video: tegra: nvmap: Avoid double updation of RSS counter

The RSS counter is updated during buffer allocation as well as mmap,
which is leading to double updation. Fix this by decrementing the RSS
counter during page fault while increment it back during unmap flow.

Bug 5222690

Change-Id: I77972185f20d9d710571cc07ae1c5188060bfa1f
Signed-off-by: Ketan Patil <ketanp@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3442670
(cherry picked from commit 1c59063ce7)
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3453103
(cherry picked from commit b27a1a79ee)
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nv-oot/+/3454644
GVS: buildbot_gerritrpt <buildbot_gerritrpt@nvidia.com>
Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com>
Reviewed-by: Amulya Yarlagadda <ayarlagadda@nvidia.com>

drivers/net/wireless/realtek/rtl8822ce/core/rtw_btcoex.c

@@ -1814,9 +1814,12 @@ void rtw_btcoex_connect_notify(PADAPTER padapter, u8 join_type)
 
 	pHalData = GET_HAL_DATA(padapter);
 
-	if (pHalData->EEPROMBluetoothCoexist == _TRUE)
+	if (pHalData->EEPROMBluetoothCoexist == _TRUE) {
 		_rtw_btcoex_connect_notify(padapter, join_type ? _FALSE : _TRUE);
-	else
+
+		if (join_type)
+			rtw_btcoex_SpecialPacketNotify(padapter, PACKET_EAPOL);
+	} else
 #endif /* CONFIG_BT_COEXIST */
 	rtw_btcoex_wifionly_connect_notify(padapter);
 }

drivers/net/wireless/realtek/rtl8822ce/core/rtw_mlme.c

@@ -1845,16 +1845,30 @@ void rtw_survey_event_callback(_adapter	*adapter, u8 *pbuf)
 					goto exit;
 				}
 			}
-			rtw_check_roaming_candidate(pmlmepriv, &candidate, pnetwork, 0);
+			candidate = pmlmepriv->roam_network; /* backup */
+			rtw_check_roaming_candidate(pmlmepriv, &pmlmepriv->roam_network, pnetwork, 0);
 
-			if (candidate) {
-				pmlmepriv->roam_network = candidate;
+			if (pnetwork == pmlmepriv->roam_network) {
+				/* we got a new candidate */
+				if (candidate)
+					candidate->fixed = _FALSE;
+
+				pmlmepriv->roam_network->fixed = _TRUE;
 				RTW_INFO("%s() found a roaming candidate. abort scan\n", __func__);
 				rtw_scan_abort_no_wait(adapter);
-			}
-			/* find second best candidate */
-			if (!candidate && IS_5G_BSS(pnetwork->network))
+
+			} else if (IS_5G_BSS(pnetwork->network)) {
+				candidate = pmlmepriv->candidate_5G; /* backup */
+				/* find second best candidate */
 				rtw_check_roaming_candidate(pmlmepriv, &pmlmepriv->candidate_5G, pnetwork, 1);
+
+				if (pnetwork == pmlmepriv->candidate_5G) {
+					/* we got a new 5G candidate */
+					if (candidate)
+						candidate->fixed = _FALSE;
+					pmlmepriv->candidate_5G->fixed = _TRUE;
+				}
+			}
 		}
 #endif
 	}
@@ -3311,11 +3325,12 @@ void rtw_stadel_event_callback(_adapter *adapter, u8 *pbuf)
 	u8 diconnect_delay = RTW_ROAM_DICONNECT_DELAY;
 
 	RTW_INFO("%s(mac_id=%d)=" MAC_FMT "\n", __func__, pstadel->mac_id, MAC_ARG(pstadel->macaddr));
+
+	rtw_sta_mstatus_disc_rpt(adapter, pstadel->mac_id);
 #ifdef CONFIG_LAYER2_ROAMING
 	if (pmlmepriv->roam_network)
 		rtw_hal_set_hwreg(adapter, HW_VAR_CHECK_TXBUF, &diconnect_delay);
 #endif
-	rtw_sta_mstatus_disc_rpt(adapter, pstadel->mac_id);
 
 #ifdef CONFIG_MCC_MODE
 	rtw_hal_mcc_update_macid_bitmap(adapter, pstadel->mac_id, _FALSE);
@@ -4133,6 +4148,9 @@ int rtw_select_roaming_candidate(struct mlme_priv *mlme)
 	mlme->roam_network = NULL;
 	mlme->candidate_5G = NULL;
 
+	if (candidate) candidate->fixed = _FALSE;
+	if (candidate_5G) candidate_5G->fixed = _FALSE;
+
 	if (mlme->cur_network_scanned == NULL) {
 		rtw_warn_on(1);
 		goto exit;

drivers/net/wireless/realtek/rtl8822ce/core/rtw_mlme_ext.c

@@ -12192,9 +12192,11 @@ no_external_auth:
 	recv_ack(padapter, true);
 	issue_auth(padapter, NULL, 0);
 
+#ifdef CONFIG_RTW_80211R
 	if (rtw_ft_roam(padapter))
 		set_link_timer(pmlmeext, REAUTH_FT_TO);
 	else
+#endif
 		set_link_timer(pmlmeext, REAUTH_TO);
 
