--- /dev/null
+From 8fec0db0d424a1692195625f80161a56f03366c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:51 +0530
+Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address
+(0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 59527bb1225a9..cb90e7645d08c 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -387,8 +387,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>,
+- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>;
++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>,
++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From 4d59e512fe465fc97628b2019e3f503e33649f01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:01:48 +0530
+Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ]
+
+Currently only the first attempt to single-step has any effect. After
+that all further stepping remains "stuck" at the same program counter
+value.
+
+Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12,
+PSTATE.SS=1 should be set at each step before transferring the PE to the
+'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set
+since the second single-step.
+
+After the first single-step, the PE transferes to the 'Inactive' state,
+with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to
+kernel_active_single_step()=true. Then the PE transferes to the
+'Active-pending' state when ERET and returns to the debugger by step
+exception.
+
+Before this patch:
+==================
+Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb>
+
+[0]kdb>
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger)
+ is enabled addr at ffffa45c13d09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb>
+
+After this patch:
+=================
+Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger)
+ is enabled addr at ffffc02d2dd09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c
+[1]kdb>
+
+Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support")
+Co-developed-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/debug-monitors.h | 1 +
+ arch/arm64/kernel/debug-monitors.c | 5 +++++
+ arch/arm64/kernel/kgdb.c | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
+index 41b065f1be88c..13630e8078ff4 100644
+--- a/arch/arm64/include/asm/debug-monitors.h
++++ b/arch/arm64/include/asm/debug-monitors.h
+@@ -125,6 +125,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs,
+ void kernel_enable_single_step(struct pt_regs *regs);
+ void kernel_disable_single_step(void);
+ int kernel_active_single_step(void);
++void kernel_rewind_single_step(struct pt_regs *regs);
+
+ #ifdef CONFIG_HAVE_HW_BREAKPOINT
+ int reinstall_suspended_bps(struct pt_regs *regs);
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 501e835c65007..f5837937cd932 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -437,6 +437,11 @@ int kernel_active_single_step(void)
+ }
+ NOKPROBE_SYMBOL(kernel_active_single_step);
+
++void kernel_rewind_single_step(struct pt_regs *regs)
++{
++ set_regs_spsr_ss(regs);
++}
++
+ /* ptrace API */
+ void user_enable_single_step(struct task_struct *task)
+ {
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index 8815b5457dd0b..d7847ef10e9d3 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -234,6 +234,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
+ */
+ if (!kernel_active_single_step())
+ kernel_enable_single_step(linux_regs);
++ else
++ kernel_rewind_single_step(linux_regs);
+ err = 0;
+ break;
+ default:
+--
+2.39.2
+
--- /dev/null
+From 930d09bc28154ab4b16592a2810092d7c37cc89e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 14:21:15 +0100
+Subject: bpftool: Fix bug for long instructions in program CFG dumps
+
+From: Quentin Monnet <quentin@isovalent.com>
+
+[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ]
+
+When dumping the control flow graphs for programs using the 16-byte long
+load instruction, we need to skip the second part of this instruction
+when looking for the next instruction to process. Otherwise, we end up
+printing "BUG_ld_00" from the kernel disassembler in the CFG.
+
+Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information")
+Signed-off-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/xlated_dumper.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
+index 3284759df98ad..7f49347bf5aa4 100644
+--- a/tools/bpf/bpftool/xlated_dumper.c
++++ b/tools/bpf/bpftool/xlated_dumper.c
+@@ -336,8 +336,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
+ struct bpf_insn *insn_start = buf_start;
+ struct bpf_insn *insn_end = buf_end;
+ struct bpf_insn *cur = insn_start;
++ bool double_insn = false;
+
+ for (; cur <= insn_end; cur++) {
++ if (double_insn) {
++ double_insn = false;
++ continue;
++ }
++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW);
++
+ printf("% 4d: ", (int)(cur - insn_start + start_idx));
+ print_bpf_insn(&cbs, cur, true);
+ if (cur != insn_end)
+--
+2.39.2
+
--- /dev/null
+From 21e7b221568642f754e77f66cb24bf4bd818b381 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 09:32:27 +0100
+Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <clement.leger@bootlin.com>
+
+[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ]
+
+When returning from of_parse_phandle_with_args(), the np member of the
+of_phandle_args structure should be put after usage. Add missing
+of_node_put() calls in both __set_clk_parents() and __set_clk_rates().
+
+Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree")
+Signed-off-by: Clément Léger <clement.leger@bootlin.com>
+Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-conf.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c
+index 49819b546134b..5c6760e45a16e 100644
+--- a/drivers/clk/clk-conf.c
++++ b/drivers/clk/clk-conf.c
+@@ -36,9 +36,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+ pclk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(pclk)) {
+ if (PTR_ERR(pclk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get parent clock %d for %pOF\n",
+@@ -51,10 +54,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ if (rc < 0)
+ goto err;
+ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ rc = 0;
+ goto err;
+ }
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get assigned clock %d for %pOF\n",
+@@ -96,10 +101,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get clock %d for %pOF\n",
+--
+2.39.2
+
--- /dev/null
+From a36e55872d449f1c0fe502630c33bcfa8ece7236 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Nov 2021 15:18:08 +0100
+Subject: crypto: drbg - make drbg_prepare_hrng() handle jent instantiation
+ errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nicolai Stange <nstange@suse.de>
+
+[ Upstream commit 559edd47cce4cc407d606b4d7f376822816fd4b8 ]
+
+Now that drbg_prepare_hrng() doesn't do anything but to instantiate a
+jitterentropy crypto_rng instance, it looks a little odd to have the
+related error handling at its only caller, drbg_instantiate().
+
+Move the handling of jitterentropy allocation failures from
+drbg_instantiate() close to the allocation itself in drbg_prepare_hrng().
+
+There is no change in behaviour.
+
+Signed-off-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Stephan Müller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 686cd976b6dd ("crypto: drbg - Only fail when jent is unavailable in FIPS mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/drbg.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index c8c56763dfded..8b80fd3690ff4 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1512,6 +1512,14 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ return 0;
+
+ drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
++ if (IS_ERR(drbg->jent)) {
++ const int err = PTR_ERR(drbg->jent);
++
++ drbg->jent = NULL;
++ if (fips_enabled || err != -ENOENT)
++ return err;
++ pr_info("DRBG: Continuing without Jitter RNG\n");
++ }
+
+ return 0;
+ }
+@@ -1567,14 +1575,6 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
+ if (ret)
+ goto free_everything;
+
+- if (IS_ERR(drbg->jent)) {
+- ret = PTR_ERR(drbg->jent);
+- drbg->jent = NULL;
+- if (fips_enabled || ret != -ENOENT)
+- goto free_everything;
+- pr_info("DRBG: Continuing without Jitter RNG\n");
+- }
+-
+ reseed = false;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 188f197057c27c123b49f32c05a32f1446cfdcdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 11:35:23 +0800
+Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ]
+
+When jent initialisation fails for any reason other than ENOENT,
+the entire drbg fails to initialise, even when we're not in FIPS
+mode. This is wrong because we can still use the kernel RNG when
+we're not in FIPS mode.
+
+Change it so that it only fails when we are in FIPS mode.
+
+Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/drbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index 8b80fd3690ff4..0df8cc9bb5637 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1516,7 +1516,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ const int err = PTR_ERR(drbg->jent);
+
+ drbg->jent = NULL;
+- if (fips_enabled || err != -ENOENT)
++ if (fips_enabled)
+ return err;
+ pr_info("DRBG: Continuing without Jitter RNG\n");
+ }
+--
+2.39.2
+
--- /dev/null
+From 4e89fd036a8f2994dff7af89610eaab9059b2286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 09:54:39 +0200
+Subject: debugobject: Prevent init race with static objects
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ]
+
+Statically initialized objects are usually not initialized via the init()
+function of the subsystem. They are special cased and the subsystem
+provides a function to validate whether an object which is not yet tracked
+by debugobjects is statically initialized. This means the object is started
+to be tracked on first use, e.g. activation.
+
+This works perfectly fine, unless there are two concurrent operations on
+that object. Schspa decoded the problem:
+
+T0 T1
+
+debug_object_assert_init(addr)
+ lock_hash_bucket()
+ obj = lookup_object(addr);
+ if (!obj) {
+ unlock_hash_bucket();
+ - > preemption
+ lock_subsytem_object(addr);
+ activate_object(addr)
+ lock_hash_bucket();
+ obj = lookup_object(addr);
+ if (!obj) {
+ unlock_hash_bucket();
+ if (is_static_object(addr))
+ init_and_track(addr);
+ lock_hash_bucket();
+ obj = lookup_object(addr);
+ obj->state = ACTIVATED;
+ unlock_hash_bucket();
+
+ subsys function modifies content of addr,
+ so static object detection does
+ not longer work.
+
+ unlock_subsytem_object(addr);
+
+ if (is_static_object(addr)) <- Fails
+
+ debugobject emits a warning and invokes the fixup function which
+ reinitializes the already active object in the worst case.
+
+This race exists forever, but was never observed until mod_timer() got a
+debug_object_assert_init() added which is outside of the timer base lock
+held section right at the beginning of the function to cover the lockless
+early exit points too.
+
+Rework the code so that the lookup, the static object check and the
+tracking object association happens atomically under the hash bucket
+lock. This prevents the issue completely as all callers are serialized on
+the hash bucket lock and therefore cannot observe inconsistent state.
+
+Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects")
+Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com
+Debugged-by: Schspa Shi <schspa@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462
+Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com
+Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 125 ++++++++++++++++++++++++---------------------
+ 1 file changed, 66 insertions(+), 59 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 6909a6e51de83..2315a75c45c3b 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -196,10 +196,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list)
+ return obj;
+ }
+
+-/*
+- * Allocate a new object. If the pool is empty, switch off the debugger.
+- * Must be called with interrupts disabled.
+- */
+ static struct debug_obj *
+ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ {
+@@ -425,11 +421,49 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ WARN_ON(1);
+ }
+
++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b,
++ struct debug_obj_descr *descr,
++ bool onstack, bool alloc_ifstatic)
++{
++ struct debug_obj *obj = lookup_object(addr, b);
++ enum debug_obj_state state = ODEBUG_STATE_NONE;
++
++ if (likely(obj))
++ return obj;
++
++ /*
++ * debug_object_init() unconditionally allocates untracked
++ * objects. It does not matter whether it is a static object or
++ * not.
++ *
++ * debug_object_assert_init() and debug_object_activate() allow
++ * allocation only if the descriptor callback confirms that the
++ * object is static and considered initialized. For non-static
++ * objects the allocation needs to be done from the fixup callback.
++ */
++ if (unlikely(alloc_ifstatic)) {
++ if (!descr->is_static_object || !descr->is_static_object(addr))
++ return ERR_PTR(-ENOENT);
++ /* Statically allocated objects are considered initialized */
++ state = ODEBUG_STATE_INIT;
++ }
++
++ obj = alloc_object(addr, b, descr);
++ if (likely(obj)) {
++ obj->state = state;
++ debug_object_is_on_stack(addr, onstack);
++ return obj;
++ }
++
++ /* Out of memory. Do the cleanup outside of the locked region */
++ debug_objects_enabled = 0;
++ return NULL;
++}
++
+ static void
+ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ {
+ enum debug_obj_state state;
+- bool check_stack = false;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -440,16 +474,11 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (!obj) {
+- obj = alloc_object(addr, db, descr);
+- if (!obj) {
+- debug_objects_enabled = 0;
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- debug_objects_oom();
+- return;
+- }
+- check_stack = true;
++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false);
++ if (unlikely(!obj)) {
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_objects_oom();
++ return;
+ }
+
+ switch (obj->state) {
+@@ -475,8 +504,6 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ }
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
+- if (check_stack)
+- debug_object_is_on_stack(addr, onstack);
+ }
+
+ /**
+@@ -516,14 +543,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);
+ */
+ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ enum debug_obj_state state;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+ int ret;
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+
+ if (!debug_objects_enabled)
+ return 0;
+@@ -532,8 +557,8 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (obj) {
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ if (likely(!IS_ERR_OR_NULL(obj))) {
+ bool print_object = false;
+
+ switch (obj->state) {
+@@ -566,24 +591,16 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
+
+- /*
+- * We are here when a static object is activated. We
+- * let the type specific code confirm whether this is
+- * true or not. if true, we just make sure that the
+- * static object is tracked in the object tracker. If
+- * not, this must be a bug, so we try to fix it up.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* track this static object */
+- debug_object_init(addr, descr);
+- debug_object_activate(addr, descr);
+- } else {
+- debug_print_object(&o, "activate");
+- ret = debug_object_fixup(descr->fixup_activate, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- return ret ? 0 : -EINVAL;
++ /* If NULL the allocation has hit OOM */
++ if (!obj) {
++ debug_objects_oom();
++ return 0;
+ }
+- return 0;
++
++ /* Object is neither static nor tracked. It's not initialized */
++ debug_print_object(&o, "activate");
++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE);
++ return ret ? 0 : -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(debug_object_activate);
+
+@@ -737,6 +754,7 @@ EXPORT_SYMBOL_GPL(debug_object_free);
+ */
+ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -747,31 +765,20 @@ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr)
+ db = get_bucket((unsigned long) addr);
+
+ raw_spin_lock_irqsave(&db->lock, flags);
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (likely(!IS_ERR_OR_NULL(obj)))
++ return;
+
+- obj = lookup_object(addr, db);
++ /* If NULL the allocation has hit OOM */
+ if (!obj) {
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- /*
+- * Maybe the object is static, and we let the type specific
+- * code confirm. Track this static object if true, else invoke
+- * fixup.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* Track this static object */
+- debug_object_init(addr, descr);
+- } else {
+- debug_print_object(&o, "assert_init");
+- debug_object_fixup(descr->fixup_assert_init, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- }
++ debug_objects_oom();
+ return;
+ }
+
+- raw_spin_unlock_irqrestore(&db->lock, flags);
++ /* Object is neither tracked nor static. It's not initialized. */
++ debug_print_object(&o, "assert_init");
++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_assert_init);
+
+--
+2.39.2
+
--- /dev/null
+From a1cc2da0b7dcfc906e931eb03f62a7c4bbff1beb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2019 10:14:46 -0400
+Subject: debugobjects: Add percpu free pools
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit d86998b17a01050c0232231fa481e65ef8171ca6 ]
+
+When a multi-threaded workload does a lot of small memory object
+allocations and deallocations, it may cause the allocation and freeing of
+many debug objects. This will make the global pool_lock a bottleneck in the
+performance of the workload. Since interrupts are disabled when acquiring
+the pool_lock, it may even cause hard lockups to happen.
+
+To reduce contention of the global pool_lock, add a percpu debug object
+free pool that can be used to buffer some of the debug object allocation
+and freeing requests without acquiring the pool_lock. Each CPU will now
+have a percpu free pool that can hold up to a maximum of 64 debug
+objects. Allocation and freeing requests will go to the percpu free pool
+first. If that fails, the pool_lock will be taken and the global free pool
+will be used.
+
+The presence or absence of obj_cache is used as a marker to see if the
+percpu cache should be used.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Yang Shi <yang.shi@linux.alibaba.com>
+Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
+Cc: Qian Cai <cai@gmx.us>
+Cc: Zhong Jiang <zhongjiang@huawei.com>
+Link: https://lkml.kernel.org/r/20190520141450.7575-2-longman@redhat.com
+Stable-dep-of: 63a759694eed ("debugobject: Prevent init race with static objects")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 115 +++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 91 insertions(+), 24 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 14afeeb7d6ef5..6e2baf9e9eb27 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -25,6 +25,7 @@
+
+ #define ODEBUG_POOL_SIZE 1024
+ #define ODEBUG_POOL_MIN_LEVEL 256
++#define ODEBUG_POOL_PERCPU_SIZE 64
+
+ #define ODEBUG_CHUNK_SHIFT PAGE_SHIFT
+ #define ODEBUG_CHUNK_SIZE (1 << ODEBUG_CHUNK_SHIFT)
+@@ -35,6 +36,17 @@ struct debug_bucket {
+ raw_spinlock_t lock;
+ };
+
++/*
++ * Debug object percpu free list
++ * Access is protected by disabling irq
++ */
++struct debug_percpu_free {
++ struct hlist_head free_objs;
++ int obj_free;
++};
++
++static DEFINE_PER_CPU(struct debug_percpu_free, percpu_obj_pool);
++
+ static struct debug_bucket obj_hash[ODEBUG_HASH_SIZE];
+
+ static struct debug_obj obj_static_pool[ODEBUG_POOL_SIZE] __initdata;
+@@ -44,13 +56,19 @@ static DEFINE_RAW_SPINLOCK(pool_lock);
+ static HLIST_HEAD(obj_pool);
+ static HLIST_HEAD(obj_to_free);
+
++/*
++ * Because of the presence of percpu free pools, obj_pool_free will
++ * under-count those in the percpu free pools. Similarly, obj_pool_used
++ * will over-count those in the percpu free pools. Adjustments will be
++ * made at debug_stats_show(). Both obj_pool_min_free and obj_pool_max_used
++ * can be off.
++ */
+ static int obj_pool_min_free = ODEBUG_POOL_SIZE;
+ static int obj_pool_free = ODEBUG_POOL_SIZE;
+ static int obj_pool_used;
+ static int obj_pool_max_used;
+ /* The number of objs on the global free list */
+ static int obj_nr_tofree;
+-static struct kmem_cache *obj_cache;
+
+ static int debug_objects_maxchain __read_mostly;
+ static int __maybe_unused debug_objects_maxchecked __read_mostly;
+@@ -63,6 +81,7 @@ static int debug_objects_pool_size __read_mostly
+ static int debug_objects_pool_min_level __read_mostly
+ = ODEBUG_POOL_MIN_LEVEL;
+ static struct debug_obj_descr *descr_test __read_mostly;
++static struct kmem_cache *obj_cache __read_mostly;
+
+ /*
+ * Track numbers of kmem_cache_alloc()/free() calls done.
+@@ -162,6 +181,21 @@ static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b)
+ return NULL;
+ }
+
++/*
++ * Allocate a new object from the hlist
++ */
++static struct debug_obj *__alloc_object(struct hlist_head *list)
++{
++ struct debug_obj *obj = NULL;
++
++ if (list->first) {
++ obj = hlist_entry(list->first, typeof(*obj), node);
++ hlist_del(&obj->node);
++ }
++
++ return obj;
++}
++
+ /*
+ * Allocate a new object. If the pool is empty, switch off the debugger.
+ * Must be called with interrupts disabled.
+@@ -169,20 +203,21 @@ static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b)
+ static struct debug_obj *
+ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ {
+- struct debug_obj *obj = NULL;
+-
+- raw_spin_lock(&pool_lock);
+- if (obj_pool.first) {
+- obj = hlist_entry(obj_pool.first, typeof(*obj), node);
+-
+- obj->object = addr;
+- obj->descr = descr;
+- obj->state = ODEBUG_STATE_NONE;
+- obj->astate = 0;
+- hlist_del(&obj->node);
++ struct debug_percpu_free *percpu_pool;
++ struct debug_obj *obj;
+
+- hlist_add_head(&obj->node, &b->list);
++ if (likely(obj_cache)) {
++ percpu_pool = this_cpu_ptr(&percpu_obj_pool);
++ obj = __alloc_object(&percpu_pool->free_objs);
++ if (obj) {
++ percpu_pool->obj_free--;
++ goto init_obj;
++ }
++ }
+
++ raw_spin_lock(&pool_lock);
++ obj = __alloc_object(&obj_pool);
++ if (obj) {
+ obj_pool_used++;
+ if (obj_pool_used > obj_pool_max_used)
+ obj_pool_max_used = obj_pool_used;
+@@ -193,6 +228,14 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ }
+ raw_spin_unlock(&pool_lock);
+
++init_obj:
++ if (obj) {
++ obj->object = addr;
++ obj->descr = descr;
++ obj->state = ODEBUG_STATE_NONE;
++ obj->astate = 0;
++ hlist_add_head(&obj->node, &b->list);
++ }
+ return obj;
+ }
+
+@@ -247,8 +290,21 @@ static bool __free_object(struct debug_obj *obj)
+ {
+ unsigned long flags;
+ bool work;
++ struct debug_percpu_free *percpu_pool;
+
+- raw_spin_lock_irqsave(&pool_lock, flags);
++ local_irq_save(flags);
++ /*
++ * Try to free it into the percpu pool first.
++ */
++ percpu_pool = this_cpu_ptr(&percpu_obj_pool);
++ if (obj_cache && percpu_pool->obj_free < ODEBUG_POOL_PERCPU_SIZE) {
++ hlist_add_head(&obj->node, &percpu_pool->free_objs);
++ percpu_pool->obj_free++;
++ local_irq_restore(flags);
++ return false;
++ }
++
++ raw_spin_lock(&pool_lock);
+ work = (obj_pool_free > debug_objects_pool_size) && obj_cache;
+ obj_pool_used--;
+
+@@ -259,7 +315,8 @@ static bool __free_object(struct debug_obj *obj)
+ obj_pool_free++;
+ hlist_add_head(&obj->node, &obj_pool);
+ }
+- raw_spin_unlock_irqrestore(&pool_lock, flags);
++ raw_spin_unlock(&pool_lock);
++ local_irq_restore(flags);
+ return work;
+ }
+
+@@ -822,13 +879,19 @@ void debug_check_no_obj_freed(const void *address, unsigned long size)
+
+ static int debug_stats_show(struct seq_file *m, void *v)
+ {
++ int cpu, obj_percpu_free = 0;
++
++ for_each_possible_cpu(cpu)
++ obj_percpu_free += per_cpu(percpu_obj_pool.obj_free, cpu);
++
+ seq_printf(m, "max_chain :%d\n", debug_objects_maxchain);
+ seq_printf(m, "max_checked :%d\n", debug_objects_maxchecked);
+ seq_printf(m, "warnings :%d\n", debug_objects_warnings);
+ seq_printf(m, "fixups :%d\n", debug_objects_fixups);
+- seq_printf(m, "pool_free :%d\n", obj_pool_free);
++ seq_printf(m, "pool_free :%d\n", obj_pool_free + obj_percpu_free);
++ seq_printf(m, "pool_pcp_free :%d\n", obj_percpu_free);
+ seq_printf(m, "pool_min_free :%d\n", obj_pool_min_free);
+- seq_printf(m, "pool_used :%d\n", obj_pool_used);
++ seq_printf(m, "pool_used :%d\n", obj_pool_used - obj_percpu_free);
+ seq_printf(m, "pool_max_used :%d\n", obj_pool_max_used);
+ seq_printf(m, "on_free_list :%d\n", obj_nr_tofree);
+ seq_printf(m, "objs_allocated:%d\n", debug_objects_allocated);
+@@ -1177,9 +1240,20 @@ static int __init debug_objects_replace_static_objects(void)
+ */
+ void __init debug_objects_mem_init(void)
+ {
++ int cpu;
++
+ if (!debug_objects_enabled)
+ return;
+
++ /*
++ * Initialize the percpu object pools
++ *
++ * Initialization is not strictly necessary, but was done for
++ * completeness.
++ */
++ for_each_possible_cpu(cpu)
++ INIT_HLIST_HEAD(&per_cpu(percpu_obj_pool.free_objs, cpu));
++
+ obj_cache = kmem_cache_create("debug_objects_cache",
+ sizeof (struct debug_obj), 0,
+ SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE,
+@@ -1191,11 +1265,4 @@ void __init debug_objects_mem_init(void)
+ pr_warn("out of memory.\n");
+ } else
+ debug_objects_selftest();
+-
+- /*
+- * Increase the thresholds for allocating and freeing objects
+- * according to the number of possible CPUs available in the system.
+- */
+- debug_objects_pool_size += num_possible_cpus() * 32;
+- debug_objects_pool_min_level += num_possible_cpus() * 4;
+ }
+--
+2.39.2
+
--- /dev/null
+From f4bae042ab9b0690baf79a8257862c656a330b0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2019 10:14:50 -0400
+Subject: debugobjects: Move printk out of db->lock critical sections
+
+From: Waiman Long <longman@redhat.com>
+
+[ Upstream commit d5f34153e526903abe71869dbbc898bfc0f69373 ]
+
+The db->lock is a raw spinlock and so the lock hold time is supposed
+to be short. This will not be the case when printk() is being involved
+in some of the critical sections. In order to avoid the long hold time,
+in case some messages need to be printed, the debug_object_is_on_stack()
+and debug_print_object() calls are now moved out of those critical
+sections.
+
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Yang Shi <yang.shi@linux.alibaba.com>
+Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
+Cc: Qian Cai <cai@gmx.us>
+Cc: Zhong Jiang <zhongjiang@huawei.com>
+Link: https://lkml.kernel.org/r/20190520141450.7575-6-longman@redhat.com
+Stable-dep-of: 63a759694eed ("debugobject: Prevent init race with static objects")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 58 +++++++++++++++++++++++++++++++---------------
+ 1 file changed, 39 insertions(+), 19 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 6e2baf9e9eb27..6909a6e51de83 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -429,6 +429,7 @@ static void
+ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ {
+ enum debug_obj_state state;
++ bool check_stack = false;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -448,7 +449,7 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ debug_objects_oom();
+ return;
+ }
+- debug_object_is_on_stack(addr, onstack);
++ check_stack = true;
+ }
+
+ switch (obj->state) {
+@@ -459,20 +460,23 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ break;
+
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "init");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "init");
+ debug_object_fixup(descr->fixup_init, addr, state);
+ return;
+
+ case ODEBUG_STATE_DESTROYED:
++ raw_spin_unlock_irqrestore(&db->lock, flags);
+ debug_print_object(obj, "init");
+- break;
++ return;
+ default:
+ break;
+ }
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (check_stack)
++ debug_object_is_on_stack(addr, onstack);
+ }
+
+ /**
+@@ -530,6 +534,8 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+
+ obj = lookup_object(addr, db);
+ if (obj) {
++ bool print_object = false;
++
+ switch (obj->state) {
+ case ODEBUG_STATE_INIT:
+ case ODEBUG_STATE_INACTIVE:
+@@ -538,14 +544,14 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+ break;
+
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "activate");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "activate");
+ ret = debug_object_fixup(descr->fixup_activate, addr, state);
+ return ret ? 0 : -EINVAL;
+
+ case ODEBUG_STATE_DESTROYED:
+- debug_print_object(obj, "activate");
++ print_object = true;
+ ret = -EINVAL;
+ break;
+ default:
+@@ -553,10 +559,13 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+ break;
+ }
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (print_object)
++ debug_print_object(obj, "activate");
+ return ret;
+ }
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++
+ /*
+ * We are here when a static object is activated. We
+ * let the type specific code confirm whether this is
+@@ -588,6 +597,7 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr)
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
++ bool print_object = false;
+
+ if (!debug_objects_enabled)
+ return;
+@@ -605,24 +615,27 @@ void debug_object_deactivate(void *addr, struct debug_obj_descr *descr)
+ if (!obj->astate)
+ obj->state = ODEBUG_STATE_INACTIVE;
+ else
+- debug_print_object(obj, "deactivate");
++ print_object = true;
+ break;
+
+ case ODEBUG_STATE_DESTROYED:
+- debug_print_object(obj, "deactivate");
++ print_object = true;
+ break;
+ default:
+ break;
+ }
+- } else {
++ }
++
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (!obj) {
+ struct debug_obj o = { .object = addr,
+ .state = ODEBUG_STATE_NOTAVAILABLE,
+ .descr = descr };
+
+ debug_print_object(&o, "deactivate");
++ } else if (print_object) {
++ debug_print_object(obj, "deactivate");
+ }
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_deactivate);
+
+@@ -637,6 +650,7 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr)
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
++ bool print_object = false;
+
+ if (!debug_objects_enabled)
+ return;
+@@ -656,20 +670,22 @@ void debug_object_destroy(void *addr, struct debug_obj_descr *descr)
+ obj->state = ODEBUG_STATE_DESTROYED;
+ break;
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "destroy");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "destroy");
+ debug_object_fixup(descr->fixup_destroy, addr, state);
+ return;
+
+ case ODEBUG_STATE_DESTROYED:
+- debug_print_object(obj, "destroy");
++ print_object = true;
+ break;
+ default:
+ break;
+ }
+ out_unlock:
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (print_object)
++ debug_print_object(obj, "destroy");
+ }
+ EXPORT_SYMBOL_GPL(debug_object_destroy);
+
+@@ -698,9 +714,9 @@ void debug_object_free(void *addr, struct debug_obj_descr *descr)
+
+ switch (obj->state) {
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "free");
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "free");
+ debug_object_fixup(descr->fixup_free, addr, state);
+ return;
+ default:
+@@ -773,6 +789,7 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
++ bool print_object = false;
+
+ if (!debug_objects_enabled)
+ return;
+@@ -788,22 +805,25 @@ debug_object_active_state(void *addr, struct debug_obj_descr *descr,
+ if (obj->astate == expect)
+ obj->astate = next;
+ else
+- debug_print_object(obj, "active_state");
++ print_object = true;
+ break;
+
+ default:
+- debug_print_object(obj, "active_state");
++ print_object = true;
+ break;
+ }
+- } else {
++ }
++
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (!obj) {
+ struct debug_obj o = { .object = addr,
+ .state = ODEBUG_STATE_NOTAVAILABLE,
+ .descr = descr };
+
+ debug_print_object(&o, "active_state");
++ } else if (print_object) {
++ debug_print_object(obj, "active_state");
+ }
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_active_state);
+
+@@ -839,10 +859,10 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size)
+
+ switch (obj->state) {
+ case ODEBUG_STATE_ACTIVE:
+- debug_print_object(obj, "free");
+ descr = obj->descr;
+ state = obj->state;
+ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_print_object(obj, "free");
+ debug_object_fixup(descr->fixup_free,
+ (void *) oaddr, state);
+ goto repeat;
+--
+2.39.2
+
--- /dev/null
+From 9b37d2bcb7f0e12282c1359089e8c31587a058a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:25 +0200
+Subject: dmaengine: at_xdmac: do not enable all cyclic channels
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ]
+
+Do not global enable all the cyclic channels in at_xdmac_resume(). Instead
+save the global status in at_xdmac_suspend() and re-enable the cyclic
+channel only if it was active before suspend.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index a451ecae16692..33ea7abd8cc97 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -223,6 +223,7 @@ struct at_xdmac {
+ int irq;
+ struct clk *clk;
+ u32 save_gim;
++ u32 save_gs;
+ struct dma_pool *at_xdmac_desc_pool;
+ struct at_xdmac_chan chan[0];
+ };
+@@ -1878,6 +1879,7 @@ static int atmel_xdmac_suspend(struct device *dev)
+ }
+ }
+ atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS);
+
+ at_xdmac_off(atxdmac);
+ clk_disable_unprepare(atxdmac->clk);
+@@ -1914,7 +1916,8 @@ static int atmel_xdmac_resume(struct device *dev)
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+ wmb();
+- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
++ if (atxdmac->save_gs & atchan->mask)
++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
+ }
+ }
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 9ec3eefdba64497e3a54f6a557ac12d74784684e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jun 2022 11:20:30 -0700
+Subject: drm/msm/adreno: Defer enabling runpm until hw_init()
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 4b18299b33655fa9672b774b6df774dc03d6aee8 ]
+
+To avoid preventing the display from coming up before the rootfs is
+mounted, without resorting to packing fw in the initrd, the GPU has
+this limbo state where the device is probed, but we aren't ready to
+start sending commands to it. This is particularly problematic for
+a6xx, since the GMU (which requires fw to be loaded) is the one that
+is controlling the power/clk/icc votes.
