--- /dev/null
+From adc06b9c6586b3986be8263a564d326aa0a85a9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2024 20:41:03 +0000
+Subject: afs: Fix directory format encoding struct
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 07a10767853adcbdbf436dc91393b729b52c4e81 ]
+
+The AFS directory format structure, union afs_xdr_dir_block::meta, has too
+many alloc counter slots declared and so pushes the hash table along and
+over the data. This doesn't cause a problem at the moment because I'm
+currently ignoring the hash table and only using the correct number of
+alloc_ctrs in the code anyway. In future, however, I should start using
+the hash table to try and speed up afs_lookup().
+
+Fix this by using the correct constant to declare the counter array.
+
+Fixes: 4ea219a839bf ("afs: Split the directory content defs into a header")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://lore.kernel.org/r/20241216204124.3752367-14-dhowells@redhat.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/xdr_fs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/afs/xdr_fs.h b/fs/afs/xdr_fs.h
+index 94f1f398eefad..cccc8e74f49b0 100644
+--- a/fs/afs/xdr_fs.h
++++ b/fs/afs/xdr_fs.h
+@@ -82,7 +82,7 @@ union afs_xdr_dir_block {
+
+ struct {
+ struct afs_xdr_dir_hdr hdr;
+- u8 alloc_ctrs[AFS_DIR_MAX_BLOCKS];
++ u8 alloc_ctrs[AFS_DIR_BLOCKS_WITH_CTR];
+ __be16 hashtable[AFS_DIR_HASHTBL_SIZE];
+ } meta;
+
+--
+2.39.5
+
--- /dev/null
+From 3e5148e281a367d8c892c23936204e0ff547ceff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jun 2024 11:46:33 +0200
+Subject: ARM: dts: mediatek: mt7623: fix IR nodename
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Rafał Miłecki <rafal@milecki.pl>
+
+[ Upstream commit 90234cf9b37c57201a24b78c217a91a8af774109 ]
+
+Fix following validation error:
+arch/arm/boot/dts/mediatek/mt7623a-rfb-emmc.dtb: cir@10013000: $nodename:0: 'cir@10013000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$'
+ from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml#
+
+Fixes: 91044f38dae7 ("arm: dts: mt7623: add ir nodes to the mt7623.dtsi file")
+Cc: linux-media@vger.kernel.org
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Link: https://lore.kernel.org/r/20240617094634.23173-1-zajec5@gmail.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/mt7623.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi
+index a79f0b6c34293..2f9154c13ea89 100644
+--- a/arch/arm/boot/dts/mt7623.dtsi
++++ b/arch/arm/boot/dts/mt7623.dtsi
+@@ -320,7 +320,7 @@
+ clock-names = "spi", "wrap";
+ };
+
+- cir: cir@10013000 {
++ cir: ir-receiver@10013000 {
+ compatible = "mediatek,mt7623-cir";
+ reg = <0 0x10013000 0 0x1000>;
+ interrupts = <GIC_SPI 87 IRQ_TYPE_LEVEL_LOW>;
+--
+2.39.5
+
--- /dev/null
+From 0668dfb74526154f5b6b5bc41394f750105e9887 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2024 13:24:20 +0800
+Subject: arm64: dts: mediatek: mt8173-evb: Drop regulator-compatible property
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit a6d5983e40f5d5b219337569cdd269727f5a3e2e ]
+
+The "regulator-compatible" property has been deprecated since 2012 in
+commit 13511def87b9 ("regulator: deprecate regulator-compatible DT
+property"), which is so old it's not even mentioned in the converted
+regulator bindings YAML file. It is also not listed in the MT6397
+regulator bindings. Having them present produces a whole bunch of
+validation errors:
+
+ Unevaluated properties are not allowed ('regulator-compatible' was unexpected)
+
+Drop the "regulator-compatible" property from the board dts. The
+property values are the same as the node name, so everything should
+continue to work.
+
+Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20241211052427.4178367-3-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 23 ---------------------
+ 1 file changed, 23 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+index 2b66afcf026e1..66f0e5b24fda4 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+@@ -307,7 +307,6 @@
+ compatible = "mediatek,mt6397-regulator";
+
+ mt6397_vpca15_reg: buck_vpca15 {
+- regulator-compatible = "buck_vpca15";
+ regulator-name = "vpca15";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -316,7 +315,6 @@
+ };
+
+ mt6397_vpca7_reg: buck_vpca7 {
+- regulator-compatible = "buck_vpca7";
+ regulator-name = "vpca7";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -325,7 +323,6 @@
+ };
+
+ mt6397_vsramca15_reg: buck_vsramca15 {
+- regulator-compatible = "buck_vsramca15";
+ regulator-name = "vsramca15";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -334,7 +331,6 @@
+ };
+
+ mt6397_vsramca7_reg: buck_vsramca7 {
+- regulator-compatible = "buck_vsramca7";
+ regulator-name = "vsramca7";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -343,7 +339,6 @@
+ };
+
+ mt6397_vcore_reg: buck_vcore {
+- regulator-compatible = "buck_vcore";
+ regulator-name = "vcore";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -352,7 +347,6 @@
+ };
+
+ mt6397_vgpu_reg: buck_vgpu {
+- regulator-compatible = "buck_vgpu";
+ regulator-name = "vgpu";
+ regulator-min-microvolt = < 700000>;
+ regulator-max-microvolt = <1350000>;
+@@ -361,7 +355,6 @@
+ };
+
+ mt6397_vdrm_reg: buck_vdrm {
+- regulator-compatible = "buck_vdrm";
+ regulator-name = "vdrm";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <1400000>;
+@@ -370,7 +363,6 @@
+ };
+
+ mt6397_vio18_reg: buck_vio18 {
+- regulator-compatible = "buck_vio18";
+ regulator-name = "vio18";
+ regulator-min-microvolt = <1620000>;
+ regulator-max-microvolt = <1980000>;
+@@ -379,19 +371,16 @@
+ };
+
+ mt6397_vtcxo_reg: ldo_vtcxo {
+- regulator-compatible = "ldo_vtcxo";
+ regulator-name = "vtcxo";
+ regulator-always-on;
+ };
+
+ mt6397_va28_reg: ldo_va28 {
+- regulator-compatible = "ldo_va28";
+ regulator-name = "va28";
+ regulator-always-on;
+ };
+
+ mt6397_vcama_reg: ldo_vcama {
+- regulator-compatible = "ldo_vcama";
+ regulator-name = "vcama";
+ regulator-min-microvolt = <1500000>;
+ regulator-max-microvolt = <2800000>;
+@@ -399,18 +388,15 @@
+ };
+
+ mt6397_vio28_reg: ldo_vio28 {
+- regulator-compatible = "ldo_vio28";
+ regulator-name = "vio28";
+ regulator-always-on;
+ };
+
+ mt6397_vusb_reg: ldo_vusb {
+- regulator-compatible = "ldo_vusb";
+ regulator-name = "vusb";
+ };
+
+ mt6397_vmc_reg: ldo_vmc {
+- regulator-compatible = "ldo_vmc";
+ regulator-name = "vmc";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <3300000>;
+@@ -418,7 +404,6 @@
+ };
+
+ mt6397_vmch_reg: ldo_vmch {
+- regulator-compatible = "ldo_vmch";
+ regulator-name = "vmch";
+ regulator-min-microvolt = <3000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -426,7 +411,6 @@
+ };
+
+ mt6397_vemc_3v3_reg: ldo_vemc3v3 {
+- regulator-compatible = "ldo_vemc3v3";
+ regulator-name = "vemc_3v3";
+ regulator-min-microvolt = <3000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -434,7 +418,6 @@
+ };
+
+ mt6397_vgp1_reg: ldo_vgp1 {
+- regulator-compatible = "ldo_vgp1";
+ regulator-name = "vcamd";
+ regulator-min-microvolt = <1220000>;
+ regulator-max-microvolt = <3300000>;
+@@ -442,7 +425,6 @@
+ };
+
+ mt6397_vgp2_reg: ldo_vgp2 {
+- regulator-compatible = "ldo_vgp2";
+ regulator-name = "vcamio";
+ regulator-min-microvolt = <1000000>;
+ regulator-max-microvolt = <3300000>;
+@@ -450,7 +432,6 @@
+ };
+
+ mt6397_vgp3_reg: ldo_vgp3 {
+- regulator-compatible = "ldo_vgp3";
+ regulator-name = "vcamaf";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3300000>;
+@@ -458,7 +439,6 @@
+ };
+
+ mt6397_vgp4_reg: ldo_vgp4 {
+- regulator-compatible = "ldo_vgp4";
+ regulator-name = "vgp4";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3300000>;
+@@ -466,7 +446,6 @@
+ };
+
+ mt6397_vgp5_reg: ldo_vgp5 {
+- regulator-compatible = "ldo_vgp5";
+ regulator-name = "vgp5";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3000000>;
+@@ -474,7 +453,6 @@
+ };
+
+ mt6397_vgp6_reg: ldo_vgp6 {
+- regulator-compatible = "ldo_vgp6";
+ regulator-name = "vgp6";
+ regulator-min-microvolt = <1200000>;
+ regulator-max-microvolt = <3300000>;
+@@ -482,7 +460,6 @@
+ };
+
+ mt6397_vibr_reg: ldo_vibr {
+- regulator-compatible = "ldo_vibr";
+ regulator-name = "vibr";
+ regulator-min-microvolt = <1300000>;
+ regulator-max-microvolt = <3300000>;
+--
+2.39.5
+
--- /dev/null
+From d7f05d25f7177868c8d6ecf2974343ce1c15203e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 17:26:13 +0800
+Subject: arm64: dts: mediatek: mt8173-evb: Fix MT6397 PMIC sub-node names
+
+From: Chen-Yu Tsai <wenst@chromium.org>
+
+[ Upstream commit 9545ba142865b9099d43c972b9ebcf463606499a ]
+
+The MT6397 PMIC bindings specify exact names for its sub-nodes. The
+names used in the current dts don't match, causing a validation error.
+
+Fix up the names. Also drop the label for the regulators node, since
+any reference should be against the individual regulator sub-nodes.
+
+Fixes: 16ea61fc5614 ("arm64: dts: mt8173-evb: Add PMIC support")
+Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
+Link: https://lore.kernel.org/r/20241210092614.3951748-2-wenst@chromium.org
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+index 66f0e5b24fda4..1158bee050e13 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
++++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+@@ -303,7 +303,7 @@
+ interrupt-controller;
+ #interrupt-cells = <2>;
+
+- mt6397regulator: mt6397regulator {
++ regulators {
+ compatible = "mediatek,mt6397-regulator";
+
+ mt6397_vpca15_reg: buck_vpca15 {
+--
+2.39.5
+
--- /dev/null
+From 2c0590d6a5a7fe4d128e9e62f3ab0293ffdce55f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2024 17:55:29 +0100
+Subject: ASoC: sun4i-spdif: Add clock multiplier settings
+
+From: George Lander <lander@jagmn.com>
+
+[ Upstream commit 0a2319308de88b9e819c0b43d0fccd857123eb31 ]
+
+There have been intermittent issues with the SPDIF output on H3
+and H2+ devices which has been fixed by setting the s_clk to 4
+times the audio pll.
+Add a quirk for the clock multiplier as not every supported SoC
+requires it. Without the multiplier, the audio at normal sampling
+rates was distorted and did not play at higher sampling rates.
+
+Fixes: 1bd92af877ab ("ASoC: sun4i-spdif: Add support for the H3 SoC")
+Signed-off-by: George Lander <lander@jagmn.com>
+Signed-off-by: Marcus Cooper <codekipper@gmail.com>
+Link: https://patch.msgid.link/20241111165600.57219-2-codekipper@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-spdif.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c
+index 680d64e0d69f4..82f3a3e37e910 100644
+--- a/sound/soc/sunxi/sun4i-spdif.c
++++ b/sound/soc/sunxi/sun4i-spdif.c
+@@ -175,6 +175,7 @@ struct sun4i_spdif_quirks {
+ unsigned int reg_dac_txdata;
+ bool has_reset;
+ unsigned int val_fctl_ftx;
++ unsigned int mclk_multiplier;
+ };
+
+ struct sun4i_spdif_dev {
+@@ -311,6 +312,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream,
+ default:
+ return -EINVAL;
+ }
++ mclk *= host->quirks->mclk_multiplier;
+
+ ret = clk_set_rate(host->spdif_clk, mclk);
+ if (ret < 0) {
+@@ -345,6 +347,7 @@ static int sun4i_spdif_hw_params(struct snd_pcm_substream *substream,
+ default:
+ return -EINVAL;
+ }
++ mclk_div *= host->quirks->mclk_multiplier;
+
+ reg_val = 0;
+ reg_val |= SUN4I_SPDIF_TXCFG_ASS;
+@@ -427,24 +430,28 @@ static struct snd_soc_dai_driver sun4i_spdif_dai = {
+ static const struct sun4i_spdif_quirks sun4i_a10_spdif_quirks = {
+ .reg_dac_txdata = SUN4I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX,
++ .mclk_multiplier = 1,
+ };
+
+ static const struct sun4i_spdif_quirks sun6i_a31_spdif_quirks = {
+ .reg_dac_txdata = SUN4I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX,
+ .has_reset = true,
++ .mclk_multiplier = 1,
+ };
+
+ static const struct sun4i_spdif_quirks sun8i_h3_spdif_quirks = {
+ .reg_dac_txdata = SUN8I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN4I_SPDIF_FCTL_FTX,
+ .has_reset = true,
++ .mclk_multiplier = 4,
+ };
+
+ static const struct sun4i_spdif_quirks sun50i_h6_spdif_quirks = {
+ .reg_dac_txdata = SUN8I_SPDIF_TXFIFO,
+ .val_fctl_ftx = SUN50I_H6_SPDIF_FCTL_FTX,
+ .has_reset = true,
++ .mclk_multiplier = 1,
+ };
+
+ static const struct of_device_id sun4i_spdif_of_match[] = {
+--
+2.39.5
+
--- /dev/null
+From dc22efa8245fbbd48a91523f116aabbec737937d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 10:36:47 +0000
+Subject: bpf: Send signals asynchronously if !preemptible
+
+From: Puranjay Mohan <puranjay@kernel.org>
+
+[ Upstream commit 87c544108b612512b254c8f79aa5c0a8546e2cc4 ]
+
+BPF programs can execute in all kinds of contexts and when a program
+running in a non-preemptible context uses the bpf_send_signal() kfunc,
+it will cause issues because this kfunc can sleep.
+Change `irqs_disabled()` to `!preemptible()`.
+
+Reported-by: syzbot+97da3d7e0112d59971de@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/67486b09.050a0220.253251.0084.GAE@google.com/
+Fixes: 1bc7896e9ef4 ("bpf: Fix deadlock with rq_lock in bpf_send_signal()")
+Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
+Acked-by: Yonghong Song <yonghong.song@linux.dev>
+Link: https://lore.kernel.org/r/20250115103647.38487-1-puranjay@kernel.org
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/bpf_trace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
+index 4a31763a8c5d7..ac3125d0c73f1 100644
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -653,7 +653,7 @@ BPF_CALL_1(bpf_send_signal, u32, sig)
+ if (unlikely(is_global_init(current)))
+ return -EPERM;
+
+- if (irqs_disabled()) {
++ if (!preemptible()) {
+ /* Do an early check on signal validity. Otherwise,
+ * the error is lost in deferred irq_work.
+ */
+--
+2.39.5
+
--- /dev/null
+From 77c901cbdbc4095ea232d95fe6ed39c591a4d72b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2024 23:16:39 -0700
+Subject: clk: analogbits: Fix incorrect calculation of vco rate delta
+
+From: Bo Gan <ganboing@gmail.com>
+
+[ Upstream commit d7f12857f095ef38523399d47e68787b357232f6 ]
+
+In wrpll_configure_for_rate() we try to determine the best PLL
+configuration for a target rate. However, in the loop where we try
+values of R, we should compare the derived `vco` with `target_vco_rate`.
+However, we were in fact comparing it with `target_rate`, which is
+actually after Q shift. This is incorrect, and sometimes can result in
+suboptimal clock rates. Fix it.
+
+Fixes: 7b9487a9a5c4 ("clk: analogbits: add Wide-Range PLL library")
+Signed-off-by: Bo Gan <ganboing@gmail.com>
+Link: https://lore.kernel.org/r/20240830061639.2316-1-ganboing@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/analogbits/wrpll-cln28hpc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/analogbits/wrpll-cln28hpc.c b/drivers/clk/analogbits/wrpll-cln28hpc.c
+index 776ead319ae9c..9df572579afb4 100644
+--- a/drivers/clk/analogbits/wrpll-cln28hpc.c
++++ b/drivers/clk/analogbits/wrpll-cln28hpc.c
+@@ -287,7 +287,7 @@ int wrpll_configure_for_rate(struct wrpll_cfg *c, u32 target_rate,
+ vco = vco_pre * f;
+ }
+
+- delta = abs(target_rate - vco);
++ delta = abs(target_vco_rate - vco);
+ if (delta < best_delta) {
+ best_delta = delta;
+ best_r = r;
+--
+2.39.5
+
--- /dev/null
+From ee746a77e11d7de0420959a893ab3fd5811e9d5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 10:14:59 +0800
+Subject: cpupower: fix TSC MHz calculation
+
+From: He Rongguang <herongguang@linux.alibaba.com>
+
+[ Upstream commit 9d6c0e58514f8b57cd9c2c755e41623d6a966025 ]
+
+Commit 'cpupower: Make TSC read per CPU for Mperf monitor' (c2adb1877b7)
+changes TSC counter reads per cpu, but left time diff global (from start
+of all cpus to end of all cpus), thus diff(time) is too large for a
+cpu's tsc counting, resulting in far less than acutal TSC_Mhz and thus
+`cpupower monitor` showing far less than actual cpu realtime frequency.
+
+/proc/cpuinfo shows frequency:
+cat /proc/cpuinfo | egrep -e 'processor' -e 'MHz'
+...
+processor : 171
+cpu MHz : 4108.498
+...
+
+before fix (System 100% busy):
+ | Mperf || Idle_Stats
+ CPU| C0 | Cx | Freq || POLL | C1 | C2
+ 171| 0.77| 99.23| 2279|| 0.00| 0.00| 0.00
+
+after fix (System 100% busy):
+ | Mperf || Idle_Stats
+ CPU| C0 | Cx | Freq || POLL | C1 | C2
+ 171| 0.46| 99.54| 4095|| 0.00| 0.00| 0.00
+
+Fixes: c2adb1877b76 ("cpupower: Make TSC read per CPU for Mperf monitor")
+Signed-off-by: He Rongguang <herongguang@linux.alibaba.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../cpupower/utils/idle_monitor/mperf_monitor.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+index 7a76d63003748..0e8c0b879d4b2 100644
+--- a/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
++++ b/tools/power/cpupower/utils/idle_monitor/mperf_monitor.c
+@@ -29,7 +29,7 @@ static int mperf_get_count_percent(unsigned int self_id, double *percent,
+ unsigned int cpu);
+ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
+ unsigned int cpu);
+-static struct timespec time_start, time_end;
++static struct timespec *time_start, *time_end;
+
+ static cstate_t mperf_cstates[MPERF_CSTATE_COUNT] = {
+ {
+@@ -135,7 +135,7 @@ static int mperf_get_count_percent(unsigned int id, double *percent,
+ dprint("%s: TSC Ref - mperf_diff: %llu, tsc_diff: %llu\n",
+ mperf_cstates[id].name, mperf_diff, tsc_diff);
+ } else if (max_freq_mode == MAX_FREQ_SYSFS) {
+- timediff = max_frequency * timespec_diff_us(time_start, time_end);
++ timediff = max_frequency * timespec_diff_us(time_start[cpu], time_end[cpu]);
+ *percent = 100.0 * mperf_diff / timediff;
+ dprint("%s: MAXFREQ - mperf_diff: %llu, time_diff: %llu\n",
+ mperf_cstates[id].name, mperf_diff, timediff);
+@@ -168,7 +168,7 @@ static int mperf_get_count_freq(unsigned int id, unsigned long long *count,
+ if (max_freq_mode == MAX_FREQ_TSC_REF) {
+ /* Calculate max_freq from TSC count */
+ tsc_diff = tsc_at_measure_end[cpu] - tsc_at_measure_start[cpu];
+- time_diff = timespec_diff_us(time_start, time_end);
++ time_diff = timespec_diff_us(time_start[cpu], time_end[cpu]);
+ max_frequency = tsc_diff / time_diff;
+ }
+
+@@ -187,9 +187,8 @@ static int mperf_start(void)
+ {
+ int cpu;
+
+- clock_gettime(CLOCK_REALTIME, &time_start);
+-
+ for (cpu = 0; cpu < cpu_count; cpu++) {
++ clock_gettime(CLOCK_REALTIME, &time_start[cpu]);
+ mperf_get_tsc(&tsc_at_measure_start[cpu]);
+ mperf_init_stats(cpu);
+ }
+@@ -204,9 +203,9 @@ static int mperf_stop(void)
+ for (cpu = 0; cpu < cpu_count; cpu++) {
+ mperf_measure_stats(cpu);
+ mperf_get_tsc(&tsc_at_measure_end[cpu]);
++ clock_gettime(CLOCK_REALTIME, &time_end[cpu]);
+ }
+
+- clock_gettime(CLOCK_REALTIME, &time_end);
+ return 0;
+ }
+
+@@ -307,6 +306,8 @@ struct cpuidle_monitor *mperf_register(void)
+ aperf_current_count = calloc(cpu_count, sizeof(unsigned long long));
+ tsc_at_measure_start = calloc(cpu_count, sizeof(unsigned long long));
+ tsc_at_measure_end = calloc(cpu_count, sizeof(unsigned long long));
++ time_start = calloc(cpu_count, sizeof(struct timespec));
++ time_end = calloc(cpu_count, sizeof(struct timespec));
+ mperf_monitor.name_len = strlen(mperf_monitor.name);
+ return &mperf_monitor;
+ }
+@@ -319,6 +320,8 @@ void mperf_unregister(void)
+ free(aperf_current_count);
+ free(tsc_at_measure_start);
+ free(tsc_at_measure_end);
++ free(time_start);
++ free(time_end);
+ free(is_valid);
+ }
+
+--
+2.39.5
+
--- /dev/null
+From a2b02ecf9798f8f96514658ac69a3466f333de98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2024 11:05:07 +0900
+Subject: dmaengine: ti: edma: fix OF node reference leaks in edma_driver
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit e883c64778e5a9905fce955681f8ee38c7197e0f ]
+
+The .probe() of edma_driver calls of_parse_phandle_with_fixed_args() but
+does not release the obtained OF nodes. Thus add a of_node_put() call.
+
+This bug was found by an experimental verification tool that I am
+developing.
+
+Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/20241219020507.1983124-3-joe@pf.is.s.u-tokyo.ac.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index b570f08888eeb..01089e5c565f3 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -217,7 +217,6 @@ struct edma_desc {
+ struct edma_cc;
+
+ struct edma_tc {
+- struct device_node *node;
+ u16 id;
+ };
+
+@@ -2414,13 +2413,13 @@ static int edma_probe(struct platform_device *pdev)
+ if (ret || i == ecc->num_tc)
+ break;
+
+- ecc->tc_list[i].node = tc_args.np;
+ ecc->tc_list[i].id = i;
+ queue_priority_mapping[i][1] = tc_args.args[0];
+ if (queue_priority_mapping[i][1] > lowest_priority) {
+ lowest_priority = queue_priority_mapping[i][1];
+ info->default_queue = i;
+ }
++ of_node_put(tc_args.np);
+ }
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 8404991baf1098a8f1a300acc043f9451b6f1900 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 11:00:43 +0300
+Subject: drm/amdgpu: Fix potential NULL pointer dereference in
+ atomctrl_get_smc_sclk_range_table
+
+From: Ivan Stepchenko <sid@itb.spb.ru>
+
+[ Upstream commit 357445e28ff004d7f10967aa93ddb4bffa5c3688 ]
+
+The function atomctrl_get_smc_sclk_range_table() does not check the return
+value of smu_atom_get_data_table(). If smu_atom_get_data_table() fails to
+retrieve SMU_Info table, it returns NULL which is later dereferenced.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+In practice this should never happen as this code only gets called
+on polaris chips and the vbios data table will always be present on
+those chips.
+
+Fixes: a23eefa2f461 ("drm/amd/powerplay: enable dpm for baffin.")
+Signed-off-by: Ivan Stepchenko <sid@itb.spb.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
+index 01dc46dc9c8a0..ec680695ed03d 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c
+@@ -1369,6 +1369,8 @@ int atomctrl_get_smc_sclk_range_table(struct pp_hwmgr *hwmgr, struct pp_atom_ctr
+ GetIndexIntoMasterTable(DATA, SMU_Info),
+ &size, &frev, &crev);
+
++ if (!psmu_info)
++ return -EINVAL;
+
+ for (i = 0; i < psmu_info->ucSclkEntryNum; i++) {
+ table->entry[i].ucVco_setting = psmu_info->asSclkFcwRangeEntry[i].ucVco_setting;
+--
+2.39.5
+
--- /dev/null
+From 42aa3dcecb90df9486916bcb6217da87a6374c2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2024 08:41:56 +0800
+Subject: drm/etnaviv: Fix page property being used for non writecombine
+ buffers
+
+From: Sui Jingfeng <sui.jingfeng@linux.dev>
+
+[ Upstream commit 834f304192834d6f0941954f3277ae0ba11a9a86 ]
+
+In the etnaviv_gem_vmap_impl() function, the driver vmap whatever buffers
+with write combine(WC) page property, this is incorrect. Cached buffers
+should be mapped with the cached page property and uncached buffers should
+be mapped with the uncached page property.
