--- /dev/null
+From 4c8ae9007454e372418b042e286b86a2ec02ade2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Dec 2022 10:07:01 -0400
+Subject: afs: Fix updating of i_size with dv jump from server
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit d7f74e9a917503ee78f2b603a456d7227cf38919 ]
+
+If the data version returned from the server is larger than expected,
+the local data is invalidated, but we may still want to note the remote
+file size.
+
+Since we're setting change_size, we have to also set data_changed
+for the i_size to get updated.
+
+Fixes: 3f4aa9818163 ("afs: Fix EOF corruption")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/afs/inode.c b/fs/afs/inode.c
+index 622363af4c1bf..fd681eec49aa2 100644
+--- a/fs/afs/inode.c
++++ b/fs/afs/inode.c
+@@ -227,6 +227,7 @@ static void afs_apply_status(struct afs_fs_cursor *fc,
+ set_bit(AFS_VNODE_ZAP_DATA, &vnode->flags);
+ }
+ change_size = true;
++ data_changed = true;
+ } else if (vnode->status.type == AFS_FTYPE_DIR) {
+ /* Expected directory change is handled elsewhere so
+ * that we can locally edit the directory and save on a
+--
+2.39.2
+
--- /dev/null
+From 7d1868f4691161dbe88c36ba06a34464c0f66c89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:51 +0530
+Subject: ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 2540279e9a9e74fc880d1e4c83754ecfcbe290a0 ]
+
+For 1MiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x100000. Hence, fix the bogus PCI address
+(0x40200000) specified in the ranges property for I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 187519403273 ("ARM: dts: ipq4019: Add a few peripheral nodes")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-16-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+index 338256c59ca5a..fc31ee980639a 100644
+--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi
+@@ -393,8 +393,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x40200000 0x40200000 0 0x00100000>,
+- <0x82000000 0 0x40300000 0x40300000 0 0x00d00000>;
++ ranges = <0x81000000 0x0 0x00000000 0x40200000 0x0 0x00100000>,
++ <0x82000000 0x0 0x40300000 0x40300000 0x0 0x00d00000>;
+
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From c68a4e500db1c08f2c198a23973df1075d6eaee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Feb 2023 22:17:52 +0530
+Subject: ARM: dts: qcom: ipq8064: Fix the PCI I/O port range
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+[ Upstream commit 0b16b34e491629016109e56747ad64588074194b ]
+
+For 64KiB of the I/O region, the I/O ports of the legacy PCI devices are
+located in the range of 0x0 to 0x10000. Hence, fix the bogus PCI addresses
+(0x0fe00000, 0x31e00000, 0x35e00000) specified in the ranges property for
+I/O region.
+
+While at it, let's use the missing 0x prefix for the addresses.
+
+Fixes: 93241840b664 ("ARM: dts: qcom: Add pcie nodes for ipq8064")
+Reported-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/linux-arm-msm/7c5dfa87-41df-4ba7-b0e4-72c8386402a8@app.fastmail.com/
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230228164752.55682-17-manivannan.sadhasivam@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+index f2653600f47f8..976a8a1fa9535 100644
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -451,8 +451,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */
+- 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x0fe00000 0x0 0x00010000 /* I/O */
++ 0x82000000 0x0 0x08000000 0x08000000 0x0 0x07e00000>; /* MEM */
+
+ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -502,8 +502,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */
+- 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x31e00000 0x0 0x00010000 /* I/O */
++ 0x82000000 0x0 0x2e000000 0x2e000000 0x0 0x03e00000>; /* MEM */
+
+ interrupts = <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+@@ -553,8 +553,8 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */
+- 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */
++ ranges = <0x81000000 0x0 0x00000000 0x35e00000 0x0 0x00010000 /* I/O */
++ 0x82000000 0x0 0x32000000 0x32000000 0x0 0x03e00000>; /* MEM */
+
+ interrupts = <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "msi";
+--
+2.39.2
+
--- /dev/null
+From 0adebd4e930cb7b957b747b9d9469eba88a27ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jul 2022 03:09:40 +0200
+Subject: ARM: dts: qcom: ipq8064: reduce pci IO size to 64K
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+[ Upstream commit 8fafb7e5c041814876266259e5e439f93571dcef ]
+
+The current value for pci IO is problematic for ath10k wifi card
+commonly connected to ipq8064 SoC.
+The current value is probably a typo and is actually uncommon to find
+1MB IO space even on a x86 arch. Also with recent changes to the pci
+driver, pci1 and pci2 now fails to function as any connected device
+fails any reg read/write. Reduce this to 64K as it should be more than
+enough and 3 * 64K of total IO space doesn't exceed the IO_SPACE_LIMIT
+hardcoded for the ARM arch.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Tested-by: Jonathan McDowell <noodles@earth.li>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220707010943.20857-7-ansuelsmth@gmail.com
+Stable-dep-of: 0b16b34e4916 ("ARM: dts: qcom: ipq8064: Fix the PCI I/O port range")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/qcom-ipq8064.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/qcom-ipq8064.dtsi b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+index 16c0da97932c1..f2653600f47f8 100644
+--- a/arch/arm/boot/dts/qcom-ipq8064.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq8064.dtsi
+@@ -451,7 +451,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00100000 /* downstream I/O */
++ ranges = <0x81000000 0 0x0fe00000 0x0fe00000 0 0x00010000 /* downstream I/O */
+ 0x82000000 0 0x08000000 0x08000000 0 0x07e00000>; /* non-prefetchable memory */
+
+ interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
+@@ -502,7 +502,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00100000 /* downstream I/O */
++ ranges = <0x81000000 0 0x31e00000 0x31e00000 0 0x00010000 /* downstream I/O */
+ 0x82000000 0 0x2e000000 0x2e000000 0 0x03e00000>; /* non-prefetchable memory */
+
+ interrupts = <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>;
+@@ -553,7 +553,7 @@
+ #address-cells = <3>;
+ #size-cells = <2>;
+
+- ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00100000 /* downstream I/O */
++ ranges = <0x81000000 0 0x35e00000 0x35e00000 0 0x00010000 /* downstream I/O */
+ 0x82000000 0 0x32000000 0x32000000 0 0x03e00000>; /* non-prefetchable memory */
+
+ interrupts = <GIC_SPI 71 IRQ_TYPE_LEVEL_HIGH>;
+--
+2.39.2
+
--- /dev/null
+From 87a11bd6e37f1b84801bcdb7008a6c69608e3c2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 16:30:32 +0100
+Subject: arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 554edc3e9239bb81e61be9f0f5dbbeb528a69e72 ]
+
+According to the RZ/G Series, 2nd Generation Hardware User’s Manual
+Rev. 1.11, the System CPU cores on RZ/G2E do not have their own power
+supply, but use the common internal power supply (typical 1.03V).
+
+Hence remove the "opp-microvolt" properties from the Operating
+Performance Points table. They are optional, and unused, when none of
+the CPU nodes is tied to a regulator using the "cpu-supply" property.
+
+Fixes: 231d8908a66fa98f ("arm64: dts: renesas: r8a774c0: Add OPPs table for cpu devices")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/8348e18a011ded94e35919cd8e17c0be1f9acf2f.1676560856.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+index 73ded80a79ba0..1de7891c658cf 100644
+--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi
+@@ -49,17 +49,14 @@
+ opp-shared;
+ opp-800000000 {
+ opp-hz = /bits/ 64 <800000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1000000000 {
+ opp-hz = /bits/ 64 <1000000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1200000000 {
+ opp-hz = /bits/ 64 <1200000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ opp-suspend;
+ };
+--
+2.39.2
+
--- /dev/null
+From fd069cc82fede04f3a771ab2e033764208f67970 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 16:30:31 +0100
+Subject: arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit fb76b0fae3ca880363214e1dcd6513ab8bd529e7 ]
+
+According to the R-Car Series, 3rd Generation Hardware User’s Manual
+Rev. 2.30, the System CPU cores on R-Car E3 do not have their own power
+supply, but use the common internal power supply (typical 1.03V).