+
+So defer enabling runpm until we are ready to call gpu->hw_init(),
+as that is a point where we know we have all the needed fw and are
+ready to start sending commands to the coproc's.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Patchwork: https://patchwork.freedesktop.org/patch/489337/
+Link: https://lore.kernel.org/r/20220613182036.2567963-1-robdclark@gmail.com
+Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 6 ++++++
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 -
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index 7d3e9a129ac74..0275be7e13b19 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -190,6 +190,12 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ if (ret)
+ return NULL;
+
++ /*
++ * Now that we have firmware loaded, and are ready to begin
++ * booting the gpu, go ahead and enable runpm:
++ */
++ pm_runtime_enable(&pdev->dev);
++
+ /* Make sure pm runtime is active and reset any previous errors */
+ pm_runtime_set_active(&pdev->dev);
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index c9f831604558f..6da144c394097 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -725,7 +725,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+ pm_runtime_set_autosuspend_delay(&pdev->dev,
+ adreno_gpu->info->inactive_period);
+ pm_runtime_use_autosuspend(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+
+ return msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base,
+ adreno_gpu->info->name, &adreno_gpu_config);
+--
+2.39.2
+
--- /dev/null
+From 273491c75db6c63f4eeda321e18b745827a4f619 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 17:48:06 +0100
+Subject: drm/msm/adreno: drop bogus pm_runtime_set_active()
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ]
+
+The runtime PM status can only be updated while runtime PM is disabled.
+
+Drop the bogus pm_runtime_set_active() call that was made after enabling
+runtime PM and which (incidentally but correctly) left the runtime PM
+status set to 'suspended'.
+
+Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Patchwork: https://patchwork.freedesktop.org/patch/524972/
+Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index 0275be7e13b19..7acb53a907e5c 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -196,9 +196,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ */
+ pm_runtime_enable(&pdev->dev);
+
+- /* Make sure pm runtime is active and reset any previous errors */
+- pm_runtime_set_active(&pdev->dev);
+-
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0) {
+ dev_err(dev->dev, "Couldn't power up the GPU: %d\n", ret);
+--
+2.39.2
+
--- /dev/null
+From b17767637ed63e0f6661633ba48b2e64eca7b109 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 16:40:52 +0100
+Subject: drm/probe-helper: Cancel previous job before starting new one
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ]
+
+Currently we schedule a call to output_poll_execute from
+drm_kms_helper_poll_enable for 10s in future. Later we try to replace
+that in drm_helper_probe_single_connector_modes with a 0s schedule with
+delayed_event set.
+
+But as there is already a job in the queue this fails, and the immediate
+job we wanted with delayed_event set doesn't occur until 10s later.
+
+And that call acts as if connector state has changed, reprobing modes.
+This has a side effect of waking up a display that has been blanked.
+
+Make sure we cancel the old job before submitting the immediate one.
+
+Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event")
+Acked-by: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+[Maxime: Switched to mod_delayed_work]
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_probe_helper.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index c0b26135dbd5b..f9e0594ee7024 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -459,8 +459,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
+ */
+ dev->mode_config.delayed_event = true;
+ if (dev->mode_config.poll_enabled)
+- schedule_delayed_work(&dev->mode_config.output_poll_work,
+- 0);
++ mod_delayed_work(system_wq,
++ &dev->mode_config.output_poll_work,
++ 0);
+ }
+
+ /* Re-enable polling in case the global poll config changed. */
+--
+2.39.2
+
--- /dev/null
+From 8daf52402ddd58ecf63a46e8fe4b70220360c8db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:17:34 -0800
+Subject: drm/rockchip: Drop unbalanced obj unref
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ]
+
+In the error path, rockchip_drm_gem_object_mmap() is dropping an obj
+reference that it doesn't own.
+
+Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+index a8db758d523e9..94242fa9e25d1 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+@@ -270,9 +270,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
+ else
+ ret = rockchip_drm_gem_object_mmap_dma(obj, vma);
+
+- if (ret)
+- drm_gem_vm_close(vma);
+-
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From f789ddf380070cd408c22019eb88c0cfc0c37c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 09:55:17 -0300
+Subject: drm/vgem: add missing mutex_destroy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ]
+
+vgem_fence_open() instantiates a mutex for a particular fence
+instance, but never destroys it by calling mutex_destroy() in
+vgem_fence_close().
+
+So, add the missing mutex_destroy() to guarantee proper resource
+destruction.
+
+Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)")
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vgem/vgem_fence.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c
+index b28876c222b46..04527d8f36236 100644
+--- a/drivers/gpu/drm/vgem/vgem_fence.c
++++ b/drivers/gpu/drm/vgem/vgem_fence.c
+@@ -280,4 +280,5 @@ void vgem_fence_close(struct vgem_file *vfile)
+ {
+ idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile);
+ idr_destroy(&vfile->fence_idr);
++ mutex_destroy(&vfile->fence_mutex);
+ }
+--
+2.39.2
+
--- /dev/null
+From 5dc44ecd534a6aeae9c2d1c374acd13171246609 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 09:17:28 +0800
+Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ]
+
+The current DRAM row address mapping arrays skx_{open,close}_row[]
+only support ranks with sizes up to 16G. Decoding a rank address
+to a DRAM row address for a 32G rank by using either one of the
+above arrays by the skx_edac driver, will result in an overflow on
+the array.
+
+For a 32G rank, the most significant DRAM row address bit (the
+bit17) is mapped from the bit34 of the rank address. Add this new
+mapping item to both arrays to fix the overflow issue.
+
+Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake")
+Reported-by: Feng Xu <feng.f.xu@intel.com>
+Tested-by: Feng Xu <feng.f.xu@intel.com>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/skx_edac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index b97803580d70f..38a82a3f45167 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -825,13 +825,13 @@ static bool skx_rir_decode(struct decoded_addr *res)
+ }
+
+ static u8 skx_close_row[] = {
+- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34
+ };
+ static u8 skx_close_column[] = {
+ 3, 4, 5, 14, 19, 23, 24, 25, 26, 27
+ };
+ static u8 skx_open_row[] = {
+- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34
+ };
+ static u8 skx_open_column[] = {
+ 3, 4, 5, 6, 7, 8, 9, 10, 11, 12
+--
+2.39.2
+
--- /dev/null
+From eb10369c6dc92dce4bc80aa3b11b161475e0441c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 15:34:44 +0800
+Subject: EDAC, skx: Move debugfs node under EDAC's hierarchy
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 85b9c8bfee67ed151c44861c71adc816fc1b46a9 ]
+
+The debugfs node is /sys/kernel/debug/skx_edac_test. Rename it and move
+under EDAC debugfs root directory. Remove the unused 'skx_fake_addr' and
+remove the 'skx_test' on error.
+
+Co-developed-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+CC: Mauro Carvalho Chehab <mchehab@kernel.org>
+CC: arozansk@redhat.com
+CC: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/1542353684-13496-1-git-send-email-qiuxu.zhuo@intel.com
+Stable-dep-of: 71b1e3ba3fed ("EDAC/skx: Fix overflows on the DRAM row address mapping arrays")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/skx_edac.c | 25 ++++++++++++-------------
+ 1 file changed, 12 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index dd209e0dd9abb..b97803580d70f 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -896,12 +896,11 @@ static bool skx_decode(struct decoded_addr *res)
+
+ #ifdef CONFIG_EDAC_DEBUG
+ /*
+- * Debug feature. Make /sys/kernel/debug/skx_edac_test/addr.
+- * Write an address to this file to exercise the address decode
+- * logic in this driver.
++ * Debug feature.
++ * Exercise the address decode logic by writing an address to
++ * /sys/kernel/debug/edac/skx_test/addr.
+ */
+ static struct dentry *skx_test;
+-static u64 skx_fake_addr;
+
+ static int debugfs_u64_set(void *data, u64 val)
+ {
+@@ -912,19 +911,19 @@ static int debugfs_u64_set(void *data, u64 val)
+
+ return 0;
+ }
+-
+ DEFINE_SIMPLE_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+-static struct dentry *mydebugfs_create(const char *name, umode_t mode,
+- struct dentry *parent, u64 *value)
+-{
+- return debugfs_create_file(name, mode, parent, value, &fops_u64_wo);
+-}
+-
+ static void setup_skx_debug(void)
+ {
+- skx_test = debugfs_create_dir("skx_edac_test", NULL);
+- mydebugfs_create("addr", S_IWUSR, skx_test, &skx_fake_addr);
++ skx_test = edac_debugfs_create_dir("skx_test");
++ if (!skx_test)
++ return;
++
++ if (!edac_debugfs_create_file("addr", 0200, skx_test,
++ NULL, &fops_u64_wo)) {
++ debugfs_remove(skx_test);
++ skx_test = NULL;
++ }
+ }
+
+ static void teardown_skx_debug(void)
+--
+2.39.2
+
--- /dev/null
+From 12d8a56f405c94b29046d851c81cd9441ac63af8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 20:44:26 +0530
+Subject: firmware: qcom_scm: Clear download bit during reboot
+
+From: Mukesh Ojha <quic_mojha@quicinc.com>
+
+[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ]
+
+During normal restart of a system download bit should
+be cleared irrespective of whether download mode is
+set or not.
+
+Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control")
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index 513908a0c2622..e795bd9c8038e 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -586,8 +586,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ static void qcom_scm_shutdown(struct platform_device *pdev)
+ {
+ /* Clean shutdown, disable download mode to allow normal restart */
+- if (download_mode)
+- qcom_scm_set_download_mode(false);
++ qcom_scm_set_download_mode(false);
+ }
+
+ static const struct of_device_id qcom_scm_dt_match[] = {
+--
+2.39.2
+
--- /dev/null
+From d8657bc081b6643a1326c2d7708462434327ab99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 15:03:08 +0100
+Subject: fpga: bridge: fix kernel-doc parameter description
+
+From: Marco Pagani <marpagan@redhat.com>
+
+[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ]
+
+Fix the kernel-doc description for the "struct fpga_image_info *info"
+parameter of the fpga_bridge_get() function.
+
+Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes")
+Signed-off-by: Marco Pagani <marpagan@redhat.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Acked-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/fpga-bridge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c
+index c983dac97501b..c7db12192facd 100644
+--- a/drivers/fpga/fpga-bridge.c
++++ b/drivers/fpga/fpga-bridge.c
+@@ -121,7 +121,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data)
+ /**
+ * fpga_bridge_get - get an exclusive reference to a fpga bridge
+ * @dev: parent device that fpga bridge was registered with
+- * @info: fpga manager info
++ * @info: fpga image specific information
+ *
+ * Given a device, get an exclusive reference to a fpga bridge.
+ *
+--
+2.39.2
+
--- /dev/null
+From 762680d5f0d800ffdb8b9ae52b20a4552c109170 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:42:58 -0800
+Subject: ia64: mm/contig: fix section mismatch warning/error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ]
+
+alloc_per_cpu_data() is called by find_memory(), which is marked as
+__init. Therefore alloc_per_cpu_data() can also be marked as __init to
+remedy this modpost problem.
+
+WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text)
+
+Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org
+Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/mm/contig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
+index e2e40bbd391c6..18a2b105f7f30 100644
+--- a/arch/ia64/mm/contig.c
++++ b/arch/ia64/mm/contig.c
+@@ -82,7 +82,7 @@ void *per_cpu_init(void)
+ return __per_cpu_start + __per_cpu_offset[smp_processor_id()];
+ }
+
+-static inline void
++static inline __init void
+ alloc_per_cpu_data(void)
+ {
+ cpu_data = __alloc_bootmem(PERCPU_PAGE_SIZE * num_possible_cpus(),
+--
+2.39.2
+
--- /dev/null
+From 8c349306e2f2ae6686c1f57065cf9810a32c4c8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:43:09 -0800
+Subject: ia64: salinfo: placate defined-but-not-used warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ]
+
+When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used. Mark the
+function as __maybe_unused to quieten the warning message.
+
+../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function]
+ 584 | static int proc_salinfo_show(struct seq_file *m, void *v)
+ | ^~~~~~~~~~~~~~~~~
+
+Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org
+Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/salinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c
+index aba1f463a8dd4..b889db4492c8d 100644
+--- a/arch/ia64/kernel/salinfo.c
++++ b/arch/ia64/kernel/salinfo.c
+@@ -580,7 +580,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu)
+ * 'data' contains an integer that corresponds to the feature we're
+ * testing
+ */
+-static int proc_salinfo_show(struct seq_file *m, void *v)
++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v)
+ {
+ unsigned long data = (unsigned long)v;
+ seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n");
+--
+2.39.2
+
--- /dev/null
+From aeac55e4b23af5e64ec2d508c0b97e6250f06464 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 12:52:39 -0400
+Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ]
+
+hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in
+mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node.
+
+As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly
+least-recently used nodes.
+
+This could be a performance issue for an application when that
+application:
+- Uses some long-lived buffers frequently.
+- Uses a large number of buffers once.
+- Hits the mmu_rb_handler cache size or pinned-page limits, forcing
+ mmu_rb_handler cache entries to be evicted.
+
+In this case, the one-time use buffers cause the long-lived buffer
+entries to eventually filter to the end of the LRU list where
+hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived
+entry instead of evicting one of the one-time use entries.
+
+Fix this by inserting new mmu_rb_node at the tail of
+mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of
+mmu_rb_handler->lru_list when the mmu_rb_node is a hit in
+hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict
+from the head of mmu_rb_handler->lru_list instead of the tail.
+
+Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list")
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index e1c7996c018ef..513a297b4ff0e 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -175,7 +175,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ goto unlock;
+ }
+ __mmu_int_rb_insert(mnode, &handler->root);
+- list_add(&mnode->list, &handler->lru_list);
++ list_add_tail(&mnode->list, &handler->lru_list);
+
+ ret = handler->ops->insert(handler->ops_arg, mnode);
+ if (ret) {
+@@ -222,8 +222,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+ spin_lock_irqsave(&handler->lock, flags);
+ node = __mmu_rb_search(handler, addr, len);
+ if (node) {
+- if (node->addr == addr && node->len == len)
++ if (node->addr == addr && node->len == len) {
++ list_move_tail(&node->list, &handler->lru_list);
+ goto unlock;
++ }
+ __mmu_int_rb_remove(node, &handler->root);
+ list_del(&node->list); /* remove from LRU list */
+ ret = true;
+@@ -244,8 +246,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ INIT_LIST_HEAD(&del_list);
+
+ spin_lock_irqsave(&handler->lock, flags);
+- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list,
+- list) {
++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) {
+ if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg,
+ &stop)) {
+ __mmu_int_rb_remove(rbnode, &handler->root);
+@@ -257,9 +258,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ }
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- while (!list_empty(&del_list)) {
+- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list);
+- list_del(&rbnode->list);
++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) {
+ handler->ops->remove(handler->ops_arg, rbnode);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 0ac8ceb68dea9c2474c74c13432d8b55af6e0757 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 20:40:35 +0800
+Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ]
+
+Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in
+__ip6_make_skb()"). icmphdr does not in skb linear region under the
+scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will
+trigger the uninit variable access bug.
+
+Use a local variable icmp_type to carry the correct value in different
+scenarios.
+
+Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_output.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 06a981676356c..92fa11e75a4d0 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1443,9 +1443,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ cork->dst = NULL;
+ skb_dst_set(skb, &rt->dst);
+
+- if (iph->protocol == IPPROTO_ICMP)
+- icmp_out_count(net, ((struct icmphdr *)
+- skb_transport_header(skb))->type);
++ if (iph->protocol == IPPROTO_ICMP) {
++ u8 icmp_type;
++
++ /* For such sockets, transhdrlen is zero when do ip_append_data(),
++ * so icmphdr does not in skb linear region and can not get icmp_type
++ * by icmp_hdr(skb)->type.
++ */
++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl)
++ icmp_type = fl4->fl4_icmp_type;
++ else
++ icmp_type = icmp_hdr(skb)->type;
++ icmp_out_count(net, icmp_type);
++ }
+
+ ip_cork_release(cork);
+ out:
+--
+2.39.2
+
--- /dev/null
+From e25cd71e645e4264287b1ad75513db3feba414d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:22 +0000
+Subject: ixgbe: Allow flow hash to be set via ethtool
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ]
+
+ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool
+because the ethtool code in the kernel passes a non-zero value for hfunc
+that ixgbe should allow.
+
+When ethtool is called with `ETHTOOL_SRXFHINDIR`,
+`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function
+with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted.
+
+When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will
+call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be
+hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should
+also be accepted.
+
+Before this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 0 1 2 3 4 5
+ 16: 6 7 8 9 0 1 2 3
+ 24: 4 5 6 7 8 9 0 1
+ ...
+
+Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index 8829bd95d0d36..a852f9c920742 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -3005,8 +3005,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir,
+ int i;
+ u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter);
+
+- if (hfunc)
+- return -EINVAL;
++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
++ return -EOPNOTSUPP;
+
+ /* Fill out the redirection table */
+ if (indir) {
+--
+2.39.2
+
--- /dev/null
+From 484d9c63c80204cdcc8ef9626f05ec3cba0076f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:23 +0000
+Subject: ixgbe: Enable setting RSS table to default values
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ]
+
+ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported
+by RSS. The driver should return the smaller of either:
+ - The maximum number of RSS queues the device supports, OR
+ - The number of RX queues configured
+
+Prior to this change, running `ethtool -X $iface default` fails if the
+number of queues configured is larger than the number supported by RSS,
+even though changing the queue count correctly resets the flowhash to
+use all supported queues.
+
+Other drivers (for example, i40e) will succeed but the flow hash will
+reset to support the maximum number of queues supported by RSS, even if
+that amount is smaller than the configured amount.
+
+Prior to this change:
+
+$ sudo ethtool -L eth1 combined 20
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 20 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+ 24: 8 9 10 11 12 13 14 15
+ 32: 0 1 2 3 4 5 6 7
+...
+
+You can see that the flowhash was correctly set to use the maximum
+number of queues supported by the driver (16).
+
+However, asking the NIC to reset to "default" fails:
+
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this change, the flowhash can be reset to default which will use
+all of the available RSS queues (16) or the configured queue count,
+whichever is smaller.
+
+Starting with eth1 which has 10 queues and a flowhash distributing to
+all 10 queues:
+
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 0 1 2 3 4 5
+ 16: 6 7 8 9 0 1 2 3
+...
+
+Increasing the queue count to 48 resets the flowhash to distribute to 16
+queues, as it did before this patch:
+
+$ sudo ethtool -L eth1 combined 48
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+...
+
+Due to the other bugfix in this series, the flowhash can be set to use
+queues 0-5:
+
+$ sudo ethtool -X eth1 equal 5
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 0 1 2
+ 8: 3 4 0 1 2 3 4 0
+ 16: 1 2 3 4 0 1 2 3
+...
+
+Due to this bugfix, the flowhash can be reset to default and use 16
+queues:
+
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+...
+
+Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index a852f9c920742..3d361557a63a3 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -2539,6 +2539,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter,
+ return 0;
+ }
+
++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
++{
++ if (adapter->hw.mac.type < ixgbe_mac_X550)
++ return 16;
++ else
++ return 64;
++}
++
+ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ u32 *rule_locs)
+ {
+@@ -2547,7 +2555,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+
+ switch (cmd->cmd) {
+ case ETHTOOL_GRXRINGS:
+- cmd->data = adapter->num_rx_queues;
++ cmd->data = min_t(int, adapter->num_rx_queues,
++ ixgbe_rss_indir_tbl_max(adapter));
+ ret = 0;
+ break;
+ case ETHTOOL_GRXCLSRLCNT:
+@@ -2949,14 +2958,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd)
+ return ret;
+ }
+
+-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
+-{
+- if (adapter->hw.mac.type < ixgbe_mac_X550)
+- return 16;
+- else
+- return 64;
+-}
+-
+ static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev)
+ {
+ return IXGBE_RSS_KEY_SIZE;
+--
+2.39.2
+
--- /dev/null
+From 0dd18d13eea147380a382c7c54b1cfe87791d32e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 19:15:29 -0700
+Subject: linux/vt_buffer.h: allow either builtin or modular for macros
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ]
+
+Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m.
+This allows the ARCH macros to be the only ones defined.
+
+In file included from ../drivers/video/console/mdacon.c:37:
+../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile'
+ 17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+ | ^~~~~~~~
+../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew'
+ 24 | #define scr_writew(val, addr) (*(addr) = (val))
+ | ^~~~
+../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token
+ 24 | #define scr_writew(val, addr) (*(addr) = (val))
+ | ^
+../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew'
+ 17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+ | ^~~~~~~~~~
+../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile'
+ 25 | static inline u16 scr_readw(volatile const u16 *addr)
+ | ^~~~~~~~
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-fbdev@vger.kernel.org
+Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/vt_buffer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h
+index 848db1b1569ff..919d999a8c1db 100644
+--- a/include/linux/vt_buffer.h
++++ b/include/linux/vt_buffer.h
+@@ -16,7 +16,7 @@
+
+ #include <linux/string.h>
+
+-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE)
++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE)
+ #include <asm/vga.h>
+ #endif
+
+--
+2.39.2
+
--- /dev/null
+From 411b86b74a994cb4b2e8e8381b79f1e6b81f2c91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 17:42:41 -0800
+Subject: macintosh: via-pmu-led: requires ATA to be set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ]
+
+LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK
+when ATA is not set/enabled causes a Kconfig warning:
+
+WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK
+ Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n]
+ Selected by [y]:
+ - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y]
+
+Fix this by making ADB_PMU_LED_DISK depend on ATA.
+
+Seen on both PPC32 and PPC64.
+
+Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
+index a316624742f68..c3d421c7b0cf1 100644
+--- a/drivers/macintosh/Kconfig
++++ b/drivers/macintosh/Kconfig
+@@ -83,6 +83,7 @@ config ADB_PMU_LED
+
+ config ADB_PMU_LED_DISK
+ bool "Use front LED as DISK LED by default"
++ depends on ATA
+ depends on ADB_PMU_LED
+ depends on LEDS_CLASS
+ select LEDS_TRIGGERS
+--
+2.39.2
+
--- /dev/null
+From f2a500bfe2f4c61a1e4d79eb2273ffe2e9f6606c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 11:35:58 +0800
+Subject: macintosh/windfarm_smu_sat: Add missing of_node_put()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ]
+
+We call of_node_get() in wf_sat_probe() after sat is created,
+so we need the of_node_put() before *kfree(sat)*.
+
+Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s")
+Signed-off-by: Liang He <windhl@126.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/windfarm_smu_sat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index 51ef77de41744..3d4b8c33640a8 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -172,6 +172,7 @@ static void wf_sat_release(struct kref *ref)
+
+ if (sat->nr >= 0)
+ sats[sat->nr] = NULL;
++ of_node_put(sat->node);
+ kfree(sat);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 8806a45a2956412e20bae29ee8b3afbbbfeafd16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:53 +0800
+Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ]
+
+raid10_sync_request() will add 'r10bio->remaining' for both rdev and
+replacement rdev. However, if the read io fails, recovery_request_write()
+returns without issuing the write io, in this case, end_sync_request()
+is only called once and 'remaining' is leaked, cause an io hang.
+
+Fix the problem by decreasing 'remaining' according to if 'bio' and
+'repl_bio' is valid.
+
+Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 9f9cd2fadc1e7..8181d9a375f0b 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2266,11 +2266,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ {
+ struct r10conf *conf = mddev->private;
+ int d;
+- struct bio *wbio, *wbio2;
++ struct bio *wbio = r10_bio->devs[1].bio;
++ struct bio *wbio2 = r10_bio->devs[1].repl_bio;
++
++ /* Need to test wbio2->bi_end_io before we call
++ * generic_make_request as if the former is NULL,
++ * the latter is free to free wbio2.
++ */
++ if (wbio2 && !wbio2->bi_end_io)
++ wbio2 = NULL;
+
+ if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) {
+ fix_recovery_read_error(r10_bio);
+- end_sync_request(r10_bio);
++ if (wbio->bi_end_io)
++ end_sync_request(r10_bio);
++ if (wbio2)
++ end_sync_request(r10_bio);
+ return;
+ }
+
+@@ -2279,14 +2290,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ * and submit the write request
+ */
+ d = r10_bio->devs[1].devnum;
+- wbio = r10_bio->devs[1].bio;
+- wbio2 = r10_bio->devs[1].repl_bio;
+- /* Need to test wbio2->bi_end_io before we call
+- * generic_make_request as if the former is NULL,
+- * the latter is free to free wbio2.
+- */
+- if (wbio2 && !wbio2->bi_end_io)
+- wbio2 = NULL;
+ if (wbio->bi_end_io) {
+ atomic_inc(&conf->mirrors[d].rdev->nr_pending);
+ md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
+--
+2.39.2
+
--- /dev/null
+From 5f6ca1a572625b4804315967561bee3dc865d3ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:54 +0800
+Subject: md/raid10: fix memleak for 'conf->bio_split'
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ]
+
+In the error path of raid10_run(), 'conf' need be freed, however,
+'conf->bio_split' is missed and memory will be leaked.
+
+Since there are 3 places to free 'conf', factor out a helper to fix the
+problem.