 }
@@ -13689,14 +13691,13 @@ bypass_active_keep_alive:
 
 void roamed_status_chk(_adapter *padapter, u8 from_timer)
 {
-	struct mlme_priv	*pmlmepriv = &padapter->mlmepriv;
-#if defined(CONFIG_LAYER2_ROAMING) && defined(CONFIG_RTW_80211K)
+	struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
+#ifdef CONFIG_LAYER2_ROAMING
 	struct wlan_network *ap = pmlmepriv->cur_network_scanned;
-	int wait_times = 10; /* unit 10ms */
-	struct roam_nb_info *pnb = &(pmlmepriv->nb_info);
-	struct recv_priv *precvpriv = &padapter->recvpriv;
 	u8 roam_cur_rssi_th;
 	u8 roam_cur_rssi_diff, pulse_cur_rssi_diff;
+	int wait_times = 10; /* unit 10ms */
+	struct recv_priv *precvpriv = &padapter->recvpriv;
 	u8 int_facotr = 1, skip_time_chk = 0, skip_rssi_chk = 0;
 	u8 reason = RTW_AUTO_SCAN_REASON_ROAM;
 	u32 wait_ms = 0, pass_ms = 0, remain_ms = 0;
@@ -13774,7 +13775,8 @@ void roamed_status_chk(_adapter *padapter, u8 from_timer)
 			pmlmepriv->roam_try_cnt = 0;
 		}
 	}
-#endif
+#endif /* CONFIG_RTW_PREFER_5G */
+
 	/* extend roam scan interval */
 	if (pmlmepriv->roam_try_cnt > pmlmepriv->roam_scan_round3) {
 		wait_ms = pmlmepriv->roam_scan_int3 * 2000;
@@ -15024,7 +15026,6 @@ static int rtw_scan_ch_decision(_adapter *padapter, struct rtw_ieee80211_channel
 	struct rtw_ieee80211_channel out5_noir[MAX_CHANNEL_NUM_5G];
 	struct rtw_ieee80211_channel out_roam[RTW_MAX_NB_RPT_NUM];
 
-
 	/* clear first */
 	_rtw_memset(out, 0, sizeof(struct rtw_ieee80211_channel) * out_num);
 	_rtw_memset(out2, 0, sizeof(out2));
@@ -15058,15 +15059,25 @@ static int rtw_scan_ch_decision(_adapter *padapter, struct rtw_ieee80211_channel
 		if (set_idx < 0)
 			continue;
 
+		chan = rfctl->channel_set[set_idx].ChannelNum;
+
 		if (rfctl->channel_set[set_idx].band == BAND_ON_5G) {
 
 			if (rfctl->channel_set[set_idx].flags & (RTW_CHF_NO_IR /*| RTW_CHF_DFS*/)) {
+
 				/* 5G DFS and NO_IR */
+				if (rtw_chlist_search_ch(out5_noir, k, chan) != -1)
+					continue;
+
 				_rtw_memcpy(&out5_noir[k], &in[i], sizeof(struct rtw_ieee80211_channel));
 				out5_noir[k].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
 				k++;
 			} else {
+
 				/* 5G Active channel */
+				if (rtw_chlist_search_ch(out5, j, chan) != -1)
+					continue;
+
 				_rtw_memcpy(&out5[j], &in[i], sizeof(struct rtw_ieee80211_channel));
 				j++;
 			}
@@ -15074,12 +15085,20 @@ static int rtw_scan_ch_decision(_adapter *padapter, struct rtw_ieee80211_channel
 		} else { /* 2G */
 
 			if (rfctl->channel_set[set_idx].flags & (RTW_CHF_NO_IR /*| RTW_CHF_DFS*/)) {
+
 				/* 2G  NO_IR */
+				if (rtw_chlist_search_ch(out2_noir, m, chan) != -1)
+					continue;
+
 				_rtw_memcpy(&out2_noir[m], &in[i], sizeof(struct rtw_ieee80211_channel));
 				out2_noir[m].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
 				m++;
 			} else {
+
 				/* 2G Active channel */
+				if (rtw_chlist_search_ch(out2, l, chan) != -1)
+					continue;
+
 				_rtw_memcpy(&out2[l], &in[i], sizeof(struct rtw_ieee80211_channel));
 				l++;
 			}
@@ -15973,8 +15992,9 @@ operation_by_state:
 			rtw_rx_ampdu_apply(padapter);
 
 		/* clear HW TX queue before scan */
+#ifdef CONFIG_SCAN_FLUSH_TX_FIFO
 		rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);
-
+#endif
 		rtw_hal_macid_sleep_all_used(padapter);
 
 		/* power save state announcement */
@@ -16188,8 +16208,9 @@ operation_by_state:
 		 */
 
 		/* clear HW TX queue before scan */
+#ifdef CONFIG_SCAN_FLUSH_TX_FIFO
 		rtw_hal_set_hwreg(padapter, HW_VAR_CHECK_TXBUF, 0);
-
+#endif
 		rtw_hal_macid_sleep_all_used(padapter);
 		if (mlmeext_chk_scan_backop_flags(pmlmeext, SS_BACKOP_PS_ANNC)
 			&& rtw_ps_annc(padapter, 1)

drivers/net/wireless/realtek/rtl8822ce/core/rtw_vht.c

@@ -1266,15 +1266,13 @@ void rtw_reattach_vht_ies(_adapter *padapter, WLAN_BSSID_EX *pnetwork)
 
 	RTW_INFO(FUNC_ADPT_FMT"\n", FUNC_ADPT_ARG(padapter));
 