+
+Hence remove the "opp-microvolt" properties from the Operating
+Performance Points table. They are optional, and unused, when none of
+the CPU nodes is tied to a regulator using the "cpu-supply" property.
+
+Fixes: dd7188eb4ed128dc ("arm64: dts: renesas: r8a77990: Add OPPs table for cpu devices")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/9232578d9d395d529f64db3333a371e31327f459.1676560856.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77990.dtsi | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+index dabee157119f9..82efc8a3627d9 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi
+@@ -60,17 +60,14 @@
+ opp-shared;
+ opp-800000000 {
+ opp-hz = /bits/ 64 <800000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1000000000 {
+ opp-hz = /bits/ 64 <1000000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ };
+ opp-1200000000 {
+ opp-hz = /bits/ 64 <1200000000>;
+- opp-microvolt = <820000>;
+ clock-latency-ns = <300000>;
+ opp-suspend;
+ };
+--
+2.39.2
+
--- /dev/null
+From 9854fb1df84e982146a78918ad05acc8f03c992b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 13:01:48 +0530
+Subject: arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+[ Upstream commit af6c0bd59f4f3ad5daad2f7b777954b1954551d5 ]
+
+Currently only the first attempt to single-step has any effect. After
+that all further stepping remains "stuck" at the same program counter
+value.
+
+Refer to the ARM Architecture Reference Manual (ARM DDI 0487E.a) D2.12,
+PSTATE.SS=1 should be set at each step before transferring the PE to the
+'Active-not-pending' state. The problem here is PSTATE.SS=1 is not set
+since the second single-step.
+
+After the first single-step, the PE transferes to the 'Inactive' state,
+with PSTATE.SS=0 and MDSCR.SS=1, thus PSTATE.SS won't be set to 1 due to
+kernel_active_single_step()=true. Then the PE transferes to the
+'Active-pending' state when ERET and returns to the debugger by step
+exception.
+
+Before this patch:
+==================
+Entering kdb (current=0xffff3376039f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb>
+
+[0]kdb>
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffa45c13d09290 (write_sysrq_trigger)
+ is enabled addr at ffffa45c13d09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to Breakpoint @ 0xffffad651a309290
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb> ss
+
+Entering kdb (current=0xffff4f7e453f8000, pid 175) on processor 1 due to SS trap @ 0xffffad651a309294
+[1]kdb>
+
+After this patch:
+=================
+Entering kdb (current=0xffff6851c39f0000, pid 1) on processor 0 due to Keyboard Entry
+[0]kdb> bp write_sysrq_trigger
+Instruction(i) BP #0 at 0xffffc02d2dd09290 (write_sysrq_trigger)
+ is enabled addr at ffffc02d2dd09290, hardtype=0 installed=0
+
+[0]kdb> go
+$ echo h > /proc/sysrq-trigger
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to Breakpoint @ 0xffffc02d2dd09290
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09294
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd09298
+[1]kdb> ss
+
+Entering kdb (current=0xffff6851c53c1840, pid 174) on processor 1 due to SS trap @ 0xffffc02d2dd0929c
+[1]kdb>
+
+Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support")
+Co-developed-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Wei Li <liwei391@huawei.com>
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Tested-by: Daniel Thompson <daniel.thompson@linaro.org>
+Link: https://lore.kernel.org/r/20230202073148.657746-3-sumit.garg@linaro.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/debug-monitors.h | 1 +
+ arch/arm64/kernel/debug-monitors.c | 5 +++++
+ arch/arm64/kernel/kgdb.c | 2 ++
+ 3 files changed, 8 insertions(+)
+
+diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
+index 0253691c4b3a1..bd451732a3afb 100644
+--- a/arch/arm64/include/asm/debug-monitors.h
++++ b/arch/arm64/include/asm/debug-monitors.h
+@@ -116,6 +116,7 @@ void user_regs_reset_single_step(struct user_pt_regs *regs,
+ void kernel_enable_single_step(struct pt_regs *regs);
+ void kernel_disable_single_step(void);
+ int kernel_active_single_step(void);
++void kernel_rewind_single_step(struct pt_regs *regs);
+
+ #ifdef CONFIG_HAVE_HW_BREAKPOINT
+ int reinstall_suspended_bps(struct pt_regs *regs);
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index d64a3c1e1b6ba..62ab9d4f995eb 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -441,6 +441,11 @@ int kernel_active_single_step(void)
+ }
+ NOKPROBE_SYMBOL(kernel_active_single_step);
+
++void kernel_rewind_single_step(struct pt_regs *regs)
++{
++ set_regs_spsr_ss(regs);
++}
++
+ /* ptrace API */
+ void user_enable_single_step(struct task_struct *task)
+ {
+diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
+index 1a157ca33262d..e4e95821b1f6c 100644
+--- a/arch/arm64/kernel/kgdb.c
++++ b/arch/arm64/kernel/kgdb.c
+@@ -223,6 +223,8 @@ int kgdb_arch_handle_exception(int exception_vector, int signo,
+ */
+ if (!kernel_active_single_step())
+ kernel_enable_single_step(linux_regs);
++ else
++ kernel_rewind_single_step(linux_regs);
+ err = 0;
+ break;
+ default:
+--
+2.39.2
+
--- /dev/null
+From fa47fe768b9ef05affe35ab978bc8a48475935c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 12:49:01 +0300
+Subject: ASoC: es8316: Handle optional IRQ assignment
+
+From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+
+[ Upstream commit 39db65a0a17b54915b269d3685f253a4731f344c ]
+
+The driver is able to work fine without relying on a mandatory interrupt
+being assigned to the I2C device. This is only needed when making use of
+the jack-detect support.
+
+However, the following warning message is always emitted when there is
+no such interrupt available:
+
+ es8316 0-0011: Failed to get IRQ 0: -22
+
+Do not attempt to request an IRQ if it is not available/valid. This also
+ensures the rather misleading message is not displayed anymore.
+
+Also note the IRQ validation relies on commit dab472eb931bc291 ("i2c /
+ACPI: Use 0 to indicate that device does not have interrupt assigned").
+
+Fixes: 822257661031 ("ASoC: es8316: Add jack-detect support")
+Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20230328094901.50763-1-cristian.ciocaltea@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index 573085f7cfd1e..efeffa0bf2d78 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -806,12 +806,14 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client,
+ es8316->irq = i2c_client->irq;
+ mutex_init(&es8316->lock);
+
+- ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
+- "es8316", es8316);
+- if (ret) {
+- dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
+- es8316->irq = -ENXIO;
++ if (es8316->irq > 0) {
++ ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
++ "es8316", es8316);
++ if (ret) {
++ dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
++ es8316->irq = -ENXIO;
++ }
+ }
+
+ return devm_snd_soc_register_component(&i2c_client->dev,
+--
+2.39.2
+
--- /dev/null
+From e03dc9f63a5175510ae3902c5bb246ef329a7d30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Oct 2021 15:22:54 +0200
+Subject: ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1cf2aa665901054b140eb71748661ceae99b6b5a ]
+
+Use the new IRQF_NO_AUTOEN flag when requesting the IRQ, rather then
+disabling it immediately after requesting it.
