mtu3_requ_complete() mtu3_gadget_ep_disable() + unlock @mtu->lock + give back request lock @mtu->lock + mtu3_ep_disable() + mtu3_gpd_ring_free() + unlock @mtu->lock + lock @mtu->lock + get next gpd [1] + +[1]: goto [0] to handle next gpd, and next gpd may be NULL. + +Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format") +Signed-off-by: Chunfeng Yun +Link: https://lore.kernel.org/r/20230417025203.18097-3-chunfeng.yun@mediatek.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/mtu3/mtu3_qmu.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index 2ea3157ddb6e2..e65586147965d 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -210,6 +210,7 @@ static struct qmu_gpd *advance_enq_gpd(struct mtu3_gpd_ring *ring) + return ring->enqueue; + } + ++/* @dequeue may be NULL if ring is unallocated or freed */ + static struct qmu_gpd *advance_deq_gpd(struct mtu3_gpd_ring *ring) + { + if (ring->dequeue < ring->end) +@@ -484,7 +485,7 @@ static void qmu_done_tx(struct mtu3 *mtu, u8 epnum) + dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n", + __func__, epnum, gpd, gpd_current, ring->enqueue); + +- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) { ++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) { + + mreq = next_request(mep); + +@@ -523,7 +524,7 @@ static void qmu_done_rx(struct mtu3 *mtu, u8 epnum) + dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n", + __func__, epnum, gpd, gpd_current, ring->enqueue); + +- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) { ++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) { + + mreq = next_request(mep); + +-- +2.39.2 + diff --git a/queue-5.4/vlan-partially-enable-siocshwtstamp-in-container.patch b/queue-5.4/vlan-partially-enable-siocshwtstamp-in-container.patch new file mode 100644 index 00000000000..cf60d0e4fa3 --- /dev/null +++ b/queue-5.4/vlan-partially-enable-siocshwtstamp-in-container.patch @@ -0,0 +1,37 @@ +From 28dcc66d50320b9e40c673fde96e7151b3006b4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Mar 2023 08:33:02 -0700 +Subject: vlan: partially enable SIOCSHWTSTAMP in container + +From: Vadim Fedorenko + +[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ] + +Setting timestamp filter was explicitly disabled on vlan devices in +containers because it might affect other processes on the host. But it's +absolutely legit in case when real device is in the same namespace. + +Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container") +Signed-off-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/8021q/vlan_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index 589615ec490bb..b10f31f98cb87 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -366,7 +366,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + + switch (cmd) { + case SIOCSHWTSTAMP: +- if (!net_eq(dev_net(dev), &init_net)) ++ if (!net_eq(dev_net(dev), dev_net(real_dev))) + break; + /* fall through */ + case SIOCGMIIPHY: +-- +2.39.2 + diff --git a/queue-5.4/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch b/queue-5.4/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch new file mode 100644 index 00000000000..5e462c4eb74 --- /dev/null +++ b/queue-5.4/vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch @@ -0,0 +1,95 @@ +From b64341b4695eec4227a4d253897023b101251a10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Mar 2023 21:01:53 +0900 +Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF + +From: Dae R. Jeong + +[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ] + +During fuzzing, a general protection fault is observed in +vmci_host_poll(). + +general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] +RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 +<- omitting registers -> +Call Trace: + + lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 + add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 + poll_wait include/linux/poll.h:49 [inline] + vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 + vfs_poll include/linux/poll.h:88 [inline] + do_pollfd fs/select.c:873 [inline] + do_poll fs/select.c:921 [inline] + do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 + __do_sys_ppoll fs/select.c:1121 [inline] + __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Example thread interleaving that causes the general protection fault +is as follows: + +CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) +----- ----- +// Read uninitialized context +context = vmci_host_dev->context; + // Initialize context + vmci_host_dev->context = vmci_ctx_create(); + vmci_host_dev->ct_type = VMCIOBJ_CONTEXT; + +if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { + // Dereferencing the wrong pointer + poll_wait(..., &context->host_context); +} + +In this scenario, vmci_host_poll() reads vmci_host_dev->context first, +and then reads vmci_host_dev->ct_type to check that +vmci_host_dev->context is initialized. However, since these two reads +are not atomically executed, there is a chance of a race condition as +described above. + +To fix this race condition, read vmci_host_dev->context after checking +the value of vmci_host_dev->ct_type so that vmci_host_poll() always +reads an initialized context. + +Reported-by: Dae R. Jeong +Fixes: 8bf503991f87 ("VMCI: host side driver