+
+Fixes: a0a5ab3e99b8 ("drm/etnaviv: call correct function when trying to vmap a DMABUF")
+Signed-off-by: Sui Jingfeng <sui.jingfeng@linux.dev>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem.c b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+index 2aabe8433cee2..3d04ac6d821df 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem.c
+@@ -350,6 +350,7 @@ void *etnaviv_gem_vmap(struct drm_gem_object *obj)
+ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj)
+ {
+ struct page **pages;
++ pgprot_t prot;
+
+ lockdep_assert_held(&obj->lock);
+
+@@ -357,8 +358,19 @@ static void *etnaviv_gem_vmap_impl(struct etnaviv_gem_object *obj)
+ if (IS_ERR(pages))
+ return NULL;
+
+- return vmap(pages, obj->base.size >> PAGE_SHIFT,
+- VM_MAP, pgprot_writecombine(PAGE_KERNEL));
++ switch (obj->flags & ETNA_BO_CACHE_MASK) {
++ case ETNA_BO_CACHED:
++ prot = PAGE_KERNEL;
++ break;
++ case ETNA_BO_UNCACHED:
++ prot = pgprot_noncached(PAGE_KERNEL);
++ break;
++ case ETNA_BO_WC:
++ default:
++ prot = pgprot_writecombine(PAGE_KERNEL);
++ }
++
++ return vmap(pages, obj->base.size >> PAGE_SHIFT, VM_MAP, prot);
+ }
+
+ static inline enum dma_data_direction etnaviv_op_to_dma_dir(u32 op)
+--
+2.39.5
+
--- /dev/null
+From 9bf05506628521224fa4f0d8cdc7e289a7ed8d8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2024 16:16:41 +0100
+Subject: dt-bindings: mmc: controller: clarify the address-cells description
+
+From: Neil Armstrong <neil.armstrong@linaro.org>
+
+[ Upstream commit b2b8e93ec00b8110cb37cbde5400d5abfdaed6a7 ]
+
+The term "slot ID" has nothing to do with the SDIO function number
+which is specified in the reg property of the subnodes, rephrase
+the description to be more accurate.
+
+Fixes: f9b7989859dd ("dt-bindings: mmc: Add YAML schemas for the generic MMC options")
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Message-ID: <20241128-topic-amlogic-arm32-upstream-bindings-fixes-convert-meson-mx-sdio-v4-1-11d9f9200a59@linaro.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/mmc/mmc-controller.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml
+index 080754e0ef352..ccb9df705fb1c 100644
+--- a/Documentation/devicetree/bindings/mmc/mmc-controller.yaml
++++ b/Documentation/devicetree/bindings/mmc/mmc-controller.yaml
+@@ -21,7 +21,7 @@ properties:
+ "#address-cells":
+ const: 1
+ description: |
+- The cell is the slot ID if a function subnode is used.
++ The cell is the SDIO function number if a function subnode is used.
+
+ "#size-cells":
+ const: 0
+--
+2.39.5
+
--- /dev/null
+From 829fbc23657b635c7da99c8f4d004ddd86561391 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 10:15:37 +0900
+Subject: fbdev: omapfb: Fix an OF node leak in dss_of_port_get_parent_device()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit de124b61e179e690277116e6be512e4f422b5dd8 ]
+
+dss_of_port_get_parent_device() leaks an OF node reference when i >= 2
+and struct device_node *np is present. Since of_get_next_parent()
+obtains a reference of the returned OF node, call of_node_put() before
+returning NULL.
+
+This was found by an experimental verifier that I am developing, and no
+runtime test was able to be performed due to that lack of actual
+devices.
+
+Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/omap2/omapfb/dss/dss-of.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
+index 0282d4eef139d..3b16c3342cb77 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss-of.c
+@@ -102,6 +102,7 @@ struct device_node *dss_of_port_get_parent_device(struct device_node *port)
+ np = of_get_next_parent(np);
+ }
+
++ of_node_put(np);
+ return NULL;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From d2f2a1debd8f67772563d029b7e6b711fae96c66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2024 17:44:19 +0800
+Subject: ipmi: ipmb: Add check devm_kasprintf() returned value
+
+From: Charles Han <hanchunchao@inspur.com>
+
+[ Upstream commit 2378bd0b264ad3a1f76bd957caf33ee0c7945351 ]
+
+devm_kasprintf() can return a NULL pointer on failure but this
+returned value is not checked.
+
+Fixes: 51bd6f291583 ("Add support for IPMB driver")
+Signed-off-by: Charles Han <hanchunchao@inspur.com>
+Message-ID: <20240926094419.25900-1-hanchunchao@inspur.com>
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmb_dev_int.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/char/ipmi/ipmb_dev_int.c b/drivers/char/ipmi/ipmb_dev_int.c
+index 09e3e25562a89..f56b92880cdaf 100644
+--- a/drivers/char/ipmi/ipmb_dev_int.c
++++ b/drivers/char/ipmi/ipmb_dev_int.c
+@@ -309,6 +309,9 @@ static int ipmb_probe(struct i2c_client *client,
+ ipmb_dev->miscdev.name = devm_kasprintf(&client->dev, GFP_KERNEL,
+ "%s%d", "ipmb-",
+ client->adapter->nr);
++ if (!ipmb_dev->miscdev.name)
++ return -ENOMEM;
++
+ ipmb_dev->miscdev.fops = &ipmb_fops;
+ ipmb_dev->miscdev.parent = &client->dev;
+ ret = misc_register(&ipmb_dev->miscdev);
+--
+2.39.5
+
--- /dev/null
+From af41c31504f62b82756809a7c8ff3d0d0d7a6984 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2025 18:12:41 +0000
+Subject: ipmr: do not call mr_mfc_uses_dev() for unres entries
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 15a901361ec3fb1c393f91880e1cbf24ec0a88bd ]
+
+syzbot found that calling mr_mfc_uses_dev() for unres entries
+would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif
+alias to "struct sk_buff_head unresolved", which contain two pointers.
+
+This code never worked, lets remove it.
+
+[1]
+Unable to handle kernel paging request at virtual address ffff5fff2d536613
+KASAN: maybe wild-memory-access in range [0xfffefff96a9b3098-0xfffefff96a9b309f]
+Modules linked in:
+CPU: 1 UID: 0 PID: 7321 Comm: syz.0.16 Not tainted 6.13.0-rc7-syzkaller-g1950a0af2d55 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
+pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline]
+ pc : mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334
+ lr : mr_mfc_uses_dev net/ipv4/ipmr_base.c:289 [inline]
+ lr : mr_table_dump+0x694/0x8b0 net/ipv4/ipmr_base.c:334
+Call trace:
+ mr_mfc_uses_dev net/ipv4/ipmr_base.c:290 [inline] (P)
+ mr_table_dump+0x5a4/0x8b0 net/ipv4/ipmr_base.c:334 (P)
+ mr_rtm_dumproute+0x254/0x454 net/ipv4/ipmr_base.c:382
+ ipmr_rtm_dumproute+0x248/0x4b4 net/ipv4/ipmr.c:2648
+ rtnl_dump_all+0x2e4/0x4e8 net/core/rtnetlink.c:4327
+ rtnl_dumpit+0x98/0x1d0 net/core/rtnetlink.c:6791
+ netlink_dump+0x4f0/0xbc0 net/netlink/af_netlink.c:2317
+ netlink_recvmsg+0x56c/0xe64 net/netlink/af_netlink.c:1973
+ sock_recvmsg_nosec net/socket.c:1033 [inline]
+ sock_recvmsg net/socket.c:1055 [inline]
+ sock_read_iter+0x2d8/0x40c net/socket.c:1125
+ new_sync_read fs/read_write.c:484 [inline]
+ vfs_read+0x740/0x970 fs/read_write.c:565
+ ksys_read+0x15c/0x26c fs/read_write.c:708
+
+Fixes: cb167893f41e ("net: Plumb support for filtering ipv4 and ipv6 multicast route dumps")
+Reported-by: syzbot+5cfae50c0e5f2c500013@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/netdev/678fe2d1.050a0220.15cac.00b3.GAE@google.com/T/#u
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://patch.msgid.link/20250121181241.841212-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ipmr_base.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c
+index 4a1a90a135406..78ca019f0a32a 100644
+--- a/net/ipv4/ipmr_base.c
++++ b/net/ipv4/ipmr_base.c
+@@ -321,9 +321,6 @@ int mr_table_dump(struct mr_table *mrt, struct sk_buff *skb,
+ list_for_each_entry(mfc, &mrt->mfc_unres_queue, list) {
+ if (e < s_e)
+ goto next_entry2;
+- if (filter->dev &&
+- !mr_mfc_uses_dev(mrt, mfc, filter->dev))
+- goto next_entry2;
+
+ err = fill(mrt, skb, NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, mfc, RTM_NEWROUTE, flags);
+--
+2.39.5
+
--- /dev/null
+From 9052f338c0a2e3819e8aa2ea03df19d584d3cd9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2024 21:07:35 +0800
+Subject: ktest.pl: Remove unused declarations in run_bisect_test function
+
+From: Ba Jing <bajing@cmss.chinamobile.com>
+
+[ Upstream commit 776735b954f49f85fd19e1198efa421fae2ad77c ]
+
+Since $output and $ret are not used in the subsequent code, the declarations
+should be removed.
+
+Fixes: a75fececff3c ("ktest: Added sample.conf, new %default option format")
+Link: https://lore.kernel.org/20240902130735.6034-1-bajing@cmss.chinamobile.com
+Signed-off-by: Ba Jing <bajing@cmss.chinamobile.com>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/ktest/ktest.pl | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
+index e7adb429018b2..184af2fcc1597 100755
+--- a/tools/testing/ktest/ktest.pl
++++ b/tools/testing/ktest/ktest.pl
+@@ -2861,8 +2861,6 @@ sub run_bisect_test {
+
+ my $failed = 0;
+ my $result;
+- my $output;
+- my $ret;
+
+ $in_bisect = 1;
+
+--
+2.39.5
+
--- /dev/null
+From 3cd5d2fdd887fd0e9e858b212859d3ddca51aba2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 19:18:17 +0000
+Subject: media: camif-core: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit 77ed2470ac09c2b0a33cf3f98cc51d18ba9ed976 ]
+
+Add check for the return value of clk_enable() to gurantee the success.
+
+Fixes: babde1c243b2 ("[media] V4L: Add driver for S3C24XX/S3C64XX SoC series camera interface")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/s3c-camif/camif-core.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c
+index ee624804862e2..3c8c262e3c687 100644
+--- a/drivers/media/platform/s3c-camif/camif-core.c
++++ b/drivers/media/platform/s3c-camif/camif-core.c
+@@ -529,10 +529,19 @@ static int s3c_camif_remove(struct platform_device *pdev)
+ static int s3c_camif_runtime_resume(struct device *dev)
+ {
+ struct camif_dev *camif = dev_get_drvdata(dev);
++ int ret;
++
++ ret = clk_enable(camif->clock[CLK_GATE]);
++ if (ret)
++ return ret;
+
+- clk_enable(camif->clock[CLK_GATE]);
+ /* null op on s3c244x */
+- clk_enable(camif->clock[CLK_CAM]);
++ ret = clk_enable(camif->clock[CLK_CAM]);
++ if (ret) {
++ clk_disable(camif->clock[CLK_GATE]);
++ return ret;
++ }
++
+ return 0;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From a18a82d8851b9dfdbfc624645107222121a2ec18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2024 17:10:42 +0800
+Subject: media: lmedm04: Handle errors for lme2510_int_read
+
+From: Chen Ni <nichen@iscas.ac.cn>
+
+[ Upstream commit a2836d3fe220220ff8c495ca9722f89cea8a67e7 ]
+
+Add check for the return value of usb_pipe_endpoint() and
+usb_submit_urb() in order to catch the errors.
+
+Fixes: 15e1ce33182d ("[media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb")
+Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20240521091042.1769684-1-nichen@iscas.ac.cn
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 2b3b780782a40..8c573c3a83d5e 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -372,6 +372,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ struct dvb_usb_device *d = adap_to_d(adap);
+ struct lme2510_state *lme_int = adap_to_priv(adap);
+ struct usb_host_endpoint *ep;
++ int ret;
+
+ lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL);
+
+@@ -389,11 +390,20 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+
+ /* Quirk of pipe reporting PIPE_BULK but behaves as interrupt */
+ ep = usb_pipe_endpoint(d->udev, lme_int->lme_urb->pipe);
++ if (!ep) {
++ usb_free_urb(lme_int->lme_urb);
++ return -ENODEV;
++ }
+
+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
+
+- usb_submit_urb(lme_int->lme_urb, GFP_KERNEL);
++ ret = usb_submit_urb(lme_int->lme_urb, GFP_KERNEL);
++ if (ret) {
++ usb_free_urb(lme_int->lme_urb);
++ return ret;
++ }
++
+ info("INT Interrupt Service Started");
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 29fa76c1c3f5e8b7e153927b160a3f9fed4bf722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Oct 2020 11:32:43 +0200
+Subject: media: lmedm04: Use GFP_KERNEL for URB allocation/submission.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+[ Upstream commit add5861769f912af0181f5fbd79dbf19c8211c20 ]
+
+lme2510_int_read is not atomically called so use GFP_KERNEL for
+usb_alloc_urb and usb_submit_urb which is the first in the chain
+of interrupt submissions.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: a2836d3fe220 ("media: lmedm04: Handle errors for lme2510_int_read")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/dvb-usb-v2/lmedm04.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+index 5ac1a6af87826..2b3b780782a40 100644
+--- a/drivers/media/usb/dvb-usb-v2/lmedm04.c
++++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c
+@@ -373,7 +373,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ struct lme2510_state *lme_int = adap_to_priv(adap);
+ struct usb_host_endpoint *ep;
+
+- lme_int->lme_urb = usb_alloc_urb(0, GFP_ATOMIC);
++ lme_int->lme_urb = usb_alloc_urb(0, GFP_KERNEL);
+
+ if (lme_int->lme_urb == NULL)
+ return -ENOMEM;
+@@ -393,7 +393,7 @@ static int lme2510_int_read(struct dvb_usb_adapter *adap)
+ if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+ lme_int->lme_urb->pipe = usb_rcvbulkpipe(d->udev, 0xa);
+
+- usb_submit_urb(lme_int->lme_urb, GFP_ATOMIC);
++ usb_submit_urb(lme_int->lme_urb, GFP_KERNEL);
+ info("INT Interrupt Service Started");
+
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From 1a8728c4922dccacd4f02149a8bcf7c96128bb9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2024 19:18:18 +0000
+Subject: media: mipi-csis: Add check for clk_enable()
+
+From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+
+[ Upstream commit 125ad1aeec77eb55273b420be6894b284a01e4b6 ]
+
+Add check for the return value of clk_enable() to gurantee the success.
+
+Fixes: b5f1220d587d ("[media] v4l: Add v4l2 subdev driver for S5P/EXYNOS4 MIPI-CSI receivers")
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/exynos4-is/mipi-csis.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
+index 1aac167abb175..6a2a85cc3e5f9 100644
+--- a/drivers/media/platform/exynos4-is/mipi-csis.c
++++ b/drivers/media/platform/exynos4-is/mipi-csis.c
+@@ -941,13 +941,19 @@ static int s5pcsis_pm_resume(struct device *dev, bool runtime)
+ state->supplies);
+ goto unlock;
+ }
+- clk_enable(state->clock[CSIS_CLK_GATE]);
++ ret = clk_enable(state->clock[CSIS_CLK_GATE]);
++ if (ret) {
++ phy_power_off(state->phy);
++ regulator_bulk_disable(CSIS_NUM_SUPPLIES,
++ state->supplies);
++ goto unlock;
++ }
+ }
+ if (state->flags & ST_STREAMING)
+ s5pcsis_start_stream(state);
+
+ state->flags &= ~ST_SUSPENDED;
+- unlock:
++unlock:
+ mutex_unlock(&state->lock);
+ return ret ? -EAGAIN : 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From 5258259e0a76e93f688f089c7ddb3560415e766a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2024 14:17:22 +0100
+Subject: media: rc: iguanair: handle timeouts
+
+From: Oliver Neukum <oneukum@suse.com>
+
+[ Upstream commit b98d5000c50544f14bacb248c34e5219fbe81287 ]
+
+In case of a timeout the IO must be cancelled or
+the next IO using the URB will fail and/or overwrite
+an operational URB.
+
+The automatic bisection fails because it arrives
+at a commit that correctly lets the test case run
+without an error.
+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Fixes: e99a7cfe93fd ("[media] iguanair: reuse existing urb callback for command responses")
+Reported-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/66f5cc9a.050a0220.46d20.0004.GAE@google.com/
+Tested-by: syzbot+ffba8e636870dac0e0c0@syzkaller.appspotmail.com
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/iguanair.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/rc/iguanair.c b/drivers/media/rc/iguanair.c
+index a7deca1fefb73..f50362bb59f27 100644
+--- a/drivers/media/rc/iguanair.c
++++ b/drivers/media/rc/iguanair.c
+@@ -200,8 +200,10 @@ static int iguanair_send(struct iguanair *ir, unsigned size)
+ if (rc)
+ return rc;
+
+- if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0)
++ if (wait_for_completion_timeout(&ir->completion, TIMEOUT) == 0) {
++ usb_kill_urb(ir->urb_out);
+ return -ETIMEDOUT;
++ }
+
+ return rc;
+ }
+--
+2.39.5
+
--- /dev/null
+From b4c1ca67ad8b68e512978501a113fbf130e0cd7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 21:39:08 +0000
+Subject: media: uvcvideo: Propagate buf->error to userspace
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+[ Upstream commit 87ce177654e388451850905a1d376658aebe8699 ]
+
+Now we return VB2_BUF_STATE_DONE for valid and invalid frames. Propagate
+the correct value, so the user can know if the frame is valid or not via
+struct v4l2_buffer->flags.
+
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Closes: https://lore.kernel.org/linux-media/84b0f212-cd88-46bb-8e6f-b94ec3eccba6@redhat.com
+Fixes: 6998b6fb4b1c ("[media] uvcvideo: Use videobuf2-vmalloc")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20241218-uvc-deprecate-v2-1-ab814139e983@chromium.org
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_queue.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c
+index da72577c29986..d7c81e205e8bb 100644
+--- a/drivers/media/usb/uvc/uvc_queue.c
++++ b/drivers/media/usb/uvc/uvc_queue.c
+@@ -486,7 +486,8 @@ static void uvc_queue_buffer_complete(struct kref *ref)
+
+ buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE;
+ vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused);
+- vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE);
++ vb2_buffer_done(&buf->buf.vb2_buf, buf->error ? VB2_BUF_STATE_ERROR :
++ VB2_BUF_STATE_DONE);
+ }
+
+ /*
+--
+2.39.5
+
--- /dev/null
+From 409d9af18088449d20c453f597f01d4b6ee8c541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 10:04:30 +0100
+Subject: module: Extend the preempt disabled section in
+ dereference_symbol_descriptor().
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit a145c848d69f9c6f32008d8319edaa133360dd74 ]
+
+dereference_symbol_descriptor() needs to obtain the module pointer
+belonging to pointer in order to resolve that pointer.
+The returned mod pointer is obtained under RCU-sched/ preempt_disable()
+guarantees and needs to be used within this section to ensure that the
+module is not removed in the meantime.
+
+Extend the preempt_disable() section to also cover
+dereference_module_function_descriptor().
+
+Fixes: 04b8eb7a4ccd9 ("symbol lookup: introduce dereference_symbol_descriptor()")
+Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Naveen N Rao <naveen@kernel.org>
+Cc: Nicholas Piggin <npiggin@gmail.com>
+Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Cc: linux-parisc@vger.kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Link: https://lore.kernel.org/r/20250108090457.512198-2-bigeasy@linutronix.de
+Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kallsyms.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/kallsyms.h b/include/linux/kallsyms.h
+index 1f96ce2b47df1..d84b677c728a9 100644
+--- a/include/linux/kallsyms.h
++++ b/include/linux/kallsyms.h
+@@ -63,10 +63,10 @@ static inline void *dereference_symbol_descriptor(void *ptr)
+
+ preempt_disable();
+ mod = __module_address((unsigned long)ptr);
+- preempt_enable();
+
+ if (mod)
+ ptr = dereference_module_function_descriptor(mod, ptr);
++ preempt_enable();
+ #endif
+ return ptr;
+ }
+--
+2.39.5
+
--- /dev/null
+From 4beb9c7f759097cff8ac4cef0f73f542711e034b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2025 17:28:59 +0800
+Subject: nbd: don't allow reconnect after disconnect
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 844b8cdc681612ff24df62cdefddeab5772fadf1 ]
+
+Following process can cause nbd_config UAF:
+
+1) grab nbd_config temporarily;
+
+2) nbd_genl_disconnect() flush all recv_work() and release the
+initial reference:
+
+ nbd_genl_disconnect
+ nbd_disconnect_and_put
+ nbd_disconnect
+ flush_workqueue(nbd->recv_workq)
+ if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...))
+ nbd_config_put
+ -> due to step 1), reference is still not zero
+
+3) nbd_genl_reconfigure() queue recv_work() again;
+
+ nbd_genl_reconfigure
+ config = nbd_get_config_unlocked(nbd)
+ if (!config)
+ -> succeed
+ if (!test_bit(NBD_RT_BOUND, ...))
+ -> succeed
+ nbd_reconnect_socket
+ queue_work(nbd->recv_workq, &args->work)
+
+4) step 1) release the reference;
+
+5) Finially, recv_work() will trigger UAF:
+
+ recv_work
+ nbd_config_put(nbd)
+ -> nbd_config is freed
+ atomic_dec(&config->recv_threads)
+ -> UAF
+
+Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so
+that nbd_genl_reconfigure() will fail.
+
+Fixes: b7aa3d39385d ("nbd: add a reconfigure netlink command")
+Reported-by: syzbot+6b0df248918b92c33e6a@syzkaller.appspotmail.com
+Closes: https://lore.kernel.org/all/675bfb65.050a0220.1a2d0d.0006.GAE@google.com/
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250103092859.3574648-1-yukuai1@huaweicloud.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index f2d847ffcbc75..a3a0f09a4f47d 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -2039,6 +2039,7 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd)
+ flush_workqueue(nbd->recv_workq);
+ nbd_clear_que(nbd);
+ nbd->task_setup = NULL;
++ clear_bit(NBD_RT_BOUND, &nbd->config->runtime_flags);
+ mutex_unlock(&nbd->config_lock);
+
+ if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
+--
+2.39.5
+
--- /dev/null
+From 0b52b54fb1a96333572bdafd27c8886bb70b888d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2025 15:42:13 -0600
+Subject: net: davicom: fix UAF in dm9000_drv_remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chenyuan Yang <chenyuan0y@gmail.com>
+
+[ Upstream commit 19e65c45a1507a1a2926649d2db3583ed9d55fd9 ]
+
+dm is netdev private data and it cannot be
+used after free_netdev() call. Using dm after free_netdev()
+can cause UAF bug. Fix it by moving free_netdev() at the end of the
+function.
+
+This is similar to the issue fixed in commit
+ad297cd2db89 ("net: qcom/emac: fix UAF in emac_remove").
+
+This bug is detected by our static analysis tool.