+
+Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 37 +++++++++++++++++--------------------
+ 1 file changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 8181d9a375f0b..fca95eb3cb1f3 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3671,6 +3671,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
+ return nc*fc;
+ }
+
++static void raid10_free_conf(struct r10conf *conf)
++{
++ if (!conf)
++ return;
++
++ mempool_exit(&conf->r10bio_pool);
++ kfree(conf->mirrors);
++ kfree(conf->mirrors_old);
++ kfree(conf->mirrors_new);
++ safe_put_page(conf->tmppage);
++ bioset_exit(&conf->bio_split);
++ kfree(conf);
++}
++
+ static struct r10conf *setup_conf(struct mddev *mddev)
+ {
+ struct r10conf *conf = NULL;
+@@ -3753,13 +3767,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ return conf;
+
+ out:
+- if (conf) {
+- mempool_exit(&conf->r10bio_pool);
+- kfree(conf->mirrors);
+- safe_put_page(conf->tmppage);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
+- }
++ raid10_free_conf(conf);
+ return ERR_PTR(err);
+ }
+
+@@ -3973,10 +3981,7 @@ static int raid10_run(struct mddev *mddev)
+
+ out_free_conf:
+ md_unregister_thread(&mddev->thread);
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf);
++ raid10_free_conf(conf);
+ mddev->private = NULL;
+ out:
+ return -EIO;
+@@ -3984,15 +3989,7 @@ static int raid10_run(struct mddev *mddev)
+
+ static void raid10_free(struct mddev *mddev, void *priv)
+ {
+- struct r10conf *conf = priv;
+-
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf->mirrors_old);
+- kfree(conf->mirrors_new);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
++ raid10_free_conf(priv);
+ }
+
+ static void raid10_quiesce(struct mddev *mddev, int quiesce)
+--
+2.39.2
+
--- /dev/null
+From 0255e0d7eb95d0695af9119368f9888e11bcb3d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:55 +0800
+Subject: md/raid10: fix memleak of md thread
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ]
+
+In raid10_run(), if setup_conf() succeed and raid10_run() failed before
+setting 'mddev->thread', then in the error path 'conf->thread' is not
+freed.
+
+Fix the problem by setting 'mddev->thread' right after setup_conf().
+
+Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 2a7f9df5b82c6..dc625f9cfa9d1 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3805,6 +3805,9 @@ static int raid10_run(struct mddev *mddev)
+ if (!conf)
+ goto out;
+
++ mddev->thread = conf->thread;
++ conf->thread = NULL;
++
+ if (mddev_is_clustered(conf->mddev)) {
+ int fc, fo;
+
+@@ -3817,9 +3820,6 @@ static int raid10_run(struct mddev *mddev)
+ }
+ }
+
+- mddev->thread = conf->thread;
+- conf->thread = NULL;
+-
+ if (mddev->queue) {
+ blk_queue_max_discard_sectors(mddev->queue,
+ mddev->chunk_sectors);
+--
+2.39.2
+
--- /dev/null
+From 2ccd8dc6f1250f049a71700d30fffb414720e997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 08:51:33 +0200
+Subject: md: update the optimal I/O size on reshape
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 16ef510139315a2147ee7525796f8dbd4e4b7864 ]
+
+The raid5 and raid10 drivers currently update the read-ahead size,
+but not the optimal I/O size on reshape. To prepare for deriving the
+read-ahead size from the optimal I/O size make sure it is updated
+as well.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Song Liu <song@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f0ddb83da3cb ("md/raid10: fix memleak of md thread")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 22 ++++++++++++++--------
+ drivers/md/raid5.c | 10 ++++++++--
+ 2 files changed, 22 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index fca95eb3cb1f3..2a7f9df5b82c6 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3771,10 +3771,20 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ return ERR_PTR(err);
+ }
+
++static void raid10_set_io_opt(struct r10conf *conf)
++{
++ int raid_disks = conf->geo.raid_disks;
++
++ if (!(conf->geo.raid_disks % conf->geo.near_copies))
++ raid_disks /= conf->geo.near_copies;
++ blk_queue_io_opt(conf->mddev->queue, (conf->mddev->chunk_sectors << 9) *
++ raid_disks);
++}
++
+ static int raid10_run(struct mddev *mddev)
+ {
+ struct r10conf *conf;
+- int i, disk_idx, chunk_size;
++ int i, disk_idx;
+ struct raid10_info *disk;
+ struct md_rdev *rdev;
+ sector_t size;
+@@ -3810,18 +3820,13 @@ static int raid10_run(struct mddev *mddev)
+ mddev->thread = conf->thread;
+ conf->thread = NULL;
+
+- chunk_size = mddev->chunk_sectors << 9;
+ if (mddev->queue) {
+ blk_queue_max_discard_sectors(mddev->queue,
+ mddev->chunk_sectors);
+ blk_queue_max_write_same_sectors(mddev->queue, 0);
+ blk_queue_max_write_zeroes_sectors(mddev->queue, 0);
+- blk_queue_io_min(mddev->queue, chunk_size);
+- if (conf->geo.raid_disks % conf->geo.near_copies)
+- blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
+- else
+- blk_queue_io_opt(mddev->queue, chunk_size *
+- (conf->geo.raid_disks / conf->geo.near_copies));
++ blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
++ raid10_set_io_opt(conf);
+ }
+
+ rdev_for_each(rdev, mddev) {
+@@ -4724,6 +4729,7 @@ static void end_reshape(struct r10conf *conf)
+ stripe /= conf->geo.near_copies;
+ if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe)
+ conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe;
++ raid10_set_io_opt(conf);
+ }
+ conf->fullsync = 0;
+ }
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 7fe0619c487ae..7eeae0301ccc6 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7153,6 +7153,12 @@ static int only_parity(int raid_disk, int algo, int raid_disks, int max_degraded
+ return 0;
+ }
+
++static void raid5_set_io_opt(struct r5conf *conf)
++{
++ blk_queue_io_opt(conf->mddev->queue, (conf->chunk_sectors << 9) *
++ (conf->raid_disks - conf->max_degraded));
++}
++
+ static int raid5_run(struct mddev *mddev)
+ {
+ struct r5conf *conf;
+@@ -7442,8 +7448,7 @@ static int raid5_run(struct mddev *mddev)
+
+ chunk_size = mddev->chunk_sectors << 9;
+ blk_queue_io_min(mddev->queue, chunk_size);
+- blk_queue_io_opt(mddev->queue, chunk_size *
+- (conf->raid_disks - conf->max_degraded));
++ raid5_set_io_opt(conf);
+ mddev->queue->limits.raid_partial_stripes_expensive = 1;
+ /*
+ * We can only discard a whole stripe. It doesn't make sense to
+@@ -8037,6 +8042,7 @@ static void end_reshape(struct r5conf *conf)
+ / PAGE_SIZE);
+ if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe)
+ conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe;
++ raid5_set_io_opt(conf);
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 165fc1f6d90e765cb6ea766ab2883f31f67cb192 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:00:23 +0100
+Subject: media: av7110: prevent underflow in write_ts_to_decoder()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ]
+
+The buf[4] value comes from the user via ts_play(). It is a value in
+the u8 range. The final length we pass to av7110_ipack_instant_repack()
+is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is
+not negative. It's not clear that passing a negative len value does
+anything bad necessarily, but it's not best practice.
+
+With the new bounds checking the "if (!len)" condition is no longer
+possible or required so remove that.
+
+Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ttpci/av7110_av.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c
+index ef1bc17cdc4d3..03d1d1fba8bc8 100644
+--- a/drivers/media/pci/ttpci/av7110_av.c
++++ b/drivers/media/pci/ttpci/av7110_av.c
+@@ -836,10 +836,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s
+ av7110_ipack_flush(ipack);
+
+ if (buf[3] & ADAPT_FIELD) {
++ if (buf[4] > len - 1 - 4)
++ return 0;
+ len -= buf[4] + 1;
+ buf += buf[4] + 1;
+- if (!len)
+- return 0;
+ }
+
+ av7110_ipack_instant_repack(buf + 4, len - 4, ipack);
+--
+2.39.2
+
--- /dev/null
+From 1c55148fc145e5752e59b5c4d2e369a3ac44c8ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 08:14:42 +0100
+Subject: media: bdisp: Add missing check for create_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ]
+
+Add the check for the return value of the create_workqueue
+in order to avoid NULL pointer dereference.
+
+Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+index 00f6e3f06dac5..7a7271f9d875a 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+@@ -1312,6 +1312,8 @@ static int bdisp_probe(struct platform_device *pdev)
+ init_waitqueue_head(&bdisp->irq_queue);
+ INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout);
+ bdisp->work_queue = create_workqueue(BDISP_NAME);
++ if (!bdisp->work_queue)
++ return -ENOMEM;
+
+ spin_lock_init(&bdisp->slock);
+ mutex_init(&bdisp->lock);
+--
+2.39.2
+
--- /dev/null
+From 32f61a4583678681db6ffdb0ee6ff02f8c0f9040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:15:06 +0800
+Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ]
+
+In dm1105_probe, it called dm1105_ir_init and bound
+&dm1105->ir.work with dm1105_emit_key.
+When it handles IRQ request with dm1105_irq,
+it may call schedule_work to start the work.
+
+When we call dm1105_remove to remove the driver, there
+may be a sequence as follows:
+
+Fix it by finishing the work before cleanup in dm1105_remove
+
+CPU0 CPU1
+
+ |dm1105_emit_key
+dm1105_remove |
+ dm1105_ir_exit |
+ rc_unregister_device |
+ rc_free_device |
+ rc_dev_release |
+ kfree(dev); |
+ |
+ | rc_keydown
+ | //use
+
+Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/dm1105/dm1105.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c
+index 1ddb0576fb7b1..dc3fc69e44806 100644
+--- a/drivers/media/pci/dm1105/dm1105.c
++++ b/drivers/media/pci/dm1105/dm1105.c
+@@ -1188,6 +1188,7 @@ static void dm1105_remove(struct pci_dev *pdev)
+ struct dvb_demux *dvbdemux = &dev->demux;
+ struct dmx_demux *dmx = &dvbdemux->dmx;
+
++ cancel_work_sync(&dev->ir.work);
+ dm1105_ir_exit(dev);
+ dmx->close(dmx);
+ dvb_net_release(&dev->dvbnet);
+--
+2.39.2
+
--- /dev/null
+From 79df403a247df7ffac71bd1f3084452bbc9eb2d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 13:38:33 -0700
+Subject: media: rc: gpio-ir-recv: Fix support for wake-up
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ]
+
+The driver was intended from the start to be a wake-up source for the
+system, however due to the absence of a suitable call to
+device_set_wakeup_capable(), the device_may_wakeup() call used to decide
+whether to enable the GPIO interrupt as a wake-up source would never
+happen. Lookup the DT standard "wakeup-source" property and call
+device_init_wakeup() to ensure the device is flagged as being wakeup
+capable.
+
+Reported-by: Matthew Lear <matthew.lear@broadcom.com>
+Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/gpio-ir-recv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c
+index 3d99b51384ac9..ed5cfde4d9e79 100644
+--- a/drivers/media/rc/gpio-ir-recv.c
++++ b/drivers/media/rc/gpio-ir-recv.c
+@@ -91,6 +91,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev)
+ rcdev->map_name = RC_MAP_EMPTY;
+
+ gpio_dev->rcdev = rcdev;
++ if (of_property_read_bool(np, "wakeup-source"))
++ device_init_wakeup(dev, true);
+
+ rc = devm_rc_register_device(dev, rcdev);
+ if (rc < 0) {
+--
+2.39.2
+
--- /dev/null
+From 055352585937f78e98d9e2c327e7606b8d001b92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 11:58:09 +0400
+Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ]
+
+rcar_fcp_get() take reference, which should be balanced with
+rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and
+the error paths of fdp1_probe() to fix this.
+
+Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+[hverkuil: resolve merge conflict, remove() is now void]
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index e1c8701d44ade..605d8188ac8c1 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2313,8 +2313,10 @@ static int fdp1_probe(struct platform_device *pdev)
+
+ /* Determine our clock rate */
+ clk = clk_get(&pdev->dev, NULL);
+- if (IS_ERR(clk))
+- return PTR_ERR(clk);
++ if (IS_ERR(clk)) {
++ ret = PTR_ERR(clk);
++ goto put_dev;
++ }
+
+ fdp1->clk_rate = clk_get_rate(clk);
+ clk_put(clk);
+@@ -2323,7 +2325,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev);
+ if (ret) {
+ v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n");
+- return ret;
++ goto put_dev;
+ }
+
+ /* M2M registration */
+@@ -2388,6 +2390,8 @@ static int fdp1_probe(struct platform_device *pdev)
+ unreg_dev:
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+
++put_dev:
++ rcar_fcp_put(fdp1->fcp);
+ return ret;
+ }
+
+@@ -2399,6 +2403,7 @@ static int fdp1_remove(struct platform_device *pdev)
+ video_unregister_device(&fdp1->vfd);
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+ pm_runtime_disable(&pdev->dev);
++ rcar_fcp_put(fdp1->fcp);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 990a5a9c88f16662fe3ce52f5d626b488c49832f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Oct 2021 05:09:38 +0200
+Subject: media: rcar_fdp1: Fix the correct variable assignments
+
+From: Tang Bin <tangbin@cmss.chinamobile.com>
+
+[ Upstream commit af88c2adbb72a09ab1bb5c37ba388c98fecca69b ]
+
+In the function fdp1_probe(), when get irq failed, the
+function platform_get_irq() log an error message, so
+remove redundant message here. And the variable type
+of "ret" is int, the "fdp1->irq" is unsigned int, when
+irq failed, this place maybe wrong, thus fix it.
+
+Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 2bd5898a62044..e1c8701d44ade 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2287,11 +2287,10 @@ static int fdp1_probe(struct platform_device *pdev)
+ return PTR_ERR(fdp1->regs);
+
+ /* Interrupt service routine registration */
+- fdp1->irq = ret = platform_get_irq(pdev, 0);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "cannot find IRQ\n");
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
+ return ret;
+- }
++ fdp1->irq = ret;
+
+ ret = devm_request_irq(&pdev->dev, fdp1->irq, fdp1_irq_handler, 0,
+ dev_name(&pdev->dev), fdp1);
+--
+2.39.2
+
--- /dev/null
+From 09bc50334efde975a9af9da5c759b6d64fc90f2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:50:23 +0800
+Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ]
+
+In saa7134_initdev, it will call saa7134_hwinit1. There are three
+function invoking here: saa7134_video_init1, saa7134_ts_init1
+and saa7134_vbi_init1.
+
+All of them will init a timer with same function. Take
+saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout
+with saa7134_buffer_timeout.
+
+In buffer_activate, the timer funtcion is started.
+
+If we remove the module or device which will call saa7134_finidev
+to make cleanup, there may be a unfinished work. The
+possible sequence is as follows, which will cause a
+typical UAF bug.
+
+Fix it by canceling the timer works accordingly before cleanup in
+saa7134_finidev.
+
+CPU0 CPU1
+
+ |saa7134_buffer_timeout
+saa7134_finidev |
+ kfree(dev); |
+ |
+ | saa7134_buffer_next
+ | //use dev
+
+Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-ts.c | 1 +
+ drivers/media/pci/saa7134/saa7134-vbi.c | 1 +
+ drivers/media/pci/saa7134/saa7134-video.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c
+index 2be703617e294..e7adcd4f99623 100644
+--- a/drivers/media/pci/saa7134/saa7134-ts.c
++++ b/drivers/media/pci/saa7134/saa7134-ts.c
+@@ -309,6 +309,7 @@ int saa7134_ts_start(struct saa7134_dev *dev)
+
+ int saa7134_ts_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->ts_q.timeout);
+ saa7134_pgtable_free(dev->pci, &dev->ts_q.pt);
+ return 0;
+ }
+diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c
+index 57bea543c39ba..559db500b19ce 100644
+--- a/drivers/media/pci/saa7134/saa7134-vbi.c
++++ b/drivers/media/pci/saa7134/saa7134-vbi.c
+@@ -194,6 +194,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev)
+ int saa7134_vbi_fini(struct saa7134_dev *dev)
+ {
+ /* nothing */
++ del_timer_sync(&dev->vbi_q.timeout);
+ return 0;
+ }
+
+diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
+index 079219288af7b..90255ecb08ca4 100644
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -2213,6 +2213,7 @@ int saa7134_video_init1(struct saa7134_dev *dev)
+
+ void saa7134_video_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->video_q.timeout);
+ /* free stuff */
+ vb2_queue_release(&dev->video_vbq);
+ saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
+--
+2.39.2
+
--- /dev/null
+From 1191922d42fbb4aad2a30fe20369ca0eab219251 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 14:46:08 +0100
+Subject: media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format.
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit 6ad253cc3436269fc6bcff03d704c672f368da0a ]
+
+MEDIA_BUS_FMT_METADATA_FIXED should be used when
+the same driver handles both sides of the link and
+the bus format is a fixed metadata format that is
+not configurable from userspace.
+The width and height will be set to 0 for this format.
+
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: eed9496a0501 ("media: av7110: prevent underflow in write_ts_to_decoder()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/uapi/v4l/subdev-formats.rst | 27 +++++++++++++++++++
+ include/uapi/linux/media-bus-format.h | 8 ++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/Documentation/media/uapi/v4l/subdev-formats.rst b/Documentation/media/uapi/v4l/subdev-formats.rst
+index 8e73fcfc69000..cc2ad8af51ea0 100644
+--- a/Documentation/media/uapi/v4l/subdev-formats.rst
++++ b/Documentation/media/uapi/v4l/subdev-formats.rst
+@@ -7565,3 +7565,30 @@ formats.
+ - 0x5001
+ - Interleaved raw UYVY and JPEG image format with embedded meta-data
+ used by Samsung S3C73MX camera sensors.
++
++.. _v4l2-mbus-metadata-fmts:
++
++Metadata Formats
++^^^^^^^^^^^^^^^^
++
++This section lists all metadata formats.
++
++The following table lists the existing metadata formats.
++
++.. tabularcolumns:: |p{8.0cm}|p{1.4cm}|p{7.7cm}|
++
++.. flat-table:: Metadata formats
++ :header-rows: 1
++ :stub-columns: 0
++
++ * - Identifier
++ - Code
++ - Comments
++ * .. _MEDIA-BUS-FMT-METADATA-FIXED:
++
++ - MEDIA_BUS_FMT_METADATA_FIXED
++ - 0x7001
++ - This format should be used when the same driver handles
++ both sides of the link and the bus format is a fixed
++ metadata format that is not configurable from userspace.
++ Width and height will be set to 0 for this format.
+diff --git a/include/uapi/linux/media-bus-format.h b/include/uapi/linux/media-bus-format.h
+index d6a5a3bfe6c43..be53a8c1a2dff 100644
+--- a/include/uapi/linux/media-bus-format.h
++++ b/include/uapi/linux/media-bus-format.h
+@@ -153,4 +153,12 @@
+ /* HSV - next is 0x6002 */
+ #define MEDIA_BUS_FMT_AHSV8888_1X32 0x6001
+
++/*
++ * This format should be used when the same driver handles
++ * both sides of the link and the bus format is a fixed
++ * metadata format that is not configurable from userspace.
++ * Width and height will be set to 0 for this format.
++ */
++#define MEDIA_BUS_FMT_METADATA_FIXED 0x7001
++
+ #endif /* __LINUX_MEDIA_BUS_FORMAT_H */
+--
+2.39.2
+
--- /dev/null
+From 3fff330dd687af8aaa1cd344999f57e3242129ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:34:39 +0530
+Subject: mtd: spi-nor: cadence-quadspi: Don't initialize rx_dma_complete on
+ failure
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 48aae57f0f9f57797772bd462b4d64902b1b4ae1 ]
+
+If driver fails to acquire DMA channel then don't initialize
+rx_dma_complete struct as it won't be used.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200601070444.16923-4-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index cdebe6853e6c3..bd62ed8710315 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -1173,6 +1173,7 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+ if (IS_ERR(cqspi->rx_chan)) {
+ dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
+ cqspi->rx_chan = NULL;
++ return;
+ }
+ init_completion(&cqspi->rx_dma_complete);
+ }
+--
+2.39.2
+
--- /dev/null
+From c669aa3fb62a67b8b2765ff6cbe2d14f6955b5e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:34:41 +0530
+Subject: mtd: spi-nor: cadence-quadspi: Handle probe deferral while requesting
+ DMA channel
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 935da5e5100f57d843cac4781b21f1c235059aa0 ]
+
+dma_request_chan_by_mask() can throw EPROBE_DEFER if DMA provider
+is not yet probed. Currently driver just falls back to using PIO mode
+(which is less efficient) in this case. Instead return probe deferral
+error as is so that driver will be re probed once DMA provider is
+available.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200601070444.16923-6-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index bd62ed8710315..16ac2e3c351df 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -1162,7 +1162,7 @@ static void cqspi_controller_init(struct cqspi_st *cqspi)
+ cqspi_controller_enable(cqspi, 1);
+ }
+
+-static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
++static int cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+ {
+ dma_cap_mask_t mask;
+
+@@ -1171,11 +1171,16 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+
+ cqspi->rx_chan = dma_request_chan_by_mask(&mask);
+ if (IS_ERR(cqspi->rx_chan)) {
+- dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
++ int ret = PTR_ERR(cqspi->rx_chan);
++
++ if (ret != -EPROBE_DEFER)
++ dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
+ cqspi->rx_chan = NULL;
+- return;
++ return ret;
+ }
+ init_completion(&cqspi->rx_dma_complete);
++
++ return 0;
+ }
+
+ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
+@@ -1256,8 +1261,11 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
+ dev_dbg(nor->dev, "using direct mode for %s\n",
+ mtd->name);
+
+- if (!cqspi->rx_chan)
+- cqspi_request_mmap_dma(cqspi);
++ if (!cqspi->rx_chan) {
++ ret = cqspi_request_mmap_dma(cqspi);
++ if (ret == -EPROBE_DEFER)
++ goto err;
++ }
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From e21727346eb0b2ade271e801ab66c7092188ee10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:34:37 +0530
+Subject: mtd: spi-nor: cadence-quadspi: Make driver independent of flash
+ geometry
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 834b4e8d344139ba64cda22099b2b2ef6c9a542d ]
+
+Drop configuration of Flash size, erase size and page size
+configuration. Flash size is needed only if using AHB decoder (BIT 23 of
+CONFIG_REG) which is not used by the driver.
+Erase size and page size are needed if IP is configured to send WREN
+automatically. But since SPI NOR layer takes care of sending WREN, there
+is no need to configure these fields either.
+
+Therefore drop these in preparation to move the driver to spi-mem
+framework where flash geometry is not visible to controller driver.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200601070444.16923-2-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 36 +--------------------------
+ 1 file changed, 1 insertion(+), 35 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index a92f531ad23a3..cdebe6853e6c3 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -80,9 +80,6 @@ struct cqspi_st {
+ dma_addr_t mmap_phys_base;
+
+ int current_cs;
+- int current_page_size;
+- int current_erase_size;
+- int current_addr_width;
+ unsigned long master_ref_clk_hz;
+ bool is_decoded_cs;
+ u32 fifo_depth;
+@@ -734,32 +731,6 @@ static void cqspi_chipselect(struct spi_nor *nor)
+ writel(reg, reg_base + CQSPI_REG_CONFIG);
+ }
+
+-static void cqspi_configure_cs_and_sizes(struct spi_nor *nor)
+-{
+- struct cqspi_flash_pdata *f_pdata = nor->priv;
+- struct cqspi_st *cqspi = f_pdata->cqspi;
+- void __iomem *iobase = cqspi->iobase;
+- unsigned int reg;
+-
+- /* configure page size and block size. */
+- reg = readl(iobase + CQSPI_REG_SIZE);
+- reg &= ~(CQSPI_REG_SIZE_PAGE_MASK << CQSPI_REG_SIZE_PAGE_LSB);
+- reg &= ~(CQSPI_REG_SIZE_BLOCK_MASK << CQSPI_REG_SIZE_BLOCK_LSB);
+- reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK;
+- reg |= (nor->page_size << CQSPI_REG_SIZE_PAGE_LSB);
+- reg |= (ilog2(nor->mtd.erasesize) << CQSPI_REG_SIZE_BLOCK_LSB);
+- reg |= (nor->addr_width - 1);
+- writel(reg, iobase + CQSPI_REG_SIZE);
+-
+- /* configure the chip select */
+- cqspi_chipselect(nor);
+-
+- /* Store the new configuration of the controller */
+- cqspi->current_page_size = nor->page_size;
+- cqspi->current_erase_size = nor->mtd.erasesize;
+- cqspi->current_addr_width = nor->addr_width;
+-}
+-
+ static unsigned int calculate_ticks_for_ns(const unsigned int ref_clk_hz,
+ const unsigned int ns_val)
+ {
+@@ -865,18 +836,13 @@ static void cqspi_configure(struct spi_nor *nor)
+ int switch_cs = (cqspi->current_cs != f_pdata->cs);
+ int switch_ck = (cqspi->sclk != sclk);
+
+- if ((cqspi->current_page_size != nor->page_size) ||
+- (cqspi->current_erase_size != nor->mtd.erasesize) ||
+- (cqspi->current_addr_width != nor->addr_width))
+- switch_cs = 1;
+-
+ if (switch_cs || switch_ck)
+ cqspi_controller_enable(cqspi, 0);
+
+ /* Switch chip select. */
+ if (switch_cs) {
+ cqspi->current_cs = f_pdata->cs;
+- cqspi_configure_cs_and_sizes(nor);
++ cqspi_chipselect(nor);
+ }
+
+ /* Setup baudrate divisor and delays */
+--
+2.39.2
+
--- /dev/null
+From 8294542e62bd8c1ec0c9be93a5a01dc257b2b580 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 23:28:01 +0800
+Subject: net: amd: Fix link leak when verifying config failed
+
+From: Gencen Gan <gangecen@hust.edu.cn>
+
+[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ]
+
+After failing to verify configuration, it returns directly without
+releasing link, which may cause memory leak.
+
+Paolo Abeni thinks that the whole code of this driver is quite
+"suboptimal" and looks unmainatained since at least ~15y, so he
+suggests that we could simply remove the whole driver, please
+take it into consideration.
+
+Simon Horman suggests that the fix label should be set to
+"Linux-2.6.12-rc2" considering that the problem has existed
+since the driver was introduced and the commit above doesn't
+seem to exist in net/net-next.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gan Gecen <gangecen@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/nmclan_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c
+index 9c152d85840d7..c9d2a6f150624 100644
+--- a/drivers/net/ethernet/amd/nmclan_cs.c
++++ b/drivers/net/ethernet/amd/nmclan_cs.c
+@@ -652,7 +652,7 @@ static int nmclan_config(struct pcmcia_device *link)
+ } else {
+ pr_notice("mace id not found: %x %x should be 0x40 0x?9\n",
+ sig[0], sig[1]);
+- return -ENODEV;
++ goto failed;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b553af6a6635d61dcb3cba905d75c027f327c277 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:08 +0000
+Subject: net/packet: convert po->auxdata to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ]
+
+po->auxdata can be read while another thread
+is changing its value, potentially raising KCSAN splat.
+
+Convert it to PACKET_SOCK_AUXDATA flag.
+
+Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 8 +++-----
+ net/packet/diag.c | 2 +-
+ net/packet/internal.h | 4 ++--
+ 3 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 91c35d45e43ca..60986c209311f 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3444,7 +3444,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+- if (pkt_sk(sk)->auxdata) {
++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) {
+ struct tpacket_auxdata aux;
+
+ aux.tp_status = TP_STATUS_USER;
+@@ -3827,9 +3827,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->auxdata = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val);
+ return 0;
+ }
+ case PACKET_ORIGDEV:
+@@ -3971,7 +3969,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+
+ break;
+ case PACKET_AUXDATA:
+- val = po->auxdata;
++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA);
+ break;
+ case PACKET_ORIGDEV:
+ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index bf5928e5df035..d9f912ad23dfa 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -22,7 +22,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ pinfo.pdi_flags = 0;
+ if (po->running)
+ pinfo.pdi_flags |= PDI_RUNNING;
+- if (po->auxdata)
++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA))
+ pinfo.pdi_flags |= PDI_AUXDATA;
+ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ pinfo.pdi_flags |= PDI_ORIGDEV;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index f39dcc7608bc6..3d871cae85b8c 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -117,8 +117,7 @@ struct packet_sock {
+ struct mutex pg_vec_lock;
+ unsigned long flags;
+ unsigned int running; /* bind_lock must be held */
+- unsigned int auxdata:1, /* writer must hold sock lock */
+- has_vnet_hdr:1,
++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */
+ tp_loss:1,
+ tp_tx_has_off:1;
+ int pressure;
+@@ -144,6 +143,7 @@ static struct packet_sock *pkt_sk(struct sock *sk)
+
+ enum packet_sock_flags {
+ PACKET_SOCK_ORIGDEV,
++ PACKET_SOCK_AUXDATA,
+ };
+
+ static inline void packet_sock_flag_set(struct packet_sock *po,
+--
+2.39.2
+
--- /dev/null
+From 4c74e8a00c04812fe01f828e79949b62df67478a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:07 +0000
+Subject: net/packet: convert po->origdev to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ]
+
+syzbot/KCAN reported that po->origdev can be read
+while another thread is changing its value.
+
+We can avoid this splat by converting this field
+to an actual bit.
+
+Following patches will convert remaining 1bit fields.