+
+This fixes a possible race where the IRQ might trigger between requesting
+and disabling it; and this also leads to a small code cleanup.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20211003132255.31743-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 39db65a0a17b ("ASoC: es8316: Handle optional IRQ assignment")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8316.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
+index b781b28de0126..573085f7cfd1e 100644
+--- a/sound/soc/codecs/es8316.c
++++ b/sound/soc/codecs/es8316.c
+@@ -807,12 +807,9 @@ static int es8316_i2c_probe(struct i2c_client *i2c_client,
+ mutex_init(&es8316->lock);
+
+ ret = devm_request_threaded_irq(dev, es8316->irq, NULL, es8316_irq,
+- IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
++ IRQF_TRIGGER_HIGH | IRQF_ONESHOT | IRQF_NO_AUTOEN,
+ "es8316", es8316);
+- if (ret == 0) {
+- /* Gets re-enabled by es8316_set_jack() */
+- disable_irq(es8316->irq);
+- } else {
++ if (ret) {
+ dev_warn(dev, "Failed to get IRQ %d: %d\n", es8316->irq, ret);
+ es8316->irq = -ENXIO;
+ }
+--
+2.39.2
+
--- /dev/null
+From 01647a5393028bcde1e007d9caefa4f4d4d2c30b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 15:53:38 -0700
+Subject: bpf: Don't EFAULT for getsockopt with optval=NULL
+
+From: Stanislav Fomichev <sdf@google.com>
+
+[ Upstream commit 00e74ae0863827d944e36e56a4ce1e77e50edb91 ]
+
+Some socket options do getsockopt with optval=NULL to estimate the size
+of the final buffer (which is returned via optlen). This breaks BPF
+getsockopt assumptions about permitted optval buffer size. Let's enforce
+these assumptions only when non-NULL optval is provided.
+
+Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
+Reported-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/ZD7Js4fj5YyI2oLd@google.com/T/#mb68daf700f87a9244a15d01d00c3f0e5b08f49f7
+Link: https://lore.kernel.org/bpf/20230418225343.553806-2-sdf@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cgroup.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index c2f0aa818b7af..08c1246c758ea 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -1131,7 +1131,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ goto out;
+ }
+
+- if (ctx.optlen > max_optlen || ctx.optlen < 0) {
++ if (optval && (ctx.optlen > max_optlen || ctx.optlen < 0)) {
+ ret = -EFAULT;
+ goto out;
+ }
+@@ -1145,8 +1145,11 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
+ }
+
+ if (ctx.optlen != 0) {
+- if (copy_to_user(optval, ctx.optval, ctx.optlen) ||
+- put_user(ctx.optlen, optlen)) {
++ if (optval && copy_to_user(optval, ctx.optval, ctx.optlen)) {
++ ret = -EFAULT;
++ goto out;
++ }
++ if (put_user(ctx.optlen, optlen)) {
+ ret = -EFAULT;
+ goto out;
+ }
+--
+2.39.2
+
--- /dev/null
+From e3d86fe224f93df47cf4b38d773e24bada9dd250 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 20:26:22 +0800
+Subject: bpf, sockmap: fix deadlocks in the sockhash and sockmap
+
+From: Xin Liu <liuxin350@huawei.com>
+
+[ Upstream commit ed17aa92dc56b6d8883e4b7a8f1c6fbf5ed6cd29 ]
+
+When huang uses sched_switch tracepoint, the tracepoint
+does only one thing in the mounted ebpf program, which
+deletes the fixed elements in sockhash ([0])
+
+It seems that elements in sockhash are rarely actively
+deleted by users or ebpf program. Therefore, we do not
+pay much attention to their deletion. Compared with hash
+maps, sockhash only provides spin_lock_bh protection.
+This causes it to appear to have self-locking behavior
+in the interrupt context.
+
+ [0]:https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/
+
+Reported-by: Hsin-Wei Hung <hsinweih@uci.edu>
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Xin Liu <liuxin350@huawei.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/r/20230406122622.109978-1-liuxin350@huawei.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index 5bce6d4d20573..78f2b6b265b2a 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -322,8 +322,9 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ {
+ struct sock *sk;
+ int err = 0;
++ unsigned long flags;
+
+- raw_spin_lock_bh(&stab->lock);
++ raw_spin_lock_irqsave(&stab->lock, flags);
+ sk = *psk;
+ if (!sk_test || sk_test == sk)
+ sk = xchg(psk, NULL);
+@@ -333,7 +334,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ else
+ err = -EINVAL;
+
+- raw_spin_unlock_bh(&stab->lock);
++ raw_spin_unlock_irqrestore(&stab->lock, flags);
+ return err;
+ }
+
+@@ -655,11 +656,12 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ struct bpf_htab_bucket *bucket;
+ struct bpf_htab_elem *elem;
+ int ret = -ENOENT;
++ unsigned long flags;
+
+ hash = sock_hash_bucket_hash(key, key_size);
+ bucket = sock_hash_select_bucket(htab, hash);
+
+- raw_spin_lock_bh(&bucket->lock);
++ raw_spin_lock_irqsave(&bucket->lock, flags);
+ elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size);
+ if (elem) {
+ hlist_del_rcu(&elem->node);
+@@ -667,7 +669,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ sock_hash_free_elem(htab, elem);
+ ret = 0;
+ }
+- raw_spin_unlock_bh(&bucket->lock);
++ raw_spin_unlock_irqrestore(&bucket->lock, flags);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 658fe6b83bdfb06c0abf45caa449aac0285f7899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 20:28:42 +0200
+Subject: bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 8c5c2a4898e3d6bad86e29d471e023c8a19ba799 ]
+
+syzbot reported a splat and bisected it to recent commit ed17aa92dc56 ("bpf,
+sockmap: fix deadlocks in the sockhash and sockmap"):
+
+ [...]
+ WARNING: CPU: 1 PID: 9280 at kernel/softirq.c:376 __local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+ Modules linked in:
+ CPU: 1 PID: 9280 Comm: syz-executor.1 Not tainted 6.2.0-syzkaller-13249-gd319f344561d #0
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
+ RIP: 0010:__local_bh_enable_ip+0xbe/0x130 kernel/softirq.c:376
+ [...]
+ Call Trace:
+ <TASK>
+ spin_unlock_bh include/linux/spinlock.h:395 [inline]
+ sock_map_del_link+0x2ea/0x510 net/core/sock_map.c:165
+ sock_map_unref+0xb0/0x1d0 net/core/sock_map.c:184
+ sock_hash_delete_elem+0x1ec/0x2a0 net/core/sock_map.c:945
+ map_delete_elem kernel/bpf/syscall.c:1536 [inline]
+ __sys_bpf+0x2edc/0x53e0 kernel/bpf/syscall.c:5053
+ __do_sys_bpf kernel/bpf/syscall.c:5166 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:5164 [inline]
+ __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5164
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+ RIP: 0033:0x7fe8f7c8c169
+ </TASK>
+ [...]
+
+Revert for now until we have a proper solution.
+
+Fixes: ed17aa92dc56 ("bpf, sockmap: fix deadlocks in the sockhash and sockmap")
+Reported-by: syzbot+49f6cef45247ff249498@syzkaller.appspotmail.com
+Cc: Hsin-Wei Hung <hsinweih@uci.edu>
+Cc: Xin Liu <liuxin350@huawei.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/000000000000f1db9605f939720e@google.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index 78f2b6b265b2a..5bce6d4d20573 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -322,9 +322,8 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ {
+ struct sock *sk;
+ int err = 0;
+- unsigned long flags;
+
+- raw_spin_lock_irqsave(&stab->lock, flags);
++ raw_spin_lock_bh(&stab->lock);
+ sk = *psk;
+ if (!sk_test || sk_test == sk)
+ sk = xchg(psk, NULL);
+@@ -334,7 +333,7 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ else
+ err = -EINVAL;
+
+- raw_spin_unlock_irqrestore(&stab->lock, flags);
++ raw_spin_unlock_bh(&stab->lock);
+ return err;
+ }
+
+@@ -656,12 +655,11 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ struct bpf_htab_bucket *bucket;
+ struct bpf_htab_elem *elem;
+ int ret = -ENOENT;
+- unsigned long flags;
+
+ hash = sock_hash_bucket_hash(key, key_size);
+ bucket = sock_hash_select_bucket(htab, hash);
+
+- raw_spin_lock_irqsave(&bucket->lock, flags);
++ raw_spin_lock_bh(&bucket->lock);
+ elem = sock_hash_lookup_elem_raw(&bucket->head, hash, key, key_size);
+ if (elem) {
+ hlist_del_rcu(&elem->node);
+@@ -669,7 +667,7 @@ static int sock_hash_delete_elem(struct bpf_map *map, void *key)
+ sock_hash_free_elem(htab, elem);
+ ret = 0;
+ }
+- raw_spin_unlock_irqrestore(&bucket->lock, flags);
++ raw_spin_unlock_bh(&bucket->lock);
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 6212176573d42400f51785571278d3df7debf017 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 14:21:15 +0100
+Subject: bpftool: Fix bug for long instructions in program CFG dumps
+
+From: Quentin Monnet <quentin@isovalent.com>
+
+[ Upstream commit 67cf52cdb6c8fa6365d29106555dacf95c9fd374 ]
+
+When dumping the control flow graphs for programs using the 16-byte long
+load instruction, we need to skip the second part of this instruction
+when looking for the next instruction to process. Otherwise, we end up
+printing "BUG_ld_00" from the kernel disassembler in the CFG.