-	if (pnetwork->IEs != NULL) {
-		vht_op_ie = rtw_set_ie(vht_cap_ie, EID_VHTCapability, VHT_CAP_IE_LEN,
-			pvhtpriv->vht_cap_ie_backup, &(pnetwork->IELength));
+	vht_op_ie = rtw_set_ie(vht_cap_ie, EID_VHTCapability, VHT_CAP_IE_LEN,
+		pvhtpriv->vht_cap_ie_backup, &(pnetwork->IELength));
 
-		rtw_set_ie(vht_op_ie, EID_VHTOperation, VHT_OP_IE_LEN,
-			pvhtpriv->vht_op_ie_backup, &(pnetwork->IELength));
+	rtw_set_ie(vht_op_ie, EID_VHTOperation, VHT_OP_IE_LEN,
+		pvhtpriv->vht_op_ie_backup, &(pnetwork->IELength));
 
-		rtw_set_vht_ext_cap(padapter, pnetwork);
-	}
+	rtw_set_vht_ext_cap(padapter, pnetwork);
 
 	pmlmepriv->vhtpriv.vht_option = _TRUE;
 }

drivers/net/wireless/realtek/rtl8822ce/hal/btc/halbtc8822c.c

@@ -61,7 +61,8 @@ static const struct btc_coex_table_para table_sant_8822c[] = {
 				{0xdaffdaff, 0xdaffdaff},
 				{0x6a555a5a, 0x5a5a5a5a},
 				{0xe5555555, 0xe5555555}, /*case-35*/
-				{0xea5a5a5a, 0xea5a5a5a} };
+				{0xea5a5a5a, 0xea5a5a5a},
+				{0x55555555, 0xaa5a5aaa} }; /*case-37*/
 
 /* Non-Shared-Antenna Coex Table */
 static const struct btc_coex_table_para table_nsant_8822c[] = {
@@ -120,7 +121,9 @@ static const struct btc_tdma_para tdma_sant_8822c[] = {
 				{ {0x65, 0x10, 0x03, 0x11, 0x10} },
 				{ {0x51, 0x10, 0x03, 0x10, 0x51} }, /*case-25*/
 				{ {0x51, 0x08, 0x03, 0x10, 0x50} },
-				{ {0x61, 0x08, 0x03, 0x11, 0x11} } };
+				{ {0x61, 0x08, 0x03, 0x11, 0x11} },
+				{ {0x61, 0x45, 0x03, 0x11, 0x11} },  /*case-28*/
+				{ {0x61, 0x55, 0x03, 0x11, 0x11} } };/*case-29*/
 
 
 /* Non-Shared-Antenna TDMA*/
@@ -214,7 +217,7 @@ const struct btc_5g_afh_map afh_5g_8822c[] = { {0, 0, 0} };
 
 const struct btc_chip_para btc_chip_para_8822c = {
 	"8822c",				/*.chip_name */
-	20240125,				/*.para_ver_date */
+	20240327,				/*.para_ver_date */
 	0x27,					/*.para_ver */
 	0x20,					/* bt_desired_ver */
 	0x7001c,				/* wl_desired_ver */

drivers/net/wireless/realtek/rtl8822ce/hal/btc/halbtccommon.c

@@ -18,7 +18,7 @@
 #if (BT_SUPPORT == 1 && COEX_SUPPORT == 1)
 
 static u8 *trace_buf = &gl_btc_trace_buf[0];
-static const u32 coex_ver_date = 20240125;
+static const u32 coex_ver_date = 20240327;
 static const u32 coex_ver = 0x27;
 
 static u8
@@ -2403,8 +2403,8 @@ static void rtw_btc_action_bt_idle(struct btc_coexist *btc)
 #endif
 	if (btc->board_info.btdm_ant_num == 1) { /* Shared-Ant */
 		if (!coex_sta->wl_gl_busy) {
-			table_case = 10;
-			tdma_case = 3;
+			table_case = 3;
+			tdma_case = 29;
 		} else if (coex_sta->bt_mesh) {
 			table_case = 26;
 			tdma_case = 7;
@@ -2417,8 +2417,8 @@ static void rtw_btc_action_bt_idle(struct btc_coexist *btc)
 			else
 				tdma_case = 7;
 		} else {
-			table_case = 12;
-			tdma_case = 7;
+			table_case = 15;
+			tdma_case = 29;
 		}
 	} else { /* Non-Shared-Ant */
 		if (!coex_sta->wl_gl_busy) {
@@ -2603,8 +2603,8 @@ static void rtw_btc_action_bt_hid(struct btc_coexist *btc)
 		} else
 #endif
 		if (coex_sta->bt_ble_exist) { /* RCU */
-			table_case = 26;
-			tdma_case = 2;
+			table_case = 12;
+			tdma_case = 3;
 		} else { /* Legacy HID  */
 			if (coex_sta->bt_profile_num == 1 &&
 			    (coex_sta->bt_multi_link ||
@@ -2616,26 +2616,26 @@ static void rtw_btc_action_bt_hid(struct btc_coexist *btc)
 				if (coex_sta->wl_gl_busy &&
 				    (coex_sta->wl_rx_rate <= 3 ||
 				    coex_sta->wl_rts_rx_rate <= 3))
-					table_case = 13;
+					table_case = 12;
 				else
 					table_case = 12;
 