+
+Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 10 ++++------
+ net/packet/diag.c | 2 +-
+ net/packet/internal.h | 22 +++++++++++++++++++++-
+ 3 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 6fa0a9a453a8b..91c35d45e43ca 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2105,7 +2105,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll = &PACKET_SKB_CB(skb)->sa.ll;
+ sll->sll_hatype = dev->type;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -2371,7 +2371,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll->sll_hatype = dev->type;
+ sll->sll_protocol = skb->protocol;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -3841,9 +3841,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->origdev = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val);
+ return 0;
+ }
+ case PACKET_VNET_HDR:
+@@ -3976,7 +3974,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ val = po->auxdata;
+ break;
+ case PACKET_ORIGDEV:
+- val = po->origdev;
++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+ break;
+ case PACKET_VNET_HDR:
+ val = po->has_vnet_hdr;
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index 7ef1c881ae741..bf5928e5df035 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -24,7 +24,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ pinfo.pdi_flags |= PDI_RUNNING;
+ if (po->auxdata)
+ pinfo.pdi_flags |= PDI_AUXDATA;
+- if (po->origdev)
++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ pinfo.pdi_flags |= PDI_ORIGDEV;
+ if (po->has_vnet_hdr)
+ pinfo.pdi_flags |= PDI_VNETHDR;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index f10294800aafb..f39dcc7608bc6 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -115,9 +115,9 @@ struct packet_sock {
+ int copy_thresh;
+ spinlock_t bind_lock;
+ struct mutex pg_vec_lock;
++ unsigned long flags;
+ unsigned int running; /* bind_lock must be held */
+ unsigned int auxdata:1, /* writer must hold sock lock */
+- origdev:1,
+ has_vnet_hdr:1,
+ tp_loss:1,
+ tp_tx_has_off:1;
+@@ -142,4 +142,24 @@ static struct packet_sock *pkt_sk(struct sock *sk)
+ return (struct packet_sock *)sk;
+ }
+
++enum packet_sock_flags {
++ PACKET_SOCK_ORIGDEV,
++};
++
++static inline void packet_sock_flag_set(struct packet_sock *po,
++ enum packet_sock_flags flag,
++ bool val)
++{
++ if (val)
++ set_bit(flag, &po->flags);
++ else
++ clear_bit(flag, &po->flags);
++}
++
++static inline bool packet_sock_flag(const struct packet_sock *po,
++ enum packet_sock_flags flag)
++{
++ return test_bit(flag, &po->flags);
++}
++
+ #endif
+--
+2.39.2
+
--- /dev/null
+From a0cd963cd94caee75f07c4af51b7891cec5fcedc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 17:13:19 +0200
+Subject: netfilter: nf_tables: don't write table validation state without
+ mutex
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ]
+
+The ->cleanup callback needs to be removed, this doesn't work anymore as
+the transaction mutex is already released in the ->abort function.
+
+Just do it after a successful validation pass, this either happens
+from commit or abort phases where transaction mutex is held.
+
+Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nfnetlink.h | 1 -
+ net/netfilter/nf_tables_api.c | 8 ++------
+ net/netfilter/nfnetlink.c | 2 --
+ 3 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index e713476ff29db..a806803fbe37a 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -32,7 +32,6 @@ struct nfnetlink_subsystem {
+ struct module *owner;
+ int (*commit)(struct net *net, struct sk_buff *skb);
+ int (*abort)(struct net *net, struct sk_buff *skb);
+- void (*cleanup)(struct net *net);
+ bool (*valid_genid)(struct net *net, u32 genid);
+ };
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 079f768496937..d7a082d5cd70e 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6241,6 +6241,8 @@ static int nf_tables_validate(struct net *net)
+ if (nft_table_validate(net, table) < 0)
+ return -EAGAIN;
+ }
++
++ nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+ break;
+ }
+
+@@ -6767,11 +6769,6 @@ static int __nf_tables_abort(struct net *net)
+ return 0;
+ }
+
+-static void nf_tables_cleanup(struct net *net)
+-{
+- nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+-}
+-
+ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
+ {
+ int ret = __nf_tables_abort(net);
+@@ -6802,7 +6799,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = {
+ .cb = nf_tables_cb,
+ .commit = nf_tables_commit,
+ .abort = nf_tables_abort,
+- .cleanup = nf_tables_cleanup,
+ .valid_genid = nf_tables_valid_genid,
+ .owner = THIS_MODULE,
+ };
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 9bacddc761ba4..39e369e18cb87 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -495,8 +495,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ } else {
+ ss->abort(net, oskb);
+ }
+- if (ss->cleanup)
+- ss->cleanup(net);
+
+ nfnl_err_deliver(&err_list, oskb);
+ kfree_skb(skb);
+--
+2.39.2
+
--- /dev/null
+From ea751f68d72b97c5e5eaf23c7ca3a700a6113010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 11:52:55 -0700
+Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ]
+
+Brad Spencer provided a detailed report [0] that when calling getsockopt()
+for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such
+options require at least sizeof(int) as length.
+
+The options return a flag value that fits into 1 byte, but such behaviour
+confuses users who do not initialise the variable before calling
+getsockopt() and do not strictly check the returned value as char.
+
+Currently, netlink_getsockopt() uses put_user() to copy data to optlen and
+optval, but put_user() casts the data based on the pointer, char *optval.
+As a result, only 1 byte is set to optval.
+
+To avoid this behaviour, we need to use copy_to_user() or cast optval for
+put_user().
+
+Note that this changes the behaviour on big-endian systems, but we document
+that the size of optval is int in the man page.
+
+ $ man 7 netlink
+ ...
+ Socket options
+ To set or get a netlink socket option, call getsockopt(2) to read
+ or setsockopt(2) to write the option with the option level argument
+ set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to
+ an int.
+
+Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups")
+Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option")
+Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag")
+Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option")
+Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting")
+Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps")
+Reported-by: Brad Spencer <bspencer@blackberry.com>
+Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 67 +++++++++++++---------------------------
+ 1 file changed, 22 insertions(+), 45 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index 6a49c0aa55bda..6867158656b86 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1738,7 +1738,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ {
+ struct sock *sk = sock->sk;
+ struct netlink_sock *nlk = nlk_sk(sk);
+- int len, val, err;
++ unsigned int flag;
++ int len, val;
+
+ if (level != SOL_NETLINK)
+ return -ENOPROTOOPT;
+@@ -1750,39 +1751,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+
+ switch (optname) {
+ case NETLINK_PKTINFO:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_PKTINFO;
+ break;
+ case NETLINK_BROADCAST_ERROR:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_BROADCAST_SEND_ERROR;
+ break;
+ case NETLINK_NO_ENOBUFS:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_NO_ENOBUFS;
+ break;
+ case NETLINK_LIST_MEMBERSHIPS: {
+- int pos, idx, shift;
++ int pos, idx, shift, err = 0;
+
+- err = 0;
+ netlink_lock_table();
+ for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
+ if (len - pos < sizeof(u32))
+@@ -1799,31 +1778,29 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
+ err = -EFAULT;
+ netlink_unlock_table();
+- break;
++ return err;
+ }
+ case NETLINK_CAP_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_CAP_ACK;
+ break;
+ case NETLINK_EXT_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;
+- if (put_user(len, optlen) || put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_EXT_ACK;
+ break;
+ default:
+- err = -ENOPROTOOPT;
++ return -ENOPROTOOPT;
+ }
+- return err;
++
++ if (len < sizeof(int))
++ return -EINVAL;
++
++ len = sizeof(int);
++ val = nlk->flags & flag ? 1 : 0;
++
++ if (put_user(len, optlen) ||
++ copy_to_user(optval, &val, len))
++ return -EFAULT;
++
++ return 0;
+ }
+
+ static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
+--
+2.39.2
+
--- /dev/null
+From c02ca8e4e59936a686d538db43805bc6df9986b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 18:45:53 -0400
+Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ]
+
+The spec requires that we always at least send a RECLAIM_COMPLETE when
+we're done establishing the lease and recovering any state.
+
+Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index e5b4c6987c846..f0f0fb7499e3a 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -66,6 +66,8 @@
+
+ #define OPENOWNER_POOL_SIZE 8
+
++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp);
++
+ const nfs4_stateid zero_stateid = {
+ { .data = { 0 } },
+ .type = NFS4_SPECIAL_STATEID_TYPE,
+@@ -338,6 +340,8 @@ int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
+ status = nfs4_proc_create_session(clp, cred);
+ if (status != 0)
+ goto out;
++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R))
++ nfs4_state_start_reclaim_reboot(clp);
+ nfs41_finish_session_reset(clp);
+ nfs_mark_client_ready(clp, NFS_CS_READY);
+ out:
+--
+2.39.2
+
--- /dev/null
+From be30cd6519405511f8bebff29d05933ee994ad4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 18:21:09 +0100
+Subject: of: Fix modalias string generation
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ]
+
+The helper generating an OF based modalias (of_device_get_modalias())
+works fine, but due to the use of snprintf() internally it needs a
+buffer one byte longer than what should be needed just for the entire
+string (excluding the '\0'). Most users of this helper are sysfs hooks
+providing the modalias string to users. They all provide a PAGE_SIZE
+buffer which is way above the number of bytes required to fit the
+modalias string and hence do not suffer from this issue.
+
+There is another user though, of_device_request_module(), which is only
+called by drivers/usb/common/ulpi.c. This request module function is
+faulty, but maybe because in most cases there is an alternative, ULPI
+driver users have not noticed it.
+
+In this function, of_device_get_modalias() is called twice. The first
+time without buffer just to get the number of bytes required by the
+modalias string (excluding the null byte), and a second time, after
+buffer allocation, to fill the buffer. The allocation asks for an
+additional byte, in order to store the trailing '\0'. However, the
+buffer *length* provided to of_device_get_modalias() excludes this extra
+byte. The internal use of snprintf() with a length that is exactly the
+number of bytes to be written has the effect of using the last available
+byte to store a '\0', which then smashes the last character of the
+modalias string.
+
+Provide the actual size of the buffer to of_device_get_modalias() to fix
+this issue.
+
+Note: the "str[size - 1] = '\0';" line is not really needed as snprintf
+will anyway end the string with a null byte, but there is a possibility
+that this function might be called on a struct device_node without
+compatible, in this case snprintf() would not be executed. So we keep it
+just to avoid possible unbounded strings.
+
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Peter Chen <peter.chen@kernel.org>
+Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/device.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 258742830e366..566d8af05157d 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -258,12 +258,15 @@ int of_device_request_module(struct device *dev)
+ if (size < 0)
+ return size;
+
+- str = kmalloc(size + 1, GFP_KERNEL);
++ /* Reserve an additional byte for the trailing '\0' */
++ size++;
++
++ str = kmalloc(size, GFP_KERNEL);
+ if (!str)
+ return -ENOMEM;
+
+ of_device_get_modalias(dev, str, size);
+- str[size] = '\0';
++ str[size - 1] = '\0';
+ ret = request_module(str);
+ kfree(str);
+
+--
+2.39.2
+
--- /dev/null
+From 471b8320a9f6ed3d6b943fbc80c58316a1e76630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 19:14:06 +0900
+Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ]
+
+In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on
+exception") the unhandled exception path was changed to do an early
+store of r30 instead of r31. The entry code was not updated and r31 is
+not getting stored to pt_regs.
+
+This patch updates the entry handler to store r31 instead of r30. We
+also remove some misleading commented out store r30 and r31
+instructrions.
+
+I noticed this while working on adding floating point exception
+handling, This issue probably would never impact anything since we kill
+the process or Oops right away on unhandled exceptions.
+
+Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index c2c3ce8a0f84e..7b408d67f11e1 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -177,7 +177,6 @@ handler: ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+ /* r30 already save */ ;\
+-/* l.sw PT_GPR30(r1),r30*/ ;\
+ l.sw PT_GPR31(r1),r31 ;\
+ TRACE_IRQS_OFF_ENTRY ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+@@ -215,9 +214,8 @@ handler: ;\
+ l.sw PT_GPR27(r1),r27 ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+- /* r31 already saved */ ;\
+- l.sw PT_GPR30(r1),r30 ;\
+-/* l.sw PT_GPR31(r1),r31 */ ;\
++ /* r30 already saved */ ;\
++ l.sw PT_GPR31(r1),r31 ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+ l.addi r30,r0,-1 ;\
+ l.sw PT_ORIG_GPR11(r1),r30 ;\
+--
+2.39.2
+
--- /dev/null
+From 86ab10cb20a0278f39eda74d4c6b792c07b1a38c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 10:35:08 +0800
+Subject: perf/core: Fix hardlockup failure caused by perf throttle
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ]
+
+commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling")
+introduces a change in throttling threshold judgment. Before this,
+compare hwc->interrupts and max_samples_per_tick, then increase
+hwc->interrupts by 1, but this commit reverses order of these two
+behaviors, causing the semantics of max_samples_per_tick to change.
+In literal sense of "max_samples_per_tick", if hwc->interrupts ==
+max_samples_per_tick, it should not be throttled, therefore, the judgment
+condition should be changed to "hwc->interrupts > max_samples_per_tick".
+
+In fact, this may cause the hardlockup to fail, The minimum value of
+max_samples_per_tick may be 1, in this case, the return value of
+__perf_event_account_interrupt function is 1.
+As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86
+architecture as an example, see x86_pmu_handle_irq).
+
+Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 72ed3f3d078fc..2bf4b6b109bf4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -7843,8 +7843,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle)
+ hwc->interrupts = 1;
+ } else {
+ hwc->interrupts++;
+- if (unlikely(throttle
+- && hwc->interrupts >= max_samples_per_tick)) {
++ if (unlikely(throttle &&
++ hwc->interrupts > max_samples_per_tick)) {
+ __this_cpu_inc(perf_throttled_count);
+ tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS);
+ hwc->interrupts = MAX_INTERRUPTS;
+--
+2.39.2
+
--- /dev/null
+From b730871fec2ca72209ef5eb6005c41eece479593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 19:16:34 +0800
+Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for
+ usb2_port and ulpi_port
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ]
+
+The tegra_xusb_port_unregister should be called when usb2_port
+and ulpi_port map fails in tegra_xusb_add_usb2_port() or in
+tegra_xusb_add_ulpi_port(), fix it.
+
+Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index 39c01ef57d83c..17211b31e1ed4 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -583,6 +583,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl,
+ usb2->base.lane = usb2->base.ops->map(&usb2->base);
+ if (IS_ERR(usb2->base.lane)) {
+ err = PTR_ERR(usb2->base.lane);
++ tegra_xusb_port_unregister(&usb2->base);
+ goto out;
+ }
+
+@@ -635,6 +636,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl,
+ ulpi->base.lane = ulpi->base.ops->map(&ulpi->base);
+ if (IS_ERR(ulpi->base.lane)) {
+ err = PTR_ERR(ulpi->base.lane);
++ tegra_xusb_port_unregister(&ulpi->base);
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 55b82df54c702158935c1d3ba50ab2cfc9365f94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 23:56:57 +0100
+Subject: power: supply: generic-adc-battery: fix unit scaling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Reichel <sre@kernel.org>
+
+[ Upstream commit 44263f50065969f2344808388bd589740f026167 ]
+
+power-supply properties are reported in µV, µA and µW.
+The IIO API provides mV, mA, mW, so the values need to
+be multiplied by 1000.
+
+Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/generic-adc-battery.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
+index 97b0e873e87d2..c2d6378bb897d 100644
+--- a/drivers/power/supply/generic-adc-battery.c
++++ b/drivers/power/supply/generic-adc-battery.c
+@@ -138,6 +138,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp,
+ result);
+ if (ret < 0)
+ pr_err("read channel error\n");
++ else
++ *result *= 1000;
++
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 20e4d81e7e09e399302fbc645a8a51f43f10bc41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:13 -0800
+Subject: powerpc/mpc512x: fix resource printk format warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat':
+../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+ 989 | snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
+ | ^~~~~~~~~ ~~~~~~~~~
+ | |
+ | resource_size_t {aka long long unsigned int}
+
+Prevents 24 such warnings.
+
+Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/512x/clock-commonclk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c
+index b3097fe6441b9..1019d78e44bb4 100644
+--- a/arch/powerpc/platforms/512x/clock-commonclk.c
++++ b/arch/powerpc/platforms/512x/clock-commonclk.c
+@@ -985,7 +985,7 @@ static void mpc5121_clk_provide_migration_support(void)
+
+ #define NODE_PREP do { \
+ of_address_to_resource(np, 0, &res); \
+- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
+ } while (0)
+
+ #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \
+--
+2.39.2
+
--- /dev/null
+From 9dac2ee1db6093f91c42341b20fe9066535a8061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:33:41 -0600
+Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ]
+
+Using memcpy() isn't safe when buf is identical to rtas_err_buf, which
+can happen during boot before slab is up. Full context which may not
+be obvious from the diff:
+
+ if (altbuf) {
+ buf = altbuf;
+ } else {
+ buf = rtas_err_buf;
+ if (slab_is_available())
+ buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ }
+ if (buf)
+ memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+
+This was found by inspection and I'm not aware of it causing problems
+in practice. It appears to have been introduced by commit
+033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the
+old ppc64 version of this code did not have this problem.
+
+Use memmove() instead.
+
+Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 7c7648e6f1c22..2646dd54eb0bb 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -401,7 +401,7 @@ static char *__fetch_rtas_last_error(char *altbuf)
+ buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ }
+ if (buf)
+- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+ }
+
+ return buf;
+--
+2.39.2
+
--- /dev/null
+From 2f1f4f9fcca9fed8deb1638a4766737fe288c827 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:16 -0800
+Subject: powerpc/sysdev/tsi108: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+ arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci':
+ include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t'
+
+Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree")
+Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[mpe: Use pr_info() and unsplit string]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/tsi108_pci.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c
+index 28ff1f53cefc1..6bd50c690006f 100644
+--- a/arch/powerpc/sysdev/tsi108_pci.c
++++ b/arch/powerpc/sysdev/tsi108_pci.c
+@@ -229,9 +229,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary)
+
+ (hose)->ops = &tsi108_direct_pci_ops;
+
+- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. "
+- "Firmware bus number: %d->%d\n",
+- rsrc.start, hose->first_busno, hose->last_busno);
++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n",
++ &rsrc.start, hose->first_busno, hose->last_busno);
+
+ /* Interpret the "ranges" property */
+ /* This also maps the I/O region and sets isa_io/mem_base */
+--
+2.39.2
+
--- /dev/null
+From e8cf7bcc190a3e653155424b6c366b6caa54da09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:14 -0800
+Subject: powerpc/wii: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ]
+
+Use "%pa" format specifier for resource_size_t to avoid compiler
+printk format warnings.
+
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info'
+ 148 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+ | ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info'
+ 174 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+ | ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info'
+ 77 | pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+ | ^~~~~~~
+
+Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support")
+Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support")
+Fixes: 5a7ee3198dfa ("powerpc: wii: platform support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +-
+ arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 2 +-
+ arch/powerpc/platforms/embedded6xx/wii.c | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+index db0be007fd063..bfca4d42b00d3 100644
+--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+@@ -149,7 +149,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np)
+ }
+ io_base = ioremap(res.start, resource_size(&res));
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __flipper_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+index 7b4edf1cb2c8d..bdc7e1a80366f 100644
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -178,7 +178,7 @@ static struct irq_domain *hlwd_pic_init(struct device_node *np)
+ return NULL;
+ }
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __hlwd_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
+index 343bffd20fcaf..768231005fb5a 100644
+--- a/arch/powerpc/platforms/embedded6xx/wii.c
++++ b/arch/powerpc/platforms/embedded6xx/wii.c
+@@ -122,8 +122,8 @@ static void __iomem *wii_ioremap_hw_regs(char *name, char *compatible)
+
+ hw_regs = ioremap(res.start, resource_size(&res));
+ if (hw_regs) {
+- pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+- res.start, hw_regs);
++ pr_info("%s at 0x%pa mapped to 0x%p\n", name,
++ &res.start, hw_regs);
+ }
+
+ out_put:
+--
+2.39.2
+
--- /dev/null
+From 7d2de15858cfb5077e22ef669c72f26a63be79d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 20:40:43 +0000
+Subject: pstore: Revert pmsg_lock back to a normal mutex
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: John Stultz <jstultz@google.com>
+
+[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ]
+
+This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721.
+
+So while priority inversion on the pmsg_lock is an occasional
+problem that an rt_mutex would help with, in uses where logging
+is writing to pmsg heavily from multiple threads, the pmsg_lock
+can be heavily contended.
+
+After this change landed, it was reported that cases where the
+mutex locking overhead was commonly adding on the order of 10s
+of usecs delay had suddenly jumped to ~msec delay with rtmutex.
+
+It seems the slight differences in the locks under this level
+of contention causes the normal mutexes to utilize the spinning
+optimizations, while the rtmutexes end up in the sleeping
+slowpath (which allows additional threads to pile on trying
+to take the lock).
+
+In this case, it devolves to a worse case senerio where the lock
+acquisition and scheduling overhead dominates, and each thread
+is waiting on the order of ~ms to do ~us of work.
+
+Obviously, having tons of threads all contending on a single
+lock for logging is non-optimal, so the proper fix is probably
+reworking pstore pmsg to have per-cpu buffers so we don't have
+contention.
+
+Additionally, Steven Rostedt has provided some furhter
+optimizations for rtmutexes that improves the rtmutex spinning
+path, but at least in my testing, I still see the test tripping
+into the sleeping path on rtmutexes while utilizing the spinning
+path with mutexes.
+
+But in the short term, lets revert the change to the rt_mutex
+and go back to normal mutexes to avoid a potentially major
+performance regression. And we can work on optimizations to both
+rtmutexes and finer-grained locking for pstore pmsg in the
+future.
+
+Cc: Wei Wang <wvw@google.com>
+Cc: Midas Chien<midaschieh@google.com>
+Cc: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Anton Vorontsov <anton@enomsg.org>
+Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: kernel-team@android.com
+Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion")
+Reported-by: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Signed-off-by: John Stultz <jstultz@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/pmsg.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c
+index ffc13ea196d2a..24db02de17874 100644
+--- a/fs/pstore/pmsg.c
++++ b/fs/pstore/pmsg.c
+@@ -15,10 +15,9 @@
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/uaccess.h>
+-#include <linux/rtmutex.h>
+ #include "internal.h"
+
+-static DEFINE_RT_MUTEX(pmsg_lock);
++static DEFINE_MUTEX(pmsg_lock);
+
+ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+@@ -37,9 +36,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ if (!access_ok(VERIFY_READ, buf, count))
+ return -EFAULT;
+
+- rt_mutex_lock(&pmsg_lock);
++ mutex_lock(&pmsg_lock);
+ ret = psinfo->write_user(&record, buf);
+- rt_mutex_unlock(&pmsg_lock);
++ mutex_unlock(&pmsg_lock);
+ return ret ? ret : count;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 0f1c0fb369a2994da8a68d4e9d0df4facdcf5915 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 21:24:29 +0800
+Subject: pwm: mtk-disp: Adjust the clocks to avoid them mismatch
+
+From: Jitao Shi <jitao.shi@mediatek.com>
+
+[ Upstream commit d7a4e582587d97a586b1f7709e3bddcf35928e96 ]
+
+The clks "main" and "mm" are prepared in .probe() (and unprepared in
+.remove()). This results in the clocks being on during suspend which
+results in unnecessarily increased power consumption.
+
+Remove the clock operations from .probe() and .remove(). Add the
+clk_prepare_enable() in .enable() and the clk_disable_unprepare() in
+.disable().
+
+Signed-off-by: Jitao Shi <jitao.shi@mediatek.com>
+[thierry.reding@gmail.com: squashed in fixup patch]
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 91 +++++++++++++++++---------------------
+ 1 file changed, 41 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index dd31a00d6326c..6d08938866048 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -82,6 +82,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ u64 div, rate;
+ int err;
+
++ err = clk_prepare_enable(mdp->clk_main);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
++ return err;
++ }
++
++ err = clk_prepare_enable(mdp->clk_mm);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++ clk_disable_unprepare(mdp->clk_main);
++ return err;
++ }
++
+ /*
+ * Find period, high_width and clk_div to suit duty_ns and period_ns.
+ * Calculate proper div value to keep period value in the bound.
+@@ -95,8 +108,11 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ rate = clk_get_rate(mdp->clk_main);
+ clk_div = div_u64(rate * period_ns, NSEC_PER_SEC) >>
+ PWM_PERIOD_BIT_WIDTH;
+- if (clk_div > PWM_CLKDIV_MAX)
++ if (clk_div > PWM_CLKDIV_MAX) {
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+ return -EINVAL;
++ }
+
+ div = NSEC_PER_SEC * (clk_div + 1);
+ period = div64_u64(rate * period_ns, div);
+@@ -106,16 +122,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ high_width = div64_u64(rate * duty_ns, div);
+ value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+
+- err = clk_enable(mdp->clk_main);
+- if (err < 0)
+- return err;
+-
+- err = clk_enable(mdp->clk_mm);
+- if (err < 0) {
+- clk_disable(mdp->clk_main);
+- return err;
+- }
+-
+ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+ PWM_CLKDIV_MASK,
+ clk_div << PWM_CLKDIV_SHIFT);
+@@ -130,10 +136,21 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ mtk_disp_pwm_update_bits(mdp, mdp->data->commit,
+ mdp->data->commit_mask,
+ 0x0);
++ } else {
++ /*
++ * For MT2701, disable double buffer before writing register
++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++ */
++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++ mdp->data->bls_debug_mask,
++ mdp->data->bls_debug_mask);
++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++ mdp->data->con0_sel,
++ mdp->data->con0_sel);
+ }
+
+- clk_disable(mdp->clk_mm);
+- clk_disable(mdp->clk_main);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+
+ return 0;
+ }
+@@ -143,13 +160,16 @@ static int mtk_disp_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ struct mtk_disp_pwm *mdp = to_mtk_disp_pwm(chip);
+ int err;
+
+- err = clk_enable(mdp->clk_main);
+- if (err < 0)
++ err = clk_prepare_enable(mdp->clk_main);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
+ return err;
++ }
+
+- err = clk_enable(mdp->clk_mm);
++ err = clk_prepare_enable(mdp->clk_mm);
+ if (err < 0) {
+- clk_disable(mdp->clk_main);
++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++ clk_disable_unprepare(mdp->clk_main);
+ return err;
+ }
+
+@@ -166,8 +186,8 @@ static void mtk_disp_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
+ 0x0);
+
+- clk_disable(mdp->clk_mm);
+- clk_disable(mdp->clk_main);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+ }
+
+ static const struct pwm_ops mtk_disp_pwm_ops = {
+@@ -202,14 +222,6 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ if (IS_ERR(mdp->clk_mm))
+ return PTR_ERR(mdp->clk_mm);
+
+- ret = clk_prepare(mdp->clk_main);
+- if (ret < 0)
+- return ret;
+-
+- ret = clk_prepare(mdp->clk_mm);
+- if (ret < 0)
+- goto disable_clk_main;
+-
+ mdp->chip.dev = &pdev->dev;
+ mdp->chip.ops = &mtk_disp_pwm_ops;
+ mdp->chip.base = -1;
+@@ -217,32 +229,13 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+
+ ret = pwmchip_add(&mdp->chip);
+ if (ret < 0) {
+- dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+- goto disable_clk_mm;
++ dev_err(&pdev->dev, "pwmchip_add() failed: %pe\n", ERR_PTR(ret));
++ return ret;
+ }
+
+ platform_set_drvdata(pdev, mdp);
+
+- /*
+- * For MT2701, disable double buffer before writing register
+- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+- */
+- if (!mdp->data->has_commit) {
+- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+- mdp->data->bls_debug_mask,
+- mdp->data->bls_debug_mask);
+- mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+- mdp->data->con0_sel,
+- mdp->data->con0_sel);
+- }
+-
+ return 0;
+-
+-disable_clk_mm:
+- clk_unprepare(mdp->clk_mm);
+-disable_clk_main:
+- clk_unprepare(mdp->clk_main);
+- return ret;
+ }
+
+ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+@@ -250,8 +243,6 @@ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+ struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev);
+
+ pwmchip_remove(&mdp->chip);
+- clk_unprepare(mdp->clk_mm);
+- clk_unprepare(mdp->clk_main);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 4ceed5f18ed6887d71c5474ca63bf85e792f2bf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 15:30:53 +0200
+Subject: pwm: mtk-disp: Disable shadow registers before setting backlight
+ values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ]
+
+If shadow registers usage is not desired, disable that before performing
+any write to CON0/1 registers in the .apply() callback, otherwise we may
+lose clkdiv or period/width updates.