+
+Fixes: efcef17a6d65 ("tools: bpftool: generate .dot graph from CFG information")
+Signed-off-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/r/20230405132120.59886-3-quentin@isovalent.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/xlated_dumper.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c
+index 5b91ee65a0802..762ca450d1980 100644
+--- a/tools/bpf/bpftool/xlated_dumper.c
++++ b/tools/bpf/bpftool/xlated_dumper.c
+@@ -363,8 +363,15 @@ void dump_xlated_for_graph(struct dump_data *dd, void *buf_start, void *buf_end,
+ struct bpf_insn *insn_start = buf_start;
+ struct bpf_insn *insn_end = buf_end;
+ struct bpf_insn *cur = insn_start;
++ bool double_insn = false;
+
+ for (; cur <= insn_end; cur++) {
++ if (double_insn) {
++ double_insn = false;
++ continue;
++ }
++ double_insn = cur->code == (BPF_LD | BPF_IMM | BPF_DW);
++
+ printf("% 4d: ", (int)(cur - insn_start + start_idx));
+ print_bpf_insn(&cbs, cur, true);
+ if (cur != insn_end)
+--
+2.39.2
+
--- /dev/null
+From 1f99292ffd01cf8972d848a1194409ba39382630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 09:32:27 +0100
+Subject: clk: add missing of_node_put() in "assigned-clocks" property parsing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Léger <clement.leger@bootlin.com>
+
+[ Upstream commit 27a6e1b09a782517fddac91259970ac466a3f7b6 ]
+
+When returning from of_parse_phandle_with_args(), the np member of the
+of_phandle_args structure should be put after usage. Add missing
+of_node_put() calls in both __set_clk_parents() and __set_clk_rates().
+
+Fixes: 86be408bfbd8 ("clk: Support for clock parents and rates assigned from device tree")
+Signed-off-by: Clément Léger <clement.leger@bootlin.com>
+Link: https://lore.kernel.org/r/20230131083227.10990-1-clement.leger@bootlin.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-conf.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk-conf.c b/drivers/clk/clk-conf.c
+index 2ef819606c417..1a4e6340f95ce 100644
+--- a/drivers/clk/clk-conf.c
++++ b/drivers/clk/clk-conf.c
+@@ -33,9 +33,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+ pclk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(pclk)) {
+ if (PTR_ERR(pclk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get parent clock %d for %pOF\n",
+@@ -48,10 +51,12 @@ static int __set_clk_parents(struct device_node *node, bool clk_supplier)
+ if (rc < 0)
+ goto err;
+ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ rc = 0;
+ goto err;
+ }
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get assigned clock %d for %pOF\n",
+@@ -93,10 +98,13 @@ static int __set_clk_rates(struct device_node *node, bool clk_supplier)
+ else
+ return rc;
+ }
+- if (clkspec.np == node && !clk_supplier)
++ if (clkspec.np == node && !clk_supplier) {
++ of_node_put(clkspec.np);
+ return 0;
++ }
+
+ clk = of_clk_get_from_provider(&clkspec);
++ of_node_put(clkspec.np);
+ if (IS_ERR(clk)) {
+ if (PTR_ERR(clk) != -EPROBE_DEFER)
+ pr_warn("clk: couldn't get clock %d for %pOF\n",
+--
+2.39.2
+
--- /dev/null
+From 1f77d308061cd7a80d669addae17306f884ac774 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Apr 2020 12:12:26 +0200
+Subject: clocksource: davinci: axe a pointless __GFP_NOFAIL
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 4855f2bd91b6e3461af7d795bfe9a40420122131 ]
+
+There is no need to specify __GFP_NOFAIL when allocating memory here, so
+axe it.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200409101226.15432-1-christophe.jaillet@wanadoo.fr
+Stable-dep-of: fb73556386e0 ("clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-davinci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
+index aae9383682303..bb4eee31ae082 100644
+--- a/drivers/clocksource/timer-davinci.c
++++ b/drivers/clocksource/timer-davinci.c
+@@ -270,7 +270,7 @@ int __init davinci_timer_register(struct clk *clk,
+ davinci_timer_init(base);
+ tick_rate = clk_get_rate(clk);
+
+- clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL | __GFP_NOFAIL);
++ clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL);
+ if (!clockevent)
+ return -ENOMEM;
+
+--
+2.39.2
+
--- /dev/null
+From 8628e6f21d6952bf80721a1f83fae6022791c894 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Apr 2020 11:25:43 +0200
+Subject: clocksource/drivers/davinci: Avoid trailing '\n' hidden in pr_fmt()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit bdf8783c0dae9d3d8fc1c4078fe849ab8aa8b583 ]
+
+pr_xxx() functions usually have '\n' at the end of the logging message.
+Here, this '\n' is added via the 'pr_fmt' macro.
+
+In order to be more consistent with other files, use a more standard
+convention and put these '\n' back in the messages themselves and remove it
+from the pr_fmt macro.