-				tdma_case = 26;
+				tdma_case = 3;
 			} else if (coex_sta->bt_a2dp_active) {
 				table_case = 9;
 				tdma_case = 18;
 			} else if (coex_sta->bt_418_hid_exist &&
 				   coex_sta->wl_gl_busy) {
 				slot_type = TDMA_4SLOT;
-				table_case = 32;
-				tdma_case = 27;
+				table_case = 12;
+				tdma_case = 3;
 			} else if (coex_sta->bt_ble_hid_exist &&
 				   coex_sta->wl_gl_busy) {
-				table_case = 32;
-				tdma_case = 9;
+				table_case = 12;
+				tdma_case = 3;
 			} else {
-				table_case = 9;
-				tdma_case = 9;
+				table_case = 12;
+				tdma_case = 3;
 			}
 		}
 	} else { /* Non-Shared-Ant */
@@ -3084,14 +3084,14 @@ static void rtw_btc_action_wl_linkscan(struct btc_coexist *btc)
 			tdma_case = 11;
 		} else if (coex_sta->bt_hid_exist) {
 			if (link_info_ext->is_connected) {
-				table_case = 36;
+				table_case = 11;
 			} else {
-				table_case = 35;
+				table_case = 11;
 			}
-			tdma_case = 5;
+			tdma_case = 1;
 		} else {
-			table_case = 9;
-			tdma_case = 7;
+			table_case = 3;
+			tdma_case = 29;
 		}
 	} else { /* Non-Shared-Ant */
 		if (coex_sta->bt_pan_exist) {
@@ -3578,13 +3578,6 @@ static void rtw_btc_run_coex(struct btc_coexist *btc, u8 reason)
 		goto exit;
 	}
 
-	if ((coex_dm->bt_status == BTC_BTSTATUS_NCON_IDLE ||
-	     coex_dm->bt_status == BTC_BTSTATUS_CON_IDLE) &&
-	     link_info_ext->is_connected) {
-		rtw_btc_action_bt_idle(btc);
-		goto exit;
-	}
-
 	if (coex_sta->wl_linkscan_proc && !coex_sta->coex_freerun) {
 		rtw_btc_action_wl_linkscan(btc);
 		goto exit;

drivers/net/wireless/realtek/rtl8822ce/hal/hal_com.c

@@ -5117,44 +5117,7 @@ void rtw_dump_fifo(void *sel, _adapter *adapter, u8 fifo_sel, u32 fifo_addr, u32
 }
 #endif
 
-#if defined(CONFIG_WOWLAN) || defined(CONFIG_AP_WOWLAN)
-static void rtw_hal_force_enable_rxdma(_adapter *adapter)
-{
-	RTW_INFO("%s: Set 0x690=0x00\n", __func__);
-	rtw_write8(adapter, REG_WOW_CTRL,
-		   (rtw_read8(adapter, REG_WOW_CTRL) & 0xf0));
-	RTW_PRINT("%s: Release RXDMA\n", __func__);
-	rtw_write32(adapter, REG_RXPKT_NUM,
-		    (rtw_read32(adapter, REG_RXPKT_NUM) & (~RW_RELEASE_EN)));
-}
-#if defined(CONFIG_RTL8188E)
-static void rtw_hal_disable_tx_report(_adapter *adapter)
-{
-	rtw_write8(adapter, REG_TX_RPT_CTRL,
-		   ((rtw_read8(adapter, REG_TX_RPT_CTRL) & ~BIT(1))) & ~BIT(5));
-	RTW_INFO("disable TXRPT:0x%02x\n", rtw_read8(adapter, REG_TX_RPT_CTRL));
-}
-
-static void rtw_hal_enable_tx_report(_adapter *adapter)
-{
-	rtw_write8(adapter, REG_TX_RPT_CTRL,
-		   ((rtw_read8(adapter, REG_TX_RPT_CTRL) | BIT(1))) | BIT(5));
-	RTW_INFO("enable TX_RPT:0x%02x\n", rtw_read8(adapter, REG_TX_RPT_CTRL));
-}
-#endif
-static void rtw_hal_release_rx_dma(_adapter *adapter)
-{
-	u32 val32 = 0;
-
-	val32 = rtw_read32(adapter, REG_RXPKT_NUM);
-
-	rtw_write32(adapter, REG_RXPKT_NUM, (val32 & (~RW_RELEASE_EN)));
-
-	RTW_INFO("%s, [0x%04x]: 0x%08x\n",
-		 __func__, REG_RXPKT_NUM, (u32)(val32 & (~RW_RELEASE_EN)));
-}
-
-static u8 rtw_hal_pause_rx_dma(_adapter *adapter)
+u8 rtw_hal_pause_rx_dma(_adapter *adapter)
 {
 	PHAL_DATA_TYPE hal = GET_HAL_DATA(adapter);
 	u8 ret = 0;
@@ -5196,7 +5159,7 @@ static u8 rtw_hal_pause_rx_dma(_adapter *adapter)
 #endif /* CONFIG_USB_HCI */
 	} while (trycnt--);
 
-	if (trycnt < 0) {
+	if (trycnt <= 0) {
 		tmp = rtw_read16(adapter, REG_RXPKT_NUM + 2);
 
 		RTW_PRINT("Stop RX DMA failed......\n");
@@ -5219,6 +5182,43 @@ static u8 rtw_hal_pause_rx_dma(_adapter *adapter)
 	return ret;
 }
 