+
+Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Tested-by: Alexandre Mergnat <amergnat@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 6d08938866048..c49b1e696b8c4 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -122,6 +122,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ high_width = div64_u64(rate * duty_ns, div);
+ value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+
++ if (mdp->data->bls_debug && !mdp->data->has_commit) {
++ /*
++ * For MT2701, disable double buffer before writing register
++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++ */
++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++ mdp->data->bls_debug_mask,
++ mdp->data->bls_debug_mask);
++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++ mdp->data->con0_sel,
++ mdp->data->con0_sel);
++ }
++
+ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+ PWM_CLKDIV_MASK,
+ clk_div << PWM_CLKDIV_SHIFT);
+@@ -136,17 +149,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ mtk_disp_pwm_update_bits(mdp, mdp->data->commit,
+ mdp->data->commit_mask,
+ 0x0);
+- } else {
+- /*
+- * For MT2701, disable double buffer before writing register
+- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+- */
+- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+- mdp->data->bls_debug_mask,
+- mdp->data->bls_debug_mask);
+- mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+- mdp->data->con0_sel,
+- mdp->data->con0_sel);
+ }
+
+ clk_disable_unprepare(mdp->clk_mm);
+--
+2.39.2
+
--- /dev/null
+From 393b6c4ff0afa2151e0d77de4182b70a789580f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 18:28:27 +0200
+Subject: pwm: mtk-disp: Don't check the return code of pwmchip_remove()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 9b7b5736ffd5da6f8f6329ebe5f1829cbcf8afae ]
+
+pwmchip_remove() returns always 0. Don't use the value to make it
+possible to eventually change the function to return void. Also the
+driver core ignores the return value of mtk_disp_pwm_remove().
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 893940d45f0d0..dd31a00d6326c 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -248,13 +248,12 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+ {
+ struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev);
+- int ret;
+
+- ret = pwmchip_remove(&mdp->chip);
++ pwmchip_remove(&mdp->chip);
+ clk_unprepare(mdp->clk_mm);
+ clk_unprepare(mdp->clk_main);
+
+- return ret;
++ return 0;
+ }
+
+ static const struct mtk_pwm_data mt2701_pwm_data = {
+--
+2.39.2
+
--- /dev/null
+From 8bd7dfc2e71aa6e8514de70a00b03683ad7b1f99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 12:51:27 +0300
+Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ]
+
+The ucmd->log_sq_bb_count variable is controlled by the user so this
+shift can wrap. Fix it by using check_shl_overflow() in the same way
+that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
+behavior in hns_roce_set_user_sq_size()").
+
+Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/qp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 7209b8a9b0dd2..87358b8c45589 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -436,9 +436,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev,
+ struct mlx4_ib_qp *qp,
+ struct mlx4_ib_create_qp *ucmd)
+ {
++ u32 cnt;
++
+ /* Sanity check SQ size before proceeding */
+- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes ||
+- ucmd->log_sq_stride >
++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) ||
++ cnt > dev->dev->caps.max_wqes)
++ return -EINVAL;
++ if (ucmd->log_sq_stride >
+ ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) ||
+ ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE)
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 1d108ff91790cd92d736ef2d71c8f9ae1e38f098 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 04:39:06 +0300
+Subject: RDMA/mlx5: Use correct device num_ports when modify DC
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ]
+
+Just like other QP types, when modify DC, the port_num should be compared
+with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port
+vHCA on DC may not work.
+
+Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP")
+Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 1520a3098f7dc..0455abfba41c2 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3350,7 +3350,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ return -EINVAL;
+
+ if (attr->port_num == 0 ||
+- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) {
++ attr->port_num > dev->num_ports) {
+ mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n",
+ attr->port_num, dev->num_ports);
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From de9029d82adcf9a8b83269ad1c9ef71451004142 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 15:44:08 +0300
+Subject: RDMA/rdmavt: Delete unnecessary NULL check
+
+From: Natalia Petrova <n.petrova@fintech.ru>
+
+[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ]
+
+There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev'
+is created in rvt_register_device() which will fail if the 'qp_dev'
+allocation fails in rvt_driver_qp_init(). Overwise this pointer
+doesn't changed and passed to rvt_qp_exit() by the next step.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table")
+Signed-off-by: Natalia Petrova <n.petrova@fintech.ru>
+Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rdmavt/qp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index fbc316775669c..c12fc2eace161 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -321,8 +321,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi)
+ if (qps_inuse)
+ rvt_pr_err(rdi, "QP memory leak! %u still in use\n",
+ qps_inuse);
+- if (!rdi->qp_dev)
+- return;
+
+ kfree(rdi->qp_dev->qp_table);
+ free_qpn_table(&rdi->qp_dev->qpn_table);
+--
+2.39.2
+
--- /dev/null
+From 815ccadfcbd14180945cd2b4e8fdc7dde4dffb9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 18:30:06 +0800
+Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove
+ due to unfinished work"
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ]
+
+This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f.
+
+This patch introduces a possible null-ptr-def problem. Revert it. And the
+fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth:
+btsdio: fix use after free bug in btsdio_remove due to race condition").
+
+Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btsdio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
+index bd55bf7a9914c..20142bc77554c 100644
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -353,7 +353,6 @@ static void btsdio_remove(struct sdio_func *func)
+
+ BT_DBG("func %p", func);
+
+- cancel_work_sync(&data->work);
+ if (!data)
+ return;
+
+--
+2.39.2
+
--- /dev/null
+From 9a69181b79e0e6da48293b2321b232d2cad185b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 15:42:31 -0500
+Subject: rtlwifi: Replace RT_TRACE with rtl_dbg
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit f108a420e50a62e0bc5cdcd7d4a2440986b526e3 ]
+
+The macro name RT_TRACE makes it seem that it is used for tracing, when
+is actually used for debugging. Change the name to rtl_dbg. Any Sparse
+errors exposed by this change were also fixed.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200723204244.24457-3-Larry.Finger@lwfinger.net
+Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 144 +++++-----
+ drivers/net/wireless/realtek/rtlwifi/cam.c | 82 +++---
+ drivers/net/wireless/realtek/rtlwifi/core.c | 259 ++++++++---------
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 4 +-
+ drivers/net/wireless/realtek/rtlwifi/efuse.c | 72 ++---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 282 +++++++++----------
+ drivers/net/wireless/realtek/rtlwifi/ps.c | 98 +++----
+ drivers/net/wireless/realtek/rtlwifi/regd.c | 18 +-
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 18 +-
+ 9 files changed, 488 insertions(+), 489 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index 6d1b6a4a81502..7644d7cbcb5af 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -217,8 +217,8 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
+ } else {
+ if (get_rf_type(rtlphy) == RF_1T2R ||
+ get_rf_type(rtlphy) == RF_2T2R) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "1T2R or 2T2R\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "1T2R or 2T2R\n");
+ ht_cap->mcs.rx_mask[0] = 0xFF;
+ ht_cap->mcs.rx_mask[1] = 0xFF;
+ ht_cap->mcs.rx_mask[4] = 0x01;
+@@ -226,7 +226,7 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
+ ht_cap->mcs.rx_highest =
+ cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS15);
+ } else if (get_rf_type(rtlphy) == RF_1T1R) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
+
+ ht_cap->mcs.rx_mask[0] = 0xFF;
+ ht_cap->mcs.rx_mask[1] = 0x00;
+@@ -1344,7 +1344,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
+ rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+ }
+ if (ieee80211_is_auth(fc)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
+
+ mac->link_state = MAC80211_LINKING;
+ /* Dul mac */
+@@ -1405,7 +1405,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ if (mac->act_scanning)
+ return false;
+
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+ "%s ACT_ADDBAREQ From :%pM\n",
+ is_tx ? "Tx" : "Rx", hdr->addr2);
+ RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, "req\n",
+@@ -1420,8 +1420,8 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ rcu_read_lock();
+ sta = rtl_find_sta(hw, hdr->addr3);
+ if (sta == NULL) {
+- RT_TRACE(rtlpriv, COMP_SEND | COMP_RECV,
+- DBG_DMESG, "sta is NULL\n");
++ rtl_dbg(rtlpriv, COMP_SEND | COMP_RECV,
++ DBG_DMESG, "sta is NULL\n");
+ rcu_read_unlock();
+ return true;
+ }
+@@ -1448,13 +1448,13 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ }
+ break;
+ case ACT_ADDBARSP:
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "%s ACT_ADDBARSP From :%pM\n",
+- is_tx ? "Tx" : "Rx", hdr->addr2);
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "%s ACT_ADDBARSP From :%pM\n",
++ is_tx ? "Tx" : "Rx", hdr->addr2);
+ break;
+ case ACT_DELBA:
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "ACT_ADDBADEL From :%pM\n", hdr->addr2);
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "ACT_ADDBADEL From :%pM\n", hdr->addr2);
+ break;
+ }
+ break;
+@@ -1539,9 +1539,9 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
+ /* 68 : UDP BOOTP client
+ * 67 : UDP BOOTP server
+ */
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV),
+- DBG_DMESG, "dhcp %s !!\n",
+- (is_tx) ? "Tx" : "Rx");
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV),
++ DBG_DMESG, "dhcp %s !!\n",
++ (is_tx) ? "Tx" : "Rx");
+
+ if (is_tx)
+ setup_special_tx(rtlpriv, ppsc,
+@@ -1560,8 +1560,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
+ rtlpriv->btcoexist.btc_info.in_4way = true;
+ rtlpriv->btcoexist.btc_info.in_4way_ts = jiffies;
+
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx");
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx");
+
+ if (is_tx) {
+ rtlpriv->ra.is_special_data = true;
+@@ -1603,12 +1603,12 @@ static void rtl_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
+ info = IEEE80211_SKB_CB(skb);
+ ieee80211_tx_info_clear_status(info);
+ if (ack) {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
+- "tx report: ack\n");
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
++ "tx report: ack\n");
+ info->flags |= IEEE80211_TX_STAT_ACK;
+ } else {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
+- "tx report: not ack\n");
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
++ "tx report: not ack\n");
+ info->flags &= ~IEEE80211_TX_STAT_ACK;
+ }
+ ieee80211_tx_status_irqsafe(hw, skb);
+@@ -1646,8 +1646,8 @@ static u16 rtl_get_tx_report_sn(struct ieee80211_hw *hw,
+ tx_report->last_sent_time = jiffies;
+ tx_info->sn = sn;
+ tx_info->send_time = tx_report->last_sent_time;
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
+- "Send TX-Report sn=0x%X\n", sn);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
++ "Send TX-Report sn=0x%X\n", sn);
+
+ return sn;
+ }
+@@ -1694,9 +1694,9 @@ void rtl_tx_report_handler(struct ieee80211_hw *hw, u8 *tmp_buf, u8 c2h_cmd_len)
+ break;
+ }
+ }
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
+- "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n",
+- st, sn, retry);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
++ "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n",
++ st, sn, retry);
+ }
+ EXPORT_SYMBOL_GPL(rtl_tx_report_handler);
+
+@@ -1709,9 +1709,9 @@ bool rtl_check_tx_report_acked(struct ieee80211_hw *hw)
+ return true;
+
+ if (time_before(tx_report->last_sent_time + 3 * HZ, jiffies)) {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_WARNING,
+- "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n",
+- tx_report->last_sent_sn, tx_report->last_recv_sn);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_WARNING,
++ "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n",
++ tx_report->last_sent_sn, tx_report->last_recv_sn);
+ return true; /* 3 sec. (timeout) seen as acked */
+ }
+
+@@ -1727,8 +1727,8 @@ void rtl_wait_tx_report_acked(struct ieee80211_hw *hw, u32 wait_ms)
+ if (rtl_check_tx_report_acked(hw))
+ break;
+ usleep_range(1000, 2000);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms);
+ }
+ }
+
+@@ -1790,9 +1790,9 @@ int rtl_tx_agg_start(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ return -ENXIO;
+ tid_data = &sta_entry->tids[tid];
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d seq:%d\n", sta->addr, tid,
+- *ssn);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d seq:%d\n", sta->addr, tid,
++ *ssn);
+
+ tid_data->agg.agg_state = RTL_AGG_START;
+
+@@ -1809,8 +1809,8 @@ int rtl_tx_agg_stop(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1849,8 +1849,8 @@ int rtl_rx_agg_start(struct ieee80211_hw *hw,
+ return -ENXIO;
+ tid_data = &sta_entry->tids[tid];
+
+- RT_TRACE(rtlpriv, COMP_RECV, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_RECV, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ tid_data->agg.rx_agg_state = RTL_RX_AGG_START;
+ return 0;
+@@ -1865,8 +1865,8 @@ int rtl_rx_agg_stop(struct ieee80211_hw *hw,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1885,8 +1885,8 @@ int rtl_tx_agg_oper(struct ieee80211_hw *hw,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1906,9 +1906,9 @@ void rtl_rx_ampdu_apply(struct rtl_priv *rtlpriv)
+ btc_ops->btc_get_ampdu_cfg(rtlpriv, &reject_agg,
+ &ctrl_agg_size, &agg_size);
+
+- RT_TRACE(rtlpriv, COMP_BT_COEXIST, DBG_DMESG,
+- "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d",
+- reject_agg, ctrl_agg_size, agg_size);
++ rtl_dbg(rtlpriv, COMP_BT_COEXIST, DBG_DMESG,
++ "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d",
++ reject_agg, ctrl_agg_size, agg_size);
+
+ rtlpriv->hw->max_rx_aggregation_subframes =
+ (ctrl_agg_size ? agg_size : IEEE80211_MAX_AMPDU_BUF_HT);
+@@ -1996,9 +1996,9 @@ void rtl_scan_list_expire(struct ieee80211_hw *hw)
+ list_del(&entry->list);
+ rtlpriv->scan_list.num--;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "BSSID=%pM is expire in scan list (total=%d)\n",
+- entry->bssid, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "BSSID=%pM is expire in scan list (total=%d)\n",
++ entry->bssid, rtlpriv->scan_list.num);
+ kfree(entry);
+ }
+
+@@ -2032,9 +2032,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) {
+ list_del_init(&entry->list);
+ entry_found = true;
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "Update BSSID=%pM to scan list (total=%d)\n",
+- hdr->addr3, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "Update BSSID=%pM to scan list (total=%d)\n",
++ hdr->addr3, rtlpriv->scan_list.num);
+ break;
+ }
+ }
+@@ -2048,9 +2048,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ memcpy(entry->bssid, hdr->addr3, ETH_ALEN);
+ rtlpriv->scan_list.num++;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "Add BSSID=%pM to scan list (total=%d)\n",
+- hdr->addr3, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "Add BSSID=%pM to scan list (total=%d)\n",
++ hdr->addr3, rtlpriv->scan_list.num);
+ }
+
+ entry->age = jiffies;
+@@ -2213,8 +2213,8 @@ void rtl_watchdog_wq_callback(void *data)
+ if ((rtlpriv->link_info.bcn_rx_inperiod +
+ rtlpriv->link_info.num_rx_inperiod) == 0) {
+ rtlpriv->link_info.roam_times++;
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "AP off for %d s\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "AP off for %d s\n",
+ (rtlpriv->link_info.roam_times * 2));
+
+ /* if we can't recv beacon for 10s,
+@@ -2325,11 +2325,11 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw,
+
+ switch (cmd_id) {
+ case C2H_DBG:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n");
+ break;
+ case C2H_TXBF:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_TXBF!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_TXBF!!\n");
+ break;
+ case C2H_TX_REPORT:
+ rtl_tx_report_handler(hw, cmd_buf, cmd_len);
+@@ -2339,20 +2339,20 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw,
+ hal_ops->c2h_ra_report_handler(hw, cmd_buf, cmd_len);
+ break;
+ case C2H_BT_INFO:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_BT_INFO!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_BT_INFO!!\n");
+ if (rtlpriv->cfg->ops->get_btc_status())
+ btc_ops->btc_btinfo_notify(rtlpriv, cmd_buf, cmd_len);
+ break;
+ case C2H_BT_MP:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_BT_MP!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_BT_MP!!\n");
+ if (rtlpriv->cfg->ops->get_btc_status())
+ btc_ops->btc_btmpinfo_notify(rtlpriv, cmd_buf, cmd_len);
+ break;
+ default:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id);
+ break;
+ }
+ }
+@@ -2376,8 +2376,8 @@ void rtl_c2hcmd_launcher(struct ieee80211_hw *hw, int exec)
+ if (!skb)
+ break;
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n",
+- *((u8 *)skb->cb));
++ rtl_dbg(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n",
++ *((u8 *)skb->cb));
+ RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_DMESG,
+ "C2H data: ", skb->data, skb->len);
+
+@@ -2721,29 +2721,29 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
+ (memcmp(mac->bssid, ap5_6, 3) == 0) ||
+ vendor == PEER_ATH) {
+ vendor = PEER_ATH;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n");
+ } else if ((memcmp(mac->bssid, ap4_4, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_5, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_1, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_2, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_3, 3) == 0) ||
+ vendor == PEER_RAL) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n");
+ vendor = PEER_RAL;
+ } else if (memcmp(mac->bssid, ap6_1, 3) == 0 ||
+ vendor == PEER_CISCO) {
+ vendor = PEER_CISCO;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n");
+ } else if ((memcmp(mac->bssid, ap3_1, 3) == 0) ||
+ (memcmp(mac->bssid, ap3_2, 3) == 0) ||
+ (memcmp(mac->bssid, ap3_3, 3) == 0) ||
+ vendor == PEER_BROAD) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n");
+ vendor = PEER_BROAD;
+ } else if (memcmp(mac->bssid, ap7_1, 3) == 0 ||
+ vendor == PEER_MARV) {
+ vendor = PEER_MARV;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n");
+ }
+
+ mac->vendor = vendor;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/cam.c b/drivers/net/wireless/realtek/rtlwifi/cam.c
+index f7a7dcbf945ef..c631295258752 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/cam.c
++++ b/drivers/net/wireless/realtek/rtlwifi/cam.c
+@@ -64,14 +64,14 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE %x: %x\n",
+- rtlpriv->cfg->maps[WCAMI], target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "The Key ID is %d\n", entry_no);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE %x: %x\n",
+- rtlpriv->cfg->maps[RWCAM], target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE %x: %x\n",
++ rtlpriv->cfg->maps[WCAMI], target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "The Key ID is %d\n", entry_no);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE %x: %x\n",
++ rtlpriv->cfg->maps[RWCAM], target_command);
+
+ } else if (entry_i == 1) {
+
+@@ -85,10 +85,10 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A4: %x\n", target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A0: %x\n", target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A4: %x\n", target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A0: %x\n", target_command);
+
+ } else {
+
+@@ -104,15 +104,15 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A4: %x\n", target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A0: %x\n", target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A4: %x\n", target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A0: %x\n", target_command);
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "after set key, usconfig:%x\n", us_config);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "after set key, usconfig:%x\n", us_config);
+ }
+
+ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+@@ -122,14 +122,14 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+ u32 us_config;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n",
+- ul_entry_idx, ul_key_id, ul_enc_alg,
+- ul_default_key, mac_addr);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n",
++ ul_entry_idx, ul_key_id, ul_enc_alg,
++ ul_default_key, mac_addr);
+
+ if (ul_key_id == TOTAL_CAM_ENTRY) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "ulKeyId exceed!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "ulKeyId exceed!\n");
+ return 0;
+ }
+
+@@ -141,7 +141,7 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+ rtl_cam_program_entry(hw, ul_entry_idx, mac_addr,
+ (u8 *)key_content, us_config);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "end\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "end\n");
+
+ return 1;
+
+@@ -154,7 +154,7 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw,
+ u32 ul_command;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id);
+
+ ul_command = ul_key_id * CAM_CONTENT_COUNT;
+ ul_command = ul_command | BIT(31) | BIT(16);
+@@ -162,10 +162,10 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], 0);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_delete_one_entry(): WRITE A4: %x\n", 0);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_delete_one_entry(): WRITE A0: %x\n", ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A4: %x\n", __func__, 0);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+
+ return 0;
+
+@@ -216,10 +216,10 @@ void rtl_cam_mark_invalid(struct ieee80211_hw *hw, u8 uc_index)
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_mark_invalid(): WRITE A4: %x\n", ul_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_mark_invalid(): WRITE A0: %x\n", ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A4: %x\n", __func__, ul_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+ }
+ EXPORT_SYMBOL(rtl_cam_mark_invalid);
+
+@@ -266,12 +266,10 @@ void rtl_cam_empty_entry(struct ieee80211_hw *hw, u8 uc_index)
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "rtl_cam_empty_entry(): WRITE A4: %x\n",
+- ul_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "rtl_cam_empty_entry(): WRITE A0: %x\n",
+- ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "%s: WRITE A4: %x\n", __func__, ul_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+ }
+
+ }
+@@ -334,8 +332,8 @@ void rtl_cam_del_entry(struct ieee80211_hw *hw, u8 *sta_addr)
+ /* Remove from HW Security CAM */
+ eth_zero_addr(rtlpriv->sec.hwsec_cam_sta_addr[i]);
+ rtlpriv->sec.hwsec_cam_bitmap &= ~(BIT(0) << i);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "&&&&&&&&&del entry %d\n", i);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "&&&&&&&&&del entry %d\n", i);
+ }
+ }
+ return;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
+index 4bf7967590ca7..0ad4e0f099f95 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -98,8 +98,8 @@ static void rtl_fw_do_work(const struct firmware *firmware, void *context,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ int err;
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+- "Firmware callback routine entered!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
++ "Firmware callback routine entered!\n");
+ complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
+ if (rtlpriv->cfg->alt_fw_name) {
+@@ -235,8 +235,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ u8 retry_limit = 0x30;
+
+ if (mac->vif) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "vif has been set!! mac->vif = 0x%p\n", mac->vif);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "vif has been set!! mac->vif = 0x%p\n", mac->vif);
+ return -EOPNOTSUPP;
+ }
+
+@@ -251,16 +251,16 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ /*fall through*/
+ case NL80211_IFTYPE_STATION:
+ if (mac->beacon_enabled == 1) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_STATION\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_STATION\n");
+ mac->beacon_enabled = 0;
+ rtlpriv->cfg->ops->update_interrupt_mask(hw, 0,
+ rtlpriv->cfg->maps[RTL_IBSS_INT_MASKS]);
+ }
+ break;
+ case NL80211_IFTYPE_ADHOC:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_ADHOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_ADHOC\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -277,8 +277,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ mac->p2p = P2P_ROLE_GO;
+ /*fall through*/
+ case NL80211_IFTYPE_AP:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_AP\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_AP\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -292,8 +292,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ retry_limit = 0x07;
+ break;
+ case NL80211_IFTYPE_MESH_POINT:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_MESH_POINT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_MESH_POINT\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -314,8 +314,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ }
+
+ if (mac->p2p) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "p2p role %x\n", vif->type);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "p2p role %x\n", vif->type);
+ mac->basic_rates = 0xff0;/*disable cck rate for p2p*/
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
+ (u8 *)(&mac->basic_rates));
+@@ -379,8 +379,8 @@ static int rtl_op_change_interface(struct ieee80211_hw *hw,
+ vif->type = new_type;
+ vif->p2p = p2p;
+ ret = rtl_op_add_interface(hw, vif);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "p2p %x\n", p2p);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "p2p %x\n", p2p);
+ return ret;
+ }
+
+@@ -454,8 +454,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw,
+ memset(mask, 0, MAX_WOL_BIT_MASK_SIZE);
+ if (patterns[i].pattern_len < 0 ||
+ patterns[i].pattern_len > MAX_WOL_PATTERN_SIZE) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_WARNING,
+- "Pattern[%d] is too long\n", i);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_WARNING,
++ "Pattern[%d] is too long\n", i);
+ continue;
+ }
+ pattern_os = patterns[i].pattern;
+@@ -534,8 +534,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw,
+ "pattern to hw\n", content, len);
+ /* 3. calculate crc */
+ rtl_pattern.crc = _calculate_wol_pattern_crc(content, len);
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "CRC_Remainder = 0x%x\n", rtl_pattern.crc);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "CRC_Remainder = 0x%x\n", rtl_pattern.crc);
+
+ /* 4. write crc & mask_for_hw to hw */
+ rtlpriv->cfg->ops->add_wowlan_pattern(hw, &rtl_pattern, i);
+@@ -550,7 +550,7 @@ static int rtl_op_suspend(struct ieee80211_hw *hw,
+ struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
+ struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
+ if (WARN_ON(!wow))
+ return -EINVAL;
+
+@@ -576,7 +576,7 @@ static int rtl_op_resume(struct ieee80211_hw *hw)
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ time64_t now;
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
+ rtlhal->driver_is_goingto_unload = false;
+ rtlhal->enter_pnp_sleep = false;
+ rtlhal->wake_from_pnp_sleep = true;
+@@ -607,8 +607,8 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
+
+ mutex_lock(&rtlpriv->locks.conf_mutex);
+ if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) { /* BIT(2)*/
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n");
+ }
+
+ /*For IPS */
+@@ -651,9 +651,9 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
+ }
+
+ if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n",
+- hw->conf.long_frame_max_tx_count);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n",
++ hw->conf.long_frame_max_tx_count);
+ /* brought up everything changes (changed == ~0) indicates first
+ * open, so use our default value instead of that of wiphy.