+
+While at it, remove a useless message in case of 'kzalloc' failure,
+especially with a __GFP_NOFAIL flag.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20200409092543.14727-1-christophe.jaillet@wanadoo.fr
+Stable-dep-of: fb73556386e0 ("clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-davinci.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
+index e421946a91c5a..aae9383682303 100644
+--- a/drivers/clocksource/timer-davinci.c
++++ b/drivers/clocksource/timer-davinci.c
+@@ -18,7 +18,7 @@
+ #include <clocksource/timer-davinci.h>
+
+ #undef pr_fmt
+-#define pr_fmt(fmt) "%s: " fmt "\n", __func__
++#define pr_fmt(fmt) "%s: " fmt, __func__
+
+ #define DAVINCI_TIMER_REG_TIM12 0x10
+ #define DAVINCI_TIMER_REG_TIM34 0x14
+@@ -250,20 +250,20 @@ int __init davinci_timer_register(struct clk *clk,
+
+ rv = clk_prepare_enable(clk);
+ if (rv) {
+- pr_err("Unable to prepare and enable the timer clock");
++ pr_err("Unable to prepare and enable the timer clock\n");
+ return rv;
+ }
+
+ if (!request_mem_region(timer_cfg->reg.start,
+ resource_size(&timer_cfg->reg),
+ "davinci-timer")) {
+- pr_err("Unable to request memory region");
++ pr_err("Unable to request memory region\n");
+ return -EBUSY;
+ }
+
+ base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg));
+ if (!base) {
+- pr_err("Unable to map the register range");
++ pr_err("Unable to map the register range\n");
+ return -ENOMEM;
+ }
+
+@@ -271,10 +271,8 @@ int __init davinci_timer_register(struct clk *clk,
+ tick_rate = clk_get_rate(clk);
+
+ clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL | __GFP_NOFAIL);
+- if (!clockevent) {
+- pr_err("Error allocating memory for clockevent data");
++ if (!clockevent)
+ return -ENOMEM;
+- }
+
+ clockevent->dev.name = "tim12";
+ clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT;
+@@ -298,7 +296,7 @@ int __init davinci_timer_register(struct clk *clk,
+ davinci_timer_irq_timer, IRQF_TIMER,
+ "clockevent/tim12", clockevent);
+ if (rv) {
+- pr_err("Unable to request the clockevent interrupt");
++ pr_err("Unable to request the clockevent interrupt\n");
+ return rv;
+ }
+
+@@ -325,7 +323,7 @@ int __init davinci_timer_register(struct clk *clk,
+
+ rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate);
+ if (rv) {
+- pr_err("Unable to register clocksource");
++ pr_err("Unable to register clocksource\n");
+ return rv;
+ }
+
+@@ -343,20 +341,20 @@ static int __init of_davinci_timer_register(struct device_node *np)
+
+ rv = of_address_to_resource(np, 0, &timer_cfg.reg);
+ if (rv) {
+- pr_err("Unable to get the register range for timer");
++ pr_err("Unable to get the register range for timer\n");
+ return rv;
+ }
+
+ rv = of_irq_to_resource_table(np, timer_cfg.irq,
+ DAVINCI_TIMER_NUM_IRQS);
+ if (rv != DAVINCI_TIMER_NUM_IRQS) {
+- pr_err("Unable to get the interrupts for timer");
++ pr_err("Unable to get the interrupts for timer\n");
+ return rv;
+ }
+
+ clk = of_clk_get(np, 0);
+ if (IS_ERR(clk)) {
+- pr_err("Unable to get the timer clock");
++ pr_err("Unable to get the timer clock\n");
+ return PTR_ERR(clk);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From b3ab4e8875be6b52b5f8417e73e7aa540a9fb9e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 13:50:37 +0000
+Subject: clocksource/drivers/davinci: Fix memory leak in
+ davinci_timer_register when init fails
+
+From: Qinrun Dai <flno@hust.edu.cn>
+
+[ Upstream commit fb73556386e074e9bee9fa2d253aeaefe4e063e0 ]
+
+Smatch reports:
+drivers/clocksource/timer-davinci.c:332 davinci_timer_register()
+warn: 'base' from ioremap() not released on lines: 274.
+
+Fix this and other potential memory leak problems
+by adding a set of corresponding exit lables.
+
+Fixes: 721154f972aa ("clocksource/drivers/davinci: Add support for clockevents")
+Signed-off-by: Qinrun Dai <flno@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230413135037.1505799-1-flno@hust.edu.cn
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-davinci.c | 30 +++++++++++++++++++++++------
+ 1 file changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
+index bb4eee31ae082..3dc0c6ceed027 100644
+--- a/drivers/clocksource/timer-davinci.c
++++ b/drivers/clocksource/timer-davinci.c
+@@ -258,21 +258,25 @@ int __init davinci_timer_register(struct clk *clk,
+ resource_size(&timer_cfg->reg),
+ "davinci-timer")) {
+ pr_err("Unable to request memory region\n");
+- return -EBUSY;
++ rv = -EBUSY;
++ goto exit_clk_disable;
+ }
+
+ base = ioremap(timer_cfg->reg.start, resource_size(&timer_cfg->reg));
+ if (!base) {
+ pr_err("Unable to map the register range\n");
+- return -ENOMEM;
++ rv = -ENOMEM;
++ goto exit_mem_region;
+ }
+
+ davinci_timer_init(base);
+ tick_rate = clk_get_rate(clk);
+
+ clockevent = kzalloc(sizeof(*clockevent), GFP_KERNEL);
+- if (!clockevent)
+- return -ENOMEM;
++ if (!clockevent) {
++ rv = -ENOMEM;
++ goto exit_iounmap_base;
++ }
+
+ clockevent->dev.name = "tim12";
+ clockevent->dev.features = CLOCK_EVT_FEAT_ONESHOT;
+@@ -297,7 +301,7 @@ int __init davinci_timer_register(struct clk *clk,
+ "clockevent/tim12", clockevent);
+ if (rv) {
+ pr_err("Unable to request the clockevent interrupt\n");
+- return rv;
++ goto exit_free_clockevent;
+ }
+
+ davinci_clocksource.dev.rating = 300;
+@@ -324,13 +328,27 @@ int __init davinci_timer_register(struct clk *clk,
+ rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate);
+ if (rv) {
+ pr_err("Unable to register clocksource\n");
+- return rv;
++ goto exit_free_irq;
+ }
+
+ sched_clock_register(davinci_timer_read_sched_clock,
+ DAVINCI_TIMER_CLKSRC_BITS, tick_rate);
+
+ return 0;
++
++exit_free_irq:
++ free_irq(timer_cfg->irq[DAVINCI_TIMER_CLOCKEVENT_IRQ].start,
++ clockevent);
++exit_free_clockevent:
++ kfree(clockevent);
++exit_iounmap_base:
++ iounmap(base);
++exit_mem_region:
++ release_mem_region(timer_cfg->reg.start,
++ resource_size(&timer_cfg->reg));
++exit_clk_disable:
++ clk_disable_unprepare(clk);
++ return rv;
+ }
+
+ static int __init of_davinci_timer_register(struct device_node *np)
+--
+2.39.2
+
--- /dev/null
+From 8118937dcd9b30a38a02bca18bac3529b957735b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Nov 2021 15:18:08 +0100
+Subject: crypto: drbg - make drbg_prepare_hrng() handle jent instantiation
+ errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nicolai Stange <nstange@suse.de>
+
+[ Upstream commit 559edd47cce4cc407d606b4d7f376822816fd4b8 ]
+
+Now that drbg_prepare_hrng() doesn't do anything but to instantiate a
+jitterentropy crypto_rng instance, it looks a little odd to have the
+related error handling at its only caller, drbg_instantiate().
+
+Move the handling of jitterentropy allocation failures from
+drbg_instantiate() close to the allocation itself in drbg_prepare_hrng().
+
+There is no change in behaviour.
+
+Signed-off-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Stephan Müller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Stable-dep-of: 686cd976b6dd ("crypto: drbg - Only fail when jent is unavailable in FIPS mode")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/drbg.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index 9329d9dcc210f..732b72e4ee4dd 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1515,6 +1515,14 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ return 0;
+
+ drbg->jent = crypto_alloc_rng("jitterentropy_rng", 0, 0);
++ if (IS_ERR(drbg->jent)) {
++ const int err = PTR_ERR(drbg->jent);
++
++ drbg->jent = NULL;
++ if (fips_enabled || err != -ENOENT)
++ return err;
++ pr_info("DRBG: Continuing without Jitter RNG\n");
++ }
+
+ return 0;
+ }
+@@ -1570,14 +1578,6 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers,
+ if (ret)
+ goto free_everything;
+
+- if (IS_ERR(drbg->jent)) {
+- ret = PTR_ERR(drbg->jent);
+- drbg->jent = NULL;
+- if (fips_enabled || ret != -ENOENT)
+- goto free_everything;
+- pr_info("DRBG: Continuing without Jitter RNG\n");
+- }
+-
+ reseed = false;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 31ece2cd74e85b74397a60d09304988a70f825cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 11:35:23 +0800
+Subject: crypto: drbg - Only fail when jent is unavailable in FIPS mode
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+[ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ]
+
+When jent initialisation fails for any reason other than ENOENT,
+the entire drbg fails to initialise, even when we're not in FIPS
+mode. This is wrong because we can still use the kernel RNG when
+we're not in FIPS mode.
+
+Change it so that it only fails when we are in FIPS mode.