+
+Fixes: cf9e60aa69ae ("net: davicom: Fix regulator not turned off on driver removal")
+Signed-off-by: Chenyuan Yang <chenyuan0y@gmail.com>
+CC: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
+Link: https://patch.msgid.link/20250123214213.623518-1-chenyuan0y@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/davicom/dm9000.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index 1d5d8984b49a3..fdf69fe78fbb6 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -1781,10 +1781,11 @@ dm9000_drv_remove(struct platform_device *pdev)
+
+ unregister_netdev(ndev);
+ dm9000_release_board(pdev, dm);
+- free_netdev(ndev); /* free device structure */
+ if (dm->power_supply)
+ regulator_disable(dm->power_supply);
+
++ free_netdev(ndev); /* free device structure */
++
+ dev_dbg(&pdev->dev, "released and freed device\n");
+ return 0;
+ }
+--
+2.39.5
+
--- /dev/null
+From fcddb78a2d50ef958f495d3a4e9fc52a6322ee7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2025 14:24:30 +0530
+Subject: net: fec: implement TSO descriptor cleanup
+
+From: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com>
+
+[ Upstream commit 61dc1fd9205bc9d9918aa933a847b08e80b4dc20 ]
+
+Implement cleanup of descriptors in the TSO error path of
+fec_enet_txq_submit_tso(). The cleanup
+
+- Unmaps DMA buffers for data descriptors skipping TSO header
+- Clears all buffer descriptors
+- Handles extended descriptors by clearing cbd_esc when enabled
+
+Fixes: 79f339125ea3 ("net: fec: Add software TSO support")
+Signed-off-by: Dheeraj Reddy Jonnalagadda <dheeraj.linuxdev@gmail.com>
+Reviewed-by: Wei Fang <wei.fang@nxp.com>
+Link: https://patch.msgid.link/20250120085430.99318-1-dheeraj.linuxdev@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 31 ++++++++++++++++++++++-
+ 1 file changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index f11824a078e9e..5660a83356eb0 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -732,6 +732,8 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq,
+ int hdr_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+ int total_len, data_left;
+ struct bufdesc *bdp = txq->bd.cur;
++ struct bufdesc *tmp_bdp;
++ struct bufdesc_ex *ebdp;
+ struct tso_t tso;
+ unsigned int index = 0;
+ int ret;
+@@ -805,7 +807,34 @@ static int fec_enet_txq_submit_tso(struct fec_enet_priv_tx_q *txq,
+ return 0;
+
+ err_release:
+- /* TODO: Release all used data descriptors for TSO */
++ /* Release all used data descriptors for TSO */
++ tmp_bdp = txq->bd.cur;
++
++ while (tmp_bdp != bdp) {
++ /* Unmap data buffers */
++ if (tmp_bdp->cbd_bufaddr &&
++ !IS_TSO_HEADER(txq, fec32_to_cpu(tmp_bdp->cbd_bufaddr)))
++ dma_unmap_single(&fep->pdev->dev,
++ fec32_to_cpu(tmp_bdp->cbd_bufaddr),
++ fec16_to_cpu(tmp_bdp->cbd_datlen),
++ DMA_TO_DEVICE);
++
++ /* Clear standard buffer descriptor fields */
++ tmp_bdp->cbd_sc = 0;
++ tmp_bdp->cbd_datlen = 0;
++ tmp_bdp->cbd_bufaddr = 0;
++
++ /* Handle extended descriptor if enabled */
++ if (fep->bufdesc_ex) {
++ ebdp = (struct bufdesc_ex *)tmp_bdp;
++ ebdp->cbd_esc = 0;
++ }
++
++ tmp_bdp = fec_enet_get_nextdesc(tmp_bdp, &txq->bd);
++ }
++
++ dev_kfree_skb_any(skb);
++
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 709e1d4e509f9e125c8ffcc57f86a6530985205c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 22:30:53 +0800
+Subject: net: let net.core.dev_weight always be non-zero
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit d1f9f79fa2af8e3b45cffdeef66e05833480148a ]
+
+The following problem was encountered during stability test:
+
+(NULL net_device): NAPI poll function process_backlog+0x0/0x530 \
+ returned 1, exceeding its budget of 0.
+------------[ cut here ]------------
+list_add double add: new=ffff88905f746f48, prev=ffff88905f746f48, \
+ next=ffff88905f746e40.
+WARNING: CPU: 18 PID: 5462 at lib/list_debug.c:35 \
+ __list_add_valid_or_report+0xf3/0x130
+CPU: 18 UID: 0 PID: 5462 Comm: ping Kdump: loaded Not tainted 6.13.0-rc7+
+RIP: 0010:__list_add_valid_or_report+0xf3/0x130
+Call Trace:
+? __warn+0xcd/0x250
+? __list_add_valid_or_report+0xf3/0x130
+enqueue_to_backlog+0x923/0x1070
+netif_rx_internal+0x92/0x2b0
+__netif_rx+0x15/0x170
+loopback_xmit+0x2ef/0x450
+dev_hard_start_xmit+0x103/0x490
+__dev_queue_xmit+0xeac/0x1950
+ip_finish_output2+0x6cc/0x1620
+ip_output+0x161/0x270
+ip_push_pending_frames+0x155/0x1a0
+raw_sendmsg+0xe13/0x1550
+__sys_sendto+0x3bf/0x4e0
+__x64_sys_sendto+0xdc/0x1b0
+do_syscall_64+0x5b/0x170
+entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+The reproduction command is as follows:
+ sysctl -w net.core.dev_weight=0
+ ping 127.0.0.1
+
+This is because when the napi's weight is set to 0, process_backlog() may
+return 0 and clear the NAPI_STATE_SCHED bit of napi->state, causing this
+napi to be re-polled in net_rx_action() until __do_softirq() times out.
+Since the NAPI_STATE_SCHED bit has been cleared, napi_schedule_rps() can
+be retriggered in enqueue_to_backlog(), causing this issue.
+
+Making the napi's weight always non-zero solves this problem.
+
+Triggering this issue requires system-wide admin (setting is
+not namespaced).
+
+Fixes: e38766054509 ("[NET]: Fix sysctl net.core.dev_weight")
+Fixes: 3d48b53fb2ae ("net: dev_weight: TX/RX orthogonality")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Link: https://patch.msgid.link/20250116143053.4146855-1-liujian56@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sysctl_net_core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 586598887095d..b3b39b0e0745b 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -242,7 +242,7 @@ static int proc_do_dev_weight(struct ctl_table *table, int write,
+ int ret, weight;
+
+ mutex_lock(&dev_weight_mutex);
+- ret = proc_dointvec(table, write, buffer, lenp, ppos);
++ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+ if (!ret && write) {
+ weight = READ_ONCE(weight_p);
+ WRITE_ONCE(dev_rx_weight, weight * dev_weight_rx_bias);
+@@ -356,6 +356,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_do_dev_weight,
++ .extra1 = SYSCTL_ONE,
+ },
+ {
+ .procname = "dev_weight_rx_bias",
+@@ -363,6 +364,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_do_dev_weight,
++ .extra1 = SYSCTL_ONE,
+ },
+ {
+ .procname = "dev_weight_tx_bias",
+@@ -370,6 +372,7 @@ static struct ctl_table net_core_table[] = {
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_do_dev_weight,
++ .extra1 = SYSCTL_ONE,
+ },
+ {
+ .procname = "netdev_max_backlog",
+--
+2.39.5
+
--- /dev/null
+From cae7d3524ac5e2379f7b93cbd634554a938cb9f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2025 14:33:16 +0200
+Subject: net/mlxfw: Drop hard coded max FW flash image size
+
+From: Maher Sanalla <msanalla@nvidia.com>
+
+[ Upstream commit 70d81f25cc92cc4e914516c9935ae752f27d78ad ]
+
+Currently, mlxfw kernel module limits FW flash image size to be
+10MB at most, preventing the ability to burn recent BlueField-3
+FW that exceeds the said size limit.
+
+Thus, drop the hard coded limit. Instead, rely on FW's
+max_component_size threshold that is reported in MCQI register
+as the size limit for FW image.
+
+Fixes: 410ed13cae39 ("Add the mlxfw module for Mellanox firmware flash process")
+Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
+Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Ido Schimmel <idosch@nvidia.com>
+Tested-by: Ido Schimmel <idosch@nvidia.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/1737030796-1441634-1-git-send-email-moshe@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
+index 29e95d0a6ad13..5fa1b7c33c54f 100644
+--- a/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
++++ b/drivers/net/ethernet/mellanox/mlxfw/mlxfw_fsm.c
+@@ -14,7 +14,6 @@
+ #define MLXFW_FSM_STATE_WAIT_TIMEOUT_MS 30000
+ #define MLXFW_FSM_STATE_WAIT_ROUNDS \
+ (MLXFW_FSM_STATE_WAIT_TIMEOUT_MS / MLXFW_FSM_STATE_WAIT_CYCLE_MS)
+-#define MLXFW_FSM_MAX_COMPONENT_SIZE (10 * (1 << 20))
+
+ static const char * const mlxfw_fsm_state_err_str[] = {
+ [MLXFW_FSM_STATE_ERR_ERROR] =
+@@ -111,7 +110,6 @@ static int mlxfw_flash_component(struct mlxfw_dev *mlxfw_dev,
+ if (err)
+ return err;
+
+- comp_max_size = min_t(u32, comp_max_size, MLXFW_FSM_MAX_COMPONENT_SIZE);
+ if (comp->data_size > comp_max_size) {
+ pr_err("Component %d is of size %d which is bigger than limit %d\n",
+ comp->index, comp->data_size, comp_max_size);
+--
+2.39.5
+
--- /dev/null
+From 472fe592a96fe51217793d415240888bd5aaa11d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2025 18:02:44 +0000
+Subject: net: rose: fix timer races against user threads
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5de7665e0a0746b5ad7943554b34db8f8614a196 ]
+
+Rose timers only acquire the socket spinlock, without
+checking if the socket is owned by one user thread.
+
+Add a check and rearm the timers if needed.
+
+BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174
+Read of size 2 at addr ffff88802f09b82a by task swapper/0/0
+
+CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
+Call Trace:
+ <IRQ>
+ __dump_stack lib/dump_stack.c:94 [inline]
+ dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
+ print_address_description mm/kasan/report.c:378 [inline]
+ print_report+0x169/0x550 mm/kasan/report.c:489
+ kasan_report+0x143/0x180 mm/kasan/report.c:602
+ rose_timer_expiry+0x31d/0x360 net/rose/rose_timer.c:174
+ call_timer_fn+0x187/0x650 kernel/time/timer.c:1793
+ expire_timers kernel/time/timer.c:1844 [inline]
+ __run_timers kernel/time/timer.c:2418 [inline]
+ __run_timer_base+0x66a/0x8e0 kernel/time/timer.c:2430
+ run_timer_base kernel/time/timer.c:2439 [inline]
+ run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449
+ handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561
+ __do_softirq kernel/softirq.c:595 [inline]
+ invoke_softirq kernel/softirq.c:435 [inline]
+ __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
+ irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
+ instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
+ sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
+ </IRQ>
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Link: https://patch.msgid.link/20250122180244.1861468-1-edumazet@google.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rose/rose_timer.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/net/rose/rose_timer.c b/net/rose/rose_timer.c
+index f06ddbed3fed6..1525773e94aa1 100644
+--- a/net/rose/rose_timer.c
++++ b/net/rose/rose_timer.c
+@@ -122,6 +122,10 @@ static void rose_heartbeat_expiry(struct timer_list *t)
+ struct rose_sock *rose = rose_sk(sk);
+
+ bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
++ sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ/20);
++ goto out;
++ }
+ switch (rose->state) {
+ case ROSE_STATE_0:
+ /* Magic here: If we listen() and a new link dies before it
+@@ -152,6 +156,7 @@ static void rose_heartbeat_expiry(struct timer_list *t)
+ }
+
+ rose_start_heartbeat(sk);
++out:
+ bh_unlock_sock(sk);
+ sock_put(sk);
+ }
+@@ -162,6 +167,10 @@ static void rose_timer_expiry(struct timer_list *t)
+ struct sock *sk = &rose->sock;
+
+ bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
++ sk_reset_timer(sk, &rose->timer, jiffies + HZ/20);
++ goto out;
++ }
+ switch (rose->state) {
+ case ROSE_STATE_1: /* T1 */
+ case ROSE_STATE_4: /* T2 */
+@@ -182,6 +191,7 @@ static void rose_timer_expiry(struct timer_list *t)
+ }
+ break;
+ }
++out:
+ bh_unlock_sock(sk);
+ sock_put(sk);
+ }
+@@ -192,6 +202,10 @@ static void rose_idletimer_expiry(struct timer_list *t)
+ struct sock *sk = &rose->sock;
+
+ bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
++ sk_reset_timer(sk, &rose->idletimer, jiffies + HZ/20);
++ goto out;
++ }
+ rose_clear_queues(sk);
+
+ rose_write_internal(sk, ROSE_CLEAR_REQUEST);
+@@ -207,6 +221,7 @@ static void rose_idletimer_expiry(struct timer_list *t)
+ sk->sk_state_change(sk);
+ sock_set_flag(sk, SOCK_DEAD);
+ }
++out:
+ bh_unlock_sock(sk);
+ sock_put(sk);
+ }
+--
+2.39.5
+
--- /dev/null
+From 5e5e8420168fd2de0a956efe5355362c27e4dd40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2025 17:37:13 -0800
+Subject: net: sched: Disallow replacing of child qdisc from one parent to
+ another
+
+From: Jamal Hadi Salim <jhs@mojatatu.com>
+
+[ Upstream commit bc50835e83f60f56e9bec2b392fb5544f250fb6f ]
+
+Lion Ackermann was able to create a UAF which can be abused for privilege
+escalation with the following script
+
+Step 1. create root qdisc
+tc qdisc add dev lo root handle 1:0 drr
+
+step2. a class for packet aggregation do demonstrate uaf
+tc class add dev lo classid 1:1 drr
+
+step3. a class for nesting
+tc class add dev lo classid 1:2 drr
+
+step4. a class to graft qdisc to
+tc class add dev lo classid 1:3 drr
+
+step5.
+tc qdisc add dev lo parent 1:1 handle 2:0 plug limit 1024
+
+step6.
+tc qdisc add dev lo parent 1:2 handle 3:0 drr
+
+step7.
+tc class add dev lo classid 3:1 drr
+
+step 8.
+tc qdisc add dev lo parent 3:1 handle 4:0 pfifo
+
+step 9. Display the class/qdisc layout
+
+tc class ls dev lo
+ class drr 1:1 root leaf 2: quantum 64Kb
+ class drr 1:2 root leaf 3: quantum 64Kb
+ class drr 3:1 root leaf 4: quantum 64Kb
+
+tc qdisc ls
+ qdisc drr 1: dev lo root refcnt 2
+ qdisc plug 2: dev lo parent 1:1
+ qdisc pfifo 4: dev lo parent 3:1 limit 1000p
+ qdisc drr 3: dev lo parent 1:2
+
+step10. trigger the bug <=== prevented by this patch
+tc qdisc replace dev lo parent 1:3 handle 4:0
+
+step 11. Redisplay again the qdiscs/classes
+
+tc class ls dev lo
+ class drr 1:1 root leaf 2: quantum 64Kb
+ class drr 1:2 root leaf 3: quantum 64Kb
+ class drr 1:3 root leaf 4: quantum 64Kb
+ class drr 3:1 root leaf 4: quantum 64Kb
+
+tc qdisc ls
+ qdisc drr 1: dev lo root refcnt 2
+ qdisc plug 2: dev lo parent 1:1
+ qdisc pfifo 4: dev lo parent 3:1 refcnt 2 limit 1000p
+ qdisc drr 3: dev lo parent 1:2
+
+Observe that a) parent for 4:0 does not change despite the replace request.
+There can only be one parent. b) refcount has gone up by two for 4:0 and
+c) both class 1:3 and 3:1 are pointing to it.
+
+Step 12. send one packet to plug
+echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10001))
+step13. send one packet to the grafted fifo
+echo "" | socat -u STDIN UDP4-DATAGRAM:127.0.0.1:8888,priority=$((0x10003))
+
+step14. lets trigger the uaf
+tc class delete dev lo classid 1:3
+tc class delete dev lo classid 1:1
+
+The semantics of "replace" is for a del/add _on the same node_ and not
+a delete from one node(3:1) and add to another node (1:3) as in step10.
+While we could "fix" with a more complex approach there could be
+consequences to expectations so the patch takes the preventive approach of
+"disallow such config".
+
+Joint work with Lion Ackermann <nnamrec@gmail.com>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20250116013713.900000-1-kuba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_api.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
+index b8dc03a7487e3..178044a845dfd 100644
+--- a/net/sched/sch_api.c
++++ b/net/sched/sch_api.c
+@@ -1593,6 +1593,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
+ q = qdisc_lookup(dev, tcm->tcm_handle);
+ if (!q)
+ goto create_n_graft;
++ if (q->parent != tcm->tcm_parent) {
++ NL_SET_ERR_MSG(extack, "Cannot move an existing qdisc to a different parent");
++ return -EINVAL;
++ }
+ if (n->nlmsg_flags & NLM_F_EXCL) {
+ NL_SET_ERR_MSG(extack, "Exclusivity flag on, cannot override");
+ return -EEXIST;
+--
+2.39.5
+
--- /dev/null
+From 7fbac4f7cfedea8e346044ef183b641151f84c6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2025 10:50:47 +0100
+Subject: net: sh_eth: Fix missing rtnl lock in suspend/resume path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kory Maincent <kory.maincent@bootlin.com>
+
+[ Upstream commit b95102215a8d0987789715ce11c0d4ec031cbfbe ]
+
+Fix the suspend/resume path by ensuring the rtnl lock is held where
+required. Calls to sh_eth_close, sh_eth_open and wol operations must be
+performed under the rtnl lock to prevent conflicts with ongoing ndo
+operations.
+
+Fixes: b71af04676e9 ("sh_eth: add more PM methods")
+Tested-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
+Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 50d85d0372302..f808e60b4ee4f 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3496,10 +3496,12 @@ static int sh_eth_suspend(struct device *dev)
+
+ netif_device_detach(ndev);
+
++ rtnl_lock();
+ if (mdp->wol_enabled)
+ ret = sh_eth_wol_setup(ndev);
+ else
+ ret = sh_eth_close(ndev);
++ rtnl_unlock();
+
+ return ret;
+ }
+@@ -3513,10 +3515,12 @@ static int sh_eth_resume(struct device *dev)
+ if (!netif_running(ndev))
+ return 0;
+
++ rtnl_lock();
+ if (mdp->wol_enabled)
+ ret = sh_eth_wol_restore(ndev);
+ else
+ ret = sh_eth_open(ndev);
++ rtnl_unlock();
+
+ if (ret < 0)
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From 5945b110dd004fcbcecbd497e97bc7d646acac07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2025 22:06:53 +0800
+Subject: ocfs2: mark dquot as inactive if failed to start trans while
+ releasing dquot
+
+From: Su Yue <glass.su@suse.com>
+
+[ Upstream commit 276c61385f6bc3223a5ecd307cf4aba2dfbb9a31 ]
+
+While running fstests generic/329, the kernel workqueue
+quota_release_workfn is dead looping in calling ocfs2_release_dquot().
+The ocfs2 state is already readonly but ocfs2_release_dquot wants to
+start a transaction but fails and returns.
+
+=====================================================================
+[ 2918.123602 ][ T275 ] On-disk corruption discovered. Please run
+fsck.ocfs2 once the filesystem is unmounted.
+[ 2918.124034 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:765
+ERROR: status = -30
+[ 2918.124452 ][ T275 ] (kworker/u135:1,275,11):ocfs2_release_dquot:795
+ERROR: status = -30
+[ 2918.124883 ][ T275 ] (kworker/u135:1,275,11):ocfs2_start_trans:357
+ERROR: status = -30
+[ 2918.125276 ][ T275 ] OCFS2: abort (device dm-0): ocfs2_start_trans:
+Detected aborted journal
+[ 2918.125710 ][ T275 ] On-disk corruption discovered. Please run
+fsck.ocfs2 once the filesystem is unmounted.
+=====================================================================
+
+ocfs2_release_dquot() is much like dquot_release(), which is called by
+ext4 to handle similar situation. So here fix it by marking the dquot as
+inactive like what dquot_release() does.
+
+Link: https://lkml.kernel.org/r/20250106140653.92292-1-glass.su@suse.com
+Fixes: 9e33d69f553a ("ocfs2: Implementation of local and global quota file handling")
+Signed-off-by: Su Yue <glass.su@suse.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/quota_global.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
+index 1ce3780e8b499..742bf103d2eb2 100644
+--- a/fs/ocfs2/quota_global.c
++++ b/fs/ocfs2/quota_global.c
+@@ -749,6 +749,11 @@ static int ocfs2_release_dquot(struct dquot *dquot)
+ handle = ocfs2_start_trans(osb,
+ ocfs2_calc_qdel_credits(dquot->dq_sb, dquot->dq_id.type));
+ if (IS_ERR(handle)) {
++ /*
++ * Mark dquot as inactive to avoid endless cycle in
++ * quota_release_workfn().
++ */
++ clear_bit(DQ_ACTIVE_B, &dquot->dq_flags);
+ status = PTR_ERR(handle);
+ mlog_errno(status);
+ goto out_ilock;
+--
+2.39.5
+
--- /dev/null
+From b25b45ebfcf69b66392e13369774889670312b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2024 23:32:01 +0100
+Subject: padata: fix sysfs store callback check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Weißschuh <linux@weissschuh.net>
+
+[ Upstream commit 9ff6e943bce67d125781fe4780a5d6f072dc44c0 ]
+
+padata_sysfs_store() was copied from padata_sysfs_show() but this check
+was not adapted. Today there is no attribute which can fail this
+check, but if there is one it may as well be correct.
+
+Fixes: 5e017dc3f8bc ("padata: Added sysfs primitives to padata subsystem")
+Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index a544da60014c0..47aebcda65d5d 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -940,7 +940,7 @@ static ssize_t padata_sysfs_store(struct kobject *kobj, struct attribute *attr,
+
+ pinst = kobj2pinst(kobj);
+ pentry = attr2pentry(attr);
+- if (pentry->show)
++ if (pentry->store)
+ ret = pentry->store(pinst, attr, buf, count);
+
+ return ret;
+--
+2.39.5
+
--- /dev/null
+From 1288e988231e74fdd188ded740d89cf91b8ca2ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2025 22:27:58 -0800
+Subject: partitions: ldm: remove the initial kernel-doc notation
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit e494e451611a3de6ae95f99e8339210c157d70fb ]
+
+Remove the file's first comment describing what the file is.
+This comment is not in kernel-doc format so it causes a kernel-doc
+warning.
+
+ldm.h:13: warning: expecting prototype for ldm(). Prototype was for _FS_PT_LDM_H_() instead
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Richard Russon (FlatCap) <ldm@flatcap.org>
+Cc: linux-ntfs-dev@lists.sourceforge.net
+Cc: Jens Axboe <axboe@kernel.dk>
+Link: https://lore.kernel.org/r/20250111062758.910458-1-rdunlap@infradead.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/partitions/ldm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/partitions/ldm.h b/block/partitions/ldm.h
+index 1ca63e97bcccf..05705ead955ec 100644
+--- a/block/partitions/ldm.h
++++ b/block/partitions/ldm.h
+@@ -1,5 +1,5 @@
+ // SPDX-License-Identifier: GPL-2.0-or-later
+-/**
++/*
+ * ldm - Part of the Linux-NTFS project.
+ *
+ * Copyright (C) 2001,2002 Richard Russon <ldm@flatcap.org>
+--
+2.39.5
+
--- /dev/null
+From 0b16a945c5f9dc5b638ee723fcd6bb2cfab4a469 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2024 22:00:18 +0800
+Subject: PCI: endpoint: Destroy the EPC device in devm_pci_epc_destroy()
+
+From: Zijun Hu <quic_zijuhu@quicinc.com>
+
+[ Upstream commit d4929755e4d02bd3de3ae5569dab69cb9502c54f ]
+
+The devm_pci_epc_destroy() comment says destroys the EPC device, but it
+does not actually do that since devres_destroy() does not call
+devm_pci_epc_release(), and it also can not fully undo what the API
+devm_pci_epc_create() does, so it is faulty.
+
+Fortunately, the faulty API has not been used by current kernel tree. Use
+devres_release() instead of devres_destroy() so the EPC device will be
+released.
+
+Link: https://lore.kernel.org/r/20241210-pci-epc-core_fix-v3-1-4d86dd573e4b@quicinc.com
+Fixes: 5e8cb4033807 ("PCI: endpoint: Add EP core layer to enable EP controller and EP functions")
+Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/pci-epc-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/endpoint/pci-epc-core.c b/drivers/pci/endpoint/pci-epc-core.c
+index 2091508c16204..3c08c2c7d339c 100644
+--- a/drivers/pci/endpoint/pci-epc-core.c
++++ b/drivers/pci/endpoint/pci-epc-core.c
+@@ -578,7 +578,7 @@ void devm_pci_epc_destroy(struct device *dev, struct pci_epc *epc)
+ {
+ int r;
+
+- r = devres_destroy(dev, devm_pci_epc_release, devm_pci_epc_match,
++ r = devres_release(dev, devm_pci_epc_release, devm_pci_epc_match,
+ epc);
+ dev_WARN_ONCE(dev, r, "couldn't find PCI EPC resource\n");
+ }
+--
+2.39.5
+
--- /dev/null
+From acb31a70b4a2476001934eebff4a709d4bdc4307 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 16:44:58 +0800
+Subject: perf header: Fix one memory leakage in process_bpf_btf()
+
+From: Zhongqiu Han <quic_zhonhan@quicinc.com>
+
+[ Upstream commit 875d22980a062521beed7b5df71fb13a1af15d83 ]
+
+If __perf_env__insert_btf() returns false due to a duplicate btf node
+insertion, the temporary node will leak. Add a check to ensure the memory
+is freed if the function returns false.