+ */
+@@ -828,13 +828,13 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (*new_flags & FIF_ALLMULTI) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AM] |
+ rtlpriv->cfg->maps[MAC_RCR_AB];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive multicast frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive multicast frame\n");
+ } else {
+ mac->rx_conf &= ~(rtlpriv->cfg->maps[MAC_RCR_AM] |
+ rtlpriv->cfg->maps[MAC_RCR_AB]);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive multicast frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive multicast frame\n");
+ }
+ update_rcr = true;
+ }
+@@ -842,12 +842,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (changed_flags & FIF_FCSFAIL) {
+ if (*new_flags & FIF_FCSFAIL) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACRC32];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive FCS error frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive FCS error frame\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACRC32];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive FCS error frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive FCS error frame\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -874,12 +874,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (*new_flags & FIF_CONTROL) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACF];
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive control frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive control frame.\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACF];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive control frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive control frame.\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -888,12 +888,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (changed_flags & FIF_OTHER_BSS) {
+ if (*new_flags & FIF_OTHER_BSS) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AAP];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive other BSS's frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive other BSS's frame.\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_AAP];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive other BSS's frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive other BSS's frame.\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -941,7 +941,7 @@ static int rtl_op_sta_add(struct ieee80211_hw *hw,
+ sta->supp_rates[0] &= 0xfffffff0;
+
+ memcpy(sta_entry->mac_addr, sta->addr, ETH_ALEN);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
+ "Add sta addr is %pM\n", sta->addr);
+ rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0, true);
+ }
+@@ -956,8 +956,8 @@ static int rtl_op_sta_remove(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_sta_info *sta_entry;
+ if (sta) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "Remove sta addr is %pM\n", sta->addr);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "Remove sta addr is %pM\n", sta->addr);
+ sta_entry = (struct rtl_sta_info *)sta->drv_priv;
+ sta_entry->wireless_mode = 0;
+ sta_entry->ratr_index = 0;
+@@ -1004,8 +1004,8 @@ static int rtl_op_conf_tx(struct ieee80211_hw *hw,
+ int aci;
+
+ if (queue >= AC_MAX) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "queue number %d is incorrect!\n", queue);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "queue number %d is incorrect!\n", queue);
+ return -EINVAL;
+ }
+
+@@ -1050,8 +1050,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ (changed & BSS_CHANGED_BEACON_ENABLED &&
+ bss_conf->enable_beacon)) {
+ if (mac->beacon_enabled == 0) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_BEACON_ENABLED\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_BEACON_ENABLED\n");
+
+ /*start hw beacon interrupt. */
+ /*rtlpriv->cfg->ops->set_bcn_reg(hw); */
+@@ -1068,8 +1068,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if ((changed & BSS_CHANGED_BEACON_ENABLED &&
+ !bss_conf->enable_beacon)) {
+ if (mac->beacon_enabled == 1) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "ADHOC DISABLE BEACON\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "ADHOC DISABLE BEACON\n");
+
+ mac->beacon_enabled = 0;
+ rtlpriv->cfg->ops->update_interrupt_mask(hw, 0,
+@@ -1078,8 +1078,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+ }
+ if (changed & BSS_CHANGED_BEACON_INT) {
+- RT_TRACE(rtlpriv, COMP_BEACON, DBG_TRACE,
+- "BSS_CHANGED_BEACON_INT\n");
++ rtl_dbg(rtlpriv, COMP_BEACON, DBG_TRACE,
++ "BSS_CHANGED_BEACON_INT\n");
+ mac->beacon_interval = bss_conf->beacon_int;
+ rtlpriv->cfg->ops->set_bcn_intv(hw);
+ }
+@@ -1117,8 +1117,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ rcu_read_unlock();
+ goto out;
+ }
+- RT_TRACE(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD,
+- "send PS STATIC frame\n");
++ rtl_dbg(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD,
++ "send PS STATIC frame\n");
+ if (rtlpriv->dm.supp_phymode_switch) {
+ if (sta->ht_cap.ht_supported)
+ rtl_send_smps_action(hw, sta,
+@@ -1158,8 +1158,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ HW_VAR_KEEP_ALIVE,
+ (u8 *)(&keep_alive));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_ASSOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_ASSOC\n");
+ } else {
+ struct cfg80211_bss *bss = NULL;
+
+@@ -1176,14 +1176,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ IEEE80211_BSS_TYPE_ESS,
+ IEEE80211_PRIVACY_OFF);
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "bssid = %pMF\n", mac->bssid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "bssid = %pMF\n", mac->bssid);
+
+ if (bss) {
+ cfg80211_unlink_bss(hw->wiphy, bss);
+ cfg80211_put_bss(hw->wiphy, bss);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "cfg80211_unlink !!\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "cfg80211_unlink !!\n");
+ }
+
+ eth_zero_addr(mac->bssid);
+@@ -1194,8 +1194,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if (rtlpriv->cfg->ops->chk_switch_dmdp)
+ rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+ }
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_UN_ASSOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_UN_ASSOC\n");
+ }
+ rtlpriv->cfg->ops->set_network_type(hw, vif->type);
+ /* For FW LPS:
+@@ -1213,14 +1213,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+
+ if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_ERP_CTS_PROT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_ERP_CTS_PROT\n");
+ mac->use_cts_protect = bss_conf->use_cts_prot;
+ }
+
+ if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n",
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n",
+ bss_conf->use_short_preamble);
+
+ mac->short_preamble = bss_conf->use_short_preamble;
+@@ -1229,8 +1229,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+
+ if (changed & BSS_CHANGED_ERP_SLOT) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_ERP_SLOT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_ERP_SLOT\n");
+
+ if (bss_conf->use_short_slot)
+ mac->slot_time = RTL_SLOT_TIME_9;
+@@ -1244,8 +1244,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if (changed & BSS_CHANGED_HT) {
+ struct ieee80211_sta *sta = NULL;
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_HT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_HT\n");
+
+ rcu_read_lock();
+ sta = ieee80211_find_sta(vif, (u8 *)bss_conf->bssid);
+@@ -1276,8 +1276,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BSSID,
+ (u8 *)bss_conf->bssid);
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "bssid: %pM\n", bss_conf->bssid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "bssid: %pM\n", bss_conf->bssid);
+
+ mac->vendor = PEER_UNKNOWN;
+ memcpy(mac->bssid, bss_conf->bssid, ETH_ALEN);
+@@ -1407,27 +1407,27 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
+
+ switch (action) {
+ case IEEE80211_AMPDU_TX_START:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_START: TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_START: TID:%d\n", tid);
+ return rtl_tx_agg_start(hw, vif, sta, tid, ssn);
+ case IEEE80211_AMPDU_TX_STOP_CONT:
+ case IEEE80211_AMPDU_TX_STOP_FLUSH:
+ case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
+ return rtl_tx_agg_stop(hw, vif, sta, tid);
+ case IEEE80211_AMPDU_TX_OPERATIONAL:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid);
+ rtl_tx_agg_oper(hw, sta, tid);
+ break;
+ case IEEE80211_AMPDU_RX_START:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_RX_START:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_RX_START:TID:%d\n", tid);
+ return rtl_rx_agg_start(hw, sta, tid);
+ case IEEE80211_AMPDU_RX_STOP:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid);
+ return rtl_rx_agg_stop(hw, sta, tid);
+ default:
+ pr_err("IEEE80211_AMPDU_ERR!!!!:\n");
+@@ -1443,7 +1443,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
+ mac->act_scanning = true;
+ if (rtlpriv->link_info.higher_busytraffic) {
+ mac->skip_scan = true;
+@@ -1481,7 +1481,7 @@ static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
+ mac->act_scanning = false;
+ mac->skip_scan = false;
+
+@@ -1531,8 +1531,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->btcoexist.btc_info.in_4way = false;
+
+ if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "not open hw encryption\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "not open hw encryption\n");
+ return -ENOSPC; /*User disabled HW-crypto */
+ }
+ /* To support IBSS, use sw-crypto for GTK */
+@@ -1540,10 +1540,10 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ vif->type == NL80211_IFTYPE_MESH_POINT) &&
+ !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+ return -ENOSPC;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "%s hardware based encryption for keyidx: %d, mac: %pM\n",
+- cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
+- sta ? sta->addr : bcast_addr);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s hardware based encryption for keyidx: %d, mac: %pM\n",
++ cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
++ sta ? sta->addr : bcast_addr);
+ rtlpriv->sec.being_setkey = true;
+ rtl_ips_nic_on(hw);
+ mutex_lock(&rtlpriv->locks.conf_mutex);
+@@ -1552,28 +1552,28 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ switch (key->cipher) {
+ case WLAN_CIPHER_SUITE_WEP40:
+ key_type = WEP40_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n");
+ break;
+ case WLAN_CIPHER_SUITE_WEP104:
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n");
+ key_type = WEP104_ENCRYPTION;
+ break;
+ case WLAN_CIPHER_SUITE_TKIP:
+ key_type = TKIP_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n");
+ break;
+ case WLAN_CIPHER_SUITE_CCMP:
+ key_type = AESCCMP_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n");
+ break;
+ case WLAN_CIPHER_SUITE_AES_CMAC:
+ /* HW don't support CMAC encryption,
+ * use software CMAC encryption
+ */
+ key_type = AESCMAC_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n");
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "HW don't support CMAC encryption, use software CMAC encryption\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "HW don't support CMAC encryption, use software CMAC encryption\n");
+ err = -EOPNOTSUPP;
+ goto out_unlock;
+ default:
+@@ -1619,9 +1619,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ key_type == WEP104_ENCRYPTION))
+ wep_only = true;
+ rtlpriv->sec.pairwise_enc_algorithm = key_type;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n",
+- key_type);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n",
++ key_type);
+ rtlpriv->cfg->ops->enable_hw_sec(hw);
+ }
+ }
+@@ -1629,8 +1629,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ switch (cmd) {
+ case SET_KEY:
+ if (wep_only) {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set WEP(group/pairwise) key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set WEP(group/pairwise) key\n");
+ /* Pairwise key with an assigned MAC address. */
+ rtlpriv->sec.pairwise_enc_algorithm = key_type;
+ rtlpriv->sec.group_enc_algorithm = key_type;
+@@ -1640,8 +1640,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->sec.key_len[key_idx] = key->keylen;
+ eth_zero_addr(mac_addr);
+ } else if (group_key) { /* group key */
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set group key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set group key\n");
+ /* group key */
+ rtlpriv->sec.group_enc_algorithm = key_type;
+ /*set local buf about group key. */
+@@ -1650,8 +1650,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->sec.key_len[key_idx] = key->keylen;
+ memcpy(mac_addr, bcast_addr, ETH_ALEN);
+ } else { /* pairwise key */
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set pairwise key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set pairwise key\n");
+ if (!sta) {
+ WARN_ONCE(true,
+ "rtlwifi: pairwise key without mac_addr\n");
+@@ -1683,8 +1683,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+ break;
+ case DISABLE_KEY:
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "disable key delete one entry\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "disable key delete one entry\n");
+ /*set local buf about wep key. */
+ if (vif->type == NL80211_IFTYPE_AP ||
+ vif->type == NL80211_IFTYPE_MESH_POINT) {
+@@ -1732,9 +1732,9 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw)
+ if (unlikely(radio_state != rtlpriv->rfkill.rfkill_state)) {
+ rtlpriv->rfkill.rfkill_state = radio_state;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "wireless radio switch turned %s\n",
+- radio_state ? "on" : "off");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "wireless radio switch turned %s\n",
++ radio_state ? "on" : "off");
+
+ blocked = (rtlpriv->rfkill.rfkill_state == 1) ? 0 : 1;
+ wiphy_rfkill_set_hw_state(hw->wiphy, blocked);
+@@ -1779,26 +1779,27 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+
+ do {
+ cfg_cmd = pwrcfgcmd[ary_idx];
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n",
+- GET_PWR_CFG_OFFSET(cfg_cmd),
+- GET_PWR_CFG_CUT_MASK(cfg_cmd),
+- GET_PWR_CFG_FAB_MASK(cfg_cmd),
+- GET_PWR_CFG_INTF_MASK(cfg_cmd),
+- GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd),
+- GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd));
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n",
++ __func__,
++ GET_PWR_CFG_OFFSET(cfg_cmd),
++ GET_PWR_CFG_CUT_MASK(cfg_cmd),
++ GET_PWR_CFG_FAB_MASK(cfg_cmd),
++ GET_PWR_CFG_INTF_MASK(cfg_cmd),
++ GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd),
++ GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd));
+
+ if ((GET_PWR_CFG_FAB_MASK(cfg_cmd)&faversion) &&
+ (GET_PWR_CFG_CUT_MASK(cfg_cmd)&cut_version) &&
+ (GET_PWR_CFG_INTF_MASK(cfg_cmd)&interface_type)) {
+ switch (GET_PWR_CFG_CMD(cfg_cmd)) {
+ case PWR_CMD_READ:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
+ "rtl_hal_pwrseqcmdparsing(): PWR_CMD_READ\n");
+ break;
+ case PWR_CMD_WRITE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "%s(): PWR_CMD_WRITE\n", __func__);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s(): PWR_CMD_WRITE\n", __func__);
+ offset = GET_PWR_CFG_OFFSET(cfg_cmd);
+
+ /*Read the value from system register*/
+@@ -1811,7 +1812,7 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ rtl_write_byte(rtlpriv, offset, value);
+ break;
+ case PWR_CMD_POLLING:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
+ "rtl_hal_pwrseqcmdparsing(): PWR_CMD_POLLING\n");
+ polling_bit = false;
+ offset = GET_PWR_CFG_OFFSET(cfg_cmd);
+@@ -1832,8 +1833,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ } while (!polling_bit);
+ break;
+ case PWR_CMD_DELAY:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_DELAY\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: PWR_CMD_DELAY\n", __func__);
+ if (GET_PWR_CFG_VALUE(cfg_cmd) ==
+ PWRSEQ_DELAY_US)
+ udelay(GET_PWR_CFG_OFFSET(cfg_cmd));
+@@ -1841,8 +1842,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ mdelay(GET_PWR_CFG_OFFSET(cfg_cmd));
+ break;
+ case PWR_CMD_END:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_END\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: PWR_CMD_END\n", __func__);
+ return true;
+ default:
+ WARN_ONCE(true,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index 474439fc2da1f..cead66f7eb9f5 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -425,8 +425,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ &path, &addr, &bitmask, &data);
+
+ if (num != 4) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "Format is <path> <addr> <mask> <data>\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "Format is <path> <addr> <mask> <data>\n");
+ return count;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c
+index 9729e51fce381..5d8995097ee79 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c
++++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c
+@@ -160,8 +160,8 @@ void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value)
+ const u32 efuse_len =
+ rtlpriv->cfg->maps[EFUSE_REAL_CONTENT_SIZE];
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n",
+- address, value);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n",
++ address, value);
+
+ if (address < efuse_len) {
+ rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL], value);
+@@ -251,9 +251,9 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
+ u8 efuse_usage;
+
+ if ((_offset + _size_byte) > rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]) {
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "read_efuse(): Invalid offset(%#x) with read bytes(%#x)!!\n",
+- _offset, _size_byte);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "%s: Invalid offset(%#x) with read bytes(%#x)!!\n",
++ __func__, _offset, _size_byte);
+ return;
+ }
+
+@@ -416,9 +416,9 @@ bool efuse_shadow_update_chk(struct ieee80211_hw *hw)
+ (EFUSE_MAX_SIZE - rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN]))
+ result = false;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse_shadow_update_chk(): totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n",
+- totalbytes, hdr_num, words_need, efuse_used);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "%s: totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n",
++ __func__, totalbytes, hdr_num, words_need, efuse_used);
+
+ return result;
+ }
+@@ -456,7 +456,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ u8 word_en = 0x0F;
+ u8 first_pg = false;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
+
+ if (!efuse_shadow_update_chk(hw)) {
+ efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]);
+@@ -464,8 +464,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ &rtlefuse->efuse_map[EFUSE_INIT_MAP][0],
+ rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]);
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse out of capacity!!\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "efuse out of capacity!!\n");
+ return false;
+ }
+ efuse_power_switch(hw, true, true);
+@@ -503,8 +503,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+
+ if (!efuse_pg_packet_write(hw, (u8) offset, word_en,
+ tmpdata)) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "PG section(%#x) fail!!\n", offset);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "PG section(%#x) fail!!\n", offset);
+ break;
+ }
+ }
+@@ -518,7 +518,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ &rtlefuse->efuse_map[EFUSE_INIT_MAP][0],
+ rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]);
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
+ return true;
+ }
+
+@@ -656,8 +656,8 @@ static int efuse_one_byte_write(struct ieee80211_hw *hw, u16 addr, u8 data)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u8 tmpidx = 0;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "Addr = %x Data=%x\n", addr, data);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "Addr = %x Data=%x\n", addr, data);
+
+ rtl_write_byte(rtlpriv,
+ rtlpriv->cfg->maps[EFUSE_CTRL] + 1, (u8) (addr & 0xff));
+@@ -1036,8 +1036,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
+
+ if (efuse_addr >= (EFUSE_MAX_SIZE -
+ rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) {
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse_addr(%#x) Out of size!!\n", efuse_addr);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "efuse_addr(%#x) Out of size!!\n", efuse_addr);
+ }
+
+ return true;
+@@ -1077,8 +1077,8 @@ static u8 enable_efuse_data_write(struct ieee80211_hw *hw,
+ u8 tmpdata[8];
+
+ memset(tmpdata, 0xff, PGPKT_DATA_SIZE);
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "word_en = %x efuse_addr=%x\n", word_en, efuse_addr);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "word_en = %x efuse_addr=%x\n", word_en, efuse_addr);
+
+ if (!(word_en & BIT(0))) {
+ tmpaddr = start_addr;
+@@ -1281,11 +1281,11 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv,
+
+ eeprom_id = *((u16 *)&hwinfo[0]);
+ if (eeprom_id != params[0]) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
+ rtlefuse->autoload_failflag = true;
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
+ rtlefuse->autoload_failflag = false;
+ }
+
+@@ -1296,30 +1296,30 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv,
+ rtlefuse->eeprom_did = *(u16 *)&hwinfo[params[2]];
+ rtlefuse->eeprom_svid = *(u16 *)&hwinfo[params[3]];
+ rtlefuse->eeprom_smid = *(u16 *)&hwinfo[params[4]];
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROMId = 0x%4x\n", eeprom_id);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROMId = 0x%4x\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
+
+ for (i = 0; i < 6; i += 2) {
+ usvalue = *(u16 *)&hwinfo[params[5] + i];
+ *((u16 *)(&rtlefuse->dev_addr[i])) = usvalue;
+ }
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
+
+ rtlefuse->eeprom_channelplan = *&hwinfo[params[6]];
+ rtlefuse->eeprom_version = *(u16 *)&hwinfo[params[7]];
+ rtlefuse->txpwr_fromeprom = true;
+ rtlefuse->eeprom_oemid = *&hwinfo[params[8]];
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid);
+
+ /* set channel plan to world wide 13 */
+ rtlefuse->channel_plan = params[9];
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 8bda1104bda85..0d22bd300f049 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -226,8 +226,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
+ return;
+
+ if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "PCI(Bridge) UNKNOWN\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "PCI(Bridge) UNKNOWN\n");
+
+ return;
+ }
+@@ -276,8 +276,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
+ return;
+
+ if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "PCI(Bridge) UNKNOWN\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "PCI(Bridge) UNKNOWN\n");
+ return;
+ }
+
+@@ -293,10 +293,10 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
+ pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
+ u_pcibridge_aspmsetting);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "PlatformEnableASPM(): Write reg[%x] = %x\n",
+- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
+- u_pcibridge_aspmsetting);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "PlatformEnableASPM(): Write reg[%x] = %x\n",
++ (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
++ u_pcibridge_aspmsetting);
+
+ udelay(50);
+
+@@ -353,11 +353,11 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list,
+ list) {
+ tpcipriv = (struct rtl_pci_priv *)tpriv->priv;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "pcipriv->ndis_adapter.funcnumber %x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "pcipriv->ndis_adapter.funcnumber %x\n",
+ pcipriv->ndis_adapter.funcnumber);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "tpcipriv->ndis_adapter.funcnumber %x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "tpcipriv->ndis_adapter.funcnumber %x\n",
+ tpcipriv->ndis_adapter.funcnumber);
+
+ if (pcipriv->ndis_adapter.busnumber ==
+@@ -372,8 +372,8 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "find_buddy_priv %d\n", find_buddy_priv);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "find_buddy_priv %d\n", find_buddy_priv);
+
+ if (find_buddy_priv)
+ *buddy_priv = tpriv;
+@@ -410,8 +410,8 @@ static void rtl_pci_parse_configuration(struct pci_dev *pdev,
+ pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &linkctrl_reg);
+ pcipriv->ndis_adapter.linkctrl_reg = (u8)linkctrl_reg;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n",
+- pcipriv->ndis_adapter.linkctrl_reg);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n",
++ pcipriv->ndis_adapter.linkctrl_reg);
+
+ pci_read_config_byte(pdev, 0x98, &tmp);
+ tmp |= BIT(4);
+@@ -579,11 +579,11 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ if (rtlpriv->rtlhal.earlymode_enable)
+ skb_pull(skb, EM_HDR_LEN);
+
+- RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE,
+- "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n",
+- ring->idx,
+- skb_queue_len(&ring->queue),
+- *(u16 *)(skb->data + 22));
++ rtl_dbg(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE,
++ "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n",
++ ring->idx,
++ skb_queue_len(&ring->queue),
++ *(u16 *)(skb->data + 22));
+
+ if (prio == TXCMD_QUEUE) {
+ dev_kfree_skb(skb);
+@@ -630,10 +630,10 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ }
+
+ if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
+- prio, ring->idx,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
++ prio, ring->idx,
++ skb_queue_len(&ring->queue));
+
+ ieee80211_wake_queue(hw, skb_get_queue_mapping(skb));
+ }
+@@ -823,9 +823,9 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ skb_reserve(skb, stats.rx_drvinfo_size +
+ stats.rx_bufshift);
+ } else {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "skb->end - skb->tail = %d, len is %d\n",
+- skb->end - skb->tail, len);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "skb->end - skb->tail = %d, len is %d\n",
++ skb->end - skb->tail, len);
+ dev_kfree_skb_any(skb);
+ goto new_trx_end;
+ }
+@@ -946,67 +946,67 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+
+ /*<1> beacon related */
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDOK])
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "beacon ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "beacon ok interrupt!\n");
+
+ if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDER]))
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "beacon err interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "beacon err interrupt!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BDOK])
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BCNINT]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "prepare beacon for interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "prepare beacon for interrupt!\n");
+ tasklet_schedule(&rtlpriv->works.irq_prepare_bcn_tasklet);
+ }
+
+ /*<2> Tx related */
+ if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_TXFOVW]))
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_MGNTDOK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "Manage ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "Manage ok interrupt!\n");
+ _rtl_pci_tx_isr(hw, MGNT_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_HIGHDOK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "HIGH_QUEUE ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "HIGH_QUEUE ok interrupt!\n");
+ _rtl_pci_tx_isr(hw, HIGH_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BKDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "BK Tx OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "BK Tx OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, BK_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BEDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "BE TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "BE TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, BE_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VIDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "VI TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "VI TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, VI_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VODOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "Vo TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "Vo TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, VO_QUEUE);
+ }
+
+@@ -1014,8 +1014,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ if (intvec.intd & rtlpriv->cfg->maps[RTL_IMR_H2CDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "H2C TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "H2C TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, H2C_QUEUE);
+ }
+ }
+@@ -1024,34 +1024,34 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_COMDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "CMD TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "CMD TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, TXCMD_QUEUE);
+ }
+ }
+
+ /*<3> Rx related */
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_ROK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_RDU])) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "rx descriptor unavailable!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "rx descriptor unavailable!\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_RXFOVW])) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ /*<4> fw related*/
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8723AE) {
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_C2HCMD]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "firmware interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "firmware interrupt!\n");
+ queue_delayed_work(rtlpriv->works.rtl_wq,
+ &rtlpriv->works.fwevt_wq, 0);
+ }
+@@ -1067,8 +1067,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ rtlhal->hw_type == HARDWARE_TYPE_RTL8723BE) {
+ if (unlikely(intvec.inta &
+ rtlpriv->cfg->maps[RTL_IMR_HSISR_IND])) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "hsisr interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "hsisr interrupt!\n");
+ _rtl_pci_hs_interrupt(hw);
+ }
+ }
+@@ -1272,8 +1272,8 @@ static int _rtl_pci_init_tx_ring(struct ieee80211_hw *hw,
+ rtlpci->tx_ring[prio].entries = entries;
+ skb_queue_head_init(&rtlpci->tx_ring[prio].queue);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n",
+- prio, desc);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n",
++ prio, desc);
+
+ /* init every desc in this ring */
+ if (!rtlpriv->use_new_trx_flow) {
+@@ -1670,10 +1670,10 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+ true, HW_DESC_OWN);
+
+ if (own == 1 && hw_queue != BEACON_QUEUE) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
+- hw_queue, ring->idx, idx,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
++ hw_queue, ring->idx, idx,
++ skb_queue_len(&ring->queue));
+
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock,
+ flags);
+@@ -1683,8 +1683,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+
+ if (rtlpriv->cfg->ops->get_available_desc &&
+ rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "get_available_desc fail\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "get_available_desc fail\n");
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+ return skb->len;
+ }
+@@ -1707,8 +1707,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+
+ if ((ring->entries - skb_queue_len(&ring->queue)) < 2 &&
+ hw_queue != BEACON_QUEUE) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+- "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
++ "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
+ hw_queue, ring->idx, idx,
+ skb_queue_len(&ring->queue));
+
+@@ -1815,8 +1815,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+
+ err = rtlpriv->cfg->ops->hw_init(hw);
+ if (err) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Failed to config hardware!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Failed to config hardware!\n");
+ kfree(rtlpriv->btcoexist.btc_context);
+ kfree(rtlpriv->btcoexist.wifi_only_context);
+ return err;
+@@ -1825,7 +1825,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+ &rtlmac->retry_long);
+
+ rtlpriv->cfg->ops->enable_interrupt(hw);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n");
+
+ rtl_init_rx_config(hw);
+
+@@ -1836,7 +1836,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+
+ rtlpci->up_first_time = false;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__);
+ return 0;
+ }
+
+@@ -1930,71 +1930,71 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ deviceid == RTL_PCI_8171_DID) {
+ switch (revisionid) {
+ case RTL_PCI_REVISION_ID_8192PCIE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192 PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192 PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192E;
+ return false;
+ case RTL_PCI_REVISION_ID_8192SE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192SE is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192SE is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE;
+ break;
+ default:
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Err: Unknown device - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Err: Unknown device - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE;
+ break;
+ }
+ } else if (deviceid == RTL_PCI_8723AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8723AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8723AE PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8723AE PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8192CET_DID ||
+ deviceid == RTL_PCI_8192CE_DID ||
+ deviceid == RTL_PCI_8191CE_DID ||
+ deviceid == RTL_PCI_8188CE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192CE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192C PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192C PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8192DE_DID ||
+ deviceid == RTL_PCI_8192DE_DID2) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192DE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192D PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192D PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8188EE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8188EE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8188EE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8188EE\n");
+ } else if (deviceid == RTL_PCI_8723BE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8723BE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8723BE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8723BE\n");
+ } else if (deviceid == RTL_PCI_8192EE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192EE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8192EE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8192EE\n");
+ } else if (deviceid == RTL_PCI_8821AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8821AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8821AE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8821AE\n");
+ } else if (deviceid == RTL_PCI_8812AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8812AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8812AE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8812AE\n");
+ } else if (deviceid == RTL_PCI_8822BE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8822BE;
+ rtlhal->bandset = BAND_ON_BOTH;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8822BE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8822BE\n");
+ } else {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Err: Unknown device - vid/did=%x/%x\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Err: Unknown device - vid/did=%x/%x\n",
+ venderid, deviceid);
+
+ rtlhal->hw_type = RTL_DEFAULT_HARDWARE_TYPE;
+@@ -2003,17 +2003,17 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192DE) {
+ if (revisionid == 0 || revisionid == 1) {
+ if (revisionid == 0) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find 92DE MAC0\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find 92DE MAC0\n");
+ rtlhal->interfaceindex = 0;
+ } else if (revisionid == 1) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find 92DE MAC1\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find 92DE MAC1\n");
+ rtlhal->interfaceindex = 1;
+ }
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n",
+ venderid, deviceid, revisionid);
+ rtlhal->interfaceindex = 0;
+ }
+@@ -2047,9 +2047,9 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+ if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
+ pcipriv->ndis_adapter.pcibridge_vendor = tmp;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Pci Bridge Vendor is found index: %d\n",
+- tmp);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Pci Bridge Vendor is found index: %d\n",
++ tmp);
+ break;
+ }
+ }
+@@ -2077,22 +2077,22 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n",
+- pcipriv->ndis_adapter.busnumber,
+- pcipriv->ndis_adapter.devnumber,
+- pcipriv->ndis_adapter.funcnumber,
+- pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n",
++ pcipriv->ndis_adapter.busnumber,
++ pcipriv->ndis_adapter.devnumber,
++ pcipriv->ndis_adapter.funcnumber,
++ pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
+- pcipriv->ndis_adapter.pcibridge_busnum,
+- pcipriv->ndis_adapter.pcibridge_devnum,
+- pcipriv->ndis_adapter.pcibridge_funcnum,
+- pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
+- pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
+- pcipriv->ndis_adapter.pcibridge_linkctrlreg,
+- pcipriv->ndis_adapter.amd_l1_patch);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
++ pcipriv->ndis_adapter.pcibridge_busnum,
++ pcipriv->ndis_adapter.pcibridge_devnum,
++ pcipriv->ndis_adapter.pcibridge_funcnum,
++ pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
++ pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
++ pcipriv->ndis_adapter.pcibridge_linkctrlreg,
++ pcipriv->ndis_adapter.amd_l1_patch);
+
+ rtl_pci_parse_configuration(pdev, hw);
+ list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list);
+@@ -2120,8 +2120,8 @@ static int rtl_pci_intr_mode_msi(struct ieee80211_hw *hw)
+
+ rtlpci->using_msi = true;
+
+- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
+- "MSI Interrupt Mode!\n");
++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
++ "MSI Interrupt Mode!\n");
+ return 0;
+ }
+
+@@ -2138,8 +2138,8 @@ static int rtl_pci_intr_mode_legacy(struct ieee80211_hw *hw)
+ return ret;
+
+ rtlpci->using_msi = false;
+- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
+- "Pin-based Interrupt Mode!\n");
++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
++ "Pin-based Interrupt Mode!\n");
+ return 0;
+ }
+
+@@ -2266,10 +2266,10 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ goto fail2;
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
+- pmem_start, pmem_len, pmem_flags,
+- rtlpriv->io.pci_mem_start);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
++ pmem_start, pmem_len, pmem_flags,
++ rtlpriv->io.pci_mem_start);
+
+ /* Disable Clk Request */
+ pci_write_config_byte(pdev, 0x81, 0);
+@@ -2331,9 +2331,9 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ rtlpci = rtl_pcidev(pcipriv);
+ err = rtl_pci_intr_mode_decide(hw);
+ if (err) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "%s: failed to register IRQ handler\n",
+- wiphy_name(hw->wiphy));
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "%s: failed to register IRQ handler\n",
++ wiphy_name(hw->wiphy));
+ goto fail3;
+ }
+ rtlpci->irq_alloc = 1;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
+index 5f998ea2d5a67..102f0d0e1cd01 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
+@@ -41,8 +41,8 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw)
+ rtlpriv->intf_ops->reset_trx_ring(hw);
+
+ if (is_hal_stop(rtlhal))
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Driver is already down!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Driver is already down!\n");
+
+ /*<2> Enable Adapter */
+ if (rtlpriv->cfg->ops->hw_init(hw))
+@@ -103,9 +103,9 @@ static bool rtl_ps_set_rf_state(struct ieee80211_hw *hw,
+ if (ppsc->rfchange_inprogress) {
+ spin_unlock(&rtlpriv->locks.rf_ps_lock);
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "RF Change in progress! Wait to set..state_toset(%d).\n",
+- state_toset);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "RF Change in progress! Wait to set..state_toset(%d).\n",
++ state_toset);
+
+ /* Set RF after the previous action is done. */
+ while (ppsc->rfchange_inprogress) {
+@@ -217,8 +217,8 @@ void rtl_ips_nic_off_wq_callback(void *data)
+ enum rf_pwrstate rtstate;
+
+ if (mac->opmode != NL80211_IFTYPE_STATION) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "not station return\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "not station return\n");
+ return;
+ }
+
+@@ -254,8 +254,8 @@ void rtl_ips_nic_off_wq_callback(void *data)
+ !ppsc->swrf_processing &&
+ (mac->link_state == MAC80211_NOLINK) &&
+ !mac->act_scanning) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "IPSEnter(): Turn off RF\n");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "IPSEnter(): Turn off RF\n");
+
+ ppsc->inactive_pwrstate = ERFOFF;
+ ppsc->in_powersavemode = true;
+@@ -333,8 +333,8 @@ static bool rtl_get_fwlps_doze(struct ieee80211_hw *hw)
+ ppsc->last_delaylps_stamp_jiffies);
+
+ if (ps_timediff < 2000) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n");
+ return false;
+ }
+
+@@ -379,9 +379,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
+
+ if ((ppsc->fwctrl_lps) && ppsc->report_linked) {
+ if (ppsc->dot11_psmode == EACTIVE) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "FW LPS leave ps_mode:%x\n",
+- FW_PS_ACTIVE_MODE);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "FW LPS leave ps_mode:%x\n",
++ FW_PS_ACTIVE_MODE);
+ enter_fwlps = false;
+ ppsc->pwr_mode = FW_PS_ACTIVE_MODE;
+ ppsc->smart_ps = 0;
+@@ -394,9 +394,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
+ rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode);
+ } else {
+ if (rtl_get_fwlps_doze(hw)) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "FW LPS enter ps_mode:%x\n",
+- ppsc->fwctrl_psmode);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "FW LPS enter ps_mode:%x\n",
++ ppsc->fwctrl_psmode);
+ if (rtlpriv->cfg->ops->get_btc_status())
+ rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode);
+ enter_fwlps = true;
+@@ -446,8 +446,8 @@ static void rtl_lps_enter_core(struct ieee80211_hw *hw)
+ * bt_ccoexist may ask to enter lps.