+
+Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/drbg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index 732b72e4ee4dd..df80752fb649b 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1519,7 +1519,7 @@ static int drbg_prepare_hrng(struct drbg_state *drbg)
+ const int err = PTR_ERR(drbg->jent);
+
+ drbg->jent = NULL;
+- if (fips_enabled || err != -ENOENT)
++ if (fips_enabled)
+ return err;
+ pr_info("DRBG: Continuing without Jitter RNG\n");
+ }
+--
+2.39.2
+
--- /dev/null
+From 4c5eef0063529ea25571180a3031374baa794a50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 09:54:39 +0200
+Subject: debugobject: Prevent init race with static objects
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 63a759694eed61025713b3e14dd827c8548daadc ]
+
+Statically initialized objects are usually not initialized via the init()
+function of the subsystem. They are special cased and the subsystem
+provides a function to validate whether an object which is not yet tracked
+by debugobjects is statically initialized. This means the object is started
+to be tracked on first use, e.g. activation.
+
+This works perfectly fine, unless there are two concurrent operations on
+that object. Schspa decoded the problem:
+
+T0 T1
+
+debug_object_assert_init(addr)
+ lock_hash_bucket()
+ obj = lookup_object(addr);
+ if (!obj) {
+ unlock_hash_bucket();
+ - > preemption
+ lock_subsytem_object(addr);
+ activate_object(addr)
+ lock_hash_bucket();
+ obj = lookup_object(addr);
+ if (!obj) {
+ unlock_hash_bucket();
+ if (is_static_object(addr))
+ init_and_track(addr);
+ lock_hash_bucket();
+ obj = lookup_object(addr);
+ obj->state = ACTIVATED;
+ unlock_hash_bucket();
+
+ subsys function modifies content of addr,
+ so static object detection does
+ not longer work.
+
+ unlock_subsytem_object(addr);
+
+ if (is_static_object(addr)) <- Fails
+
+ debugobject emits a warning and invokes the fixup function which
+ reinitializes the already active object in the worst case.
+
+This race exists forever, but was never observed until mod_timer() got a
+debug_object_assert_init() added which is outside of the timer base lock
+held section right at the beginning of the function to cover the lockless
+early exit points too.
+
+Rework the code so that the lookup, the static object check and the
+tracking object association happens atomically under the hash bucket
+lock. This prevents the issue completely as all callers are serialized on
+the hash bucket lock and therefore cannot observe inconsistent state.
+
+Fixes: 3ac7fe5a4aab ("infrastructure to debug (dynamic) objects")
+Reported-by: syzbot+5093ba19745994288b53@syzkaller.appspotmail.com
+Debugged-by: Schspa Shi <schspa@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://syzkaller.appspot.com/bug?id=22c8a5938eab640d1c6bcc0e3dc7be519d878462
+Link: https://lore.kernel.org/lkml/20230303161906.831686-1-schspa@gmail.com
+Link: https://lore.kernel.org/r/87zg7dzgao.ffs@tglx
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 125 ++++++++++++++++++++++++---------------------
+ 1 file changed, 66 insertions(+), 59 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 48054dbf1b51f..c7cebd2abf482 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -218,10 +218,6 @@ static struct debug_obj *__alloc_object(struct hlist_head *list)
+ return obj;
+ }
+
+-/*
+- * Allocate a new object. If the pool is empty, switch off the debugger.
+- * Must be called with interrupts disabled.
+- */
+ static struct debug_obj *
+ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ {
+@@ -528,11 +524,49 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ WARN_ON(1);
+ }
+
++static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket *b,
++ struct debug_obj_descr *descr,
++ bool onstack, bool alloc_ifstatic)
++{
++ struct debug_obj *obj = lookup_object(addr, b);
++ enum debug_obj_state state = ODEBUG_STATE_NONE;
++
++ if (likely(obj))
++ return obj;
++
++ /*
++ * debug_object_init() unconditionally allocates untracked
++ * objects. It does not matter whether it is a static object or
++ * not.
++ *
++ * debug_object_assert_init() and debug_object_activate() allow
++ * allocation only if the descriptor callback confirms that the
++ * object is static and considered initialized. For non-static
++ * objects the allocation needs to be done from the fixup callback.
++ */
++ if (unlikely(alloc_ifstatic)) {
++ if (!descr->is_static_object || !descr->is_static_object(addr))
++ return ERR_PTR(-ENOENT);
++ /* Statically allocated objects are considered initialized */
++ state = ODEBUG_STATE_INIT;
++ }
++
++ obj = alloc_object(addr, b, descr);
++ if (likely(obj)) {
++ obj->state = state;
++ debug_object_is_on_stack(addr, onstack);
++ return obj;
++ }
++
++ /* Out of memory. Do the cleanup outside of the locked region */
++ debug_objects_enabled = 0;
++ return NULL;
++}
++
+ static void
+ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ {
+ enum debug_obj_state state;
+- bool check_stack = false;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -543,16 +577,11 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (!obj) {
+- obj = alloc_object(addr, db, descr);
+- if (!obj) {
+- debug_objects_enabled = 0;
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- debug_objects_oom();
+- return;
+- }
+- check_stack = true;
++ obj = lookup_object_or_alloc(addr, db, descr, onstack, false);
++ if (unlikely(!obj)) {
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ debug_objects_oom();
++ return;
+ }
+
+ switch (obj->state) {
+@@ -578,8 +607,6 @@ __debug_object_init(void *addr, struct debug_obj_descr *descr, int onstack)
+ }
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
+- if (check_stack)
+- debug_object_is_on_stack(addr, onstack);
+ }
+
+ /**
+@@ -619,14 +646,12 @@ EXPORT_SYMBOL_GPL(debug_object_init_on_stack);
+ */
+ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ enum debug_obj_state state;
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+ int ret;
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+
+ if (!debug_objects_enabled)
+ return 0;
+@@ -635,8 +660,8 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+
+ raw_spin_lock_irqsave(&db->lock, flags);
+
+- obj = lookup_object(addr, db);
+- if (obj) {
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ if (likely(!IS_ERR_OR_NULL(obj))) {
+ bool print_object = false;
+
+ switch (obj->state) {
+@@ -669,24 +694,16 @@ int debug_object_activate(void *addr, struct debug_obj_descr *descr)
+
+ raw_spin_unlock_irqrestore(&db->lock, flags);
+
+- /*
+- * We are here when a static object is activated. We
+- * let the type specific code confirm whether this is
+- * true or not. if true, we just make sure that the
+- * static object is tracked in the object tracker. If
+- * not, this must be a bug, so we try to fix it up.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* track this static object */
+- debug_object_init(addr, descr);
+- debug_object_activate(addr, descr);
+- } else {
+- debug_print_object(&o, "activate");
+- ret = debug_object_fixup(descr->fixup_activate, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- return ret ? 0 : -EINVAL;
++ /* If NULL the allocation has hit OOM */
++ if (!obj) {
++ debug_objects_oom();
++ return 0;
+ }
+- return 0;
++
++ /* Object is neither static nor tracked. It's not initialized */
++ debug_print_object(&o, "activate");
++ ret = debug_object_fixup(descr->fixup_activate, addr, ODEBUG_STATE_NOTAVAILABLE);
++ return ret ? 0 : -EINVAL;
+ }
+ EXPORT_SYMBOL_GPL(debug_object_activate);
+
+@@ -840,6 +857,7 @@ EXPORT_SYMBOL_GPL(debug_object_free);
+ */
+ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr)
+ {
++ struct debug_obj o = { .object = addr, .state = ODEBUG_STATE_NOTAVAILABLE, .descr = descr };
+ struct debug_bucket *db;
+ struct debug_obj *obj;
+ unsigned long flags;
+@@ -850,31 +868,20 @@ void debug_object_assert_init(void *addr, struct debug_obj_descr *descr)
+ db = get_bucket((unsigned long) addr);
+
+ raw_spin_lock_irqsave(&db->lock, flags);
++ obj = lookup_object_or_alloc(addr, db, descr, false, true);
++ raw_spin_unlock_irqrestore(&db->lock, flags);
++ if (likely(!IS_ERR_OR_NULL(obj)))
++ return;
+
+- obj = lookup_object(addr, db);
++ /* If NULL the allocation has hit OOM */
+ if (!obj) {
+- struct debug_obj o = { .object = addr,
+- .state = ODEBUG_STATE_NOTAVAILABLE,
+- .descr = descr };
+-
+- raw_spin_unlock_irqrestore(&db->lock, flags);
+- /*
+- * Maybe the object is static, and we let the type specific
+- * code confirm. Track this static object if true, else invoke
+- * fixup.