+
+Fixes: a70a1123174ab592 ("perf bpf: Save BTF information as headers to perf.data")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <song@kernel.org>
+Cc: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20241205084500.823660-2-quic_zhonhan@quicinc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/header.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index a68feeb3eb00d..6dc99378b191b 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2777,7 +2777,8 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)
+ if (__do_read(ff, node->data, data_size))
+ goto out;
+
+- __perf_env__insert_btf(env, node);
++ if (!__perf_env__insert_btf(env, node))
++ free(node);
+ node = NULL;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 054d48098942ba409849d7761c1134dd3ee32288 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2024 16:44:59 +0800
+Subject: perf header: Fix one memory leakage in process_bpf_prog_info()
+
+From: Zhongqiu Han <quic_zhonhan@quicinc.com>
+
+[ Upstream commit a7da6c7030e1aec32f0a41c7b4fa70ec96042019 ]
+
+Function __perf_env__insert_bpf_prog_info() will return without inserting
+bpf prog info node into perf env again due to a duplicate bpf prog info
+node insertion, causing the temporary info_linear and info_node memory to
+leak. Modify the return type of this function to bool and add a check to
+ensure the memory is freed if the function returns false.
+
+Fixes: 606f972b1361f477 ("perf bpf: Save bpf_prog_info information as headers to perf.data")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <song@kernel.org>
+Cc: Yicong Yang <yangyicong@hisilicon.com>
+Link: https://lore.kernel.org/r/20241205084500.823660-3-quic_zhonhan@quicinc.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/env.c | 5 +++--
+ tools/perf/util/env.h | 2 +-
+ tools/perf/util/header.c | 5 ++++-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
+index 953db9dd25eb0..f8239fbe6b09d 100644
+--- a/tools/perf/util/env.c
++++ b/tools/perf/util/env.c
+@@ -21,7 +21,7 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env,
+ up_write(&env->bpf_progs.lock);
+ }
+
+-void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node)
++bool __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node)
+ {
+ __u32 prog_id = info_node->info_linear->info.id;
+ struct bpf_prog_info_node *node;
+@@ -39,13 +39,14 @@ void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info
+ p = &(*p)->rb_right;
+ } else {
+ pr_debug("duplicated bpf prog info %u\n", prog_id);
+- return;
++ return false;
+ }
+ }
+
+ rb_link_node(&info_node->rb_node, parent, p);
+ rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos);
+ env->bpf_progs.infos_cnt++;
++ return true;
+ }
+
+ struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
+diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h
+index b0778483fa04b..9c5777a2ea7e0 100644
+--- a/tools/perf/util/env.h
++++ b/tools/perf/util/env.h
+@@ -117,7 +117,7 @@ const char *perf_env__raw_arch(struct perf_env *env);
+ int perf_env__nr_cpus_avail(struct perf_env *env);
+
+ void perf_env__init(struct perf_env *env);
+-void __perf_env__insert_bpf_prog_info(struct perf_env *env,
++bool __perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node);
+ void perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node);
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index 6dc99378b191b..a66a05091a974 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -2724,7 +2724,10 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused)
+ /* after reading from file, translate offset to address */
+ bpf_program__bpil_offs_to_addr(info_linear);
+ info_node->info_linear = info_linear;
+- __perf_env__insert_bpf_prog_info(env, info_node);
++ if (!__perf_env__insert_bpf_prog_info(env, info_node)) {
++ free(info_linear);
++ free(info_node);
++ }
+ }
+
+ up_write(&env->bpf_progs.lock);
+--
+2.39.5
+
--- /dev/null
+From d731ccd4e854ada2366083734c02715de329bf3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 10:15:24 +0100
+Subject: perf machine: Don't ignore _etext when not a text symbol
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 7a93786c306296f15e728b1dbd949a319e4e3d19 ]
+
+Depending on how vmlinux.lds is written, _etext might be the very first
+data symbol instead of the very last text symbol.
+
+Don't require it to be a text symbol, accept any symbol type.
+
+Comitter notes:
+
+See the first Link for further discussion, but it all boils down to
+this:
+
+ ---
+ # grep -e _stext -e _etext -e _edata /proc/kallsyms
+ c0000000 T _stext
+ c08b8000 D _etext
+
+ So there is no _edata and _etext is not text
+
+ $ ppc-linux-objdump -x vmlinux | grep -e _stext -e _etext -e _edata
+ c0000000 g .head.text 00000000 _stext
+ c08b8000 g .rodata 00000000 _etext
+ c1378000 g .sbss 00000000 _edata
+ ---
+
+Fixes: ed9adb2035b5be58 ("perf machine: Read also the end of the kernel")
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Song Liu <songliubraving@fb.com>
+Link: https://lore.kernel.org/r/b3ee1994d95257cb7f2de037c5030ba7d1bed404.1736327613.git.christophe.leroy@csgroup.eu
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/machine.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index e7f970681efce..f27fd5e1b6f3f 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -952,7 +952,7 @@ static int machine__get_running_kernel_start(struct machine *machine,
+
+ err = kallsyms__get_symbol_start(filename, "_edata", &addr);
+ if (err)
+- err = kallsyms__get_function_start(filename, "_etext", &addr);
++ err = kallsyms__get_symbol_start(filename, "_etext", &addr);
+ if (!err)
+ *end = addr;
+
+--
+2.39.5
+
--- /dev/null
+From d9b0d9f13d180a904a07c9bfea4ecad3ab4d7d12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jul 2023 17:19:29 -0700
+Subject: perf machine: Include data symbols in the kernel map
+
+From: Namhyung Kim <namhyung@kernel.org>
+
+[ Upstream commit 69a87a32f5cd8b262cb2195b045f96c63aede734 ]
+
+When 'perf record -d' is used, it needs data mmaps to symbolize global
+data. But it missed to collect kernel data maps so it cannot symbolize
+them. Instead of having a separate map, just increase the kernel map
+size to include the data section.
+
+Probably we can have a separate kernel map for data, but the current
+code assumes a single kernel map. So it'd require more changes in other
+places and looks error-prone. I decided not to go that way for now.
+
+Also it seems the kernel module size already includes the data section.
+
+For example, my system has the following.
+
+ $ grep -e _stext -e _etext -e _edata /proc/kallsyms
+ ffffffff99800000 T _stext
+ ffffffff9a601ac8 T _etext
+ ffffffff9b446a00 D _edata
+
+Size of the text section is (0x9a601ac8 - 0x99800000 = 0xe01ac8) and
+size including data section is (0x9b446a00 - 0x99800000 = 0x1c46a00).
+
+Before:
+ $ perf record -d true
+
+ $ perf report -D | grep MMAP | head -1
+ 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0xe01ac8) @ 0xffffffff99800000]: x [kernel.kallsyms]_text
+ ^^^^^^^^
+ here
+After:
+ $ perf report -D | grep MMAP | head -1
+ 0 0 0x460 [0x60]: PERF_RECORD_MMAP -1/0: [0xffffffff99800000(0x1c46a00) @ 0xffffffff99800000]: x [kernel.kallsyms]_text
+ ^^^^^^^^^
+
+Instead of just replacing it to _edata, try _edata first and then fall
+back to _etext just in case.
+
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20230725001929.368041-2-namhyung@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Stable-dep-of: 7a93786c3062 ("perf machine: Don't ignore _etext when not a text symbol")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/machine.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
+index 8c3addc2e9e1e..e7f970681efce 100644
+--- a/tools/perf/util/machine.c
++++ b/tools/perf/util/machine.c
+@@ -950,7 +950,9 @@ static int machine__get_running_kernel_start(struct machine *machine,
+
+ *start = addr;
+
+- err = kallsyms__get_function_start(filename, "_etext", &addr);
++ err = kallsyms__get_symbol_start(filename, "_edata", &addr);
++ if (err)
++ err = kallsyms__get_function_start(filename, "_etext", &addr);
+ if (!err)
+ *end = addr;
+
+--
+2.39.5
+
--- /dev/null
+From de3980c677dcb15eec90bf6cc3a126bc4c2516b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2025 23:22:19 +0800
+Subject: perf report: Fix misleading help message about --demangle
+
+From: Jiachen Zhang <me@jcix.top>
+
+[ Upstream commit ac0ac75189a4d6a29a2765a7adbb62bc6cc650c7 ]
+
+The wrong help message may mislead users. This commit fixes it.
+
+Fixes: 328ccdace8855289 ("perf report: Add --no-demangle option")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Jiachen Zhang <me@jcix.top>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung.kim@lge.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20250109152220.1869581-1-me@jcix.top
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-report.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
+index dc228bdf2bbc2..2f0917dbadcf4 100644
+--- a/tools/perf/builtin-report.c
++++ b/tools/perf/builtin-report.c
+@@ -1175,7 +1175,7 @@ int cmd_report(int argc, const char **argv)
+ OPT_STRING(0, "objdump", &report.annotation_opts.objdump_path, "path",
+ "objdump binary to use for disassembly and annotations"),
+ OPT_BOOLEAN(0, "demangle", &symbol_conf.demangle,
+- "Disable symbol demangling"),
++ "Symbol demangling. Enabled by default, use --no-demangle to disable."),
+ OPT_BOOLEAN(0, "demangle-kernel", &symbol_conf.demangle_kernel,
+ "Enable kernel symbol demangling"),
+ OPT_BOOLEAN(0, "mem-mode", &report.mem_mode, "mem access profile"),
+--
+2.39.5
+
--- /dev/null
+From 68b8b646daffd0233cdc5fd2b62d92ed0c969773 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2025 16:50:39 -0300
+Subject: perf top: Don't complain about lack of vmlinux when not resolving
+ some kernel samples
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+[ Upstream commit 058b38ccd2af9e5c95590b018e8425fa148d7aca ]
+
+Recently we got a case where a kernel sample wasn't being resolved due
+to a bug that was not setting the end address on kernel functions
+implemented in assembly (see Link: tag), and then those were not being
+found by machine__resolve() -> map__find_symbol().
+
+So we ended up with:
+
+ # perf top --stdio
+ PerfTop: 0 irqs/s kernel: 0% exact: 0% lost: 0/0 drop: 0/0 [cycles/P]
+ -----------------------------------------------------------------------
+
+ Warning:
+ A vmlinux file was not found.
+ Kernel samples will not be resolved.
+ ^Z
+ [1]+ Stopped perf top --stdio
+ #
+
+But then resolving all other kernel symbols.
+
+So just fixup the logic to only print that warning when there are no
+symbols in the kernel map.
+
+Fixes: d88205db9caa0e9d ("perf dso: Add dso__has_symbols() method")
+Reviewed-by: Namhyung Kim <namhyung@kernel.org>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: James Clark <james.clark@linaro.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Link: https://lore.kernel.org/lkml/Z3buKhcCsZi3_aGb@x1
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-top.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index b8fab267e8556..5631d44a3f6bc 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -796,7 +796,7 @@ static void perf_event__process_sample(struct perf_tool *tool,
+ * invalid --vmlinux ;-)
+ */
+ if (!machine->kptr_restrict_warned && !top->vmlinux_warned &&
+- __map__is_kernel(al.map) && map__has_symbols(al.map)) {
++ __map__is_kernel(al.map) && !map__has_symbols(al.map)) {
+ if (symbol_conf.vmlinux_name) {
+ char serr[256];
+ dso__strerror_load(al.map->dso, serr, sizeof(serr));
+--
+2.39.5
+
--- /dev/null
+From 3fad0825b70b0520545c5d69ecd8ae2413ff4707 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2025 18:55:19 -0800
+Subject: perf trace: Fix runtime error of index out of bounds
+
+From: Howard Chu <howardchu95@gmail.com>
+
+[ Upstream commit c7b87ce0dd10b64b68a0b22cb83bbd556e28fe81 ]
+
+libtraceevent parses and returns an array of argument fields, sometimes
+larger than RAW_SYSCALL_ARGS_NUM (6) because it includes "__syscall_nr",
+idx will traverse to index 6 (7th element) whereas sc->fmt->arg holds 6
+elements max, creating an out-of-bounds access. This runtime error is
+found by UBsan. The error message:
+
+ $ sudo UBSAN_OPTIONS=print_stacktrace=1 ./perf trace -a --max-events=1
+ builtin-trace.c:1966:35: runtime error: index 6 out of bounds for type 'syscall_arg_fmt [6]'
+ #0 0x5c04956be5fe in syscall__alloc_arg_fmts /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:1966
+ #1 0x5c04956c0510 in trace__read_syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2110
+ #2 0x5c04956c372b in trace__syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2436
+ #3 0x5c04956d2f39 in trace__init_syscalls_bpf_prog_array_maps /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:3897
+ #4 0x5c04956d6d25 in trace__run /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:4335
+ #5 0x5c04956e112e in cmd_trace /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:5502
+ #6 0x5c04956eda7d in run_builtin /home/howard/hw/linux-perf/tools/perf/perf.c:351
+ #7 0x5c04956ee0a8 in handle_internal_command /home/howard/hw/linux-perf/tools/perf/perf.c:404
+ #8 0x5c04956ee37f in run_argv /home/howard/hw/linux-perf/tools/perf/perf.c:448
+ #9 0x5c04956ee8e9 in main /home/howard/hw/linux-perf/tools/perf/perf.c:556
+ #10 0x79eb3622a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+ #11 0x79eb3622a47a in __libc_start_main_impl ../csu/libc-start.c:360
+ #12 0x5c04955422d4 in _start (/home/howard/hw/linux-perf/tools/perf/perf+0x4e02d4) (BuildId: 5b6cab2d59e96a4341741765ad6914a4d784dbc6)
+
+ 0.000 ( 0.014 ms): Chrome_ChildIO/117244 write(fd: 238, buf: !, count: 1) = 1
+
+Fixes: 5e58fcfaf4c6 ("perf trace: Allow allocating sc->arg_fmt even without the syscall tracepoint")
+Signed-off-by: Howard Chu <howardchu95@gmail.com>
+Link: https://lore.kernel.org/r/20250122025519.361873-1-howardchu95@gmail.com
+Signed-off-by: Namhyung Kim <namhyung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-trace.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
+index c8c01e706118e..6a444123a0954 100644
+--- a/tools/perf/builtin-trace.c
++++ b/tools/perf/builtin-trace.c
+@@ -1582,8 +1582,12 @@ static int trace__read_syscall_info(struct trace *trace, int id)
+ return PTR_ERR(sc->tp_format);
+ }
+
++ /*
++ * The tracepoint format contains __syscall_nr field, so it's one more
++ * than the actual number of syscall arguments.
++ */
+ if (syscall__alloc_arg_fmts(sc, IS_ERR(sc->tp_format) ?
+- RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields))
++ RAW_SYSCALL_ARGS_NUM : sc->tp_format->format.nr_fields - 1))
+ return -ENOMEM;
+
+ sc->args = sc->tp_format->format.fields;
+--
+2.39.5
+
--- /dev/null
+From c947e96eb96620e9ede7a73b762802a86e0d1ca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jan 2025 22:32:05 +0800
+Subject: PM: hibernate: Add error handling for syscore_suspend()
+
+From: Wentao Liang <vulab@iscas.ac.cn>
+
+[ Upstream commit e20a70c572539a486dbd91b225fa6a194a5e2122 ]
+
+In hibernation_platform_enter(), the code did not check the
+return value of syscore_suspend(), potentially leading to a
+situation where syscore_resume() would be called even if
+syscore_suspend() failed. This could cause unpredictable
+behavior or system instability.
+
+Modify the code sequence in question to properly handle errors returned
+by syscore_suspend(). If an error occurs in the suspend path, the code
+now jumps to label 'Enable_irqs' skipping the syscore_resume() call and
+only enabling interrupts after setting the system state to SYSTEM_RUNNING.
+
+Fixes: 40dc166cb5dd ("PM / Core: Introduce struct syscore_ops for core subsystems PM")
+Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
+Link: https://patch.msgid.link/20250119143205.2103-1-vulab@iscas.ac.cn
+[ rjw: Changelog edits ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/power/hibernate.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index f8934f9746e66..78d913a082bee 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -578,7 +578,11 @@ int hibernation_platform_enter(void)
+
+ local_irq_disable();
+ system_state = SYSTEM_SUSPEND;
+- syscore_suspend();
++
++ error = syscore_suspend();
++ if (error)
++ goto Enable_irqs;
++
+ if (pm_wakeup_pending()) {
+ error = -EAGAIN;
+ goto Power_up;
+@@ -590,6 +594,7 @@ int hibernation_platform_enter(void)
+
+ Power_up:
+ syscore_resume();
++ Enable_irqs:
+ system_state = SYSTEM_RUNNING;
+ local_irq_enable();
+
+--
+2.39.5
+
--- /dev/null
+From 8873787bf20051b878e24ef43eaf1a98d7829ee2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 16:53:18 -0500
+Subject: pwm: stm32-lp: Add check for clk_enable()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mingwei Zheng <zmw12306@gmail.com>
+
+[ Upstream commit cce16e7f6216227964cda25f5f23634bce2c500f ]
+
+Add check for the return value of clk_enable() to catch the potential
+error.
+We used APP-Miner to find it.
+
+Fixes: e70a540b4e02 ("pwm: Add STM32 LPTimer PWM driver")
+Signed-off-by: Mingwei Zheng <zmw12306@gmail.com>
+Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
+Link: https://lore.kernel.org/r/20241206215318.3402860-1-zmw12306@gmail.com
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-stm32-lp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-stm32-lp.c b/drivers/pwm/pwm-stm32-lp.c
+index 20657c649c65e..f03dd7799f864 100644
+--- a/drivers/pwm/pwm-stm32-lp.c
++++ b/drivers/pwm/pwm-stm32-lp.c
+@@ -169,8 +169,12 @@ static void stm32_pwm_lp_get_state(struct pwm_chip *chip,
+ regmap_read(priv->regmap, STM32_LPTIM_CR, &val);
+ state->enabled = !!FIELD_GET(STM32_LPTIM_ENABLE, val);
+ /* Keep PWM counter clock refcount in sync with PWM initial state */
+- if (state->enabled)
+- clk_enable(priv->clk);
++ if (state->enabled) {
++ int ret = clk_enable(priv->clk);
++
++ if (ret)
++ return ret;
++ }
+
+ regmap_read(priv->regmap, STM32_LPTIM_CFGR, &val);
+ presc = FIELD_GET(STM32_LPTIM_PRESC, val);
+--
+2.39.5
+
--- /dev/null
+From e09039486ed08b57bb18ace12b5e584d8e51c66e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Nov 2024 13:01:37 +0300
+Subject: rdma/cxgb4: Prevent potential integer overflow on 32bit
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit bd96a3935e89486304461a21752f824fc25e0f0b ]
+
+The "gl->tot_len" variable is controlled by the user. It comes from
+process_responses(). On 32bit systems, the "gl->tot_len + sizeof(struct
+cpl_pass_accept_req) + sizeof(struct rss_header)" addition could have an
+integer wrapping bug. Use size_add() to prevent this.
+
+Fixes: 1cab775c3e75 ("RDMA/cxgb4: Fix LE hash collision bug for passive open connection")
+Link: https://patch.msgid.link/r/86b404e1-4a75-4a35-a34e-e3054fa554c7@stanley.mountain
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/device.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
+index 541dbcf22d0eb..13e4b2c40d835 100644
+--- a/drivers/infiniband/hw/cxgb4/device.c
++++ b/drivers/infiniband/hw/cxgb4/device.c
+@@ -1114,8 +1114,10 @@ static inline struct sk_buff *copy_gl_to_skb_pkt(const struct pkt_gl *gl,
+ * The math here assumes sizeof cpl_pass_accept_req >= sizeof
+ * cpl_rx_pkt.
+ */
+- skb = alloc_skb(gl->tot_len + sizeof(struct cpl_pass_accept_req) +
+- sizeof(struct rss_header) - pktshift, GFP_ATOMIC);
++ skb = alloc_skb(size_add(gl->tot_len,
++ sizeof(struct cpl_pass_accept_req) +
++ sizeof(struct rss_header)) - pktshift,
++ GFP_ATOMIC);
+ if (unlikely(!skb))
+ return NULL;
+
+--
+2.39.5
+
--- /dev/null
+From e0c469b7f5d27c22555ec7a50b29a0f39bbeeb04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2024 15:44:25 +0200
+Subject: RDMA/mlx4: Avoid false error about access to uninitialized gids array
+
+From: Leon Romanovsky <leonro@nvidia.com>
+
+[ Upstream commit 1f53d88cbb0dcc7df235bf6611ae632b254fccd8 ]
+
+Smatch generates the following false error report:
+drivers/infiniband/hw/mlx4/main.c:393 mlx4_ib_del_gid() error: uninitialized symbol 'gids'.
+
+Traditionally, we are not changing kernel code and asking people to fix
+the tools. However in this case, the fix can be done by simply rearranging
+the code to be more clear.
+
+Fixes: e26be1bfef81 ("IB/mlx4: Implement ib_device callbacks")
+Link: https://patch.msgid.link/6a3a1577463da16962463fcf62883a87506e9b62.1733233426.git.leonro@nvidia.com
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
+index baa129a6c9127..20335542a81ae 100644
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -384,10 +384,10 @@ static int mlx4_ib_del_gid(const struct ib_gid_attr *attr, void **context)
+ }
+ spin_unlock_bh(&iboe->lock);
+
+- if (!ret && hw_update) {
++ if (gids)
+ ret = mlx4_ib_update_gids(gids, ibdev, attr->port_num);
+- kfree(gids);
+- }
++
++ kfree(gids);
+ return ret;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From 28ad8e119f3138f10e45f2b9d2da134d9aa71122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2025 17:04:53 +0900
+Subject: regulator: of: Implement the unwind path of of_regulator_match()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit dddca3b2fc676113c58b04aaefe84bfb958ac83e ]
+
+of_regulator_match() does not release the OF node reference in the error
+path, resulting in an OF node leak. Therefore, call of_node_put() on the
+obtained nodes before returning the EINVAL error.
+
+Since it is possible that some drivers call this function and do not
+exit on failure, such as s2mps11_pmic_driver, clear the init_data and
+of_node in the error path.
+
+This was reported by an experimental verification tool that I am
+developing. As I do not have access to actual devices nor the QEMU board
+configuration to test drivers that call this function, no runtime test
+was able to be performed.
+
+Fixes: 1c8fa58f4750 ("regulator: Add generic DT parsing for regulators")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Link: https://patch.msgid.link/20250104080453.2153592-1-joe@pf.is.s.u-tokyo.ac.jp
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/of_regulator.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
+index 7a0a235e44658..c4b72fa8ad815 100644
+--- a/drivers/regulator/of_regulator.c
++++ b/drivers/regulator/of_regulator.c
+@@ -377,7 +377,7 @@ int of_regulator_match(struct device *dev, struct device_node *node,
+ "failed to parse DT for regulator %pOFn\n",
+ child);
+ of_node_put(child);
+- return -EINVAL;
++ goto err_put;
+ }
+ match->of_node = of_node_get(child);
+ count++;
+@@ -386,6 +386,18 @@ int of_regulator_match(struct device *dev, struct device_node *node,
+ }
+
+ return count;
++
++err_put:
++ for (i = 0; i < num_matches; i++) {
++ struct of_regulator_match *match = &matches[i];
++
++ match->init_data = NULL;
++ if (match->of_node) {
++ of_node_put(match->of_node);
++ match->of_node = NULL;
++ }
++ }
++ return -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(of_regulator_match);
+
+--
+2.39.5
+
--- /dev/null
+From 0000e6da28502e1ddaddd7d92de514b5d74492a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 20:34:58 +0100
+Subject: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 3ab8c5ed4f84fa20cd16794fe8dc31f633fbc70c ]
+
+The nvmem interface supports variable buffer sizes, while the regmap
+interface operates with fixed-size storage. If an nvmem client uses a
+buffer size less than 4 bytes, regmap_read will write out of bounds
+as it expects the buffer to point at an unsigned int.
+
+Fix this by using an intermediary unsigned int to hold the value.
+
+Fixes: fadfd092ee91 ("rtc: pcf85063: add nvram support")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Link: https://lore.kernel.org/r/20241218-rtc-pcf85063-stack-corruption-v1-1-12fd0ee0f046@pengutronix.de
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf85063.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf85063.c b/drivers/rtc/rtc-pcf85063.c
+index 3e7ea5244562e..5251b6cc2def0 100644
+--- a/drivers/rtc/rtc-pcf85063.c
++++ b/drivers/rtc/rtc-pcf85063.c
+@@ -332,7 +332,16 @@ static const struct rtc_class_ops pcf85063_rtc_ops_alarm = {
+ static int pcf85063_nvmem_read(void *priv, unsigned int offset,
+ void *val, size_t bytes)
+ {
+- return regmap_read(priv, PCF85063_REG_RAM, val);
++ unsigned int tmp;
++ int ret;
++
++ ret = regmap_read(priv, PCF85063_REG_RAM, &tmp);
++ if (ret < 0)
++ return ret;
++
++ *(u8 *)val = tmp;
++
++ return 0;
+ }
+
+ static int pcf85063_nvmem_write(void *priv, unsigned int offset,
+--
+2.39.5
+
--- /dev/null
+From 3f19d9745be2e70242b615d3cf262aa153179931 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Mar 2022 08:21:24 +0100
+Subject: rtlwifi: replace usage of found with dedicated list iterator variable
+
+From: Jakob Koschel <jakobkoschel@gmail.com>
+
+[ Upstream commit a0ff2a87194a968b9547fd4d824a09092171d1ea ]
+
+To move the list iterator variable into the list_for_each_entry_*()
+macro in the future it should be avoided to use the list iterator
+variable after the loop body.