+#if defined(CONFIG_WOWLAN) || defined(CONFIG_AP_WOWLAN)
+static void rtw_hal_force_enable_rxdma(_adapter *adapter)
+{
+	RTW_INFO("%s: Set 0x690=0x00\n", __func__);
+	rtw_write8(adapter, REG_WOW_CTRL,
+		   (rtw_read8(adapter, REG_WOW_CTRL) & 0xf0));
+	RTW_PRINT("%s: Release RXDMA\n", __func__);
+	rtw_write32(adapter, REG_RXPKT_NUM,
+		    (rtw_read32(adapter, REG_RXPKT_NUM) & (~RW_RELEASE_EN)));
+}
+#if defined(CONFIG_RTL8188E)
+static void rtw_hal_disable_tx_report(_adapter *adapter)
+{
+	rtw_write8(adapter, REG_TX_RPT_CTRL,
+		   ((rtw_read8(adapter, REG_TX_RPT_CTRL) & ~BIT(1))) & ~BIT(5));
+	RTW_INFO("disable TXRPT:0x%02x\n", rtw_read8(adapter, REG_TX_RPT_CTRL));
+}
+
+static void rtw_hal_enable_tx_report(_adapter *adapter)
+{
+	rtw_write8(adapter, REG_TX_RPT_CTRL,
+		   ((rtw_read8(adapter, REG_TX_RPT_CTRL) | BIT(1))) | BIT(5));
+	RTW_INFO("enable TX_RPT:0x%02x\n", rtw_read8(adapter, REG_TX_RPT_CTRL));
+}
+#endif
+static void rtw_hal_release_rx_dma(_adapter *adapter)
+{
+	u32 val32 = 0;
+
+	val32 = rtw_read32(adapter, REG_RXPKT_NUM);
+
+	rtw_write32(adapter, REG_RXPKT_NUM, (val32 & (~RW_RELEASE_EN)));
+
+	RTW_INFO("%s, [0x%04x]: 0x%08x\n",
+		 __func__, REG_RXPKT_NUM, (u32)(val32 & (~RW_RELEASE_EN)));
+}
+
 #if defined(CONFIG_SDIO_HCI) || defined(CONFIG_GSPI_HCI)
 #ifndef RTW_HALMAC
 static u8 rtw_hal_enable_cpwm2(_adapter *adapter)

drivers/net/wireless/realtek/rtl8822ce/hal/hal_intf.c

@@ -474,6 +474,7 @@ u32 rtw_hal_power_on(_adapter *padapter)
 void rtw_hal_power_off(_adapter *padapter)
 {
 	struct macid_ctl_t *macid_ctl = &padapter->dvobj->macid_ctl;
+	int res;
 
 	_rtw_memset(macid_ctl->h2c_msr, 0, MACID_NUM_SW_LIMIT);
 	_rtw_memset(macid_ctl->op_num, 0, H2C_MSR_ROLE_MAX);
@@ -486,6 +487,10 @@ void rtw_hal_power_off(_adapter *padapter)
 	rtw_btcoex_PowerOffSetting(padapter);
 #endif
 
+	res = rtw_hal_pause_rx_dma(padapter);
+	if (res == _FAIL)
+		RTW_PRINT("[WARNING] pause RX DMA fail\n");
+	
 	padapter->hal_func.hal_power_off(padapter);
 }
 

drivers/net/wireless/realtek/rtl8822ce/hal/phydm/phydm_debug.h

@@ -88,8 +88,6 @@
 #elif (DM_ODM_SUPPORT_TYPE == ODM_CE) && defined(DM_ODM_CE_MAC80211)
 	#define PHYDM_SNPRINTF		snprintf
 #elif (DM_ODM_SUPPORT_TYPE == ODM_CE)
-	#undef	pr_debug
-	#define pr_debug		printk
 	#define RT_PRINTK(fmt, args...)	pr_debug(fmt, ## args)
 	#define	RT_DISP(dbgtype, dbgflag, printstr)
 	#define RT_TRACE(adapter, comp, drv_level, fmt, args...)	\

drivers/net/wireless/realtek/rtl8822ce/include/hal_com.h

@@ -373,6 +373,7 @@ void rtw_hal_dump_macaddr(void *sel, _adapter *adapter);
 void rtw_hal_set_hw_macaddr(PADAPTER adapter, u8 *mac_addr);
 
 void rtw_init_hal_com_default_value(PADAPTER Adapter);
+u8 rtw_hal_pause_rx_dma(_adapter *adapter);
 
 #ifdef CONFIG_FW_C2H_REG
 void c2h_evt_clear(_adapter *adapter);

drivers/net/wireless/realtek/rtl8822ce/include/rtw_mlme.h

@@ -1157,6 +1157,8 @@ int rtw_is_same_ibss(_adapter *adapter, struct wlan_network *pnetwork);
 int is_same_network(WLAN_BSSID_EX *src, WLAN_BSSID_EX *dst, u8 feature);
 
 #ifdef CONFIG_LAYER2_ROAMING
+int rtw_check_roaming_candidate(struct mlme_priv *mlme,
+	struct wlan_network **candidate, struct wlan_network *competitor, u8 potential_5G);
 #define rtw_roam_flags(adapter) ((adapter)->mlmepriv.roam_flags)
 #define rtw_chk_roam_flags(adapter, flags) ((adapter)->mlmepriv.roam_flags & flags)
 #define rtw_clr_roam_flags(adapter, flags) \

drivers/net/wireless/realtek/rtl8822ce/include/rtw_mlme_ext.h

@@ -23,8 +23,8 @@
  *	This will increase the chance to receive the probe response from SoftAP. */
 #define SURVEY_TO		(100)
 