+- */
+- if (descr->is_static_object && descr->is_static_object(addr)) {
+- /* Track this static object */
+- debug_object_init(addr, descr);
+- } else {
+- debug_print_object(&o, "assert_init");
+- debug_object_fixup(descr->fixup_assert_init, addr,
+- ODEBUG_STATE_NOTAVAILABLE);
+- }
++ debug_objects_oom();
+ return;
+ }
+
+- raw_spin_unlock_irqrestore(&db->lock, flags);
++ /* Object is neither tracked nor static. It's not initialized. */
++ debug_print_object(&o, "assert_init");
++ debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE);
+ }
+ EXPORT_SYMBOL_GPL(debug_object_assert_init);
+
+--
+2.39.2
+
--- /dev/null
+From c4f498c890ef43c0f9b70e9e4ba848bf13701e3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 17:18:25 +0200
+Subject: dmaengine: at_xdmac: do not enable all cyclic channels
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit f8435befd81dd85b7b610598551fadf675849bc1 ]
+
+Do not global enable all the cyclic channels in at_xdmac_resume(). Instead
+save the global status in at_xdmac_suspend() and re-enable the cyclic
+channel only if it was active before suspend.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Link: https://lore.kernel.org/r/20230214151827.1050280-6-claudiu.beznea@microchip.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/at_xdmac.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index a406b3c0d170a..fdf3b5be2d50d 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -212,6 +212,7 @@ struct at_xdmac {
+ int irq;
+ struct clk *clk;
+ u32 save_gim;
++ u32 save_gs;
+ struct dma_pool *at_xdmac_desc_pool;
+ struct at_xdmac_chan chan[0];
+ };
+@@ -1922,6 +1923,7 @@ static int atmel_xdmac_suspend(struct device *dev)
+ }
+ }
+ atxdmac->save_gim = at_xdmac_read(atxdmac, AT_XDMAC_GIM);
++ atxdmac->save_gs = at_xdmac_read(atxdmac, AT_XDMAC_GS);
+
+ at_xdmac_off(atxdmac);
+ clk_disable_unprepare(atxdmac->clk);
+@@ -1958,7 +1960,8 @@ static int atmel_xdmac_resume(struct device *dev)
+ at_xdmac_chan_write(atchan, AT_XDMAC_CNDC, atchan->save_cndc);
+ at_xdmac_chan_write(atchan, AT_XDMAC_CIE, atchan->save_cim);
+ wmb();
+- at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
++ if (atxdmac->save_gs & atchan->mask)
++ at_xdmac_write(atxdmac, AT_XDMAC_GE, atchan->mask);
+ }
+ }
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From 7efc73b82b03b74392db3a780cdcd7e6b8f43dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 19:17:57 +0900
+Subject: dmaengine: dw-edma: Fix to change for continuous transfer
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit a251994a441ee0a69ba7062c8cd2d08ead3db379 ]
+
+The dw-edma driver stops after processing a DMA request even if a request
+remains in the issued queue, which is not the expected behavior. The DMA
+engine API requires continuous processing.
+
+Add a trigger to start after one processing finished if there are requests
+remain.
+
+Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Link: https://lore.kernel.org/r/20230411101758.438472-1-mie@igel.co.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index afbd1a4590192..ff6e8cf641dbc 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -165,7 +165,7 @@ static void vchan_free_desc(struct virt_dma_desc *vdesc)
+ dw_edma_free_desc(vd2dw_edma_desc(vdesc));
+ }
+
+-static void dw_edma_start_transfer(struct dw_edma_chan *chan)
++static int dw_edma_start_transfer(struct dw_edma_chan *chan)
+ {
+ struct dw_edma_chunk *child;
+ struct dw_edma_desc *desc;
+@@ -173,16 +173,16 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan)
+
+ vd = vchan_next_desc(&chan->vc);
+ if (!vd)
+- return;
++ return 0;
+
+ desc = vd2dw_edma_desc(vd);
+ if (!desc)
+- return;
++ return 0;
+
+ child = list_first_entry_or_null(&desc->chunk->list,
+ struct dw_edma_chunk, list);
+ if (!child)
+- return;
++ return 0;
+
+ dw_edma_v0_core_start(child, !desc->xfer_sz);
+ desc->xfer_sz += child->ll_region.sz;
+@@ -190,6 +190,8 @@ static void dw_edma_start_transfer(struct dw_edma_chan *chan)
+ list_del(&child->list);
+ kfree(child);
+ desc->chunks_alloc--;
++
++ return 1;
+ }
+
+ static int dw_edma_device_config(struct dma_chan *dchan,
+@@ -483,14 +485,14 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
+ switch (chan->request) {
+ case EDMA_REQ_NONE:
+ desc = vd2dw_edma_desc(vd);
+- if (desc->chunks_alloc) {
+- chan->status = EDMA_ST_BUSY;
+- dw_edma_start_transfer(chan);
+- } else {
++ if (!desc->chunks_alloc) {
+ list_del(&vd->node);
+ vchan_cookie_complete(vd);
+- chan->status = EDMA_ST_IDLE;
+ }
++
++ /* Continue transferring if there are remaining chunks or issued requests.
++ */
++ chan->status = dw_edma_start_transfer(chan) ? EDMA_ST_BUSY : EDMA_ST_IDLE;
+ break;
+
+ case EDMA_REQ_STOP:
+--
+2.39.2
+
--- /dev/null
+From 568bcbd78afe3fef6b221310d4387f592e070069 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 19:17:58 +0900
+Subject: dmaengine: dw-edma: Fix to enable to issue dma request on DMA
+ processing
+
+From: Shunsuke Mie <mie@igel.co.jp>
+
+[ Upstream commit 970b17dfe264a9085ba4e593730ecfd496b950ab ]
+
+The issue_pending request is ignored while driver is processing a DMA
+request. Fix to issue the pending requests on any dma channel status.
+
+Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver")
+Signed-off-by: Shunsuke Mie <mie@igel.co.jp>
+Link: https://lore.kernel.org/r/20230411101758.438472-2-mie@igel.co.jp
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-edma/dw-edma-core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
+index ff6e8cf641dbc..25d65f64cd507 100644
+--- a/drivers/dma/dw-edma/dw-edma-core.c
++++ b/drivers/dma/dw-edma/dw-edma-core.c
+@@ -275,9 +275,12 @@ static void dw_edma_device_issue_pending(struct dma_chan *dchan)
+ struct dw_edma_chan *chan = dchan2dw_edma_chan(dchan);
+ unsigned long flags;
+
++ if (!chan->configured)
++ return;
++
+ spin_lock_irqsave(&chan->vc.lock, flags);
+- if (chan->configured && chan->request == EDMA_REQ_NONE &&
+- chan->status == EDMA_ST_IDLE && vchan_issue_pending(&chan->vc)) {
++ if (vchan_issue_pending(&chan->vc) && chan->request == EDMA_REQ_NONE &&
++ chan->status == EDMA_ST_IDLE) {
+ chan->status = EDMA_ST_BUSY;
+ dw_edma_start_transfer(chan);
+ }
+--
+2.39.2
+
--- /dev/null
+From 9c05f0b9b3b1177e627b24ce3dd1b5d40cb4d813 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 09:06:37 +0200
+Subject: dmaengine: mv_xor_v2: Fix an error code.