+
+To *never* use the list iterator variable after the loop it was
+concluded to use a separate iterator variable instead of a
+found boolean [1].
+
+This removes the need to use a found variable and simply checking if
+the variable was set, can determine if the break/goto was hit.
+
+Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/
+Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20220324072124.62458-1-jakobkoschel@gmail.com
+Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 13 ++++++-------
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 15 +++++++--------
+ 2 files changed, 13 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 8fb0b54738ca9..5898109b1c3e8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -1995,8 +1995,7 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ unsigned long flags;
+
+- struct rtl_bssid_entry *entry;
+- bool entry_found = false;
++ struct rtl_bssid_entry *entry = NULL, *iter;
+
+ /* check if it is scanning */
+ if (!mac->act_scanning)
+@@ -2009,10 +2008,10 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+
+ spin_lock_irqsave(&rtlpriv->locks.scan_list_lock, flags);
+
+- list_for_each_entry(entry, &rtlpriv->scan_list.list, list) {
+- if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) {
+- list_del_init(&entry->list);
+- entry_found = true;
++ list_for_each_entry(iter, &rtlpriv->scan_list.list, list) {
++ if (memcmp(iter->bssid, hdr->addr3, ETH_ALEN) == 0) {
++ list_del_init(&iter->list);
++ entry = iter;
+ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
+ "Update BSSID=%pM to scan list (total=%d)\n",
+ hdr->addr3, rtlpriv->scan_list.num);
+@@ -2020,7 +2019,7 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ }
+ }
+
+- if (!entry_found) {
++ if (!entry) {
+ entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
+
+ if (!entry)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index a31d013d8815a..f8e34ae09a800 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -300,14 +300,13 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+- bool find_buddy_priv = false;
+- struct rtl_priv *tpriv;
++ struct rtl_priv *tpriv = NULL, *iter;
+ struct rtl_pci_priv *tpcipriv = NULL;
+
+ if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) {
+- list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list,
++ list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list,
+ list) {
+- tpcipriv = (struct rtl_pci_priv *)tpriv->priv;
++ tpcipriv = (struct rtl_pci_priv *)iter->priv;
+ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+ "pcipriv->ndis_adapter.funcnumber %x\n",
+ pcipriv->ndis_adapter.funcnumber);
+@@ -321,19 +320,19 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ tpcipriv->ndis_adapter.devnumber &&
+ pcipriv->ndis_adapter.funcnumber !=
+ tpcipriv->ndis_adapter.funcnumber) {
+- find_buddy_priv = true;
++ tpriv = iter;
+ break;
+ }
+ }
+ }
+
+ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "find_buddy_priv %d\n", find_buddy_priv);
++ "find_buddy_priv %d\n", tpriv != NULL);
+
+- if (find_buddy_priv)
++ if (tpriv)
+ *buddy_priv = tpriv;
+
+- return find_buddy_priv;
++ return tpriv != NULL;
+ }
+
+ static void rtl_pci_parse_configuration(struct pci_dev *pdev,
+--
+2.39.5
+
--- /dev/null
+From e3d7aeca98ae3683c49bcdd9072ab3e64479e90c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 15:42:39 -0500
+Subject: rtlwifi: rtl8192se Rename RT_TRACE to rtl_dbg
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit fca8218d33f3f425aed1ca5d3e796ceb9cdfd0ee ]
+
+Change the misleading macro name to one that is more descriptive for
+rtl8192se. Changes suggested by ckeckpatch.pl have been made.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200723204244.24457-11-Larry.Finger@lwfinger.net
+Stable-dep-of: 8559a9e0c457 ("wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last step")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/realtek/rtlwifi/rtl8192se/dm.c | 42 ++--
+ .../wireless/realtek/rtlwifi/rtl8192se/fw.c | 40 ++--
+ .../wireless/realtek/rtlwifi/rtl8192se/hw.c | 157 +++++++------
+ .../wireless/realtek/rtlwifi/rtl8192se/led.c | 10 +-
+ .../wireless/realtek/rtlwifi/rtl8192se/phy.c | 211 +++++++++---------
+ .../wireless/realtek/rtlwifi/rtl8192se/rf.c | 70 +++---
+ .../wireless/realtek/rtlwifi/rtl8192se/sw.c | 4 +-
+ .../wireless/realtek/rtlwifi/rtl8192se/trx.c | 10 +-
+ 8 files changed, 271 insertions(+), 273 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c
+index a6e4384ceea1d..5fce3db52cd9a 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/dm.c
+@@ -144,10 +144,10 @@ static void _rtl92s_dm_txpowertracking_callback_thermalmeter(
+
+ thermalvalue = (u8)rtl_get_rfreg(hw, RF90_PATH_A, RF_T_METER, 0x1f);
+
+- RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+- "Readback Thermal Meter = 0x%x pre thermal meter 0x%x eeprom_thermal meter 0x%x\n",
+- thermalvalue,
+- rtlpriv->dm.thermalvalue, rtlefuse->eeprom_thermalmeter);
++ rtl_dbg(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
++ "Readback Thermal Meter = 0x%x pre thermal meter 0x%x eeprom_thermal meter 0x%x\n",
++ thermalvalue,
++ rtlpriv->dm.thermalvalue, rtlefuse->eeprom_thermalmeter);
+
+ if (thermalvalue) {
+ rtlpriv->dm.thermalvalue = thermalvalue;
+@@ -158,8 +158,8 @@ static void _rtl92s_dm_txpowertracking_callback_thermalmeter(
+ (rtlpriv->efuse.thermalmeter[0] << 8) |
+ (thermalvalue << 16));
+
+- RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
+- "Write to FW Thermal Val = 0x%x\n", fw_cmd);
++ rtl_dbg(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD,
++ "Write to FW Thermal Val = 0x%x\n", fw_cmd);
+
+ rtl_write_dword(rtlpriv, WFM5, fw_cmd);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+@@ -264,10 +264,10 @@ static void _rtl92s_dm_refresh_rateadaptive_mask(struct ieee80211_hw *hw)
+ }
+
+ if (ra->pre_ratr_state != ra->ratr_state) {
+- RT_TRACE(rtlpriv, COMP_RATE, DBG_LOUD,
+- "RSSI = %ld RSSI_LEVEL = %d PreState = %d, CurState = %d\n",
+- rtlpriv->dm.undec_sm_pwdb, ra->ratr_state,
+- ra->pre_ratr_state, ra->ratr_state);
++ rtl_dbg(rtlpriv, COMP_RATE, DBG_LOUD,
++ "RSSI = %ld RSSI_LEVEL = %d PreState = %d, CurState = %d\n",
++ rtlpriv->dm.undec_sm_pwdb, ra->ratr_state,
++ ra->pre_ratr_state, ra->ratr_state);
+
+ rcu_read_lock();
+ sta = rtl_find_sta(hw, mac->bssid);
+@@ -576,8 +576,8 @@ static void _rtl92s_dm_dynamic_txpower(struct ieee80211_hw *hw)
+
+ if ((mac->link_state < MAC80211_LINKED) &&
+ (rtlpriv->dm.entry_min_undec_sm_pwdb == 0)) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "Not connected to any\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "Not connected to any\n");
+
+ rtlpriv->dm.dynamic_txhighpower_lvl = TX_HIGHPWR_LEVEL_NORMAL;
+
+@@ -588,21 +588,21 @@ static void _rtl92s_dm_dynamic_txpower(struct ieee80211_hw *hw)
+ if (mac->link_state >= MAC80211_LINKED) {
+ if (mac->opmode == NL80211_IFTYPE_ADHOC) {
+ undec_sm_pwdb = rtlpriv->dm.entry_min_undec_sm_pwdb;
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "AP Client PWDB = 0x%lx\n",
+- undec_sm_pwdb);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "AP Client PWDB = 0x%lx\n",
++ undec_sm_pwdb);
+ } else {
+ undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "STA Default Port PWDB = 0x%lx\n",
+- undec_sm_pwdb);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "STA Default Port PWDB = 0x%lx\n",
++ undec_sm_pwdb);
+ }
+ } else {
+ undec_sm_pwdb = rtlpriv->dm.entry_min_undec_sm_pwdb;
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "AP Ext Port PWDB = 0x%lx\n",
+- undec_sm_pwdb);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "AP Ext Port PWDB = 0x%lx\n",
++ undec_sm_pwdb);
+ }
+
+ txpwr_threshold_lv2 = TX_POWER_NEAR_FIELD_THRESH_LVL2;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c
+index 541b7881735e8..61bc3a384fdac 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/fw.c
+@@ -39,8 +39,8 @@ static bool _rtl92s_firmware_enable_cpu(struct ieee80211_hw *hw)
+ do {
+ cpustatus = rtl_read_byte(rtlpriv, TCR);
+ if (cpustatus & IMEM_RDY) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "IMEM Ready after CPU has refilled\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "IMEM Ready after CPU has refilled\n");
+ break;
+ }
+
+@@ -195,8 +195,8 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw,
+ short pollingcnt = 1000;
+ bool rtstatus = true;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "LoadStaus(%d)\n", loadfw_status);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "LoadStaus(%d)\n", loadfw_status);
+
+ firmware->fwstatus = (enum fw_status)loadfw_status;
+
+@@ -256,9 +256,9 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw,
+ goto status_check_fail;
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "DMEM code download success, cpustatus(%#x)\n",
+- cpustatus);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "DMEM code download success, cpustatus(%#x)\n",
++ cpustatus);
+
+ /* Prevent Delay too much and being scheduled out */
+ /* Polling Load Firmware ready */
+@@ -270,9 +270,9 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw,
+ udelay(40);
+ } while (pollingcnt--);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Polling Load Firmware ready, cpustatus(%x)\n",
+- cpustatus);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Polling Load Firmware ready, cpustatus(%x)\n",
++ cpustatus);
+
+ if (((cpustatus & LOAD_FW_READY) != LOAD_FW_READY) ||
+ (pollingcnt <= 0)) {
+@@ -290,8 +290,8 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw,
+ rtl_write_dword(rtlpriv, RCR, (tmpu4b | RCR_APPFCS |
+ RCR_APP_ICV | RCR_APP_MIC));
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Current RCR settings(%#x)\n", tmpu4b);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Current RCR settings(%#x)\n", tmpu4b);
+
+ /* Set to normal mode. */
+ rtl_write_byte(rtlpriv, LBKMD_SEL, LBK_NORMAL);
+@@ -304,9 +304,9 @@ static bool _rtl92s_firmware_checkready(struct ieee80211_hw *hw,
+ }
+
+ status_check_fail:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "loadfw_status(%d), rtstatus(%x)\n",
+- loadfw_status, rtstatus);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "loadfw_status(%d), rtstatus(%x)\n",
++ loadfw_status, rtstatus);
+ return rtstatus;
+ }
+
+@@ -337,11 +337,11 @@ int rtl92s_download_fw(struct ieee80211_hw *hw)
+ firmware->firmwareversion = byte(pfwheader->version, 0);
+ firmware->pfwheader->fwpriv.hci_sel = 1;/* pcie */
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "signature:%x, version:%x, size:%x, imemsize:%x, sram size:%x\n",
+- pfwheader->signature,
+- pfwheader->version, pfwheader->dmem_size,
+- pfwheader->img_imem_size, pfwheader->img_sram_size);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "signature:%x, version:%x, size:%x, imemsize:%x, sram size:%x\n",
++ pfwheader->signature,
++ pfwheader->version, pfwheader->dmem_size,
++ pfwheader->img_imem_size, pfwheader->img_sram_size);
+
+ /* 2. Retrieve IMEM image. */
+ if ((pfwheader->img_imem_size == 0) || (pfwheader->img_imem_size >
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c
+index 6d6e8994460d9..b04f5595414a1 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/hw.c
+@@ -111,8 +111,8 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+ case HW_VAR_SLOT_TIME:{
+ u8 e_aci;
+
+- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+- "HW_VAR_SLOT_TIME %x\n", val[0]);
++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD,
++ "HW_VAR_SLOT_TIME %x\n", val[0]);
+
+ rtl_write_byte(rtlpriv, SLOT_TIME, val[0]);
+
+@@ -156,9 +156,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+
+ *val = min_spacing_to_set;
+
+- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+- "Set HW_VAR_AMPDU_MIN_SPACE: %#x\n",
+- mac->min_space_cfg);
++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD,
++ "Set HW_VAR_AMPDU_MIN_SPACE: %#x\n",
++ mac->min_space_cfg);
+
+ rtl_write_byte(rtlpriv, AMPDU_MIN_SPACE,
+ mac->min_space_cfg);
+@@ -172,9 +172,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+ mac->min_space_cfg = rtlpriv->rtlhal.minspace_cfg;
+ mac->min_space_cfg |= (density_to_set << 3);
+
+- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+- "Set HW_VAR_SHORTGI_DENSITY: %#x\n",
+- mac->min_space_cfg);
++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD,
++ "Set HW_VAR_SHORTGI_DENSITY: %#x\n",
++ mac->min_space_cfg);
+
+ rtl_write_byte(rtlpriv, AMPDU_MIN_SPACE,
+ mac->min_space_cfg);
+@@ -215,9 +215,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+ (factorlevel[17] << 4));
+ rtl_write_byte(rtlpriv, AGGLEN_LMT_H, regtoset);
+
+- RT_TRACE(rtlpriv, COMP_MLME, DBG_LOUD,
+- "Set HW_VAR_AMPDU_FACTOR: %#x\n",
+- factor_toset);
++ rtl_dbg(rtlpriv, COMP_MLME, DBG_LOUD,
++ "Set HW_VAR_AMPDU_FACTOR: %#x\n",
++ factor_toset);
+ }
+ break;
+ }
+@@ -253,9 +253,9 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+ acm_ctrl |= ACMHW_VOQEN;
+ break;
+ default:
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "HW_VAR_ACM_CTRL acm set failed: eACI is %d\n",
+- acm);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "HW_VAR_ACM_CTRL acm set failed: eACI is %d\n",
++ acm);
+ break;
+ }
+ } else {
+@@ -276,8 +276,8 @@ void rtl92se_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_QOS, DBG_TRACE,
+- "HW_VAR_ACM_CTRL Write 0x%X\n", acm_ctrl);
++ rtl_dbg(rtlpriv, COMP_QOS, DBG_TRACE,
++ "HW_VAR_ACM_CTRL Write 0x%X\n", acm_ctrl);
+ rtl_write_byte(rtlpriv, ACMHWCTRL, acm_ctrl);
+ break;
+ }
+@@ -417,14 +417,14 @@ void rtl92se_enable_hw_security_config(struct ieee80211_hw *hw)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u8 sec_reg_value = 0x0;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "PairwiseEncAlgorithm = %d GroupEncAlgorithm = %d\n",
+- rtlpriv->sec.pairwise_enc_algorithm,
+- rtlpriv->sec.group_enc_algorithm);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "PairwiseEncAlgorithm = %d GroupEncAlgorithm = %d\n",
++ rtlpriv->sec.pairwise_enc_algorithm,
++ rtlpriv->sec.group_enc_algorithm);
+
+ if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "not open hw encryption\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "not open hw encryption\n");
+ return;
+ }
+
+@@ -435,8 +435,8 @@ void rtl92se_enable_hw_security_config(struct ieee80211_hw *hw)
+ sec_reg_value |= SCR_RXUSEDK;
+ }
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD, "The SECR-value %x\n",
+- sec_reg_value);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD, "The SECR-value %x\n",
++ sec_reg_value);
+
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_WPA_CONFIG, &sec_reg_value);
+
+@@ -870,10 +870,10 @@ static void _rtl92se_macconfig_after_fwdownload(struct ieee80211_hw *hw)
+
+ /* Change Program timing */
+ rtl_write_byte(rtlpriv, REG_EFUSE_CTRL + 3, 0x72);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "EFUSE CONFIG OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "EFUSE CONFIG OK\n");
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "OK\n");
+
+ }
+
+@@ -960,9 +960,8 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
+ /* 2. download firmware */
+ rtstatus = rtl92s_download_fw(hw);
+ if (!rtstatus) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Failed to download FW. Init HW without FW now... "
+- "Please copy FW into /lib/firmware/rtlwifi\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Failed to download FW. Init HW without FW now... Please copy FW into /lib/firmware/rtlwifi\n");
+ err = 1;
+ goto exit;
+ }
+@@ -1014,7 +1013,7 @@ int rtl92se_hw_init(struct ieee80211_hw *hw)
+ rtl_write_byte(rtlpriv, RF_CTRL, 0x07);
+
+ if (!rtl92s_phy_rf_config(hw)) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "RF Config failed\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "RF Config failed\n");
+ err = rtstatus;
+ goto exit;
+ }
+@@ -1147,23 +1146,23 @@ static int _rtl92se_set_media_status(struct ieee80211_hw *hw,
+ switch (type) {
+ case NL80211_IFTYPE_UNSPECIFIED:
+ bt_msr |= (MSR_LINK_NONE << MSR_LINK_SHIFT);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "Set Network type to NO LINK!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "Set Network type to NO LINK!\n");
+ break;
+ case NL80211_IFTYPE_ADHOC:
+ bt_msr |= (MSR_LINK_ADHOC << MSR_LINK_SHIFT);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "Set Network type to Ad Hoc!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "Set Network type to Ad Hoc!\n");
+ break;
+ case NL80211_IFTYPE_STATION:
+ bt_msr |= (MSR_LINK_MANAGED << MSR_LINK_SHIFT);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "Set Network type to STA!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "Set Network type to STA!\n");
+ break;
+ case NL80211_IFTYPE_AP:
+ bt_msr |= (MSR_LINK_MASTER << MSR_LINK_SHIFT);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "Set Network type to AP!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "Set Network type to AP!\n");
+ break;
+ default:
+ pr_err("Network type %d not supported!\n", type);
+@@ -1606,8 +1605,8 @@ void rtl92se_update_interrupt_mask(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_LOUD, "add_msr:%x, rm_msr:%x\n",
+- add_msr, rm_msr);
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_LOUD, "add_msr:%x, rm_msr:%x\n",
++ add_msr, rm_msr);
+
+ if (add_msr)
+ rtlpci->irq_mask[0] |= add_msr;
+@@ -1671,11 +1670,11 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
+
+ eeprom_id = *((u16 *)&hwinfo[0]);
+ if (eeprom_id != RTL8190_EEPROM_ID) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
+ rtlefuse->autoload_failflag = true;
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
+ rtlefuse->autoload_failflag = false;
+ }
+
+@@ -1692,16 +1691,16 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
+ rtlefuse->eeprom_smid = *(u16 *)&hwinfo[EEPROM_SMID];
+ rtlefuse->eeprom_version = *(u16 *)&hwinfo[EEPROM_VERSION];
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROMId = 0x%4x\n", eeprom_id);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROMId = 0x%4x\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
+
+ for (i = 0; i < 6; i += 2) {
+ usvalue = *(u16 *)&hwinfo[EEPROM_MAC_ADDR + i];
+@@ -1711,7 +1710,7 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
+ for (i = 0; i < 6; i++)
+ rtl_write_byte(rtlpriv, MACIDR0 + i, rtlefuse->dev_addr[i]);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
+
+ /* Get Tx Power Level by Channel */
+ /* Read Tx power of Channel 1 ~ 14 from EEPROM. */
+@@ -1964,15 +1963,15 @@ static void _rtl92se_read_adapter_info(struct ieee80211_hw *hw)
+ tempval = rtl_read_byte(rtlpriv, 0x07);
+ if (!(tempval & BIT(0))) {
+ rtlefuse->b1x1_recvcombine = true;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "RF_TYPE=1T2R but only 1SS\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "RF_TYPE=1T2R but only 1SS\n");
+ }
+ }
+ rtlefuse->b1ss_support = rtlefuse->b1x1_recvcombine;
+ rtlefuse->eeprom_oemid = *&hwinfo[EEPROM_CUSTOMID];
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "EEPROM Customer ID: 0x%2x\n",
+- rtlefuse->eeprom_oemid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "EEPROM Customer ID: 0x%2x\n",
++ rtlefuse->eeprom_oemid);
+
+ /* set channel paln to world wide 13 */
+ rtlefuse->channel_plan = COUNTRY_CODE_WORLD_WIDE_13;
+@@ -1987,15 +1986,15 @@ void rtl92se_read_eeprom_info(struct ieee80211_hw *hw)
+ tmp_u1b = rtl_read_byte(rtlpriv, EPROM_CMD);
+
+ if (tmp_u1b & BIT(4)) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EEPROM\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EEPROM\n");
+ rtlefuse->epromtype = EEPROM_93C46;
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EFUSE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "Boot from EFUSE\n");
+ rtlefuse->epromtype = EEPROM_BOOT_EFUSE;
+ }
+
+ if (tmp_u1b & BIT(5)) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
+ rtlefuse->autoload_failflag = false;
+ _rtl92se_read_adapter_info(hw);
+ } else {
+@@ -2101,8 +2100,8 @@ static void rtl92se_update_hal_rate_table(struct ieee80211_hw *hw,
+ else
+ rtl92s_phy_set_fw_cmd(hw, FW_CMD_RA_REFRESH_BG);
+
+- RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
+- rtl_read_dword(rtlpriv, ARFR0));
++ rtl_dbg(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
++ rtl_read_dword(rtlpriv, ARFR0));
+ }
+
+ static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw,
+@@ -2256,8 +2255,8 @@ static void rtl92se_update_hal_rate_mask(struct ieee80211_hw *hw,
+
+ mask |= (bmulticast ? 1 : 0) << 9 | (macid & 0x1f) << 4 | (band & 0xf);
+
+- RT_TRACE(rtlpriv, COMP_RATR, DBG_TRACE, "mask = %x, bitmap = %x\n",
+- mask, ratr_bitmap);
++ rtl_dbg(rtlpriv, COMP_RATR, DBG_TRACE, "mask = %x, bitmap = %x\n",
++ mask, ratr_bitmap);
+ rtl_write_dword(rtlpriv, 0x2c4, ratr_bitmap);
+ rtl_write_dword(rtlpriv, WFM5, (FW_RA_UPDATE_MASK | (mask << 8)));
+
+@@ -2332,15 +2331,15 @@ bool rtl92se_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 *valid)
+ rfpwr_toset = _rtl92se_rf_onoff_detect(hw);
+
+ if ((ppsc->hwradiooff) && (rfpwr_toset == ERFON)) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "RFKILL-HW Radio ON, RF ON\n");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "RFKILL-HW Radio ON, RF ON\n");
+
+ rfpwr_toset = ERFON;
+ ppsc->hwradiooff = false;
+ actuallyset = true;
+ } else if ((!ppsc->hwradiooff) && (rfpwr_toset == ERFOFF)) {
+- RT_TRACE(rtlpriv, COMP_RF,
+- DBG_DMESG, "RFKILL-HW Radio OFF, RF OFF\n");
++ rtl_dbg(rtlpriv, COMP_RF,
++ DBG_DMESG, "RFKILL-HW Radio OFF, RF OFF\n");
+
+ rfpwr_toset = ERFOFF;
+ ppsc->hwradiooff = true;
+@@ -2404,7 +2403,7 @@ void rtl92se_set_key(struct ieee80211_hw *hw, u32 key_index, u8 *p_macaddr,
+ u8 cam_offset = 0;
+ u8 clear_number = 5;
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "clear_all\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "clear_all\n");
+
+ for (idx = 0; idx < clear_number; idx++) {
+ rtl_cam_mark_invalid(hw, cam_offset + idx);
+@@ -2463,26 +2462,26 @@ void rtl92se_set_key(struct ieee80211_hw *hw, u32 key_index, u8 *p_macaddr,
+ }
+
+ if (rtlpriv->sec.key_len[key_index] == 0) {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "delete one entry, entry_id is %d\n",
+- entry_id);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "delete one entry, entry_id is %d\n",
++ entry_id);
+ if (mac->opmode == NL80211_IFTYPE_AP)
+ rtl_cam_del_entry(hw, p_macaddr);
+ rtl_cam_delete_one_entry(hw, p_macaddr, entry_id);
+ } else {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "add one entry\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "add one entry\n");
+ if (is_pairwise) {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set Pairwise key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set Pairwise key\n");
+
+ rtl_cam_add_one_entry(hw, macaddr, key_index,
+ entry_id, enc_algo,
+ CAM_CONFIG_NO_USEDK,
+ rtlpriv->sec.key_buf[key_index]);
+ } else {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set group key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set group key\n");
+
+ if (mac->opmode == NL80211_IFTYPE_ADHOC) {
+ rtl_cam_add_one_entry(hw,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c
+index 2d18bc1ee4803..ecbf425f679f8 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/led.c
+@@ -27,8 +27,8 @@ void rtl92se_sw_led_on(struct ieee80211_hw *hw, struct rtl_led *pled)
+ u8 ledcfg;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n",
+- LEDCFG, pled->ledpin);
++ rtl_dbg(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n",
++ LEDCFG, pled->ledpin);
+
+ ledcfg = rtl_read_byte(rtlpriv, LEDCFG);
+
+@@ -57,8 +57,8 @@ void rtl92se_sw_led_off(struct ieee80211_hw *hw, struct rtl_led *pled)
+ rtlpriv = rtl_priv(hw);
+ if (!rtlpriv || rtlpriv->max_fw_size)
+ return;
+- RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n",
+- LEDCFG, pled->ledpin);
++ rtl_dbg(rtlpriv, COMP_LED, DBG_LOUD, "LedAddr:%X ledpin=%d\n",
++ LEDCFG, pled->ledpin);
+
+ ledcfg = rtl_read_byte(rtlpriv, LEDCFG);
+
+@@ -119,7 +119,7 @@ void rtl92se_led_control(struct ieee80211_hw *hw, enum led_ctl_mode ledaction)
+ ledaction == LED_CTL_POWER_ON)) {
+ return;
+ }
+- RT_TRACE(rtlpriv, COMP_LED, DBG_LOUD, "ledaction %d\n", ledaction);
++ rtl_dbg(rtlpriv, COMP_LED, DBG_LOUD, "ledaction %d\n", ledaction);
+
+ _rtl92se_sw_led_control(hw, ledaction);
+ }
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+index f377531bc2bd3..cd735d61f6304 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+@@ -19,15 +19,15 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u32 returnvalue = 0, originalvalue, bitshift;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n",
+- regaddr, bitmask);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n",
++ regaddr, bitmask);
+
+ originalvalue = rtl_read_dword(rtlpriv, regaddr);
+ bitshift = calculate_bit_shift(bitmask);
+ returnvalue = (originalvalue & bitmask) >> bitshift;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
+- bitmask, regaddr, originalvalue);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
++ bitmask, regaddr, originalvalue);
+
+ return returnvalue;
+
+@@ -39,9 +39,9 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u32 originalvalue, bitshift;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "regaddr(%#x), bitmask(%#x), data(%#x)\n",
+- regaddr, bitmask, data);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "regaddr(%#x), bitmask(%#x), data(%#x)\n",
++ regaddr, bitmask, data);
+
+ if (bitmask != MASKDWORD) {
+ originalvalue = rtl_read_dword(rtlpriv, regaddr);
+@@ -51,9 +51,9 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
+
+ rtl_write_dword(rtlpriv, regaddr, data);
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "regaddr(%#x), bitmask(%#x), data(%#x)\n",
+- regaddr, bitmask, data);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "regaddr(%#x), bitmask(%#x), data(%#x)\n",
++ regaddr, bitmask, data);
+
+ }
+
+@@ -111,8 +111,8 @@ static u32 _rtl92s_phy_rf_serial_read(struct ieee80211_hw *hw,
+ retvalue = rtl_get_bbreg(hw, pphyreg->rf_rb,
+ BLSSI_READBACK_DATA);
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "RFR-%d Addr[0x%x]=0x%x\n",
+- rfpath, pphyreg->rf_rb, retvalue);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "RFR-%d Addr[0x%x]=0x%x\n",
++ rfpath, pphyreg->rf_rb, retvalue);
+
+ return retvalue;
+
+@@ -134,8 +134,8 @@ static void _rtl92s_phy_rf_serial_write(struct ieee80211_hw *hw,
+ data_and_addr = ((newoffset << 20) | (data & 0x000fffff)) & 0x0fffffff;
+ rtl_set_bbreg(hw, pphyreg->rf3wire_offset, MASKDWORD, data_and_addr);
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "RFW-%d Addr[0x%x]=0x%x\n",
+- rfpath, pphyreg->rf3wire_offset, data_and_addr);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "RFW-%d Addr[0x%x]=0x%x\n",
++ rfpath, pphyreg->rf3wire_offset, data_and_addr);
+ }
+
+
+@@ -145,8 +145,8 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u32 original_value, readback_value, bitshift;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "regaddr(%#x), rfpath(%#x), bitmask(%#x)\n",
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "regaddr(%#x), rfpath(%#x), bitmask(%#x)\n",
+ regaddr, rfpath, bitmask);
+
+ spin_lock(&rtlpriv->locks.rf_lock);
+@@ -158,9 +158,9 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+
+ spin_unlock(&rtlpriv->locks.rf_lock);
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
+- regaddr, rfpath, bitmask, original_value);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
++ regaddr, rfpath, bitmask, original_value);
+
+ return readback_value;
+ }
+@@ -175,9 +175,9 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+ if (!((rtlphy->rf_pathmap >> rfpath) & 0x1))
+ return;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n",
+- regaddr, bitmask, data, rfpath);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n",
++ regaddr, bitmask, data, rfpath);
+
+ spin_lock(&rtlpriv->locks.rf_lock);
+
+@@ -192,9 +192,9 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
+
+ spin_unlock(&rtlpriv->locks.rf_lock);
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n",
+- regaddr, bitmask, data, rfpath);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "regaddr(%#x), bitmask(%#x), data(%#x), rfpath(%#x)\n",
++ regaddr, bitmask, data, rfpath);
+
+ }
+
+@@ -227,9 +227,9 @@ void rtl92s_phy_set_bw_mode(struct ieee80211_hw *hw,
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ u8 reg_bw_opmode;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "Switch to %s bandwidth\n",
+- rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ?