+ * In normal case, this constraint move to rtl_lps_set_psmode().
+ */
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Enter 802.11 power save mode...\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Enter 802.11 power save mode...\n");
+ rtl_lps_set_psmode(hw, EAUTOPS);
+
+ mutex_unlock(&rtlpriv->locks.lps_mutex);
+@@ -475,8 +475,8 @@ static void rtl_lps_leave_core(struct ieee80211_hw *hw)
+ RT_CLEAR_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM);
+ }
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Busy Traffic,Leave 802.11 power save..\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Busy Traffic,Leave 802.11 power save..\n");
+
+ rtl_lps_set_psmode(hw, EACTIVE);
+ }
+@@ -560,8 +560,8 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
+ queue_delayed_work(rtlpriv->works.rtl_wq,
+ &rtlpriv->works.ps_work, MSECS(5));
+ } else {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
+ }
+ }
+ EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
+@@ -656,9 +656,9 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
+ /* this print should always be dtim_conter = 0 &
+ * sleep = dtim_period, that meaons, we should
+ * awake before every dtim */
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "dtim_counter:%x will sleep :%d beacon_intv\n",
+- rtlpriv->psc.dtim_counter, sleep_intv);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "dtim_counter:%x will sleep :%d beacon_intv\n",
++ rtlpriv->psc.dtim_counter, sleep_intv);
+
+ /* we tested that 40ms is enough for sw & hw sw delay */
+ queue_delayed_work(rtlpriv->works.rtl_wq, &rtlpriv->works.ps_rfon_wq,
+@@ -769,9 +769,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+ if (ie[0] == 12) {
+ find_p2p_ps_ie = true;
+ if ((noa_len - 2) % 13 != 0) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "P2P notice of absence: invalid length.%d\n",
+- noa_len);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "P2P notice of absence: invalid length.%d\n",
++ noa_len);
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
+@@ -782,8 +782,8 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+ noa_index = ie[3];
+ if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
+ P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "update NOA ie.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "update NOA ie.\n");
+ p2pinfo->noa_index = noa_index;
+ p2pinfo->opp_ps = (ie[4] >> 7);
+ p2pinfo->ctwindow = ie[4] & 0x7F;
+@@ -854,7 +854,7 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+ if (ie == NULL)
+ return;
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
+ /*to find noa ie*/
+ while (ie + 1 < end) {
+ noa_len = READEF2BYTE((__le16 *)&ie[1]);
+@@ -862,13 +862,13 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+ return;
+
+ if (ie[0] == 12) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n");
+ RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_LOUD, "noa ie ",
+ ie, noa_len);
+ if ((noa_len - 2) % 13 != 0) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "P2P notice of absence: invalid length.%d\n",
+- noa_len);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "P2P notice of absence: invalid length.%d\n",
++ noa_len);
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
+@@ -926,7 +926,7 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state)
+ struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw));
+ struct rtl_p2p_ps_info *p2pinfo = &(rtlpriv->psc.p2p_ps_info);
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n" , p2p_ps_state);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n", p2p_ps_state);
+ switch (p2p_ps_state) {
+ case P2P_PS_DISABLE:
+ p2pinfo->p2p_ps_state = p2p_ps_state;
+@@ -978,18 +978,18 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state)
+ default:
+ break;
+ }
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "ctwindow %x oppps %x\n",
+- p2pinfo->ctwindow , p2pinfo->opp_ps);
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "count %x duration %x index %x interval %x start time %x noa num %x\n",
+- p2pinfo->noa_count_type[0],
+- p2pinfo->noa_duration[0],
+- p2pinfo->noa_index,
+- p2pinfo->noa_interval[0],
+- p2pinfo->noa_start_time[0],
+- p2pinfo->noa_num);
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "end\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "ctwindow %x oppps %x\n",
++ p2pinfo->ctwindow, p2pinfo->opp_ps);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "count %x duration %x index %x interval %x start time %x noa num %x\n",
++ p2pinfo->noa_count_type[0],
++ p2pinfo->noa_duration[0],
++ p2pinfo->noa_index,
++ p2pinfo->noa_interval[0],
++ p2pinfo->noa_start_time[0],
++ p2pinfo->noa_num);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "end\n");
+ }
+
+ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c
+index 72ca370331fb4..f89f60ddfebe0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -434,13 +434,13 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ rtlpriv->regd.country_code =
+ channel_plan_to_country_code(rtlpriv->efuse.channel_plan);
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG,
+- "rtl: EEPROM regdomain: 0x%0x country code: %d\n",
+- rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code);
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG,
++ "rtl: EEPROM regdomain: 0x%0x country code: %d\n",
++ rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code);
+
+ if (rtlpriv->regd.country_code >= COUNTRY_CODE_MAX) {
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG,
+- "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n");
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG,
++ "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n");
+
+ rtlpriv->regd.country_code = COUNTRY_CODE_WORLD_WIDE_13;
+ }
+@@ -455,9 +455,9 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ rtlpriv->regd.alpha2[1] = '0';
+ }
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_TRACE,
+- "rtl: Country alpha2 being used: %c%c\n",
+- rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]);
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_TRACE,
++ "rtl: Country alpha2 being used: %c%c\n",
++ rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]);
+
+ _rtl_regd_init_wiphy(&rtlpriv->regd, wiphy, reg_notifier);
+
+@@ -469,7 +469,7 @@ void rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_LOUD, "\n");
+
+ _rtl_reg_notifier_apply(wiphy, request, &rtlpriv->regd);
+ }
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 395671383ca93..35ebbd8ca9caf 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -282,14 +282,14 @@ static int _rtl_usb_init_tx(struct ieee80211_hw *hw)
+ ? USB_HIGH_SPEED_BULK_SIZE
+ : USB_FULL_SPEED_BULK_SIZE;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n",
+- rtlusb->max_bulk_out_size);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n",
++ rtlusb->max_bulk_out_size);
+
+ for (i = 0; i < __RTL_TXQ_NUM; i++) {
+ u32 ep_num = rtlusb->ep_map.ep_mapping[i];
+ if (!ep_num) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Invalid endpoint map setting!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Invalid endpoint map setting!\n");
+ return -EINVAL;
+ }
+ }
+@@ -358,10 +358,10 @@ static int _rtl_usb_init(struct ieee80211_hw *hw)
+ else if (usb_endpoint_dir_out(pep_desc))
+ rtlusb->out_ep_nums++;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
+- pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
+- pep_desc->bInterval);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
++ pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
++ pep_desc->bInterval);
+ }
+ if (rtlusb->in_ep_nums < rtlpriv->cfg->usb_interface_cfg->in_ep_num) {
+ pr_err("Too few input end points found\n");
+@@ -960,7 +960,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw,
+
+ memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
+ if (ieee80211_is_auth(fc)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
+ }
+
+ if (rtlpriv->psc.sw_ps_enabled) {
+--
+2.39.2
+
--- /dev/null
+From c6b3a45aa4d7ffbb188e333a947b37bdecf48b55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Aug 2019 17:03:44 -0500
+Subject: rtlwifi: rtl_pci: Fix memory leak when hardware init fails
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit 8cc782cd997dc4eb3ac183228d563727884ba874 ]
+
+If the call to hw_init() fails for any of the drivers, the driver will
+leak memory that was allocated in BT coexistence setup. Technically, each
+of the drivers should have done this free; however placing it in rtl_pci
+fixes all the drivers with only a single patch.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 83749578fa8b3..8bda1104bda85 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -1817,6 +1817,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+ if (err) {
+ RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+ "Failed to config hardware!\n");
++ kfree(rtlpriv->btcoexist.btc_context);
++ kfree(rtlpriv->btcoexist.wifi_only_context);
+ return err;
+ }
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RETRY_LIMIT,
+--
+2.39.2
+
--- /dev/null
+From d2c9c3b66bbe13631840a23cf2c643376e43db7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 15:42:30 -0500
+Subject: rtlwifi: Start changing RT_TRACE into rtl_dbg
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit 78a7245d84300cd616dbce26e6fc42a039a62279 ]
+
+The macro name RT_TRACE makes it seem that it is used for tracing, when
+is actually used for debugging. Change the name to RT_DEBUG.
+
+This step creates the new macro while keeping the old RT_TRACE to allow
+building. It will be removed at the end of the patch series.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200723204244.24457-2-Larry.Finger@lwfinger.net
+Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.h b/drivers/net/wireless/realtek/rtlwifi/debug.h
+index ad6834af618b4..14f822afc89ac 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.h
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.h
+@@ -181,6 +181,10 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level,
+ const char *titlestring,
+ const void *hexdata, int hexdatalen);
+
++#define rtl_dbg(rtlpriv, comp, level, fmt, ...) \
++ _rtl_dbg_trace(rtlpriv, comp, level, \
++ fmt, ##__VA_ARGS__)
++
+ #define RT_TRACE(rtlpriv, comp, level, fmt, ...) \
+ _rtl_dbg_trace(rtlpriv, comp, level, \
+ fmt, ##__VA_ARGS__)
+@@ -197,6 +201,13 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level,
+
+ struct rtl_priv;
+
++__printf(4, 5)
++static inline void rtl_dbg(struct rtl_priv *rtlpriv,
++ u64 comp, int level,
++ const char *fmt, ...)
++{
++}
++
+ __printf(4, 5)
+ static inline void RT_TRACE(struct rtl_priv *rtlpriv,
+ u64 comp, int level,
+--
+2.39.2
+
--- /dev/null
+From 0a7e86091ddd70d1afa6349a618b0a5cee9252b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 12:32:11 +0100
+Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
+
+From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ]
+
+Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
+wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
+
+For some reason we have no corresponding check for SO_PASSSEC.
+
+In the recvmsg(2) doc we have:
+ MSG_CTRUNC
+ indicates that some control data was discarded due to lack
+ of space in the buffer for ancillary data.
+
+So, we need to set MSG_CTRUNC flag for all types of SCM.
+
+This change can break applications those don't check MSG_CTRUNC flag.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Leon Romanovsky <leon@kernel.org>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+v2:
+- commit message was rewritten according to Eric's suggestion
+Acked-by: Paul Moore <paul@paul-moore.com>
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/scm.h | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 1ce365f4c2560..585adc1346bd0 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
+ }
+ }
+ }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return test_bit(SOCK_PASSSEC, &sock->flags);
++}
+ #else
+ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
+ { }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return false;
++}
+ #endif /* CONFIG_SECURITY_NETWORK */
+
+ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
+ struct scm_cookie *scm, int flags)
+ {
+ if (!msg->msg_control) {
+- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
++ scm_has_secdata(sock))
+ msg->msg_flags |= MSG_CTRUNC;
+ scm_destroy(scm);
+ return;
+--
+2.39.2
+
--- /dev/null
+From a470ed047c99624268df95c13f542acc0dd6566f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 17:51:09 +0000
+Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ]
+
+When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is
+dereferenced below.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling")
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 7352d46ebb093..44d648baabd87 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1444,6 +1444,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status)
+ */
+ if (cmdid == CMDID_INT_CMDS) {
+ scb = &adapter->int_scb;
++ cmd = scb->cmd;
+
+ list_del_init(&scb->list);
+ scb->state = SCB_FREE;
+--
+2.39.2
+
--- /dev/null
+From 0a097e20ab61b57f60ef80370f83101389a5bb56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:19 -0500
+Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ]
+
+Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort
+fabric stop race").
+
+If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the
+last put on the cmd and free it, because the connection is down and we will
+not up sending the response and doing the put from the normal I/O
+path.
+
+Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now
+detect this case and run iscsit_free_cmd().
+
+Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race")
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 58ccded1be857..7738e249c4a24 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4056,9 +4056,12 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+- if (se_cmd->se_tfo != NULL) {
+- spin_lock_irq(&se_cmd->t_state_lock);
+- if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!se_cmd->se_tfo)
++ continue;
++
++ spin_lock_irq(&se_cmd->t_state_lock);
++ if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!(se_cmd->transport_state & CMD_T_TAS))
+ /*
+ * LIO's abort path owns the cleanup for this,
+ * so put it back on the list and let
+@@ -4066,11 +4069,10 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ */
+ list_move_tail(&cmd->i_conn_node,
+ &conn->conn_cmd_list);
+- } else {
+- se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+- }
+- spin_unlock_irq(&se_cmd->t_state_lock);
++ } else {
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+ }
++ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ spin_unlock_bh(&conn->cmd_lock);
+
+--
+2.39.2
+
--- /dev/null
+From 98a247b368ef15b2338fd2e08b04d4fd76b05039 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:29:11 -0400
+Subject: selinux: ensure av_permissions.h is built when needed
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ]
+
+The Makefile rule responsible for building flask.h and
+av_permissions.h only lists flask.h as a target which means that
+av_permissions.h is only generated when flask.h needs to be
+generated. This patch fixes this by adding av_permissions.h as a
+target to the rule.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index 3efb0dda95b55..08ba8ca81d403 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -22,5 +22,5 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+--
+2.39.2
+
--- /dev/null
+From 4774f58e8b412d87595b1403a73c31923f309598 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 15:59:19 +0200
+Subject: selinux: fix Makefile dependencies of flask.h
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ]
+
+Make the flask.h target depend on the genheaders binary instead of
+classmap.h to ensure that it is rebuilt if any of the dependencies of
+genheaders are changed.
+
+Notably this fixes flask.h not being rebuilt when
+initial_sid_to_string.h is modified.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index c7161f8792b2d..3efb0dda95b55 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -19,8 +19,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
+ $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h
+
+ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h
++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: $(src)/include/classmap.h FORCE
++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+--
+2.39.2
+
--- /dev/null
+From a310e3e70667b1219bc3826a61463b4dfd8ed56d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 10:02:39 -0700
+Subject: serial: 8250: Add missing wakeup event reporting
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ]
+
+An 8250 UART configured as a wake-up source would not have reported
+itself through sysfs as being the source of wake-up, correct that.
+
+Fixes: b3b708fa2780 ("wake up from a serial port")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index ce266e10a21e0..81574efff3c1c 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -19,6 +19,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/ioport.h>
+ #include <linux/init.h>
++#include <linux/irq.h>
+ #include <linux/console.h>
+ #include <linux/sysrq.h>
+ #include <linux/delay.h>
+@@ -1885,6 +1886,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ unsigned char status;
+ unsigned long flags;
+ struct uart_8250_port *up = up_to_u8250p(port);
++ struct tty_port *tport = &port->state->port;
+ bool skip_rx = false;
+
+ if (iir & UART_IIR_NO_INT)
+@@ -1908,6 +1910,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ skip_rx = true;
+
+ if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
++ pm_wakeup_event(tport->tty->dev, 0);
+ if (!up->dma || handle_rx_dma(up, iir))
+ status = serial8250_rx_chars(up, status);
+ }
+--
+2.39.2
+
ubifs-fix-memleak-when-insert_old_idx-failed.patch
ubi-fix-return-value-overwrite-issue-in-try_write_vid_and_data.patch
ubifs-free-memory-for-tmpfile-name.patch
+selinux-fix-makefile-dependencies-of-flask.h.patch
+selinux-ensure-av_permissions.h-is-built-when-needed.patch
+drm-rockchip-drop-unbalanced-obj-unref.patch
+drm-vgem-add-missing-mutex_destroy.patch
+drm-probe-helper-cancel-previous-job-before-starting.patch
+edac-skx-move-debugfs-node-under-edac-s-hierarchy.patch
+edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch
+arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch
+media-bdisp-add-missing-check-for-create_workqueue.patch
+media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch
+media-av7110-prevent-underflow-in-write_ts_to_decode.patch
+firmware-qcom_scm-clear-download-bit-during-reboot.patch
+drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch
+drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch
+x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch
+media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch
+media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch
+media-rcar_fdp1-fix-the-correct-variable-assignments.patch
+media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch
+media-rc-gpio-ir-recv-fix-support-for-wake-up.patch
+x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch
+arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch
+debugobjects-add-percpu-free-pools.patch
+debugobjects-move-printk-out-of-db-lock-critical-sec.patch
+debugobject-prevent-init-race-with-static-objects.patch
+wifi-ath6kl-minor-fix-for-allocation-size.patch
+wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch
+wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch
+wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch
+tools-bpftool-remove-invalid-json-escape.patch
+scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch
+vlan-partially-enable-siocshwtstamp-in-container.patch
+net-packet-convert-po-origdev-to-an-atomic-flag.patch
+net-packet-convert-po-auxdata-to-an-atomic-flag.patch
+scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch
+scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
+rtlwifi-rtl_pci-fix-memory-leak-when-hardware-init-f.patch
+rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch
+rtlwifi-replace-rt_trace-with-rtl_dbg.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-14890
+bpftool-fix-bug-for-long-instructions-in-program-cfg.patch
+crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch
+crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch
+md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch
+md-raid10-fix-memleak-for-conf-bio_split.patch
+md-update-the-optimal-i-o-size-on-reshape.patch
+md-raid10-fix-memleak-of-md-thread.patch
+wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch
+wifi-iwlwifi-mvm-check-firmware-response-size.patch
+ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch
+ixgbe-enable-setting-rss-table-to-default-values.patch
+netfilter-nf_tables-don-t-write-table-validation-sta.patch
+ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch
+revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch
+netlink-use-copy_to_user-for-optval-in-netlink_getso.patch
+net-amd-fix-link-leak-when-verifying-config-failed.patch
+tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch
+pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch
+usb-host-xhci-rcar-remove-leftover-quirk-handling.patch
+fpga-bridge-fix-kernel-doc-parameter-description.patch
+usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch
+linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch
+spi-qup-fix-pm-reference-leak-in-spi_qup_remove.patch
+spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch
+spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch
+vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch
+of-fix-modalias-string-generation.patch
+ia64-mm-contig-fix-section-mismatch-warning-error.patch
+ia64-salinfo-placate-defined-but-not-used-warning.patch
+mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch
+mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch
+mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch
+spi-cadence-quadspi-fix-suspend-resume-implementatio.patch
+uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch
+sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch
+usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch
+tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch
+serial-8250-add-missing-wakeup-event-reporting.patch
+staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch
+spmi-add-a-check-for-remove-callback-when-removing-a.patch
+spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch
+macintosh-windfarm_smu_sat-add-missing-of_node_put.patch
+powerpc-mpc512x-fix-resource-printk-format-warning.patch
+powerpc-wii-fix-resource-printk-format-warnings.patch
+powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch
+macintosh-via-pmu-led-requires-ata-to-be-set.patch
+powerpc-rtas-use-memmove-for-potentially-overlapping.patch
+perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch
+rdma-rdmavt-delete-unnecessary-null-check.patch
+rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch
+power-supply-generic-adc-battery-fix-unit-scaling.patch
+clk-add-missing-of_node_put-in-assigned-clocks-prope.patch
+ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch
+nfsv4.1-always-send-a-reclaim_complete-after-establi.patch
+sunrpc-remove-the-maximum-number-of-retries-in-call_.patch
+rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch
+openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch
+pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch
+pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch
+pwm-mtk-disp-disable-shadow-registers-before-setting.patch
+phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch
+dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch
--- /dev/null
+From 0245c1f065774156ec2d3be954c5c1cfcd408e68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 13:48:52 +0200
+Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ]
+
+The Store Queue code allocates a bitmap buffer with the size of
+multiple of sizeof(long) in sq_api_init(). While the buffer size
+is calculated correctly, the code uses the wrong element size to
+allocate the buffer which results in the allocated bitmap buffer
+being too small.
+
+Fix this by allocating the buffer with kcalloc() with element size
+sizeof(long) instead of kzalloc() whose elements size defaults to
+sizeof(char).
+
+Fixes: d7c30c682a27 ("sh: Store Queue API rework.")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/cpu/sh4/sq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
+index 4ca78ed71ad2c..c218bae8fe208 100644
+--- a/arch/sh/kernel/cpu/sh4/sq.c
++++ b/arch/sh/kernel/cpu/sh4/sq.c
+@@ -383,7 +383,7 @@ static int __init sq_api_init(void)
+ if (unlikely(!sq_cache))
+ return ret;
+
+- sq_bitmap = kzalloc(size, GFP_KERNEL);
++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL);
+ if (unlikely(!sq_bitmap))
+ goto out;
+
+--
+2.39.2
+
--- /dev/null
+From 77c742edaec6bb38b0da9ad55dc7289d5b2f5ada Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 17:46:15 +0530
+Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ]
+
+Get rid of conditional compilation based on CONFIG_PM_SLEEP because
+it may introduce build issues with certain configs where it maybe disabled
+This is because if above config is not enabled the suspend-resume
+functions are never part of the code but the bcm63xx_spi_pm_ops struct
+still inits them to non-existent suspend-resume functions.
+
+Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver")
+
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
+index bfe5754768f97..c7b67388709fe 100644
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -625,7 +625,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-#ifdef CONFIG_PM_SLEEP
+ static int bcm63xx_spi_suspend(struct device *dev)
+ {
+ struct spi_master *master = dev_get_drvdata(dev);
+@@ -652,7 +651,6 @@ static int bcm63xx_spi_resume(struct device *dev)
+
+ return 0;
+ }
+-#endif
+
+ static const struct dev_pm_ops bcm63xx_spi_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume)
+--
+2.39.2
+
--- /dev/null
+From e380b260536d81580a132fb28def11c951a37f46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 14:40:27 +0530
+Subject: spi: cadence-quadspi: fix suspend-resume implementations
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ]
+
+The cadence QSPI driver misbehaves after performing a full system suspend
+resume:
+...
+spi-nor spi0.0: resume() failed
+...
+This results in a flash connected via OSPI interface after system suspend-
+resume to be unusable.
+fix these suspend and resume functions.
+
+Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 16ac2e3c351df..d5c6b91fd1139 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -1412,17 +1412,30 @@ static int cqspi_remove(struct platform_device *pdev)
+ static int cqspi_suspend(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
++ int ret;
+
++ ret = spi_master_suspend(master);
+ cqspi_controller_enable(cqspi, 0);
+- return 0;
++
++ clk_disable_unprepare(cqspi->clk);
++
++ return ret;
+ }
+
+ static int cqspi_resume(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
+
+- cqspi_controller_enable(cqspi, 1);
+- return 0;
++ clk_prepare_enable(cqspi->clk);
++ cqspi_wait_idle(cqspi);
++ cqspi_controller_init(cqspi);
++
++ cqspi->current_cs = -1;
++ cqspi->sclk = 0;
++
++ return spi_master_resume(master);
+ }
+
+ static const struct dev_pm_ops cqspi__dev_pm_ops = {
+--
+2.39.2
+
--- /dev/null
+From 9d92308230698af10d9b250c455e572eb96fd68e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Apr 2023 19:59:46 +0200
+Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ]
+
+CPM has the same problem as QE so for CPM also use the fix added
+by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"):
+
+ CPM mode uses Little Endian so words > 8 bits are byte swapped.
+ Workaround this by always enforcing wordsize 8 for 16 and 32 bits
+ words. Unfortunately this will not work for LSB transfers
+ where wordsize is > 8 bits so disable these for now.
+
+Also limit the workaround to 16 and 32 bits words because it can
+only work for multiples of 8-bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
+Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian")
+Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index cd784552de7f1..479d10dc6cb84 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -205,8 +205,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ struct spi_device *spi,
+ int bits_per_word)
+ {
+- /* QE uses Little Endian for words > 8
+- * so transform all words > 8 into 8 bits
++ /* CPM/QE uses Little Endian for words > 8
++ * so transform 16 and 32 bits words into 8 bits
+ * Unfortnatly that doesn't work for LSB so
+ * reject these for now */
+ /* Note: 32 bits word, LSB works iff
+@@ -214,9 +214,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ if (spi->mode & SPI_LSB_FIRST &&
+ bits_per_word > 8)
+ return -EINVAL;
+- if (bits_per_word > 8)
++ if (bits_per_word <= 8)
++ return bits_per_word;
++ if (bits_per_word == 16 || bits_per_word == 32)
+ return 8; /* pretend its 8 bits */
+- return bits_per_word;
++ return -EINVAL;
+ }
+
+ static int fsl_spi_setup_transfer(struct spi_device *spi,
+@@ -246,7 +248,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi,
+ bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi,
+ mpc8xxx_spi,
+ bits_per_word);
+- else if (mpc8xxx_spi->flags & SPI_QE)
++ else
+ bits_per_word = mspi_apply_qe_mode_quirks(cs, spi,
+ bits_per_word);
+
+--
+2.39.2
+
--- /dev/null
+From c7d0ae7cb08171321d4b2b6f5b4ea4a12830653b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 23:03:40 +0200
+Subject: spi: qup: Don't skip cleanup in remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ]
+
+Returning early in a platform driver's remove callback is wrong. In this
+case the dma resources are not released in the error path. this is never
+retried later and so this is a permanent leak. To fix this, only skip
+hardware disabling if waking the device fails.
+
+Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qup.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index e8009f8c212c0..defe959884dae 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1249,18 +1249,22 @@ static int spi_qup_remove(struct platform_device *pdev)
+ struct spi_qup *controller = spi_master_get_devdata(master);
+ int ret;
+
+- ret = pm_runtime_resume_and_get(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ ret = pm_runtime_get_sync(&pdev->dev);
+
+- ret = spi_qup_set_state(controller, QUP_STATE_RESET);
+- if (ret)
+- return ret;
++ if (ret >= 0) {
++ ret = spi_qup_set_state(controller, QUP_STATE_RESET);
++ if (ret)
++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n",
++ ERR_PTR(ret));
+
+- spi_qup_release_dma(master);
++ clk_disable_unprepare(controller->cclk);
++ clk_disable_unprepare(controller->iclk);
++ } else {
++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n",
++ ERR_PTR(ret));
++ }
+
+- clk_disable_unprepare(controller->cclk);
+- clk_disable_unprepare(controller->iclk);
++ spi_qup_release_dma(master);
+
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+--
+2.39.2
+
--- /dev/null
+From e78d8a0bcfe33aad81d6559dd3644745a14fbb17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Apr 2021 09:54:58 +0000
+Subject: spi: qup: fix PM reference leak in spi_qup_remove()
+
+From: Wang Li <wangli74@huawei.com>
+
+[ Upstream commit cec77e0a249892ceb10061bf17b63f9fb111d870 ]
+
+pm_runtime_get_sync will increment pm usage counter even it failed.
+Forgetting to putting operation will result in reference leak here.