implementation.") +Signed-off-by: Dae R. Jeong +Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c +index 833e2bd248a57..8ff8d649d9b3a 100644 +--- a/drivers/misc/vmw_vmci/vmci_host.c ++++ b/drivers/misc/vmw_vmci/vmci_host.c +@@ -160,10 +160,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp) + static __poll_t vmci_host_poll(struct file *filp, poll_table *wait) + { + struct vmci_host_dev *vmci_host_dev = filp->private_data; +- struct vmci_ctx *context = vmci_host_dev->context; ++ struct vmci_ctx *context; + __poll_t mask = 0; + + if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { ++ /* ++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make ++ * sure that context is initialized ++ */ ++ context = vmci_host_dev->context; ++ + /* Check for VMCI calls to this VM context. */ + if (wait) + poll_wait(filp, &context->host_context.wait_queue, +-- +2.39.2 + diff --git a/queue-5.4/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch b/queue-5.4/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch new file mode 100644 index 00000000000..06f1c77fee3 --- /dev/null +++ b/queue-5.4/wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch @@ -0,0 +1,39 @@ +From 9c344c3700b5e3ad87e2688a8955faeaae325dd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Feb 2023 16:15:48 +0300 +Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list() + +From: Dan Carpenter + +[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ] + +This loop checks that i < max at the start of loop but then it does +i++ which could put it past the end of the array. It's harmless to +check again and prevent a potential out of bounds. + +Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data") +Signed-off-by: Dan Carpenter +Reviewed-by: Luis Chamberlain +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index 01163b3339451..92f5c8e830901 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max, + ee->ee_n_piers[mode]++; + + freq2 = (val >> 8) & 0xff; +- if (!freq2) ++ if (!freq2 || i >= max) + break; + + pc[i++].freq = ath5k_eeprom_bin2freq(ee, +-- +2.39.2 + diff --git a/queue-5.4/wifi-ath6kl-minor-fix-for-allocation-size.patch b/queue-5.4/wifi-ath6kl-minor-fix-for-allocation-size.patch new file mode 100644 index 00000000000..d4edda2f467 --- /dev/null +++ b/queue-5.4/wifi-ath6kl-minor-fix-for-allocation-size.patch @@ -0,0 +1,40 @@ +From 80742220caa0458951179f4581e2b68e48737efc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Feb 2023 20:31:37 +0200 +Subject: wifi: ath6kl: minor fix for allocation size + +From: Alexey V. Vissarionov + +[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ] + +Although the "param" pointer occupies more or equal space compared +to "*param", the allocation size should use the size of variable +itself. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver") +Signed-off-by: Alexey V. Vissarionov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/bmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c +index bde5a10d470c8..af98e871199d3 100644 +--- a/drivers/net/wireless/ath/ath6kl/bmi.c ++++ b/drivers/net/wireless/ath/ath6kl/bmi.c +@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param) + return -EACCES; + } + +- size = sizeof(cid) + sizeof(addr) + sizeof(param); ++ size = sizeof(cid) + sizeof(addr) + sizeof(*param); + if (size > ar->bmi.max_cmd_size) { + WARN_ON(1); + return -EINVAL; +-- +2.39.2 + diff --git a/queue-5.4/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch b/queue-5.4/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch new file mode 100644 index 00000000000..adcf065f177 --- /dev/null +++ b/queue-5.4/wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch @@ -0,0 +1,43 @@ +From 9ef0d3db6dd8bc4a7e53b8abe73789b9d0a0b997 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Feb 2023 12:28:05 +0200 +Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback + +From: Fedor Pchelkin + +[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ] + +The warn is triggered on a known race condition, documented in the code above +the test, that is correctly handled. Using WARN() hinders automated testing. +Reducing severity. + +Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload") +Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +index c68848819a52d..9b88d96bfe96c 100644 +--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c ++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c +@@ -960,8 +960,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb, + * Thus the possibility of ar->htc_target being NULL + * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work. + */ +- if (WARN_ON_ONCE(!target)) { +- ath6kl_err("Target not yet initialized\n"); ++ if (!target) { ++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n"); + status = -EINVAL; + goto free_skb; + } +-- +2.39.2 + diff --git a/queue-5.4/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch b/queue-5.4/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch new file mode 100644 index 00000000000..3bce27f6bff --- /dev/null +++ b/queue-5.4/wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch @@ -0,0 +1,87 @@ +From 101a14d0948336b27c65ee127e4dca50f06b0f1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Feb 2023 22:23:01 +0300 +Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fedor Pchelkin + +[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ] + +hif_dev->remain_skb is allocated and used exclusively in +ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is +processed and subsequently freed (in error paths) only during the next +call of ath9k_hif_usb_rx_stream(). + +So, if the urbs are deallocated between those two calls due to the device +deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() +is not called next time and the allocated remain_skb is leaked. Our local +Syzkaller instance was able to trigger that. + +remain_skb makes sense when receiving two consecutive urbs which are +logically linked together, i.e. a specific data field from the first skb +indicates a cached skb to be allocated, memcpy'd with some data and +subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs +deallocation supposedly makes that link irrelevant so we need to free the +cached skb in those cases. + +Fix the leak by introducing a function to explicitly free remain_skb (if +it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL +when it has not been allocated at all (hif_dev struct is kzalloced) or +when it has been processed in next call to ath9k_hif_usb_rx_stream(). + +Found by Linux Verification Center (linuxtesting.org) with Syzkaller. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Fedor Pchelkin +Signed-off-by: Alexey Khoroshilov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index e23d58f83dd6f..3aa915d215545 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = { + .send = hif_usb_send, + }; + ++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream ++ * in case ath9k_hif_usb_rx_stream wasn't called next time to ++ * process the buffer and subsequently free it. ++ */ ++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&hif_dev->rx_lock, flags); ++ if (hif_dev->remain_skb) { ++ dev_kfree_skb_any(hif_dev->remain_skb); ++ hif_dev->remain_skb = NULL; ++ hif_dev->rx_remain_len = 0; ++ RX_STAT_INC(hif_dev, skb_dropped); ++ } ++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags); ++} ++ + static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + struct sk_buff *skb) + { +@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) + static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) + { + usb_kill_anchored_urbs(&hif_dev->rx_submitted); ++ ath9k_hif_usb_free_rx_remain_skb(hif_dev); + } + + static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) +-- +2.39.2 + diff --git a/queue-5.4/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch b/queue-5.4/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch new file mode 100644 index 00000000000..bf731f3c758 --- /dev/null +++ b/queue-5.4/wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch @@ -0,0 +1,50 @@ +From 96d8a884fb8087a11901cae97f1c688b3a01cd88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Apr 2023 15:47:38 +0300 +Subject: wifi: iwlwifi: make the loop for card preparation effective + +From: Emmanuel Grumbach + +[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ] + +Since we didn't reset t to 0, only the first iteration of the loop +did checked the ready bit several times. +From the second iteration and on, we just tested the bit once and +continued to the next iteration. + +Reported-and-tested-by: Lorenzo Zolfanelli +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452 +Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 8915030030c4c..3a93a7b8ba0af 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -630,7 +630,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans) + int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + { + int ret; +- int t = 0; + int iter; + + IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n"); +@@ -645,6 +644,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans) + usleep_range(1000, 2000); + + for (iter = 0; iter < 10; iter++) { ++ int t = 0; ++ + /* If HW is not ready, prepare the conditions to check again */ + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, + CSR_HW_IF_CONFIG_REG_PREPARE); +-- +2.39.2 + diff --git a/queue-5.4/wifi-iwlwifi-mvm-check-firmware-response-size.patch b/queue-5.4/wifi-iwlwifi-mvm-check-firmware-response-size.patch new file mode 100644 index 00000000000..ef869081d07 --- /dev/null +++ b/queue-5.4/wifi-iwlwifi-mvm-check-firmware-response-size.patch @@ -0,0 +1,53 @@ +From 7e4ab7682557ad7ed23fe5384773dc628ab3bcdb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Apr 2023 11:41:33 +0300 +Subject: wifi: iwlwifi: mvm: check firmware response size + +From: Johannes Berg + +[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ] + +Check the firmware response size for responses to the +memory read/write command in debugfs before using it. + +Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry") +Signed-off-by: Johannes Berg +Signed-off-by: Gregory Greenman +Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +index 524f9dd2323dc..f8785c70842dc 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +@@ -1877,6 +1877,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +@@ -1954,6 +1959,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file, + if (ret < 0) + return ret; + ++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { ++ ret = -EIO; ++ goto out; ++ } ++ + rsp = (void *)hcmd.resp_pkt->data; + if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) { + ret = -ENXIO; +-- +2.39.2 + diff --git a/queue-5.4/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch b/queue-5.4/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch new file mode 100644 index 00000000000..1b8d012c927 --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch @@ -0,0 +1,54 @@ +From db259efc6ff59623a866e46330b249bd1f2b6253 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:31:38 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_rfreg() + +From: Wei Chen + +[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ] + +If there is a failure during copy_from_user or user-provided data buffer +is invalid, rtl_debugfs_set_write_rfreg should return negative error code +instead of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index a7a5d8fa3cc0c..c8db166a7dc80 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -395,8 +395,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -406,7 +406,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp, + if (num != 4) { + rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG, + "Format is \n"); +- return count; ++ return -EINVAL; + } + + rtl_set_rfreg(hw, path, addr, bitmask, data); +-- +2.39.2 + diff --git a/queue-5.4/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-16446 b/queue-5.4/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-16446 new file mode 100644 index 00000000000..b4cfe13973f --- /dev/null +++ b/queue-5.4/wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-16446 @@ -0,0 +1,54 @@ +From dffe6e0bb61fd26b38ebc57b6525ad6a259b29ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 05:42:17 +0000 +Subject: wifi: rtlwifi: fix incorrect error codes in + rtl_debugfs_set_write_reg() + +From: Wei Chen + +[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ] + +If there is a failure during copy_from_user or user-provided data buffer is +invalid, rtl_debugfs_set_write_reg should return negative error code instead +of a positive value count. + +Fix this bug by returning correct error code. Moreover, the check of buffer +against null is removed since it will be handled by copy_from_user. + +Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs") +Signed-off-by: Wei Chen +Reviewed-by: Simon Horman +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c +index c8db166a7dc80..3866ea300a70b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/debug.c ++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c +@@ -298,8 +298,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + + tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count); + +- if (!buffer || copy_from_user(tmp, buffer, tmp_len)) +- return count; ++ if (copy_from_user(tmp, buffer, tmp_len)) ++ return -EFAULT; + + tmp[tmp_len] = '\0'; + +@@ -307,7 +307,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp, + num = sscanf(tmp, "%x %x %x", &addr, &val, &len); + + if (num != 3) +- return count; ++ return -EINVAL; + + switch (len) { + case 1: +-- +2.39.2 + diff --git a/queue-5.4/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch b/queue-5.4/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch new file mode 100644 index 00000000000..31dfec612dc --- /dev/null +++ b/queue-5.4/wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch @@ -0,0 +1,51 @@ +From 559cb70c91a4ae8bb6ab14de80a092b744961749 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 23:10:04 +0100 +Subject: wifi: rtw88: mac: Return the original error from + rtw_mac_power_switch() + +From: Martin Blumenstingl + +[ Upstream commit 15c8e267dfa62f207ee1db666c822324e3362b84 ] + +rtw_mac_power_switch() calls rtw_pwr_seq_parser() which can return +-EINVAL, -EBUSY or 0. Propagate the original error code instead of +unconditionally returning -EINVAL in case of an error. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230226221004.138331-3-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c +index 9a50984fa06c9..94e69e97d5f5f 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac.c ++++ b/drivers/net/wireless/realtek/rtw88/mac.c +@@ -224,6 +224,7 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on) + struct rtw_pwr_seq_cmd **pwr_seq; + u8 rpwm; + bool cur_pwr; ++ int ret; + + rpwm = rtw_read8(rtwdev, rtwdev->hci.rpwm_addr); + +@@ -245,8 +246,9 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on) + return -EALREADY; + + pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq; +- if (rtw_pwr_seq_parser(rtwdev, pwr_seq)) +- return -EINVAL; ++ ret = rtw_pwr_seq_parser(rtwdev, pwr_seq); ++ if (ret) ++ return ret; + + return 0; + } +-- +2.39.2 + diff --git a/queue-5.4/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch b/queue-5.4/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch new file mode 100644 index 00000000000..73a40aa0578 --- /dev/null +++ b/queue-5.4/wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch @@ -0,0 +1,39 @@ +From 9e606625b16346c10bc0d7dc89cc9277a32f5f63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Feb 2023 23:10:03 +0100 +Subject: wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser() + +From: Martin Blumenstingl + +[ Upstream commit b7ed9fa2cb76ca7a3c3cd4a6d35748fe1fbda9f6 ] + +rtw_pwr_seq_parser() calls rtw_sub_pwr_seq_parser() which can either +return -EBUSY, -EINVAL or 0. Propagate the original error code instead +of unconditionally returning -EBUSY in case of an error. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230226221004.138331-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c +index b61b073031e57..9a50984fa06c9 100644 +--- a/drivers/net/wireless/realtek/rtw88/mac.c ++++ b/drivers/net/wireless/realtek/rtw88/mac.c +@@ -210,7 +210,7 @@ static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev, + + ret = rtw_sub_pwr_seq_parser(rtwdev, intf_mask, cut_mask, cmd); + if (ret) +- return -EBUSY; ++ return ret; + + idx++; + } while (1); +-- +2.39.2 + diff --git a/queue-5.4/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch b/queue-5.4/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch new file mode 100644 index 00000000000..fb74874d97d --- /dev/null +++ b/queue-5.4/x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch @@ -0,0 +1,49 @@ +From c5bcbdc18aa3a8cfe5b8b98bdca5eb2744ac43d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Feb 2023 17:09:17 +0100 +Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset() + +From: Uros Bizjak + +[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ] + +The detection of atomic update failure in reserve_eilvt_offset() is +not correct. The value returned by atomic_cmpxchg() should be compared +to the old value from the location to be updated. + +If these two are the same, then atomic update succeeded and +"eilvt_offsets[offset]" location is updated to "new" in an atomic way. + +Otherwise, the atomic update failed and it should be retried with the +value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg() +does in a correct and more optimal way. + +Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)") +Signed-off-by: Uros Bizjak +Signed-off-by: Borislav Petkov (AMD) +Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 68c7340325233..a3b7b2fb04cb0 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -410,10 +410,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new) + if (vector && !eilvt_entry_is_changeable(vector, new)) + /* may not change if vectors are different */ + return rsvd; +- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new); +- } while (rsvd != new); ++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new)); + +- rsvd &= ~APIC_EILVT_MASKED; ++ rsvd = new & ~APIC_EILVT_MASKED; + if (rsvd && rsvd != vector) + pr_info("LVT offset %d assigned for vector 0x%02x\n", + offset, rsvd); +-- +2.39.2 + diff --git a/queue-5.4/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch b/queue-5.4/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch new file mode 100644 index 00000000000..e493d8847d9 --- /dev/null +++ b/queue-5.4/x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch @@ -0,0 +1,72 @@ +From 13d6c83d6968b10a40d115aeaac4eee771dfc628 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 00:30:04 -0700 +Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() + +From: Saurabh Sengar + +[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ] + +arch_dynirq_lower_bound() is invoked by the core interrupt code to +retrieve the lowest possible Linux interrupt number for dynamically +allocated interrupts like MSI. + +The x86 implementation uses this to exclude the IO/APIC GSI space. +This works correctly as long as there is an IO/APIC registered, but +returns 0 if not. This has been observed in VMs where the BIOS does +not advertise an IO/APIC. + +0 is an invalid interrupt number except for the legacy timer interrupt +on x86. The return value is unchecked in the core code, so it ends up +to allocate interrupt number 0 which is subsequently considered to be +invalid by the caller, e.g. the MSI allocation code. + +The function has already a check for 0 in the case that an IO/APIC is +registered, as ioapic_dynirq_base is 0 in case of device tree setups. + +Consolidate this and zero check for both ioapic_dynirq_base and gsi_top, +which is used in the case that no IO/APIC is registered. + +Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines") +Signed-off-by: Saurabh Sengar +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/io_apic.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index 1622cff009c9a..e4d63392c619e 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2455,17 +2455,21 @@ static int io_apic_get_redir_entries(int ioapic) + + unsigned int arch_dynirq_lower_bound(unsigned int from) + { ++ unsigned int ret; ++ + /* + * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use + * gsi_top if ioapic_dynirq_base hasn't been initialized yet. + */ +- if (!ioapic_initialized) +- return gsi_top; ++ ret = ioapic_dynirq_base ? : gsi_top; ++ + /* +- * For DT enabled machines ioapic_dynirq_base is irrelevant and not +- * updated. So simply return @from if ioapic_dynirq_base == 0. ++ * For DT enabled machines ioapic_dynirq_base is irrelevant and ++ * always 0. gsi_top can be 0 if there is no IO/APIC registered. ++ * 0 is an invalid interrupt number for dynamic allocations. Return ++ * @from instead. + */ +- return ioapic_dynirq_base ? : from; ++ return ret ? : from; + } + + #ifdef CONFIG_X86_32 +-- +2.39.2 +