+- "20MHz" : "40MHz");
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "Switch to %s bandwidth\n",
++ rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20 ?
++ "20MHz" : "40MHz");
+
+ if (rtlphy->set_bwmode_inprogress)
+ return;
+@@ -284,7 +284,7 @@ void rtl92s_phy_set_bw_mode(struct ieee80211_hw *hw,
+
+ rtl92s_phy_rf6052_set_bandwidth(hw, rtlphy->current_chan_bw);
+ rtlphy->set_bwmode_inprogress = false;
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n");
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n");
+ }
+
+ static bool _rtl92s_phy_set_sw_chnl_cmdarray(struct swchnlcmd *cmdtable,
+@@ -422,8 +422,8 @@ u8 rtl92s_phy_sw_chnl(struct ieee80211_hw *hw)
+ u32 delay;
+ bool ret;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "switch to channel%d\n",
+- rtlphy->current_channel);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "switch to channel%d\n",
++ rtlphy->current_channel);
+
+ if (rtlphy->sw_chnl_inprogress)
+ return 0;
+@@ -459,7 +459,7 @@ u8 rtl92s_phy_sw_chnl(struct ieee80211_hw *hw)
+
+ rtlphy->sw_chnl_inprogress = false;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n");
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_TRACE, "<==\n");
+
+ return 1;
+ }
+@@ -518,20 +518,19 @@ bool rtl92s_phy_set_rf_power_state(struct ieee80211_hw *hw,
+ u32 initializecount = 0;
+ do {
+ initializecount++;
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "IPS Set eRf nic enable\n");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "IPS Set eRf nic enable\n");
+ rtstatus = rtl_ps_enable_nic(hw);
+ } while (!rtstatus && (initializecount < 10));
+
+ RT_CLEAR_PS_LEVEL(ppsc,
+ RT_RF_OFF_LEVL_HALT_NIC);
+ } else {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "awake, sleeped:%d ms state_inap:%x\n",
+- jiffies_to_msecs(jiffies -
+- ppsc->
+- last_sleep_jiffies),
+- rtlpriv->psc.state_inap);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "awake, slept:%d ms state_inap:%x\n",
++ jiffies_to_msecs(jiffies -
++ ppsc->last_sleep_jiffies),
++ rtlpriv->psc.state_inap);
+ ppsc->last_awake_jiffies = jiffies;
+ rtl_write_word(rtlpriv, CMDR, 0x37FC);
+ rtl_write_byte(rtlpriv, TXPAUSE, 0x00);
+@@ -548,8 +547,8 @@ bool rtl92s_phy_set_rf_power_state(struct ieee80211_hw *hw,
+ }
+ case ERFOFF:{
+ if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_HALT_NIC) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "IPS Set eRf nic disable\n");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "IPS Set eRf nic disable\n");
+ rtl_ps_disable_nic(hw);
+ RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_HALT_NIC);
+ } else {
+@@ -574,34 +573,34 @@ bool rtl92s_phy_set_rf_power_state(struct ieee80211_hw *hw,
+ queue_id++;
+ continue;
+ } else {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "eRf Off/Sleep: %d times TcbBusyQueue[%d] = %d before doze!\n",
+- i + 1, queue_id,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "eRf Off/Sleep: %d times TcbBusyQueue[%d] = %d before doze!\n",
++ i + 1, queue_id,
++ skb_queue_len(&ring->queue));
+
+ udelay(10);
+ i++;
+ }
+
+ if (i >= MAX_DOZE_WAITING_TIMES_9x) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "ERFOFF: %d times TcbBusyQueue[%d] = %d !\n",
+- MAX_DOZE_WAITING_TIMES_9x,
+- queue_id,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "ERFOFF: %d times TcbBusyQueue[%d] = %d !\n",
++ MAX_DOZE_WAITING_TIMES_9x,
++ queue_id,
++ skb_queue_len(&ring->queue));
+ break;
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "Set ERFSLEEP awaked:%d ms\n",
+- jiffies_to_msecs(jiffies -
+- ppsc->last_awake_jiffies));
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "Set ERFSLEEP awaked:%d ms\n",
++ jiffies_to_msecs(jiffies -
++ ppsc->last_awake_jiffies));
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "sleep awaked:%d ms state_inap:%x\n",
+- jiffies_to_msecs(jiffies -
+- ppsc->last_awake_jiffies),
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "sleep awaked:%d ms state_inap:%x\n",
++ jiffies_to_msecs(jiffies -
++ ppsc->last_awake_jiffies),
+ rtlpriv->psc.state_inap);
+ ppsc->last_sleep_jiffies = jiffies;
+ _rtl92se_phy_set_rf_sleep(hw);
+@@ -956,7 +955,7 @@ u8 rtl92s_phy_config_rf(struct ieee80211_hw *hw, enum radio_path rfpath)
+ radio_b_tblen = RADIOB_ARRAYLENGTH;
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Radio No %x\n", rfpath);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Radio No %x\n", rfpath);
+ rtstatus = true;
+
+ switch (rfpath) {
+@@ -1076,20 +1075,20 @@ void rtl92s_phy_get_hw_reg_originalvalue(struct ieee80211_hw *hw)
+ ROFDM0_XCAGCCORE1, MASKBYTE0);
+ rtlphy->default_initialgain[3] = rtl_get_bbreg(hw,
+ ROFDM0_XDAGCCORE1, MASKBYTE0);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Default initial gain (c50=0x%x, c58=0x%x, c60=0x%x, c68=0x%x)\n",
+- rtlphy->default_initialgain[0],
+- rtlphy->default_initialgain[1],
+- rtlphy->default_initialgain[2],
+- rtlphy->default_initialgain[3]);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Default initial gain (c50=0x%x, c58=0x%x, c60=0x%x, c68=0x%x)\n",
++ rtlphy->default_initialgain[0],
++ rtlphy->default_initialgain[1],
++ rtlphy->default_initialgain[2],
++ rtlphy->default_initialgain[3]);
+
+ /* read framesync */
+ rtlphy->framesync = rtl_get_bbreg(hw, ROFDM0_RXDETECTOR3, MASKBYTE0);
+ rtlphy->framesync_c34 = rtl_get_bbreg(hw, ROFDM0_RXDETECTOR2,
+ MASKDWORD);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Default framesync (0x%x) = 0x%x\n",
+- ROFDM0_RXDETECTOR3, rtlphy->framesync);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Default framesync (0x%x) = 0x%x\n",
++ ROFDM0_RXDETECTOR3, rtlphy->framesync);
+
+ }
+
+@@ -1151,10 +1150,10 @@ void rtl92s_phy_set_txpower(struct ieee80211_hw *hw, u8 channel)
+ _rtl92s_phy_get_txpower_index(hw, channel, &cckpowerlevel[0],
+ &ofdmpowerlevel[0]);
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Channel-%d, cckPowerLevel (A / B) = 0x%x / 0x%x, ofdmPowerLevel (A / B) = 0x%x / 0x%x\n",
+- channel, cckpowerlevel[0], cckpowerlevel[1],
+- ofdmpowerlevel[0], ofdmpowerlevel[1]);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Channel-%d, cckPowerLevel (A / B) = 0x%x / 0x%x, ofdmPowerLevel (A / B) = 0x%x / 0x%x\n",
++ channel, cckpowerlevel[0], cckpowerlevel[1],
++ ofdmpowerlevel[0], ofdmpowerlevel[1]);
+
+ _rtl92s_phy_ccxpower_indexcheck(hw, channel, &cckpowerlevel[0],
+ &ofdmpowerlevel[0]);
+@@ -1212,17 +1211,17 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw)
+ skip:
+ switch (rtlhal->current_fwcmd_io) {
+ case FW_CMD_RA_RESET:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_RESET\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_RESET\n");
+ rtl_write_dword(rtlpriv, WFM5, FW_RA_RESET);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_RA_ACTIVE:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_ACTIVE\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_ACTIVE\n");
+ rtl_write_dword(rtlpriv, WFM5, FW_RA_ACTIVE);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_RA_REFRESH_N:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_REFRESH_N\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_RA_REFRESH_N\n");
+ input = FW_RA_REFRESH;
+ rtl_write_dword(rtlpriv, WFM5, input);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+@@ -1230,29 +1229,29 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw)
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_RA_REFRESH_BG:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG,
+- "FW_CMD_RA_REFRESH_BG\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG,
++ "FW_CMD_RA_REFRESH_BG\n");
+ rtl_write_dword(rtlpriv, WFM5, FW_RA_REFRESH);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ rtl_write_dword(rtlpriv, WFM5, FW_RA_DISABLE_RSSI_MASK);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_RA_REFRESH_N_COMB:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG,
+- "FW_CMD_RA_REFRESH_N_COMB\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG,
++ "FW_CMD_RA_REFRESH_N_COMB\n");
+ input = FW_RA_IOT_N_COMB;
+ rtl_write_dword(rtlpriv, WFM5, input);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_RA_REFRESH_BG_COMB:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG,
+- "FW_CMD_RA_REFRESH_BG_COMB\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG,
++ "FW_CMD_RA_REFRESH_BG_COMB\n");
+ input = FW_RA_IOT_BG_COMB;
+ rtl_write_dword(rtlpriv, WFM5, input);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_IQK_ENABLE:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_IQK_ENABLE\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_IQK_ENABLE\n");
+ rtl_write_dword(rtlpriv, WFM5, FW_IQK_ENABLE);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+@@ -1287,7 +1286,7 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw)
+ rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, 0xcd);
+ break;
+ case FW_CMD_LPS_ENTER:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_ENTER\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_ENTER\n");
+ current_aid = rtlpriv->mac80211.assoc_id;
+ rtl_write_dword(rtlpriv, WFM5, (FW_LPS_ENTER |
+ ((current_aid | 0xc000) << 8)));
+@@ -1296,18 +1295,18 @@ static void _rtl92s_phy_set_fwcmd_io(struct ieee80211_hw *hw)
+ * turbo mode until driver leave LPS */
+ break;
+ case FW_CMD_LPS_LEAVE:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_LEAVE\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_LPS_LEAVE\n");
+ rtl_write_dword(rtlpriv, WFM5, FW_LPS_LEAVE);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_ADD_A2_ENTRY:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_ADD_A2_ENTRY\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_DMESG, "FW_CMD_ADD_A2_ENTRY\n");
+ rtl_write_dword(rtlpriv, WFM5, FW_ADD_A2_ENTRY);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+ case FW_CMD_CTRL_DM_BY_DRIVER:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "FW_CMD_CTRL_DM_BY_DRIVER\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "FW_CMD_CTRL_DM_BY_DRIVER\n");
+ rtl_write_dword(rtlpriv, WFM5, FW_CTRL_DM_BY_DRIVER);
+ rtl92s_phy_chk_fwcmd_iodone(hw);
+ break;
+@@ -1332,9 +1331,9 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
+ u16 fw_cmdmap = FW_CMD_IO_QUERY(rtlpriv);
+ bool postprocessing = false;
+
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "Set FW Cmd(%#x), set_fwcmd_inprogress(%d)\n",
+- fw_cmdio, rtlhal->set_fwcmd_inprogress);
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "Set FW Cmd(%#x), set_fwcmd_inprogress(%d)\n",
++ fw_cmdio, rtlhal->set_fwcmd_inprogress);
+
+ do {
+ /* We re-map to combined FW CMD ones if firmware version */
+@@ -1371,30 +1370,30 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
+ * DM map table in the future. */
+ switch (fw_cmdio) {
+ case FW_CMD_RA_INIT:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD, "RA init!!\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD, "RA init!!\n");
+ fw_cmdmap |= FW_RA_INIT_CTL;
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+ /* Clear control flag to sync with FW. */
+ FW_CMD_IO_CLR(rtlpriv, FW_RA_INIT_CTL);
+ break;
+ case FW_CMD_DIG_DISABLE:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "Set DIG disable!!\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "Set DIG disable!!\n");
+ fw_cmdmap &= ~FW_DIG_ENABLE_CTL;
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+ break;
+ case FW_CMD_DIG_ENABLE:
+ case FW_CMD_DIG_RESUME:
+ if (!(rtlpriv->dm.dm_flag & HAL_DM_DIG_DISABLE)) {
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "Set DIG enable or resume!!\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "Set DIG enable or resume!!\n");
+ fw_cmdmap |= (FW_DIG_ENABLE_CTL | FW_SS_CTL);
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+ }
+ break;
+ case FW_CMD_DIG_HALT:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "Set DIG halt!!\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "Set DIG halt!!\n");
+ fw_cmdmap &= ~(FW_DIG_ENABLE_CTL | FW_SS_CTL);
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+ break;
+@@ -1409,9 +1408,9 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
+ fw_param |= ((thermalval << 24) |
+ (rtlefuse->thermalmeter[0] << 16));
+
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "Set TxPwr tracking!! FwCmdMap(%#x), FwParam(%#x)\n",
+- fw_cmdmap, fw_param);
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "Set TxPwr tracking!! FwCmdMap(%#x), FwParam(%#x)\n",
++ fw_cmdmap, fw_param);
+
+ FW_CMD_PARA_SET(rtlpriv, fw_param);
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+@@ -1431,9 +1430,9 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
+ /* Clear FW parameter in terms of RA parts. */
+ fw_param &= FW_RA_PARAM_CLR;
+
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "[FW CMD] [New Version] Set RA/IOT Comb in n mode!! FwCmdMap(%#x), FwParam(%#x)\n",
+- fw_cmdmap, fw_param);
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "[FW CMD] [New Version] Set RA/IOT Comb in n mode!! FwCmdMap(%#x), FwParam(%#x)\n",
++ fw_cmdmap, fw_param);
+
+ FW_CMD_PARA_SET(rtlpriv, fw_param);
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+@@ -1519,8 +1518,8 @@ bool rtl92s_phy_set_fw_cmd(struct ieee80211_hw *hw, enum fwcmd_iotype fw_cmdio)
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+ break;
+ case FW_CMD_PAPE_CONTROL:
+- RT_TRACE(rtlpriv, COMP_CMD, DBG_LOUD,
+- "[FW CMD] Set PAPE Control\n");
++ rtl_dbg(rtlpriv, COMP_CMD, DBG_LOUD,
++ "[FW CMD] Set PAPE Control\n");
+ fw_cmdmap &= ~FW_PAPE_CTL_BY_SW_HW;
+
+ FW_CMD_IO_SET(rtlpriv, fw_cmdmap);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c
+index a37855f57e76f..85f6d0d4dd799 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/rf.c
+@@ -95,13 +95,13 @@ static void _rtl92s_get_powerbase(struct ieee80211_hw *hw, u8 *p_pwrlevel,
+ }
+
+ if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "40MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n",
+- p_final_pwridx[0], p_final_pwridx[1]);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "40MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n",
++ p_final_pwridx[0], p_final_pwridx[1]);
+ } else {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "20MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n",
+- p_final_pwridx[0], p_final_pwridx[1]);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "20MHz finalpwr_idx (A / B) = 0x%x / 0x%x\n",
++ p_final_pwridx[0], p_final_pwridx[1]);
+ }
+ }
+
+@@ -124,9 +124,9 @@ static void _rtl92s_set_antennadiff(struct ieee80211_hw *hw,
+ if (ant_pwr_diff < -8)
+ ant_pwr_diff = -8;
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Antenna Diff from RF-B to RF-A = %d (0x%x)\n",
+- ant_pwr_diff, ant_pwr_diff & 0xf);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Antenna Diff from RF-B to RF-A = %d (0x%x)\n",
++ ant_pwr_diff, ant_pwr_diff & 0xf);
+
+ ant_pwr_diff &= 0xf;
+ }
+@@ -143,8 +143,8 @@ static void _rtl92s_set_antennadiff(struct ieee80211_hw *hw,
+ rtl_set_bbreg(hw, RFPGA0_TXGAINSTAGE, (BXBTXAGC | BXCTXAGC | BXDTXAGC),
+ u4reg_val);
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD, "Write BCD-Diff(0x%x) = 0x%x\n",
+- RFPGA0_TXGAINSTAGE, u4reg_val);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD, "Write BCD-Diff(0x%x) = 0x%x\n",
++ RFPGA0_TXGAINSTAGE, u4reg_val);
+ }
+
+ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+@@ -169,8 +169,8 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+ writeval = rtlphy->mcs_offset[chnlgroup][index] +
+ ((index < 2) ? pwrbase0 : pwrbase1);
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "RTK better performance, writeval = 0x%x\n", writeval);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "RTK better performance, writeval = 0x%x\n", writeval);
+ break;
+ case 1:
+ /* Realtek regulatory increase power diff defined
+@@ -178,9 +178,9 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+ if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40) {
+ writeval = ((index < 2) ? pwrbase0 : pwrbase1);
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Realtek regulatory, 40MHz, writeval = 0x%x\n",
+- writeval);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Realtek regulatory, 40MHz, writeval = 0x%x\n",
++ writeval);
+ } else {
+ chnlgroup = 0;
+
+@@ -199,16 +199,16 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+ + ((index < 2) ?
+ pwrbase0 : pwrbase1);
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Realtek regulatory, 20MHz, writeval = 0x%x\n",
+- writeval);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Realtek regulatory, 20MHz, writeval = 0x%x\n",
++ writeval);
+ }
+ break;
+ case 2:
+ /* Better regulatory don't increase any power diff */
+ writeval = ((index < 2) ? pwrbase0 : pwrbase1);
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Better regulatory, writeval = 0x%x\n", writeval);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Better regulatory, writeval = 0x%x\n", writeval);
+ break;
+ case 3:
+ /* Customer defined power diff. increase power diff
+@@ -216,15 +216,15 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+ chnlgroup = 0;
+
+ if (rtlphy->current_chan_bw == HT_CHANNEL_WIDTH_20_40) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "customer's limit, 40MHz = 0x%x\n",
+- rtlefuse->pwrgroup_ht40
+- [RF90_PATH_A][chnl - 1]);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "customer's limit, 40MHz = 0x%x\n",
++ rtlefuse->pwrgroup_ht40
++ [RF90_PATH_A][chnl - 1]);
+ } else {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "customer's limit, 20MHz = 0x%x\n",
+- rtlefuse->pwrgroup_ht20
+- [RF90_PATH_A][chnl - 1]);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "customer's limit, 20MHz = 0x%x\n",
++ rtlefuse->pwrgroup_ht20
++ [RF90_PATH_A][chnl - 1]);
+ }
+
+ for (i = 0; i < 4; i++) {
+@@ -256,20 +256,20 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
+ (pwrdiff_limit[2] << 16) |
+ (pwrdiff_limit[1] << 8) |
+ (pwrdiff_limit[0]);
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Customer's limit = 0x%x\n", customer_limit);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Customer's limit = 0x%x\n", customer_limit);
+
+ writeval = customer_limit + ((index < 2) ?
+ pwrbase0 : pwrbase1);
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Customer, writeval = 0x%x\n", writeval);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Customer, writeval = 0x%x\n", writeval);
+ break;
+ default:
+ chnlgroup = 0;
+ writeval = rtlphy->mcs_offset[chnlgroup][index] +
+ ((index < 2) ? pwrbase0 : pwrbase1);
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "RTK better performance, writeval = 0x%x\n", writeval);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "RTK better performance, writeval = 0x%x\n", writeval);
+ break;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+index 1c7ee569f4bf9..4c4a1201d420f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+@@ -66,8 +66,8 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
+ struct rt_firmware *pfirmware = NULL;
+ char *fw_name = "rtlwifi/rtl8192sefw.bin";
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+- "Firmware callback routine entered!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
++ "Firmware callback routine entered!\n");
+ complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
+ pr_err("Firmware %s not available\n", fw_name);
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c
+index efb432c6d7858..4ec8c93620601 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/trx.c
+@@ -333,8 +333,8 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
+ u8 bw_40 = 0;
+
+ if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+- "DMA mapping error\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_TRACE,
++ "DMA mapping error\n");
+ return;
+ }
+ if (mac->opmode == NL80211_IFTYPE_STATION) {
+@@ -487,7 +487,7 @@ void rtl92se_tx_fill_desc(struct ieee80211_hw *hw,
+ /* DOWRD 8 */
+ SET_TX_DESC_TX_BUFFER_ADDRESS(pdesc, mapping);
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE, "\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_TRACE, "\n");
+ }
+
+ void rtl92se_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
+@@ -502,8 +502,8 @@ void rtl92se_tx_fill_cmddesc(struct ieee80211_hw *hw, u8 *pdesc,
+ PCI_DMA_TODEVICE);
+
+ if (pci_dma_mapping_error(rtlpci->pdev, mapping)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_TRACE,
+- "DMA mapping error\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_TRACE,
++ "DMA mapping error\n");
+ return;
+ }
+ /* Clear all status */
+--
+2.39.5
+
--- /dev/null
+From 36634085bde6624189954a18ed6e59a43e00d4d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2024 23:18:12 +0100
+Subject: scsi: mpt3sas: Set ioc->manu_pg11.EEDPTagMode directly to 1
+
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+
+[ Upstream commit ad7c3c0cb8f61d6d5a48b83e62ca4a9fd2f26153 ]
+
+Currently, the code does:
+
+ if (x == 0) {
+ x &= ~0x3;
+ x |= 0x1;
+ }
+
+Zeroing bits 0 and 1 of a variable that is 0 is not necessary. So directly
+set the variable to 1.