-#define REAUTH_TO		(300) /* (50) */
-#define REASSOC_TO		(300) /* (50) */
+#define REAUTH_TO		(240) /* (50) */
+#define REASSOC_TO		(240) /* (50) */
 
 #define REAUTH_FT_TO		(1000)
 #define REASSOC_FT_TO		(1000)

drivers/net/wireless/realtek/rtl8822ce/include/rtw_version.h

@@ -1,2 +1,2 @@
-#define DRIVERVERSION	"v5.14.0.4-203-g4a9c85a0f.20240219_COEX20240125-2727_beta"
-#define BTCOEXVERSION	"COEX20240125-2727"
+#define DRIVERVERSION	"v5.14.0.4-217-g7a0377e61.20240410_COEX20240327-2727_beta"
+#define BTCOEXVERSION	"COEX20240327-2727"

drivers/net/wireless/realtek/rtl8822ce/include/rtw_wnm.h

@@ -208,7 +208,5 @@ u32 rtw_wnm_btm_candidates_survey(_adapter *padapter,
 	u8* pframe, u32 elem_len, u8 is_preference);
 
 struct mlme_priv;
-int rtw_check_roaming_candidate(struct mlme_priv *mlme,
-	struct wlan_network **candidate, struct wlan_network *competitor, u8 potential_5G);
 #endif /* __RTW_WNM_H_ */
 

drivers/net/wireless/realtek/rtl8822ce/os_dep/linux/wifi_regd.c

@@ -694,7 +694,7 @@ int rtw_regd_init(struct wiphy *wiphy)
 	wiphy->regulatory_flags &= ~REGULATORY_DISABLE_BEACON_HINTS;
 #endif
 
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0))
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(3, 19, 0)) && (LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 39))
 	wiphy->regulatory_flags |= REGULATORY_IGNORE_STALE_KICKOFF;
 #endif
 

drivers/video/tegra/nvmap/nvmap_alloc.c

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2011-2023, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2011-2025, NVIDIA CORPORATION. All rights reserved.
  *
  * Handle allocation and freeing routines for nvmap
  */
@@ -28,6 +28,7 @@
 #include <linux/libnvdimm.h>
 #endif /* NVMAP_UPSTREAM_KERNEL */
 #include "nvmap_priv.h"
+#include <linux/mm.h>
 
 bool nvmap_convert_carveout_to_iovmm;
 bool nvmap_convert_iovmm_to_carveout;
@@ -494,6 +495,8 @@ static int handle_page_alloc(struct nvmap_client *client,
 #else
 	static u8 chipid;
 #endif
+	struct mm_struct *mm = current->mm;
+	struct nvmap_handle_ref *ref;
 
 	if (!chipid) {
 #ifdef NVMAP_CONFIG_COLOR_PAGES
@@ -511,6 +514,13 @@ static int handle_page_alloc(struct nvmap_client *client,
 	if (!pages)
 		return -ENOMEM;
 
+	/*
+	 * Get refcount on mm_struct, so that it won't be freed until
+	 * nvmap reduces refcount after it reduces the RSS counter.
+	 */
+	if (!mmget_not_zero(mm))
+		goto page_free;
+
 	if (contiguous) {
 		struct page *page;
 		page = nvmap_alloc_pages_exact(gfp, size, true, h->numa_id);
@@ -582,6 +592,12 @@ static int handle_page_alloc(struct nvmap_client *client,
 		nvmap_total_page_allocs += nr_page;
 	}
 
+	/*
+	 * Increment the RSS counter of the allocating process by number of pages allocated.
+	 */
+	 h->anon_count = nr_page;
+	 nvmap_add_mm_counter(mm, MM_ANONPAGES, nr_page);
+
 	/*
 	 * Make sure any data in the caches is cleaned out before
 	 * passing these pages to userspace. Many nvmap clients assume that
@@ -595,11 +611,28 @@ static int handle_page_alloc(struct nvmap_client *client,
 	h->pgalloc.pages = pages;
 	h->pgalloc.contig = contiguous;
 	atomic_set(&h->pgalloc.ndirty, 0);
+
+	nvmap_ref_lock(client);
+	ref = __nvmap_validate_locked(client, h, false);
+	if (ref) {
+		ref->mm = mm;
+		ref->anon_count = h->anon_count;
+	} else {
+		nvmap_add_mm_counter(mm, MM_ANONPAGES, -nr_page);
+		mmput(mm);
+	}
+
+	nvmap_ref_unlock(client);
 	return 0;
 
 fail:
 	while (i--)
 		__free_page(pages[i]);
+
+	/* Incase of failure, release the reference on mm_struct. */
+	mmput(mm);
+
+page_free:
 	nvmap_altfree(pages, nr_page * sizeof(*pages));
 	wmb();
 	return -ENOMEM;
@@ -1072,9 +1105,18 @@ void _nvmap_handle_free(struct nvmap_handle *h)
 		h->pgalloc.pages[i] = nvmap_to_page(h->pgalloc.pages[i]);
 