+Fix it by replacing it with pm_runtime_resume_and_get to keep usage
+counter balanced.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Li <wangli74@huawei.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Link: https://lore.kernel.org/r/20210409095458.29921-1-wangli74@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 61f49171a43a ("spi: qup: Don't skip cleanup in remove's error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index 1ca678bcb5279..e8009f8c212c0 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1249,7 +1249,7 @@ static int spi_qup_remove(struct platform_device *pdev)
+ struct spi_qup *controller = spi_master_get_devdata(master);
+ int ret;
+
+- ret = pm_runtime_get_sync(&pdev->dev);
++ ret = pm_runtime_resume_and_get(&pdev->dev);
+ if (ret < 0)
+ return ret;
+
+--
+2.39.2
+
--- /dev/null
+From 3769bfa3ee81b2eabb4b3def31dc524c97570a2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 15:38:34 -0700
+Subject: spmi: Add a check for remove callback when removing a SPMI driver
+
+From: Jishnu Prakash <quic_jprakash@quicinc.com>
+
+[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ]
+
+When removing a SPMI driver, there can be a crash due to NULL pointer
+dereference if it does not have a remove callback defined. This is
+one such call trace observed when removing the QCOM SPMI PMIC driver:
+
+ dump_backtrace.cfi_jt+0x0/0x8
+ dump_stack_lvl+0xd8/0x16c
+ panic+0x188/0x498
+ __cfi_slowpath+0x0/0x214
+ __cfi_slowpath+0x1dc/0x214
+ spmi_drv_remove+0x16c/0x1e0
+ device_release_driver_internal+0x468/0x79c
+ driver_detach+0x11c/0x1a0
+ bus_remove_driver+0xc4/0x124
+ driver_unregister+0x58/0x84
+ cleanup_module+0x1c/0xc24 [qcom_spmi_pmic]
+ __do_sys_delete_module+0x3ec/0x53c
+ __arm64_sys_delete_module+0x18/0x28
+ el0_svc_common+0xdc/0x294
+ el0_svc+0x38/0x9c
+ el0_sync_handler+0x8c/0xf0
+ el0_sync+0x1b4/0x1c0
+
+If a driver has all its resources allocated through devm_() APIs and
+does not need any other explicit cleanup, it would not require a
+remove callback to be defined. Hence, add a check for remove callback
+presence before calling it when removing a SPMI driver.
+
+Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com
+Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()")
+Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI")
+Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spmi/spmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
+index aa3edabc2b0fe..55f1cad836ba2 100644
+--- a/drivers/spmi/spmi.c
++++ b/drivers/spmi/spmi.c
+@@ -356,7 +356,8 @@ static int spmi_drv_remove(struct device *dev)
+ const struct spmi_driver *sdrv = to_spmi_driver(dev->driver);
+
+ pm_runtime_get_sync(dev);
+- sdrv->remove(to_spmi_device(dev));
++ if (sdrv->remove)
++ sdrv->remove(to_spmi_device(dev));
+ pm_runtime_put_noidle(dev);
+
+ pm_runtime_disable(dev);
+--
+2.39.2
+
--- /dev/null
+From 3e6dffec9685262aacd356fbab04099104204d7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 22:02:01 +0200
+Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
+
+From: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+
+[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ]
+
+When loading the driver for rtl8192e, the W_DISABLE# switch is working as
+intended. But when the WLAN is turned off in software and then turned on
+again the W_DISABLE# does not work anymore. Reason for this is that in
+the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is
+checked and returned when true. bfirst_after_down is set true when
+switching the WLAN off in software. But it is not set to false again
+when WLAN is turned on again.
+
+Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix
+above described bug.
+
+Fixes: 94a799425eee ("From: wlanfae <wlanfae@realtek.com> [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
+Signed-off-by: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index da73998bc5f70..d5ef1986bde4d 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -778,6 +778,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset)
+ else
+ netif_wake_queue(dev);
+
++ priv->bfirst_after_down = false;
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 7d46b94ae8c3258cf1ba938b9ad2d4a5a119491d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 13:19:02 -0700
+Subject: SUNRPC: remove the maximum number of retries in call_bind_status
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ]
+
+Currently call_bind_status places a hard limit of 3 to the number of
+retries on EACCES error. This limit was done to prevent NLM unlock
+requests from being hang forever when the server keeps returning garbage.
+However this change causes problem for cases when NLM service takes
+longer than 9 seconds to register with the port mapper after a restart.
+
+This patch removes this hard coded limit and let the RPC handles
+the retry based on the standard hard/soft task semantics.
+
+Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests")
+Reported-by: Helen Chao <helen.chao@oracle.com>
+Tested-by: Helen Chao <helen.chao@oracle.com>
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/sched.h | 3 +--
+ net/sunrpc/clnt.c | 3 ---
+ net/sunrpc/sched.c | 1 -
+ 3 files changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index ad2e243f3f032..96837ae07822b 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -88,8 +88,7 @@ struct rpc_task {
+ #endif
+ unsigned char tk_priority : 2,/* Task priority */
+ tk_garb_retry : 2,
+- tk_cred_retry : 2,
+- tk_rebind_retry : 2;
++ tk_cred_retry : 2;
+ };
+
+ typedef void (*rpc_action)(struct rpc_task *);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 1946bd13d5df7..e5498253ad93b 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -1814,9 +1814,6 @@ call_bind_status(struct rpc_task *task)
+ status = -EOPNOTSUPP;
+ break;
+ }
+- if (task->tk_rebind_retry == 0)
+- break;
+- task->tk_rebind_retry--;
+ rpc_delay(task, 3*HZ);
+ goto retry_timeout;
+ case -ETIMEDOUT:
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index e36ae4d4b540c..9af919364a001 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -709,7 +709,6 @@ rpc_init_task_statistics(struct rpc_task *task)
+ /* Initialize retry counters */
+ task->tk_garb_retry = 2;
+ task->tk_cred_retry = 2;
+- task->tk_rebind_retry = 2;
+
+ /* starting timestamp */
+ task->tk_start = ktime_get();
+--
+2.39.2
+
--- /dev/null
+From 8da86b9bbd054b92783ddee390ec9f625db1a57a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 15:20:22 -0700
+Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ]
+
+syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY
+skbs. We can reproduce the problem with these sequences:
+
+ sk = socket(AF_INET, SOCK_DGRAM, 0)
+ sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE)
+ sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1)
+ sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53))
+ sk.close()
+
+sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets
+skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct
+ubuf_info_msgzc indirectly holds a refcnt of the socket. When the
+skb is sent, __skb_tstamp_tx() clones it and puts the clone into
+the socket's error queue with the TX timestamp.
+
+When the original skb is received locally, skb_copy_ubufs() calls
+skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt.
+This additional count is decremented while freeing the skb, but struct
+ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is
+not called.
+
+The last refcnt is not released unless we retrieve the TX timestamped
+skb by recvmsg(). Since we clear the error queue in inet_sock_destruct()
+after the socket's refcnt reaches 0, there is a circular dependency.
+If we close() the socket holding such skbs, we never call sock_put()
+and leak the count, sk, and skb.
+
+TCP has the same problem, and commit e0c8bccd40fc ("net: stream:
+purge sk_error_queue in sk_stream_kill_queues()") tried to fix it
+by calling skb_queue_purge() during close(). However, there is a
+small chance that skb queued in a qdisc or device could be put
+into the error queue after the skb_queue_purge() call.
+
+In __skb_tstamp_tx(), the cloned skb should not have a reference
+to the ubuf to remove the circular dependency, but skb_clone() does
+not call skb_copy_ubufs() for zerocopy skb. So, we need to call
+skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs().
+
+[0]:
+BUG: memory leak
+unreferenced object 0xffff88800c6d2d00 (size 1152):
+ comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................
+ 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
+ backtrace:
+ [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024
+ [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083
+ [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline]
+ [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245
+ [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515
+ [<00000000b9b11231>] sock_create net/socket.c:1566 [inline]
+ [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline]
+ [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline]
+ [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636
+ [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline]
+ [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline]
+ [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647
+ [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+ [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+BUG: memory leak
+unreferenced object 0xffff888017633a00 (size 240):
+ comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m.....
+ backtrace:
+ [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497
+ [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline]
+ [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596
+ [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline]
+ [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370
+ [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037
+ [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652
+ [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253
+ [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819
+ [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline]
+ [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734
+ [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117
+ [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline]
+ [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline]
+ [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125
+ [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+ [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY")
+Fixes: b5947e5d1e71 ("udp: msg_zerocopy")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 7f501dff4501c..5ae62d7433575 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4445,6 +4445,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
+ skb = alloc_skb(0, GFP_ATOMIC);
+ } else {
+ skb = skb_clone(orig_skb, GFP_ATOMIC);
++
++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC))
++ return;
+ }
+ if (!skb)
+ return;
+--
+2.39.2
+
--- /dev/null
+From dd2a3bb623c73d67248f82adebb6715dd72c8b40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 16:08:54 +0100
+Subject: tools: bpftool: Remove invalid \' json escape
+
+From: Luis Gerhorst <gerhorst@cs.fau.de>
+
+[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ]
+
+RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange
+Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid
+two-character escape sequences. This does not include \', which is not
+required in JSON because it exclusively uses double quotes as string
+separators.
+
+Solidus (/) may be escaped, but does not have to. Only reverse
+solidus (\), double quotes ("), and the control characters have to be
+escaped. Therefore, with this fix, bpftool correctly supports all valid
+two-character escape sequences (but still does not support characters
+that require multi-character escape sequences).
+
+Witout this fix, attempting to load a JSON file generated by bpftool
+using Python 3.10.6's default json.load() may fail with the error
+"Invalid \escape" if the file contains the invalid escaped single
+quote (\').
+
+Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository")
+Signed-off-by: Luis Gerhorst <gerhorst@cs.fau.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/json_writer.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c
+index c6eef76322ae9..0c38c41269bee 100644
+--- a/tools/bpf/bpftool/json_writer.c
++++ b/tools/bpf/bpftool/json_writer.c
+@@ -84,9 +84,6 @@ static void jsonw_puts(json_writer_t *self, const char *str)
+ case '"':
+ fputs("\\\"", self->out);
+ break;
+- case '\'':
+- fputs("\\\'", self->out);
+- break;
+ default:
+ putc(*str, self->out);
+ }
+--
+2.39.2
+
--- /dev/null
+From 148518db9ff42e114c561f8d0bd5c82ae248715c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 14:55:55 -0500
+Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ]
+
+Based on the fls function definition provided below, we should not
+subtract 1 to obtain the correct buffer length:
+
+fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
+
+Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx")
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 6ea1d23623e51..dbfec943071d6 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -994,7 +994,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
+ * 10ms at any baud rate.
+ */
+ sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2;
+- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1));
++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len));
+ if (sport->rx_dma_rng_buf_len < 16)
+ sport->rx_dma_rng_buf_len = 16;
+
+--
+2.39.2
+
--- /dev/null
+From aea1b808e8161600d444efd421416bab69849a40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:27:47 +0100
+Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__
+
+From: Kevin Brodsky <kevin.brodsky@arm.com>
+
+[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ]
+
+typeof is (still) a GNU extension, which means that it cannot be used when
+building ISO C (e.g. -std=c99). It should therefore be avoided in uapi
+headers in favour of the ISO-friendly __typeof__.
+
+Unfortunately this issue could not be detected by
+CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in
+any uapi header.
+
+This matters from a userspace perspective, not a kernel one. uapi
+headers and their contents are expected to be usable in a variety of
+situations, and in particular when building ISO C applications (with
+-std=c99 or similar).
+
+This particular problem can be reproduced by trying to use the
+__ALIGN_KERNEL macro directly in application code, say:
+
+#include <linux/const.h>
+
+int align(int x, int a)
+{
+ return __KERNEL_ALIGN(x, a);
+}
+
+and trying to build that with -std=c99.
+
+Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com
+Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()")
+Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
+Reported-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Tested-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Tested-by: Petr Vorel <pvorel@suse.cz>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/const.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h
+index af2a44c08683d..a429381e7ca50 100644
+--- a/include/uapi/linux/const.h
++++ b/include/uapi/linux/const.h
+@@ -28,7 +28,7 @@
+ #define _BITUL(x) (_UL(1) << (x))
+ #define _BITULL(x) (_ULL(1) << (x))
+
+-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+ #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
+
+ #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+--
+2.39.2
+
--- /dev/null
+From 137a949703fdd4fbae8e0f6edea981f9becd1fb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:58:52 +0800
+Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe`
+
+From: Yinhao Hu <dddddd@hust.edu.cn>
+
+[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ]
+
+From the comment of ci_usb_phy_init, it returns an error code if
+usb_phy_init has failed, and it should do some clean up, not just
+return directly.
+
+Fix this by goto the error handling.
+
+Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core")
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Yinhao Hu <dddddd@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 3fd1073a345db..9f6a52ed038e2 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -984,7 +984,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ ret = ci_usb_phy_init(ci);
+ if (ret) {
+ dev_err(dev, "unable to init phy: %d\n", ret);
+- return ret;
++ goto ulpi_exit;
+ }
+
+ ci->hw_bank.phys = res->start;
+--
+2.39.2
+
--- /dev/null
+From e15fccb666b414759167c483a190a1374eff4cbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 14:29:31 +0800
+Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in
+ renesas_usb3_remove due to race condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ]
+
+In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work.
+renesas_usb3_start will be called to start the work.
+
+If we remove the driver which will call usbhs_remove, there may be
+an unfinished work. The possible sequence is as follows:
+
+CPU0 CPU1
+
+ renesas_usb3_role_work
+renesas_usb3_remove
+usb_role_switch_unregister
+device_unregister
+kfree(sw)
+//free usb3->role_sw
+ usb_role_switch_set_role
+ //use usb3->role_sw
+
+The usb3->role_sw could be freed under such circumstance and then
+used in usb_role_switch_set_role.
+
+This bug was found by static analysis. And note that removing a
+driver is a root-only operation, and should never happen in normal
+case. But the root user may directly remove the device which
+will also trigger the remove function.
+
+Fix it by canceling the work before cleanup in the renesas_usb3_remove.
+
+Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index c17d7a71e29a3..013db752d55da 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2478,6 +2478,7 @@ static int renesas_usb3_remove(struct platform_device *pdev)
+ debugfs_remove_recursive(usb3->dentry);
+ device_remove_file(&pdev->dev, &dev_attr_role);
+
++ cancel_work_sync(&usb3->role_work);
+ usb_role_switch_unregister(usb3->role_sw);
+
+ usb_del_gadget_udc(&usb3->gadget);
+--
+2.39.2
+
--- /dev/null
+From f3b6597804eb620281941b9ba4006ea96a27d124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 17:30:37 +0100
+Subject: usb: host: xhci-rcar: remove leftover quirk handling
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ]
+
+Loading V3 firmware does not need a quirk anymore, remove the leftover
+code.
+
+Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-rcar.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 4ebbe2c232926..4353c1948e5c6 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -74,7 +74,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3);
+
+ /* For soc_device_attribute */
+ #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */
+-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */
+
+ static const struct soc_device_attribute rcar_quirks_match[] = {
+ {
+@@ -156,8 +155,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd)
+
+ if (quirks & RCAR_XHCI_FIRMWARE_V2)
+ firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2;
+- else if (quirks & RCAR_XHCI_FIRMWARE_V3)
+- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3;
+ else
+ firmware_name = priv->firmware_name;
+
+--
+2.39.2
+
--- /dev/null
+From c99f4fc9d6aa6c36b88dfb3a7f50ef1bc774b9ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 08:33:02 -0700
+Subject: vlan: partially enable SIOCSHWTSTAMP in container
+
+From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+
+[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ]
+
+Setting timestamp filter was explicitly disabled on vlan devices in
+containers because it might affect other processes on the host. But it's
+absolutely legit in case when real device is in the same namespace.
+
+Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container")
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/8021q/vlan_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 84ef837721141..c80add6edf598 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -369,7 +369,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+
+ switch (cmd) {
+ case SIOCSHWTSTAMP:
+- if (!net_eq(dev_net(dev), &init_net))
++ if (!net_eq(dev_net(dev), dev_net(real_dev)))
+ break;
+ case SIOCGMIIPHY:
+ case SIOCGMIIREG:
+--
+2.39.2
+
--- /dev/null
+From 670a717976446e70e79e8ee6a794bd9905c504ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 21:01:53 +0900
+Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF
+
+From: Dae R. Jeong <threeearcat@gmail.com>
+
+[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ]
+
+During fuzzing, a general protection fault is observed in
+vmci_host_poll().
+
+general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
+RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926
+<- omitting registers ->
+Call Trace:
+ <TASK>
+ lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672
+ __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
+ _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162
+ add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22
+ poll_wait include/linux/poll.h:49 [inline]
+ vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174
+ vfs_poll include/linux/poll.h:88 [inline]
+ do_pollfd fs/select.c:873 [inline]
+ do_poll fs/select.c:921 [inline]
+ do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015
+ __do_sys_ppoll fs/select.c:1121 [inline]
+ __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Example thread interleaving that causes the general protection fault
+is as follows:
+
+CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context)
+----- -----
+// Read uninitialized context
+context = vmci_host_dev->context;
+ // Initialize context
+ vmci_host_dev->context = vmci_ctx_create();
+ vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;
+
+if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
+ // Dereferencing the wrong pointer
+ poll_wait(..., &context->host_context);
+}
+
+In this scenario, vmci_host_poll() reads vmci_host_dev->context first,
+and then reads vmci_host_dev->ct_type to check that
+vmci_host_dev->context is initialized. However, since these two reads
+are not atomically executed, there is a chance of a race condition as
+described above.
+
+To fix this race condition, read vmci_host_dev->context after checking
+the value of vmci_host_dev->ct_type so that vmci_host_poll() always
+reads an initialized context.
+
+Reported-by: Dae R. Jeong <threeearcat@gmail.com>
+Fixes: 8bf503991f87 ("VMCI: host side driver implementation.")
+Signed-off-by: Dae R. Jeong <threeearcat@gmail.com>
+Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
+index 83e0c95d20a47..5acbf384ffa64 100644
+--- a/drivers/misc/vmw_vmci/vmci_host.c
++++ b/drivers/misc/vmw_vmci/vmci_host.c
+@@ -169,10 +169,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp)
+ static __poll_t vmci_host_poll(struct file *filp, poll_table *wait)
+ {
+ struct vmci_host_dev *vmci_host_dev = filp->private_data;
+- struct vmci_ctx *context = vmci_host_dev->context;
++ struct vmci_ctx *context;
+ __poll_t mask = 0;
+
+ if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
++ /*
++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make
++ * sure that context is initialized
++ */
++ context = vmci_host_dev->context;
++
+ /* Check for VMCI calls to this VM context. */
+ if (wait)
+ poll_wait(filp, &context->host_context.wait_queue,
+--
+2.39.2
+
--- /dev/null
+From 24bd8e94d5955254433995f5b0bbfab298552e70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 16:15:48 +0300
+Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ]
+
+This loop checks that i < max at the start of loop but then it does
+i++ which could put it past the end of the array. It's harmless to
+check again and prevent a potential out of bounds.
+
+Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
+index 01163b3339451..92f5c8e830901 100644
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max,
+ ee->ee_n_piers[mode]++;
+
+ freq2 = (val >> 8) & 0xff;
+- if (!freq2)
++ if (!freq2 || i >= max)
+ break;
+
+ pc[i++].freq = ath5k_eeprom_bin2freq(ee,
+--
+2.39.2
+
--- /dev/null
+From 521490349b094e659dca70a311017b55f511df00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 20:31:37 +0200
+Subject: wifi: ath6kl: minor fix for allocation size
+
+From: Alexey V. Vissarionov <gremlin@altlinux.org>
+
+[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ]
+
+Although the "param" pointer occupies more or equal space compared
+to "*param", the allocation size should use the size of variable
+itself.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver")
+Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/bmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c
+index bde5a10d470c8..af98e871199d3 100644
+--- a/drivers/net/wireless/ath/ath6kl/bmi.c
++++ b/drivers/net/wireless/ath/ath6kl/bmi.c
+@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param)
+ return -EACCES;
+ }
+
+- size = sizeof(cid) + sizeof(addr) + sizeof(param);
++ size = sizeof(cid) + sizeof(addr) + sizeof(*param);
+ if (size > ar->bmi.max_cmd_size) {
+ WARN_ON(1);
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 977e58334093bab4745e40f9cbcf5fa4984a34b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 12:28:05 +0200
+Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ]
+
+The warn is triggered on a known race condition, documented in the code above
+the test, that is correctly handled. Using WARN() hinders automated testing.
+Reducing severity.
+
+Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload")
+Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+index 434b668296466..73bf4af1f3c7c 100644
+--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+@@ -963,8 +963,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
+ * Thus the possibility of ar->htc_target being NULL
+ * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
+ */
+- if (WARN_ON_ONCE(!target)) {
+- ath6kl_err("Target not yet initialized\n");
++ if (!target) {
++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n");
+ status = -EINVAL;
+ goto free_skb;
+ }
+--
+2.39.2
+
--- /dev/null
+From aab0d0f7bdec6aae5fd661f604a89672c82aeca0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 22:23:01 +0300
+Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ]
+
+hif_dev->remain_skb is allocated and used exclusively in
+ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is
+processed and subsequently freed (in error paths) only during the next
+call of ath9k_hif_usb_rx_stream().
+
+So, if the urbs are deallocated between those two calls due to the device
+deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream()
+is not called next time and the allocated remain_skb is leaked. Our local
+Syzkaller instance was able to trigger that.
+
+remain_skb makes sense when receiving two consecutive urbs which are
+logically linked together, i.e. a specific data field from the first skb
+indicates a cached skb to be allocated, memcpy'd with some data and
+subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs
+deallocation supposedly makes that link irrelevant so we need to free the
+cached skb in those cases.
+
+Fix the leak by introducing a function to explicitly free remain_skb (if
+it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL
+when it has not been allocated at all (hif_dev struct is kzalloced) or
+when it has been processed in next call to ath9k_hif_usb_rx_stream().
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index e23d58f83dd6f..3aa915d215545 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = {
+ .send = hif_usb_send,
+ };
+
++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream
++ * in case ath9k_hif_usb_rx_stream wasn't called next time to
++ * process the buffer and subsequently free it.
++ */
++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&hif_dev->rx_lock, flags);
++ if (hif_dev->remain_skb) {
++ dev_kfree_skb_any(hif_dev->remain_skb);
++ hif_dev->remain_skb = NULL;
++ hif_dev->rx_remain_len = 0;
++ RX_STAT_INC(hif_dev, skb_dropped);
++ }
++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags);
++}
++
+ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ struct sk_buff *skb)
+ {
+@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+ usb_kill_anchored_urbs(&hif_dev->rx_submitted);
++ ath9k_hif_usb_free_rx_remain_skb(hif_dev);
+ }
+
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+--
+2.39.2
+
--- /dev/null
+From 60d5914aef2c3ec5a20f498a051ebcf3d8a22366 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 15:47:38 +0300
+Subject: wifi: iwlwifi: make the loop for card preparation effective
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ]
+
+Since we didn't reset t to 0, only the first iteration of the loop
+did checked the ready bit several times.
+From the second iteration and on, we just tested the bit once and
+continued to the next iteration.
+
+Reported-and-tested-by: Lorenzo Zolfanelli <lorenzo@zolfa.nl>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452
+Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 2d2afc1758304..c69c13e762bbe 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -666,7 +666,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans)
+ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ {
+ int ret;
+- int t = 0;
+ int iter;
+
+ IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
+@@ -681,6 +680,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ usleep_range(1000, 2000);
+
+ for (iter = 0; iter < 10; iter++) {
++ int t = 0;
++
+ /* If HW is not ready, prepare the conditions to check again */
+ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+ CSR_HW_IF_CONFIG_REG_PREPARE);
+--
+2.39.2
+
--- /dev/null
+From 63bb78a4220a1dee17e7571c4b6e524ca3603f5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 11:41:33 +0300
+Subject: wifi: iwlwifi: mvm: check firmware response size
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ]
+
+Check the firmware response size for responses to the
+memory read/write command in debugfs before using it.
+
+Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+index 05b77419953ce..9540c874fc380 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+@@ -1835,6 +1835,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+@@ -1912,6 +1917,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+--
+2.39.2
+
--- /dev/null
+From b6eb033d3231c9906489c20cbba435a86ae3df78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:31:38 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_rfreg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ]
+
+If there is a failure during copy_from_user or user-provided data buffer
+is invalid, rtl_debugfs_set_write_rfreg should return negative error code
+instead of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index cead66f7eb9f5..deacc7a28d3a7 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -416,8 +416,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -427,7 +427,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ if (num != 4) {
+ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
+ "Format is <path> <addr> <mask> <data>\n");
+- return count;
++ return -EINVAL;
+ }
+
+ rtl_set_rfreg(hw, path, addr, bitmask, data);
+--
+2.39.2
+
--- /dev/null
+From ad2f3d20ee05ce644d868aea74cb9c03bdf99fa1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:42:17 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_reg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ]
+
+If there is a failure during copy_from_user or user-provided data buffer is
+invalid, rtl_debugfs_set_write_reg should return negative error code instead
+of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index deacc7a28d3a7..6a0dfc6d4905e 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -319,8 +319,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -328,7 +328,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+ num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
+
+ if (num != 3)
+- return count;
++ return -EINVAL;
+
+ switch (len) {
+ case 1:
+--
+2.39.2
+
--- /dev/null
+From 4749c6bdf416084c30139fabc6859f1f061afa3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 17:09:17 +0100
+Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ]
+
+The detection of atomic update failure in reserve_eilvt_offset() is
+not correct. The value returned by atomic_cmpxchg() should be compared
+to the old value from the location to be updated.
+
+If these two are the same, then atomic update succeeded and
+"eilvt_offsets[offset]" location is updated to "new" in an atomic way.
+
+Otherwise, the atomic update failed and it should be retried with the
+value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg()
+does in a correct and more optimal way.
+
+Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/apic.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 926939978c1c3..9318fe7d850e3 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -403,10 +403,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new)
+ if (vector && !eilvt_entry_is_changeable(vector, new))
+ /* may not change if vectors are different */
+ return rsvd;
+- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new);
+- } while (rsvd != new);
++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new));
+
+- rsvd &= ~APIC_EILVT_MASKED;
++ rsvd = new & ~APIC_EILVT_MASKED;
+ if (rsvd && rsvd != vector)
+ pr_info("LVT offset %d assigned for vector 0x%02x\n",
+ offset, rsvd);
+--
+2.39.2
+
--- /dev/null
+From 7ad55a4e06e578a83b8e44f390ba7010ed08ac58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 00:30:04 -0700
+Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
+
+From: Saurabh Sengar <ssengar@linux.microsoft.com>
+
+[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ]
+
+arch_dynirq_lower_bound() is invoked by the core interrupt code to
+retrieve the lowest possible Linux interrupt number for dynamically
+allocated interrupts like MSI.
+
+The x86 implementation uses this to exclude the IO/APIC GSI space.
+This works correctly as long as there is an IO/APIC registered, but
+returns 0 if not. This has been observed in VMs where the BIOS does
+not advertise an IO/APIC.
+
+0 is an invalid interrupt number except for the legacy timer interrupt
+on x86. The return value is unchecked in the core code, so it ends up
+to allocate interrupt number 0 which is subsequently considered to be
+invalid by the caller, e.g. the MSI allocation code.
+
+The function has already a check for 0 in the case that an IO/APIC is
+registered, as ioapic_dynirq_base is 0 in case of device tree setups.
+
+Consolidate this and zero check for both ioapic_dynirq_base and gsi_top,
+which is used in the case that no IO/APIC is registered.
+
+Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines")
+Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/io_apic.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 677508baf95a0..af59aa9c55233 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2449,17 +2449,21 @@ static int io_apic_get_redir_entries(int ioapic)
+
+ unsigned int arch_dynirq_lower_bound(unsigned int from)
+ {
++ unsigned int ret;
++
+ /*
+ * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
+ * gsi_top if ioapic_dynirq_base hasn't been initialized yet.
+ */
+- if (!ioapic_initialized)
+- return gsi_top;
++ ret = ioapic_dynirq_base ? : gsi_top;
++
+ /*
+- * For DT enabled machines ioapic_dynirq_base is irrelevant and not
+- * updated. So simply return @from if ioapic_dynirq_base == 0.
++ * For DT enabled machines ioapic_dynirq_base is irrelevant and
++ * always 0. gsi_top can be 0 if there is no IO/APIC registered.
++ * 0 is an invalid interrupt number for dynamic allocations. Return
++ * @from instead.
+ */
+- return ioapic_dynirq_base ? : from;
++ return ret ? : from;
+ }
+
+ #ifdef CONFIG_X86_32
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