+
+Cc: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
+Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Link: https://lore.kernel.org/r/20241212221817.78940-2-pmenzel@molgen.mpg.de
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/mpt3sas/mpt3sas_base.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
+index 69023ddceb59f..7df4e8cfeb923 100644
+--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
+@@ -4627,8 +4627,7 @@ _base_static_config_pages(struct MPT3SAS_ADAPTER *ioc)
+ if (!ioc->is_gen35_ioc && ioc->manu_pg11.EEDPTagMode == 0) {
+ pr_err("%s: overriding NVDATA EEDPTagMode setting\n",
+ ioc->name);
+- ioc->manu_pg11.EEDPTagMode &= ~0x3;
+- ioc->manu_pg11.EEDPTagMode |= 0x1;
++ ioc->manu_pg11.EEDPTagMode = 0x1;
+ mpt3sas_config_set_manufacturing_pg11(ioc, &mpi_reply,
+ &ioc->manu_pg11);
+ }
+--
+2.39.5
+
--- /dev/null
+From ca4d1a662ba87060fb04f1df8a6b0b51ee0fc0a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2024 09:42:13 +0800
+Subject: scsi: ufs: bsg: Delete bsg_dev when setting up bsg fails
+
+From: Guixin Liu <kanie@linux.alibaba.com>
+
+[ Upstream commit fcf247deb3c3e1c6be5774e3fa03bbd018eff1a9 ]
+
+We should remove the bsg device when bsg_setup_queue() fails to release the
+resources.
+
+Fixes: df032bf27a41 ("scsi: ufs: Add a bsg endpoint that supports UPIUs")
+Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20241218014214.64533-2-kanie@linux.alibaba.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs_bsg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/ufs/ufs_bsg.c b/drivers/scsi/ufs/ufs_bsg.c
+index bad366e491591..78e72a1aec9b1 100644
+--- a/drivers/scsi/ufs/ufs_bsg.c
++++ b/drivers/scsi/ufs/ufs_bsg.c
+@@ -213,6 +213,7 @@ int ufs_bsg_probe(struct ufs_hba *hba)
+ q = bsg_setup_queue(bsg_dev, dev_name(bsg_dev), ufs_bsg_request, NULL, 0);
+ if (IS_ERR(q)) {
+ ret = PTR_ERR(q);
++ device_del(bsg_dev);
+ goto out;
+ }
+
+--
+2.39.5
+
--- /dev/null
+From c057170bd9035110fa34ae0adeb5b38260f56181 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jun 2020 11:16:50 -0700
+Subject: selftests/harness: Display signed values correctly
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit d088c92802549fc1cf77a12a4e3986160d63662a ]
+
+Since forever the harness output for signed value tests have reported
+unsigned values to avoid casting. Instead, actually test the variable
+types and perform the correct casts and choose the correct format
+specifiers.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Stable-dep-of: 02bc220dc6dc ("selftests: harness: fix printing of mismatch values in __EXPECT()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest_harness.h | 42 ++++++++++++++++++---
+ 1 file changed, 37 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h
+index 5336b26506ab2..f393fe8cf3725 100644
+--- a/tools/testing/selftests/kselftest_harness.h
++++ b/tools/testing/selftests/kselftest_harness.h
+@@ -603,17 +603,49 @@
+ if (_metadata->passed && _metadata->step < 255) \
+ _metadata->step++;
+
++#define is_signed_type(var) (!!(((__typeof__(var))(-1)) < (__typeof__(var))1))
++
+ #define __EXPECT(_expected, _expected_str, _seen, _seen_str, _t, _assert) do { \
+ /* Avoid multiple evaluation of the cases */ \
+ __typeof__(_expected) __exp = (_expected); \
+ __typeof__(_seen) __seen = (_seen); \
+ if (_assert) __INC_STEP(_metadata); \
+ if (!(__exp _t __seen)) { \
+- unsigned long long __exp_print = (uintptr_t)__exp; \
+- unsigned long long __seen_print = (uintptr_t)__seen; \
+- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \
+- _expected_str, __exp_print, #_t, \
+- _seen_str, __seen_print); \
++ /* Report with actual signedness to avoid weird output. */ \
++ switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \
++ case 0: { \
++ unsigned long long __exp_print = (uintptr_t)__exp; \
++ unsigned long long __seen_print = (uintptr_t)__seen; \
++ __TH_LOG("Expected %s (%llu) %s %s (%llu)", \
++ _expected_str, __exp_print, #_t, \
++ _seen_str, __seen_print); \
++ break; \
++ } \
++ case 1: { \
++ unsigned long long __exp_print = (uintptr_t)__exp; \
++ long long __seen_print = (intptr_t)__seen; \
++ __TH_LOG("Expected %s (%llu) %s %s (%lld)", \
++ _expected_str, __exp_print, #_t, \
++ _seen_str, __seen_print); \
++ break; \
++ } \
++ case 2: { \
++ long long __exp_print = (intptr_t)__exp; \
++ unsigned long long __seen_print = (uintptr_t)__seen; \
++ __TH_LOG("Expected %s (%lld) %s %s (%llu)", \
++ _expected_str, __exp_print, #_t, \
++ _seen_str, __seen_print); \
++ break; \
++ } \
++ case 3: { \
++ long long __exp_print = (intptr_t)__exp; \
++ long long __seen_print = (intptr_t)__seen; \
++ __TH_LOG("Expected %s (%lld) %s %s (%lld)", \
++ _expected_str, __exp_print, #_t, \
++ _seen_str, __seen_print); \
++ break; \
++ } \
++ } \
+ _metadata->passed = 0; \
+ /* Ensure the optional handler is triggered */ \
+ _metadata->trigger = 1; \
+--
+2.39.5
+
--- /dev/null
+From 6beab5e8950c9702fee4eacb3c8ba4de0c55b733 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2025 19:07:57 +0200
+Subject: selftests: harness: fix printing of mismatch values in __EXPECT()
+
+From: Dmitry V. Levin <ldv@strace.io>
+
+[ Upstream commit 02bc220dc6dc7c56edc4859bc5dd2c08b95d5fb5 ]
+
+intptr_t and uintptr_t are not big enough types on 32-bit architectures
+when printing 64-bit values, resulting to the following incorrect
+diagnostic output:
+
+ # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (3134324433)
+
+Replace intptr_t and uintptr_t with intmax_t and uintmax_t, respectively.
+With this fix, the same test produces more usable diagnostic output:
+
+ # get_syscall_info.c:209:get_syscall_info:Expected exp_args[2] (3134324433) == info.entry.args[1] (18446744072548908753)
+
+Link: https://lore.kernel.org/r/20250108170757.GA6723@strace.io
+Fixes: b5bb6d3068ea ("selftests/seccomp: fix 32-bit build warnings")
+Signed-off-by: Dmitry V. Levin <ldv@strace.io>
+Reviewed-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest_harness.h | 24 ++++++++++-----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h
+index f393fe8cf3725..9465f1aca2af6 100644
+--- a/tools/testing/selftests/kselftest_harness.h
++++ b/tools/testing/selftests/kselftest_harness.h
+@@ -614,33 +614,33 @@
+ /* Report with actual signedness to avoid weird output. */ \
+ switch (is_signed_type(__exp) * 2 + is_signed_type(__seen)) { \
+ case 0: { \
+- unsigned long long __exp_print = (uintptr_t)__exp; \
+- unsigned long long __seen_print = (uintptr_t)__seen; \
+- __TH_LOG("Expected %s (%llu) %s %s (%llu)", \
++ uintmax_t __exp_print = (uintmax_t)__exp; \
++ uintmax_t __seen_print = (uintmax_t)__seen; \
++ __TH_LOG("Expected %s (%ju) %s %s (%ju)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+ } \
+ case 1: { \
+- unsigned long long __exp_print = (uintptr_t)__exp; \
+- long long __seen_print = (intptr_t)__seen; \
+- __TH_LOG("Expected %s (%llu) %s %s (%lld)", \
++ uintmax_t __exp_print = (uintmax_t)__exp; \
++ intmax_t __seen_print = (intmax_t)__seen; \
++ __TH_LOG("Expected %s (%ju) %s %s (%jd)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+ } \
+ case 2: { \
+- long long __exp_print = (intptr_t)__exp; \
+- unsigned long long __seen_print = (uintptr_t)__seen; \
+- __TH_LOG("Expected %s (%lld) %s %s (%llu)", \
++ intmax_t __exp_print = (intmax_t)__exp; \
++ uintmax_t __seen_print = (uintmax_t)__seen; \
++ __TH_LOG("Expected %s (%jd) %s %s (%ju)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+ } \
+ case 3: { \
+- long long __exp_print = (intptr_t)__exp; \
+- long long __seen_print = (intptr_t)__seen; \
+- __TH_LOG("Expected %s (%lld) %s %s (%lld)", \
++ intmax_t __exp_print = (intmax_t)__exp; \
++ intmax_t __seen_print = (intmax_t)__seen; \
++ __TH_LOG("Expected %s (%jd) %s %s (%jd)", \
+ _expected_str, __exp_print, #_t, \
+ _seen_str, __seen_print); \
+ break; \
+--
+2.39.5
+
--- /dev/null
+afs-fix-directory-format-encoding-struct.patch
+nbd-don-t-allow-reconnect-after-disconnect.patch
+partitions-ldm-remove-the-initial-kernel-doc-notatio.patch
+drm-etnaviv-fix-page-property-being-used-for-non-wri.patch
+drm-amdgpu-fix-potential-null-pointer-dereference-in.patch
+ipmi-ipmb-add-check-devm_kasprintf-returned-value.patch
+wifi-rtlwifi-do-not-complete-firmware-loading-needle.patch
+rtlwifi-rtl8192se-rename-rt_trace-to-rtl_dbg.patch
+wifi-rtlwifi-rtl8192se-rise-completion-of-firmware-l.patch
+wifi-rtlwifi-usb-fix-workqueue-leak-when-probe-fails.patch
+dt-bindings-mmc-controller-clarify-the-address-cells.patch
+rtlwifi-replace-usage-of-found-with-dedicated-list-i.patch
+wifi-rtlwifi-remove-unused-timer-and-related-code.patch
+wifi-rtlwifi-remove-unused-dualmac-control-leftovers.patch
+wifi-rtlwifi-remove-unused-check_buddy_priv.patch
+wifi-rtlwifi-fix-memory-leaks-and-invalid-access-at-.patch
+wifi-rtlwifi-pci-wait-for-firmware-loading-before-re.patch
+cpupower-fix-tsc-mhz-calculation.patch
+pwm-stm32-lp-add-check-for-clk_enable.patch
+team-prevent-adding-a-device-which-is-already-a-team.patch
+regulator-of-implement-the-unwind-path-of-of_regulat.patch
+wifi-wlcore-fix-unbalanced-pm_runtime-calls.patch
+selftests-harness-display-signed-values-correctly.patch
+selftests-harness-fix-printing-of-mismatch-values-in.patch
+clk-analogbits-fix-incorrect-calculation-of-vco-rate.patch
+net-let-net.core.dev_weight-always-be-non-zero.patch
+net-mlxfw-drop-hard-coded-max-fw-flash-image-size.patch
+net-sched-disallow-replacing-of-child-qdisc-from-one.patch
+tools-testing-selftests-bpf-test_tc_tunnel.sh-fix-wa.patch
+asoc-sun4i-spdif-add-clock-multiplier-settings.patch
+perf-header-fix-one-memory-leakage-in-process_bpf_bt.patch
+perf-header-fix-one-memory-leakage-in-process_bpf_pr.patch
+ktest.pl-remove-unused-declarations-in-run_bisect_te.patch
+padata-fix-sysfs-store-callback-check.patch
+perf-top-don-t-complain-about-lack-of-vmlinux-when-n.patch
+perf-machine-include-data-symbols-in-the-kernel-map.patch
+perf-machine-don-t-ignore-_etext-when-not-a-text-sym.patch
+perf-report-fix-misleading-help-message-about-demang.patch
+bpf-send-signals-asynchronously-if-preemptible.patch
+soc-atmel-fix-device_node-release-in-atmel_soc_devic.patch
+rdma-mlx4-avoid-false-error-about-access-to-uninitia.patch
+rdma-cxgb4-prevent-potential-integer-overflow-on-32b.patch
+arm64-dts-mediatek-mt8173-evb-drop-regulator-compati.patch
+arm64-dts-mediatek-mt8173-evb-fix-mt6397-pmic-sub-no.patch
+arm-dts-mediatek-mt7623-fix-ir-nodename.patch
+fbdev-omapfb-fix-an-of-node-leak-in-dss_of_port_get_.patch
+media-rc-iguanair-handle-timeouts.patch
+media-lmedm04-use-gfp_kernel-for-urb-allocation-subm.patch
+media-lmedm04-handle-errors-for-lme2510_int_read.patch
+pci-endpoint-destroy-the-epc-device-in-devm_pci_epc_.patch
+media-mipi-csis-add-check-for-clk_enable.patch
+media-camif-core-add-check-for-clk_enable.patch
+media-uvcvideo-propagate-buf-error-to-userspace.patch
+staging-media-imx-fix-of-node-leak-in-imx_media_add_.patch
+scsi-mpt3sas-set-ioc-manu_pg11.eedptagmode-directly-.patch
+scsi-ufs-bsg-delete-bsg_dev-when-setting-up-bsg-fail.patch
+ocfs2-mark-dquot-as-inactive-if-failed-to-start-tran.patch
+module-extend-the-preempt-disabled-section-in-derefe.patch
+dmaengine-ti-edma-fix-of-node-reference-leaks-in-edm.patch
+rtc-pcf85063-fix-potential-oob-write-in-pcf85063-nvm.patch
+ubifs-skip-dumping-tnc-tree-when-zroot-is-null.patch
+net-fec-implement-tso-descriptor-cleanup.patch
+ipmr-do-not-call-mr_mfc_uses_dev-for-unres-entries.patch
+pm-hibernate-add-error-handling-for-syscore_suspend.patch
+net-rose-fix-timer-races-against-user-threads.patch
+net-davicom-fix-uaf-in-dm9000_drv_remove.patch
+perf-trace-fix-runtime-error-of-index-out-of-bounds.patch
+vsock-allow-retrying-on-connect-failure.patch
+net-sh_eth-fix-missing-rtnl-lock-in-suspend-resume-p.patch
--- /dev/null
+From f7738b4dba8712d5b3cc7e04b0ae81fd973837c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2024 13:33:36 +0100
+Subject: soc: atmel: fix device_node release in atmel_soc_device_init()
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+[ Upstream commit d3455ab798100f40af77123e7c2443ec979c546b ]
+
+A device_node acquired via of_find_node_by_path() requires explicit
+calls to of_node_put() when it is no longer needed to avoid leaking the
+resource.
+
+Instead of adding the missing calls to of_node_put() in all execution
+paths, use the cleanup attribute for 'np' by means of the __free()
+macro, which automatically calls of_node_put() when the variable goes
+out of scope.
+
+Fixes: 960ddf70cc11 ("drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs")
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Link: https://lore.kernel.org/r/20241031-soc-atmel-soc-cleanup-v2-1-73f2d235fd98@gmail.com
+Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/atmel/soc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/atmel/soc.c b/drivers/soc/atmel/soc.c
+index 4b4174597150d..eed42bc9ea89d 100644
+--- a/drivers/soc/atmel/soc.c
++++ b/drivers/soc/atmel/soc.c
+@@ -274,7 +274,7 @@ static const struct of_device_id at91_soc_allowed_list[] __initconst = {
+
+ static int __init atmel_soc_device_init(void)
+ {
+- struct device_node *np = of_find_node_by_path("/");
++ struct device_node *np __free(device_node) = of_find_node_by_path("/");
+
+ if (!of_match_node(at91_soc_allowed_list, np))
+ return 0;
+--
+2.39.5
+
--- /dev/null
+From b9ab8b576949b3a2dbe8d7b980a25cc45167d65d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 12:54:11 +0900
+Subject: staging: media: imx: fix OF node leak in imx_media_add_of_subdevs()
+
+From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+
+[ Upstream commit 094f5c315f756b19198e6c401aa821ac0e868750 ]
+
+imx_media_add_of_subdevs() calls of_parse_phandle() and passes the
+obtained node to imx_media_of_add_csi(). The passed node is used in
+v4l2_async_nf_add_fwnode(), which increments the refcount of the node.
+Therefore, while the current implementation only releases the node when
+imx_media_of_add_csi() fails, but should always release it. Call
+of_node_put() right after imx_media_of_add_csi().
+
+Fixes: dee747f88167 ("media: imx: Don't register IPU subdevs/links if CSI port missing")
+Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
+Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/imx/imx-media-of.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c
+index 2d3efd2a6dde0..d9b34605ff9bc 100644
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -55,23 +55,19 @@ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd,
+ break;
+
+ ret = imx_media_of_add_csi(imxmd, csi_np);
++ of_node_put(csi_np);
+ if (ret) {
+ /* unavailable or already added is not an error */
+ if (ret == -ENODEV || ret == -EEXIST) {
+- of_node_put(csi_np);
+ continue;
+ }
+
+ /* other error, can't continue */
+- goto err_out;
++ return ret;
+ }
+ }
+
+ return 0;
+-
+-err_out:
+- of_node_put(csi_np);
+- return ret;
+ }
+ EXPORT_SYMBOL_GPL(imx_media_add_of_subdevs);
+
+--
+2.39.5
+
--- /dev/null
+From 7c15e2b737d9b03c307d2a7081a2396e1f07c249 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2024 12:56:47 -0800
+Subject: team: prevent adding a device which is already a team device lower
+
+From: Octavian Purdila <tavip@google.com>
+
+[ Upstream commit 3fff5da4ca2164bb4d0f1e6cd33f6eb8a0e73e50 ]
+
+Prevent adding a device which is already a team device lower,
+e.g. adding veth0 if vlan1 was already added and veth0 is a lower of
+vlan1.
+
+This is not useful in practice and can lead to recursive locking:
+
+$ ip link add veth0 type veth peer name veth1
+$ ip link set veth0 up
+$ ip link set veth1 up
+$ ip link add link veth0 name veth0.1 type vlan protocol 802.1Q id 1
+$ ip link add team0 type team
+$ ip link set veth0.1 down
+$ ip link set veth0.1 master team0
+team0: Port device veth0.1 added
+$ ip link set veth0 down
+$ ip link set veth0 master team0
+
+============================================
+WARNING: possible recursive locking detected
+6.13.0-rc2-virtme-00441-ga14a429069bb #46 Not tainted
+--------------------------------------------
+ip/7684 is trying to acquire lock:
+ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+
+but task is already holding lock:
+ffff888016848e00 (team->team_lock_key){+.+.}-{4:4}, at: team_add_slave (drivers/net/team/team_core.c:1147 drivers/net/team/team_core.c:1977)
+
+other info that might help us debug this:
+Possible unsafe locking scenario:
+
+CPU0
+----
+lock(team->team_lock_key);
+lock(team->team_lock_key);
+
+*** DEADLOCK ***
+
+May be due to missing lock nesting notation
+
+2 locks held by ip/7684:
+
+stack backtrace:
+CPU: 3 UID: 0 PID: 7684 Comm: ip Not tainted 6.13.0-rc2-virtme-00441-ga14a429069bb #46
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
+Call Trace:
+<TASK>
+dump_stack_lvl (lib/dump_stack.c:122)
+print_deadlock_bug.cold (kernel/locking/lockdep.c:3040)
+__lock_acquire (kernel/locking/lockdep.c:3893 kernel/locking/lockdep.c:5226)
+? netlink_broadcast_filtered (net/netlink/af_netlink.c:1548)
+lock_acquire.part.0 (kernel/locking/lockdep.c:467 kernel/locking/lockdep.c:5851)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? trace_lock_acquire (./include/trace/events/lock.h:24 (discriminator 2))
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? lock_acquire (kernel/locking/lockdep.c:5822)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+__mutex_lock (kernel/locking/mutex.c:587 kernel/locking/mutex.c:735)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+? fib_sync_up (net/ipv4/fib_semantics.c:2167)
+? team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+team_device_event (drivers/net/team/team_core.c:2928 drivers/net/team/team_core.c:2951 drivers/net/team/team_core.c:2973)
+notifier_call_chain (kernel/notifier.c:85)
+call_netdevice_notifiers_info (net/core/dev.c:1996)
+__dev_notify_flags (net/core/dev.c:8993)
+? __dev_change_flags (net/core/dev.c:8975)
+dev_change_flags (net/core/dev.c:9027)
+vlan_device_event (net/8021q/vlan.c:85 net/8021q/vlan.c:470)
+? br_device_event (net/bridge/br.c:143)
+notifier_call_chain (kernel/notifier.c:85)
+call_netdevice_notifiers_info (net/core/dev.c:1996)
+dev_open (net/core/dev.c:1519 net/core/dev.c:1505)
+team_add_slave (drivers/net/team/team_core.c:1219 drivers/net/team/team_core.c:1977)
+? __pfx_team_add_slave (drivers/net/team/team_core.c:1972)
+do_set_master (net/core/rtnetlink.c:2917)
+do_setlink.isra.0 (net/core/rtnetlink.c:3117)
+
+Reported-by: syzbot+3c47b5843403a45aef57@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=3c47b5843403a45aef57
+Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
+Signed-off-by: Octavian Purdila <tavip@google.com>
+Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/team/team.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 56caff2d01c45..b0a9dd33a0196 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1165,6 +1165,13 @@ static int team_port_add(struct team *team, struct net_device *port_dev,
+ return -EBUSY;
+ }
+
++ if (netdev_has_upper_dev(port_dev, dev)) {
++ NL_SET_ERR_MSG(extack, "Device is already a lower device of the team interface");
++ netdev_err(dev, "Device %s is already a lower device of the team interface\n",
++ portname);
++ return -EBUSY;
++ }
++
+ if (port_dev->features & NETIF_F_VLAN_CHALLENGED &&
+ vlan_uses_dev(dev)) {
+ NL_SET_ERR_MSG(extack, "Device is VLAN challenged and team device has VLAN set up");
+--
+2.39.5
+
--- /dev/null
+From 9e2686ed8688394dbc77066a6c7a9e8926762d92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2024 12:45:30 -0800
+Subject: tools/testing/selftests/bpf/test_tc_tunnel.sh: Fix wait for server
+ bind
+
+From: Marco Leogrande <leogrande@google.com>
+
+[ Upstream commit e2f0791124a1b6ca8d570110cbd487969d9d41ef ]
+
+Commit f803bcf9208a ("selftests/bpf: Prevent client connect before
+server bind in test_tc_tunnel.sh") added code that waits for the
+netcat server to start before the netcat client attempts to connect to
+it. However, not all calls to 'server_listen' were guarded.
+
+This patch adds the existing 'wait_for_port' guard after the remaining
+call to 'server_listen'.
+
+Fixes: f803bcf9208a ("selftests/bpf: Prevent client connect before server bind in test_tc_tunnel.sh")
+Signed-off-by: Marco Leogrande <leogrande@google.com>
+Acked-by: Stanislav Fomichev <sdf@fomichev.me>
+Link: https://lore.kernel.org/r/20241202204530.1143448-1-leogrande@google.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/test_tc_tunnel.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/bpf/test_tc_tunnel.sh b/tools/testing/selftests/bpf/test_tc_tunnel.sh
+index 21bde60c95230..e42d8959cbf1c 100755
+--- a/tools/testing/selftests/bpf/test_tc_tunnel.sh
++++ b/tools/testing/selftests/bpf/test_tc_tunnel.sh
+@@ -286,6 +286,7 @@ else
+ client_connect
+ verify_data
+ server_listen
++ wait_for_port ${port} ${netcat_opt}
+ fi
+
+ # bpf_skb_net_shrink does not take tunnel flags yet, cannot update L3.