 #ifdef NVMAP_CONFIG_PAGE_POOLS
-	if (!h->from_va && !h->is_subhandle)
-		page_index = nvmap_page_pool_fill_lots(&nvmap_dev->pool,
-					h->pgalloc.pages, nr_page);
+	if (!h->from_va && !h->is_subhandle) {
+		/*
+		 * When the process is exiting with kill signal pending, don't release the memory
+		 * back into page pool. So that memory would be released back to the kernel and OOM
+		 * killer would be able to actually free the memory.
+		 */
+		if (fatal_signal_pending(current) == 0 &&
+			sigismember(&current->signal->shared_pending.signal, SIGKILL) == 0) {
+			page_index = nvmap_page_pool_fill_lots(&nvmap_dev->pool,
+						h->pgalloc.pages, nr_page);
+		}
+	}
 #endif
 
 	for (i = page_index; i < nr_page; i++) {
@@ -1129,6 +1171,17 @@ void nvmap_free_handle(struct nvmap_client *client,
 	if (h->owner == client)
 		h->owner = NULL;
 
+	/*
+	 * When a reference is freed, decrement rss counter of the process corresponding
+	 * to this ref and do mmput so that mm_struct can be freed, if required.
+	 */
+	if (ref->mm != NULL && ref->anon_count != 0) {
+		nvmap_add_mm_counter(ref->mm, MM_ANONPAGES, -ref->anon_count);
+		mmput(ref->mm);
+		ref->mm = NULL;
+		ref->anon_count = 0;
+	}
+
 	if (is_ro)
 		dma_buf_put(ref->handle->dmabuf_ro);
 	else

drivers/video/tegra/nvmap/nvmap_dev.c

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: GPL-2.0-only
+// SPDX-FileCopyrightText: Copyright (c) 2011-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 /*
  * Copyright (c) 2011-2023, NVIDIA CORPORATION. All rights reserved.
  *
@@ -277,6 +278,17 @@ static void destroy_client(struct nvmap_client *client)
 		if (ref->handle->owner == client)
 			ref->handle->owner = NULL;
 
+		/*
+		 * When a reference is freed, decrement rss counter of the process corresponding
+		 * to this ref and do mmput so that mm_struct can be freed, if required.
+		 */
+		if (ref->mm != NULL && ref->anon_count != 0) {
+			nvmap_add_mm_counter(ref->mm, MM_ANONPAGES, -ref->anon_count);
+			mmput(ref->mm);
+			ref->mm = NULL;
+			ref->anon_count = 0;
+		}
+
 		if (ref->is_ro)
 			dma_buf_put(ref->handle->dmabuf_ro);
 		else

drivers/video/tegra/nvmap/nvmap_dmabuf.c

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2012-2023, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2012-2025, NVIDIA CORPORATION.  All rights reserved.
  *
  * dma_buf exporter for nvmap
  */
@@ -450,6 +450,7 @@ int __nvmap_map(struct nvmap_handle *h, struct vm_area_struct *vma)
 		nvmap_handle_put(h);
 		return -ENOMEM;
 	}
+	mutex_init(&priv->vma_lock);
 	priv->handle = h;
 
 #if defined(NV_VM_AREA_STRUCT_HAS_CONST_VM_FLAGS) /* Linux v6.3 */

drivers/video/tegra/nvmap/nvmap_fault.c

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2011-2023, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2011-2025, NVIDIA CORPORATION. All rights reserved.
  */
 
 #define pr_fmt(fmt)	"%s: " fmt, __func__
@@ -147,6 +147,14 @@ static void nvmap_vma_close(struct vm_area_struct *vma)
 	BUG_ON(!vma_found);
 	nvmap_umaps_dec(h);
 
+	mutex_lock(&priv->vma_lock);
+	if (priv->mm != NULL && h->anon_count != 0) {
+		nvmap_add_mm_counter(priv->mm, MM_ANONPAGES, priv->map_rss_count);
+		priv->map_rss_count = 0;
+		priv->mm = NULL;
+	}
+	mutex_unlock(&priv->vma_lock);
+
 	if (__atomic_add_unless(&priv->count, -1, 0) == 1) {
 		if (h->heap_pgalloc) {
 			for (i = 0; i < nr_page; i++) {
@@ -233,6 +241,14 @@ static int nvmap_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 					return VM_FAULT_SIGSEGV;
 			}
 
+			mutex_lock(&priv->vma_lock);
+			if (priv->handle->anon_count != 0 && current->mm != NULL) {
+				nvmap_add_mm_counter(current->mm, MM_ANONPAGES, -1);
+				priv->map_rss_count++;
+				priv->mm = current->mm;
+			}
+			mutex_unlock(&priv->vma_lock);
+
 			if (!nvmap_handle_track_dirty(priv->handle))
 				goto finish;
 			mutex_lock(&priv->handle->lock);

drivers/video/tegra/nvmap/nvmap_handle.c

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2009-2023, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2009-2025, NVIDIA CORPORATION. All rights reserved.
  *
  * Handle allocation and freeing routines for nvmap
  */
@@ -401,17 +401,31 @@ struct nvmap_handle_ref *nvmap_duplicate_handle(struct nvmap_client *client,
 
 	atomic_set(&ref->dupes, 1);
 	ref->handle = h;
+
+	/*
+	 * When a new reference is created to the handle, save mm, anon_count in ref and
+	 * increment ref count of mm.
+	 */
+	ref->mm = current->mm;
+	ref->anon_count = h->anon_count;
 	add_handle_ref(client, ref);
 