+--
+2.39.5
+
--- /dev/null
+From 2d31eafdfaad096c363f505800524e4fb4cf519f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Dec 2024 16:18:23 +0800
+Subject: ubifs: skip dumping tnc tree when zroot is null
+
+From: pangliyuan <pangliyuan1@huawei.com>
+
+[ Upstream commit bdb0ca39e0acccf6771db49c3f94ed787d05f2d7 ]
+
+Clearing slab cache will free all znode in memory and make
+c->zroot.znode = NULL, then dumping tnc tree will access
+c->zroot.znode which cause null pointer dereference.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=219624#c0
+Fixes: 1e51764a3c2a ("UBIFS: add new flash file system")
+Signed-off-by: pangliyuan <pangliyuan1@huawei.com>
+Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/debug.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
+index 992b74f9c9414..b5efbaf7eac2b 100644
+--- a/fs/ubifs/debug.c
++++ b/fs/ubifs/debug.c
+@@ -925,16 +925,20 @@ void ubifs_dump_tnc(struct ubifs_info *c)
+
+ pr_err("\n");
+ pr_err("(pid %d) start dumping TNC tree\n", current->pid);
+- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL);
+- level = znode->level;
+- pr_err("== Level %d ==\n", level);
+- while (znode) {
+- if (level != znode->level) {
+- level = znode->level;
+- pr_err("== Level %d ==\n", level);
++ if (c->zroot.znode) {
++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, NULL);
++ level = znode->level;
++ pr_err("== Level %d ==\n", level);
++ while (znode) {
++ if (level != znode->level) {
++ level = znode->level;
++ pr_err("== Level %d ==\n", level);
++ }
++ ubifs_dump_znode(c, znode);
++ znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode);
+ }
+- ubifs_dump_znode(c, znode);
+- znode = ubifs_tnc_levelorder_next(c, c->zroot.znode, znode);
++ } else {
++ pr_err("empty TNC tree in memory\n");
+ }
+ pr_err("(pid %d) finish dumping TNC tree\n", current->pid);
+ }
+--
+2.39.5
+
--- /dev/null
+From 9fdf794348d20559fcbc2c5dd8cd3ba4bccdc6aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2025 14:15:28 +0100
+Subject: vsock: Allow retrying on connect() failure
+
+From: Michal Luczaj <mhal@rbox.co>
+
+[ Upstream commit aa388c72113b7458127b709bdd7d3628af26e9b4 ]
+
+sk_err is set when a (connectible) connect() fails. Effectively, this makes
+an otherwise still healthy SS_UNCONNECTED socket impossible to use for any
+subsequent connection attempts.
+
+Clear sk_err upon trying to establish a connection.
+
+Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
+Signed-off-by: Michal Luczaj <mhal@rbox.co>
+Link: https://patch.msgid.link/20250128-vsock-transport-vs-autobind-v3-2-1cf57065b770@rbox.co
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 4cd65a1a07f97..5d490633a7f11 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1185,6 +1185,11 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
+ if (err < 0)
+ goto out;
+
++ /* sk_err might have been set as a result of an earlier
++ * (failed) connect attempt.
++ */
++ sk->sk_err = 0;
++
+ /* Mark sock as connecting and set the error code to in
+ * progress in case this is a non-blocking connect.
+ */
+--
+2.39.5
+
--- /dev/null
+From 1d538fc0b3733ce833b11f958ed50044664d0a4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:18 -0300
+Subject: wifi: rtlwifi: do not complete firmware loading needlessly
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit e73e11d303940119e41850a0452a0deda2cc4eb5 ]
+
+The only code waiting for completion is driver removal, which will not be
+called when probe returns a failure. So this completion is unnecessary.
+
+Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-2-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 1 -
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 1c77b3b2173c8..a31d013d8815a 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -2282,7 +2282,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
+
+ pci_release_regions(pdev);
+- complete(&rtlpriv->firmware_loading_complete);
+
+ fail1:
+ if (hw)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index fc1548ad434f6..b5b95ec1231e0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1083,7 +1083,6 @@ int rtl_usb_probe(struct usb_interface *intf,
+ error_out2:
+ _rtl_usb_io_handler_release(hw);
+ usb_put_dev(udev);
+- complete(&rtlpriv->firmware_loading_complete);
+ kfree(rtlpriv->usb_data);
+ return -ENODEV;
+ }
+--
+2.39.5
+
--- /dev/null
+From ce68a255d111f8f56ea34ce99d4cf534a46d0e47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 14:37:12 -0300
+Subject: wifi: rtlwifi: fix memory leaks and invalid access at probe error
+ path
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit e7ceefbfd8d447abc8aca8ab993a942803522c06 ]
+
+Deinitialize at reverse order when probe fails.
+
+When init_sw_vars fails, rtl_deinit_core should not be called, specially
+now that it destroys the rtl_wq workqueue.
+
+And call rtl_pci_deinit and deinit_sw_vars, otherwise, memory will be
+leaked.
+
+Remove pci_set_drvdata call as it will already be cleaned up by the core
+driver code and could lead to memory leaks too. cf. commit 8d450935ae7f
+("wireless: rtlwifi: remove unnecessary pci_set_drvdata()") and
+commit 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory").
+
+Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241206173713.3222187-4-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index c4abfc0cab53c..4d01996c9df5e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -2177,7 +2177,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+ pr_err("Can't init_sw_vars\n");
+ err = -ENODEV;
+- goto fail3;
++ goto fail2;
+ }
+ rtlpriv->cfg->ops->init_sw_leds(hw);
+
+@@ -2195,14 +2195,14 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ err = rtl_pci_init(hw, pdev);
+ if (err) {
+ pr_err("Failed to init PCI\n");
+- goto fail3;
++ goto fail4;
+ }
+
+ err = ieee80211_register_hw(hw);
+ if (err) {
+ pr_err("Can't register mac80211 hw.\n");
+ err = -ENODEV;
+- goto fail3;
++ goto fail5;
+ }
+ rtlpriv->mac80211.mac80211_registered = 1;
+
+@@ -2225,9 +2225,12 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
+ return 0;
+
+-fail3:
+- pci_set_drvdata(pdev, NULL);
++fail5:
++ rtl_pci_deinit(hw);
++fail4:
+ rtl_deinit_core(hw);
++fail3:
++ rtlpriv->cfg->ops->deinit_sw_vars(hw);
+
+ fail2:
+ if (rtlpriv->io.pci_mem_start != 0)
+--
+2.39.5
+
--- /dev/null
+From 0798cd753398b2905e49db7cdfa07d6bf1bfd63f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 14:37:13 -0300
+Subject: wifi: rtlwifi: pci: wait for firmware loading before releasing memory
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit b59b86c5d08be7d761c04affcbcec8184738c200 ]
+
+At probe error path, the firmware loading work may have already been
+queued. In such a case, it will try to access memory allocated by the probe
+function, which is about to be released. In such paths, wait for the
+firmware worker to finish before releasing memory.
+
+Fixes: 3d86b93064c7 ("rtlwifi: Fix PCI probe error path orphaned memory")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241206173713.3222187-5-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 4d01996c9df5e..b16b1f1fb1e05 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -2230,6 +2230,7 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ fail4:
+ rtl_deinit_core(hw);
+ fail3:
++ wait_for_completion(&rtlpriv->firmware_loading_complete);
+ rtlpriv->cfg->ops->deinit_sw_vars(hw);
+
+ fail2:
+--
+2.39.5
+
--- /dev/null
+From 9de8438f546ab5f852d2819ca5150f4536f8afd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2024 14:37:10 -0300
+Subject: wifi: rtlwifi: remove unused check_buddy_priv
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 2fdac64c3c35858aa8ac5caa70b232e03456e120 ]
+
+Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global
+list of private data structures.
+
+Later on, commit 26634c4b1868 ("rtlwifi Modify existing bits to match
+vendor version 2013.02.07") started adding the private data to that list at
+probe time and added a hook, check_buddy_priv to find the private data from
+a similar device.
+
+However, that function was never used.
+
+Besides, though there is a lock for that list, it is never used. And when
+the probe fails, the private data is never removed from the list. This
+would cause a second probe to access freed memory.
+
+Remove the unused hook, structures and members, which will prevent the
+potential race condition on the list and its corruption during a second
+probe when probe fails.
+
+Fixes: 26634c4b1868 ("rtlwifi Modify existing bits to match vendor version 2013.02.07")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241206173713.3222187-2-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 7 ----
+ drivers/net/wireless/realtek/rtlwifi/base.h | 1 -
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 44 ---------------------
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 12 ------
+ 4 files changed, 64 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 3c844d7ba2bef..c98aeb1b824d1 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -2722,9 +2722,6 @@ MODULE_AUTHOR("Larry Finger <Larry.FInger@lwfinger.net>");
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("Realtek 802.11n PCI wireless core");
+
+-struct rtl_global_var rtl_global_var = {};
+-EXPORT_SYMBOL_GPL(rtl_global_var);
+-
+ static int __init rtl_core_module_init(void)
+ {
+ BUILD_BUG_ON(TX_PWR_BY_RATE_NUM_RATE < TX_PWR_BY_RATE_NUM_SECTION);
+@@ -2738,10 +2735,6 @@ static int __init rtl_core_module_init(void)
+ /* add debugfs */
+ rtl_debugfs_add_topdir();
+
+- /* init some global vars */
+- INIT_LIST_HEAD(&rtl_global_var.glb_priv_list);
+- spin_lock_init(&rtl_global_var.glb_list_lock);
+-
+ return 0;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
+index 1eccdf9d62a66..f24908642ea9c 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.h
++++ b/drivers/net/wireless/realtek/rtlwifi/base.h
+@@ -127,7 +127,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw,
+ u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie);
+ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
+ u8 rtl_tid_to_ac(u8 tid);
+-extern struct rtl_global_var rtl_global_var;
+ void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation);
+
+ #endif
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 9ddd7bd6ee150..c4abfc0cab53c 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -295,46 +295,6 @@ static bool rtl_pci_get_amd_l1_patch(struct ieee80211_hw *hw)
+ return status;
+ }
+
+-static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+- struct rtl_priv **buddy_priv)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
+- struct rtl_priv *tpriv = NULL, *iter;
+- struct rtl_pci_priv *tpcipriv = NULL;
+-
+- if (!list_empty(&rtlpriv->glb_var->glb_priv_list)) {
+- list_for_each_entry(iter, &rtlpriv->glb_var->glb_priv_list,
+- list) {
+- tpcipriv = (struct rtl_pci_priv *)iter->priv;
+- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "pcipriv->ndis_adapter.funcnumber %x\n",
+- pcipriv->ndis_adapter.funcnumber);
+- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "tpcipriv->ndis_adapter.funcnumber %x\n",
+- tpcipriv->ndis_adapter.funcnumber);
+-
+- if (pcipriv->ndis_adapter.busnumber ==
+- tpcipriv->ndis_adapter.busnumber &&
+- pcipriv->ndis_adapter.devnumber ==
+- tpcipriv->ndis_adapter.devnumber &&
+- pcipriv->ndis_adapter.funcnumber !=
+- tpcipriv->ndis_adapter.funcnumber) {
+- tpriv = iter;
+- break;
+- }
+- }
+- }
+-
+- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
+- "find_buddy_priv %d\n", tpriv != NULL);
+-
+- if (tpriv)
+- *buddy_priv = tpriv;
+-
+- return tpriv != NULL;
+-}
+-
+ static void rtl_pci_parse_configuration(struct pci_dev *pdev,
+ struct ieee80211_hw *hw)
+ {
+@@ -2021,7 +1981,6 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ pcipriv->ndis_adapter.amd_l1_patch);
+
+ rtl_pci_parse_configuration(pdev, hw);
+- list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list);
+
+ return true;
+ }
+@@ -2168,7 +2127,6 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ rtlpriv->rtlhal.interface = INTF_PCI;
+ rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_data);
+ rtlpriv->intf_ops = &rtl_pci_ops;
+- rtlpriv->glb_var = &rtl_global_var;
+ rtl_efuse_ops_init(hw);
+
+ /* MEM map */
+@@ -2326,7 +2284,6 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
+ if (rtlpci->using_msi)
+ pci_disable_msi(rtlpci->pdev);
+
+- list_del(&rtlpriv->list);
+ if (rtlpriv->io.pci_mem_start != 0) {
+ pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start);
+ pci_release_regions(pdev);
+@@ -2386,7 +2343,6 @@ const struct rtl_intf_ops rtl_pci_ops = {
+ .read_efuse_byte = read_efuse_byte,
+ .adapter_start = rtl_pci_start,
+ .adapter_stop = rtl_pci_stop,
+- .check_buddy_priv = rtl_pci_check_buddy_priv,
+ .adapter_tx = rtl_pci_tx,
+ .flush = rtl_pci_flush,
+ .reset_trx_ring = rtl_pci_reset_trx_ring,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index 99860f1547653..0dbe442d6c3e4 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -2337,8 +2337,6 @@ struct rtl_intf_ops {
+ void (*read_efuse_byte)(struct ieee80211_hw *hw, u16 _offset, u8 *pbuf);
+ int (*adapter_start)(struct ieee80211_hw *hw);
+ void (*adapter_stop)(struct ieee80211_hw *hw);
+- bool (*check_buddy_priv)(struct ieee80211_hw *hw,
+- struct rtl_priv **buddy_priv);
+
+ int (*adapter_tx)(struct ieee80211_hw *hw,
+ struct ieee80211_sta *sta,
+@@ -2582,14 +2580,6 @@ struct dig_t {
+ u32 rssi_max;
+ };
+
+-struct rtl_global_var {
+- /* from this list we can get
+- * other adapter's rtl_priv
+- */
+- struct list_head glb_priv_list;
+- spinlock_t glb_list_lock;
+-};
+-
+ #define IN_4WAY_TIMEOUT_TIME (30 * MSEC_PER_SEC) /* 30 seconds */
+
+ struct rtl_btc_info {
+@@ -2735,9 +2725,7 @@ struct rtl_scan_list {
+ struct rtl_priv {
+ struct ieee80211_hw *hw;
+ struct completion firmware_loading_complete;
+- struct list_head list;
+ struct rtl_priv *buddy_priv;
+- struct rtl_global_var *glb_var;
+ struct rtl_dmsp_ctl dmsp_ctl;
+ struct rtl_locks locks;
+ struct rtl_works works;
+--
+2.39.5
+
--- /dev/null
+From 775768b4fa3e274166bc1975dfcc3a4fe50b8578 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 09:59:40 +0300
+Subject: wifi: rtlwifi: remove unused dualmac control leftovers
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 557123259200b30863e1b6a8f24a8c8060b6fc1d ]
+
+Remove 'struct rtl_dualmac_easy_concurrent_ctl' of 'struct rtl_priv'
+and related code in '_rtl_pci_tx_chk_waitq()'.
+
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230602065940.149198-2-dmantipov@yandex.ru
+Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 5 -----
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 9 ---------
+ 2 files changed, 14 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index f8e34ae09a800..9ddd7bd6ee150 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -443,11 +443,6 @@ static void _rtl_pci_tx_chk_waitq(struct ieee80211_hw *hw)
+ if (!rtlpriv->rtlhal.earlymode_enable)
+ return;
+
+- if (rtlpriv->dm.supp_phymode_switch &&
+- (rtlpriv->easy_concurrent_ctl.switch_in_process ||
+- (rtlpriv->buddy_priv &&
+- rtlpriv->buddy_priv->easy_concurrent_ctl.switch_in_process)))
+- return;
+ /* we just use em for BE/BK/VI/VO */
+ for (tid = 7; tid >= 0; tid--) {
+ u8 hw_queue = ac_to_hwq[rtl_tid_to_ac(tid)];
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index eebbd01256415..99860f1547653 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -2498,14 +2498,6 @@ struct rtl_debug {
+ #define MIMO_PS_DYNAMIC 1
+ #define MIMO_PS_NOLIMIT 3
+
+-struct rtl_dualmac_easy_concurrent_ctl {
+- enum band_type currentbandtype_backfordmdp;
+- bool close_bbandrf_for_dmsp;
+- bool change_to_dmdp;
+- bool change_to_dmsp;
+- bool switch_in_process;
+-};
+-
+ struct rtl_dmsp_ctl {
+ bool activescan_for_slaveofdmsp;
+ bool scan_for_anothermac_fordmsp;
+@@ -2746,7 +2738,6 @@ struct rtl_priv {
+ struct list_head list;
+ struct rtl_priv *buddy_priv;
+ struct rtl_global_var *glb_var;
+- struct rtl_dualmac_easy_concurrent_ctl easy_concurrent_ctl;
+ struct rtl_dmsp_ctl dmsp_ctl;
+ struct rtl_locks locks;
+ struct rtl_works works;
+--
+2.39.5
+
--- /dev/null
+From 79043426ec7419378694dffcbf8c69956538423b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 09:59:39 +0300
+Subject: wifi: rtlwifi: remove unused timer and related code
+
+From: Dmitry Antipov <dmantipov@yandex.ru>
+
+[ Upstream commit 358b94f0a7cadd2ec7824531d54dadaa8b71de04 ]
+
+Drop unused 'dualmac_easyconcurrent_retrytimer' of 'struct rtl_works',
+corresponding 'rtl_easy_concurrent_retrytimer_callback()' handler,
+'dualmac_easy_concurrent' function pointer of 'struct rtl_hal_ops'
+and related call to 'timer_setup()' in '_rtl_init_deferred_work()'.
+
+Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230602065940.149198-1-dmantipov@yandex.ru
+Stable-dep-of: 2fdac64c3c35 ("wifi: rtlwifi: remove unused check_buddy_priv")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 16 +---------------
+ drivers/net/wireless/realtek/rtlwifi/base.h | 1 -
+ drivers/net/wireless/realtek/rtlwifi/wifi.h | 2 --
+ 3 files changed, 1 insertion(+), 18 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 5898109b1c3e8..3c844d7ba2bef 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -448,8 +448,7 @@ static int _rtl_init_deferred_work(struct ieee80211_hw *hw)
+ /* <1> timer */
+ timer_setup(&rtlpriv->works.watchdog_timer,
+ rtl_watch_dog_timer_callback, 0);
+- timer_setup(&rtlpriv->works.dualmac_easyconcurrent_retrytimer,
+- rtl_easy_concurrent_retrytimer_callback, 0);
++
+ /* <2> work queue */
+ rtlpriv->works.hw = hw;
+ rtlpriv->works.rtl_wq = wq;
+@@ -2378,19 +2377,6 @@ void rtl_c2hcmd_wq_callback(void *data)
+ rtl_c2hcmd_launcher(hw, 1);
+ }
+
+-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t)
+-{
+- struct rtl_priv *rtlpriv =
+- from_timer(rtlpriv, t, works.dualmac_easyconcurrent_retrytimer);
+- struct ieee80211_hw *hw = rtlpriv->hw;
+- struct rtl_priv *buddy_priv = rtlpriv->buddy_priv;
+-
+- if (buddy_priv == NULL)
+- return;
+-
+- rtlpriv->cfg->ops->dualmac_easy_concurrent(hw);
+-}
+-
+ /*********************************************************
+ *
+ * frame process functions
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h
+index e4a7e074ae3ff..1eccdf9d62a66 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.h
++++ b/drivers/net/wireless/realtek/rtlwifi/base.h
+@@ -127,7 +127,6 @@ int rtl_send_smps_action(struct ieee80211_hw *hw,
+ u8 *rtl_find_ie(u8 *data, unsigned int len, u8 ie);
+ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len);
+ u8 rtl_tid_to_ac(u8 tid);
+-void rtl_easy_concurrent_retrytimer_callback(struct timer_list *t);
+ extern struct rtl_global_var rtl_global_var;
+ void rtl_phy_scan_operation_backup(struct ieee80211_hw *hw, u8 operation);
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+index abec9ceabe285..eebbd01256415 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
+@@ -2302,7 +2302,6 @@ struct rtl_hal_ops {
+ u32 regaddr, u32 bitmask, u32 data);
+ void (*linked_set_reg)(struct ieee80211_hw *hw);
+ void (*chk_switch_dmdp)(struct ieee80211_hw *hw);
+- void (*dualmac_easy_concurrent)(struct ieee80211_hw *hw);
+ void (*dualmac_switch_to_dmdp)(struct ieee80211_hw *hw);
+ bool (*phy_rf6052_config)(struct ieee80211_hw *hw);
+ void (*phy_rf6052_set_cck_txpower)(struct ieee80211_hw *hw,
+@@ -2468,7 +2467,6 @@ struct rtl_works {
+
+ /*timer */
+ struct timer_list watchdog_timer;
+- struct timer_list dualmac_easyconcurrent_retrytimer;
+ struct timer_list fw_clockoff_timer;
+ struct timer_list fast_antenna_training_timer;
+ /*task */
+--
+2.39.5
+
--- /dev/null
+From 964f504606e873e65c7e017c47fb364fa0123a18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:19 -0300
+Subject: wifi: rtlwifi: rtl8192se: rise completion of firmware loading as last
+ step
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit 8559a9e0c457729fe3edb3176bbf7c7874f482b0 ]
+
+Just like in commit 4dfde294b979 ("rtlwifi: rise completion at the last
+step of firmware callback"), only signal completion once the function is
+finished. Otherwise, the module removal waiting for the completion could
+free the memory that the callback will still use before returning.
+
+Fixes: b0302aba812b ("rtlwifi: Convert to asynchronous firmware load")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-3-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+index 4c4a1201d420f..78547e4035dc6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/sw.c
+@@ -68,22 +68,23 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
+
+ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
+ "Firmware callback routine entered!\n");
+- complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
+ pr_err("Firmware %s not available\n", fw_name);
+ rtlpriv->max_fw_size = 0;
+- return;
++ goto exit;
+ }
+ if (firmware->size > rtlpriv->max_fw_size) {
+ pr_err("Firmware is too big!\n");
+ rtlpriv->max_fw_size = 0;
+ release_firmware(firmware);
+- return;
++ goto exit;
+ }
+ pfirmware = (struct rt_firmware *)rtlpriv->rtlhal.pfirmware;
+ memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size);
+ pfirmware->sz_fw_tmpbufferlen = firmware->size;
+ release_firmware(firmware);
++exit:
++ complete(&rtlpriv->firmware_loading_complete);
+ }
+
+ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
+--
+2.39.5
+
--- /dev/null
+From 0e89ad2619dd78ad64c3f7f475f6d3b1cebe93b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2024 10:33:22 -0300
+Subject: wifi: rtlwifi: usb: fix workqueue leak when probe fails
+
+From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+
+[ Upstream commit f79bc5c67867c19ce2762e7934c20dbb835ed82c ]
+
+rtl_init_core creates a workqueue that is then assigned to rtl_wq.
+rtl_deinit_core does not destroy it. It is left to rtl_usb_deinit, which
+must be called in the probe error path.
+
+Fixes: 2ca20f79e0d8 ("rtlwifi: Add usb driver")
+Fixes: 851639fdaeac ("rtlwifi: Modify some USB de-initialize code.")
+Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241107133322.855112-6-cascardo@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index b5b95ec1231e0..9e31ce0a9f562 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1079,6 +1079,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+ return 0;
+
+ error_out:
++ rtl_usb_deinit(hw);
+ rtl_deinit_core(hw);
+ error_out2:
+ _rtl_usb_io_handler_release(hw);
+--
+2.39.5
+
--- /dev/null
+From ad61ed223ef2184a0acd8213ae5ba338970f6474 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2025 20:55:07 +0100
+Subject: wifi: wlcore: fix unbalanced pm_runtime calls
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 996c934c8c196144af386c4385f61fcd5349af28 ]
+
+If firmware boot failes, runtime pm is put too often:
+[12092.708099] wlcore: ERROR firmware boot failed despite 3 retries
+[12092.708099] wl18xx_driver wl18xx.1.auto: Runtime PM usage count underflow!
+Fix that by redirecting all error gotos before runtime_get so that runtime is
+not put.
+
+Fixes: c40aad28a3cf ("wlcore: Make sure firmware is initialized in wl1271_op_add_interface()")
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Reviewed-by: Michael Nemanov <michael.nemanov@ti.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://patch.msgid.link/20250104195507.402673-1-akemnade@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ti/wlcore/main.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index be0ed19f93569..5af0f0fdecda1 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -2546,24 +2546,24 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
+ if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags) ||
+ test_bit(WLVIF_FLAG_INITIALIZED, &wlvif->flags)) {
+ ret = -EBUSY;
+- goto out;
++ goto out_unlock;
+ }
+
+
+ ret = wl12xx_init_vif_data(wl, vif);
+ if (ret < 0)
+- goto out;
++ goto out_unlock;
+
+ wlvif->wl = wl;
+ role_type = wl12xx_get_role_type(wl, wlvif);
+ if (role_type == WL12XX_INVALID_ROLE_TYPE) {
+ ret = -EINVAL;
+- goto out;
++ goto out_unlock;
+ }
+
+ ret = wlcore_allocate_hw_queue_base(wl, wlvif);
+ if (ret < 0)
+- goto out;
++ goto out_unlock;
+
+ /*
+ * TODO: after the nvs issue will be solved, move this block
+@@ -2578,7 +2578,7 @@ static int wl1271_op_add_interface(struct ieee80211_hw *hw,
+
+ ret = wl12xx_init_fw(wl);
+ if (ret < 0)
+- goto out;
++ goto out_unlock;
+ }
+
+ /*
+--
+2.39.5
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