+	if (ref->anon_count != 0 && ref->mm != NULL) {
+		if (!mmget_not_zero(ref->mm))
+			goto exit;
+
+		nvmap_add_mm_counter(ref->mm, MM_ANONPAGES, ref->anon_count);
+	}
+
 	if (is_ro) {
 		ref->is_ro = true;
 		if (!h->dmabuf_ro)
-			goto exit;
+			goto exit_mm;
 		get_dma_buf(h->dmabuf_ro);
 	} else {
 		ref->is_ro = false;
 		if (!h->dmabuf)
-			goto exit;
+			goto exit_mm;
 		get_dma_buf(h->dmabuf);
 	}
 
@@ -420,6 +434,14 @@ out:
 		NVMAP_TP_ARGS_CHR(client, h, ref));
 	return ref;
 
+exit_mm:
+	if (ref->anon_count != 0 && ref->mm != NULL) {
+		nvmap_add_mm_counter(ref->mm, MM_ANONPAGES, -ref->anon_count);
+		mmput(ref->mm);
+		ref->mm = NULL;
+		ref->anon_count = 0;
+	}
+
 exit:
 	pr_err("dmabuf is NULL\n");
 	kfree(ref);

drivers/video/tegra/nvmap/nvmap_priv.h

@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Copyright (c) 2009-2023, NVIDIA CORPORATION. All rights reserved.
+ * Copyright (c) 2009-2025, NVIDIA CORPORATION. All rights reserved.
  *
  * GPU memory management driver for Tegra
  */
@@ -93,7 +93,7 @@ do {                                                    \
 	}                                               \
 } while (0)
 
-#define GFP_NVMAP       (GFP_KERNEL | __GFP_HIGHMEM | __GFP_NOWARN)
+#define GFP_NVMAP       (GFP_KERNEL | __GFP_HIGHMEM | __GFP_NOWARN | __GFP_ACCOUNT | __GFP_NORETRY)
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
 
@@ -271,6 +271,7 @@ struct nvmap_handle {
 	wait_queue_head_t waitq;
 	int numa_id;
 	u64 serial_id;
+	u64 anon_count;
 };
 
 struct nvmap_handle_info {
@@ -295,6 +296,8 @@ struct nvmap_handle_ref {
 	struct rb_node	node;
 	atomic_t	dupes;	/* number of times to free on file close */
 	bool is_ro;
+	struct mm_struct *mm;
+	u64 anon_count;
 };
 
 #if defined(NVMAP_CONFIG_PAGE_POOLS)
@@ -377,6 +380,9 @@ struct nvmap_vma_priv {
 	struct nvmap_handle *handle;
 	size_t		offs;
 	atomic_t	count;	/* number of processes cloning the VMA */
+	u64 map_rss_count;
+	struct mm_struct *mm;
+	struct mutex vma_lock;
 };
 
 struct nvmap_device {
@@ -913,6 +919,16 @@ static inline struct dma_buf *nvmap_id_array_id_release(struct xarray *xarr, u32
 	return NULL;
 }
 #endif
+
+static inline void nvmap_add_mm_counter(struct mm_struct *mm, int member, long value)
+{
+#if defined(NV_MM_STRUCT_STRUCT_HAS_PERCPU_COUNTER_RSS_STAT) /* Linux v6.2 */
+	percpu_counter_add(&mm->rss_stat[member], value);
+#else
+	atomic_long_add_return(value, &mm->rss_stat.count[member]);
+#endif
+}
+
 void *nvmap_dmabuf_get_drv_data(struct dma_buf *dmabuf,
 		struct device *dev);
 bool is_nvmap_memory_available(size_t size, uint32_t heap);

scripts/conftest/Makefile

@@ -125,6 +125,7 @@ NV_CONFTEST_FUNCTION_COMPILE_TESTS += i2c_driver_struct_remove_return_type_int
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += iio_dev_opaque_has_mlock
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += iommu_map_has_gfp_arg
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += kthread_complete_and_exit
+NV_CONFTEST_FUNCTION_COMPILE_TESTS += mm_struct_struct_has_percpu_counter_rss_stat
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += mii_bus_struct_has_read_c45
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += mii_bus_struct_has_write_c45
 NV_CONFTEST_FUNCTION_COMPILE_TESTS += netif_set_tso_max_size

scripts/conftest/conftest.sh

@@ -7152,6 +7152,23 @@ compile_test() {
             compile_check_conftest "$CODE" "NV_MII_BUS_STRUCT_HAS_WRITE_C45" "" "types"
         ;;
 
+        mm_struct_struct_has_percpu_counter_rss_stat)
+            #
+            # Determine if the 'rss_stat' member of the 'mm_struct' structure is
+            # defined with 'percpu_counter'.
+            #
+            # This change was made in Linux v6.2 by commit f1a7941243c1 ("mm:
+            # convert mm's rss stats into percpu_counter2").
+            #
+            CODE="
+            #include <linux/mm_types.h>
+            void conftest_mm_struct_struct_has_percpu_counter_rss_stat(struct mm_struct *mm) {
+                percpu_counter_add(&mm->rss_stat[0], 0);
+            }"
+
+            compile_check_conftest "$CODE" "NV_MM_STRUCT_STRUCT_HAS_PERCPU_COUNTER_RSS_STAT" "" "types"
+        ;;
+
         pwm_chip_struct_has_base_arg)
             #
             # Determine if 'struct pwm_chip' has the 'base' field.