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 827026ae2e56ec05ef1155661079badbbfc0b038 ]
+
+If the probe is deferred, -EPROBE_DEFER should be returned, not
++EPROBE_DEFER.
+
+Fixes: 3cd2c313f1d6 ("dmaengine: mv_xor_v2: Fix clock resource by adding a register clock")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/201170dff832a3c496d125772e10070cd834ebf2.1679814350.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 741b7270a9f5f..e27df4fed0368 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -751,7 +751,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
+
+ xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
+ if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
+- ret = EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
+ goto disable_reg_clk;
+ }
+ if (!IS_ERR(xor_dev->clk)) {
+--
+2.39.2
+
--- /dev/null
+From 4aaa2d2b92adfcdfb60cc7b038f99847dacca183 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 22:27:11 -0700
+Subject: drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
+
+From: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+
+[ Upstream commit c5647cae2704e58d1c4e5fedbf63f11bca6376c9 ]
+
+Smatch reports:
+drivers/gpu/drm/lima/lima_drv.c:396 lima_pdev_probe() warn:
+ missing unwind goto?
+
+Store return value in err and goto 'err_out0' which has
+lima_sched_slab_fini() before returning.
+
+Fixes: a1d2a6339961 ("drm/lima: driver for ARM Mali4xx GPUs")
+Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
+Signed-off-by: Qiang Yu <yuq825@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230314052711.4061652-1-harshit.m.mogalapalli@oracle.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/lima/lima_drv.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/lima/lima_drv.c b/drivers/gpu/drm/lima/lima_drv.c
+index 75ec703d22e03..89513c7c50d55 100644
+--- a/drivers/gpu/drm/lima/lima_drv.c
++++ b/drivers/gpu/drm/lima/lima_drv.c
+@@ -300,8 +300,10 @@ static int lima_pdev_probe(struct platform_device *pdev)
+
+ /* Allocate and initialize the DRM device. */
+ ddev = drm_dev_alloc(&lima_drm_driver, &pdev->dev);
+- if (IS_ERR(ddev))
+- return PTR_ERR(ddev);
++ if (IS_ERR(ddev)) {
++ err = PTR_ERR(ddev);
++ goto err_out0;
++ }
+
+ ddev->dev_private = ldev;
+ ldev->ddev = ddev;
+--
+2.39.2
+
--- /dev/null
+From 169b195cfab01b4767d2a955743ff0cb14ddee65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jun 2022 11:20:30 -0700
+Subject: drm/msm/adreno: Defer enabling runpm until hw_init()
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 4b18299b33655fa9672b774b6df774dc03d6aee8 ]
+
+To avoid preventing the display from coming up before the rootfs is
+mounted, without resorting to packing fw in the initrd, the GPU has
+this limbo state where the device is probed, but we aren't ready to
+start sending commands to it. This is particularly problematic for
+a6xx, since the GMU (which requires fw to be loaded) is the one that
+is controlling the power/clk/icc votes.
+
+So defer enabling runpm until we are ready to call gpu->hw_init(),
+as that is a point where we know we have all the needed fw and are
+ready to start sending commands to the coproc's.
+
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Patchwork: https://patchwork.freedesktop.org/patch/489337/
+Link: https://lore.kernel.org/r/20220613182036.2567963-1-robdclark@gmail.com
+Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 6 ++++++
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 1 -
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index 0888e0df660dd..6ad9d2de07ed6 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -233,6 +233,12 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ if (ret)
+ return NULL;
+
++ /*
++ * Now that we have firmware loaded, and are ready to begin
++ * booting the gpu, go ahead and enable runpm:
++ */
++ pm_runtime_enable(&pdev->dev);
++
+ /* Make sure pm runtime is active and reset any previous errors */
+ pm_runtime_set_active(&pdev->dev);
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 0d9404d2afe4e..b472cbe6adff6 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -899,7 +899,6 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+ pm_runtime_set_autosuspend_delay(&pdev->dev,
+ adreno_gpu->info->inactive_period);
+ pm_runtime_use_autosuspend(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+
+ return msm_gpu_init(drm, pdev, &adreno_gpu->base, &funcs->base,
+ adreno_gpu->info->name, &adreno_gpu_config);
+--
+2.39.2
+
--- /dev/null
+From d52725212577fe96a403d3abb373ee5577f97e67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 17:48:06 +0100
+Subject: drm/msm/adreno: drop bogus pm_runtime_set_active()
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+[ Upstream commit db7662d076c973072d788bd0e8130e04430307a1 ]
+
+The runtime PM status can only be updated while runtime PM is disabled.
+
+Drop the bogus pm_runtime_set_active() call that was made after enabling
+runtime PM and which (incidentally but correctly) left the runtime PM
+status set to 'suspended'.
+
+Fixes: 2c087a336676 ("drm/msm/adreno: Load the firmware before bringing up the hardware")
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Patchwork: https://patchwork.freedesktop.org/patch/524972/
+Link: https://lore.kernel.org/r/20230303164807.13124-4-johan+linaro@kernel.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_device.c b/drivers/gpu/drm/msm/adreno/adreno_device.c
+index 6ad9d2de07ed6..2a727ab0faf75 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -239,9 +239,6 @@ struct msm_gpu *adreno_load_gpu(struct drm_device *dev)
+ */
+ pm_runtime_enable(&pdev->dev);
+
+- /* Make sure pm runtime is active and reset any previous errors */
+- pm_runtime_set_active(&pdev->dev);
+-
+ ret = pm_runtime_get_sync(&pdev->dev);
+ if (ret < 0) {
+ pm_runtime_put_sync(&pdev->dev);
+--
+2.39.2
+
--- /dev/null
+From 4c16e8b16b64768595e4c1e97e191eb0e18a8812 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 18:53:40 -0400
+Subject: drm/msm: fix unbalanced pm_runtime_enable in adreno_gpu_{init,
+ cleanup}
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 17e822f7591fb66162aca07685dc0b01468e5480 ]
+
+adreno_gpu_init calls pm_runtime_enable, so adreno_gpu_cleanup needs to
+call pm_runtime_disable.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Stable-dep-of: db7662d076c9 ("drm/msm/adreno: drop bogus pm_runtime_set_active()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/adreno_gpu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+index 3802ad38c519c..0d9404d2afe4e 100644
+--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c
+@@ -908,11 +908,14 @@ int adreno_gpu_init(struct drm_device *drm, struct platform_device *pdev,
+ void adreno_gpu_cleanup(struct adreno_gpu *adreno_gpu)
+ {
+ struct msm_gpu *gpu = &adreno_gpu->base;
++ struct msm_drm_private *priv = gpu->dev->dev_private;
+ unsigned int i;
+
+ for (i = 0; i < ARRAY_SIZE(adreno_gpu->info->fw); i++)
+ release_firmware(adreno_gpu->fw[i]);
+
++ pm_runtime_disable(&priv->gpu_pdev->dev);
++
+ icc_put(gpu->icc_path);
+
+ msm_gpu_cleanup(&adreno_gpu->base);
+--
+2.39.2
+
--- /dev/null
+From 627789fcb9ea3b8e98b74f0c8f347320f1569c71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Jan 2023 16:40:52 +0100
+Subject: drm/probe-helper: Cancel previous job before starting new one
+
+From: Dom Cobley <popcornmix@gmail.com>
+
+[ Upstream commit a8e47884f1906cd7440fafa056adc8817568e73e ]
+
+Currently we schedule a call to output_poll_execute from
+drm_kms_helper_poll_enable for 10s in future. Later we try to replace
+that in drm_helper_probe_single_connector_modes with a 0s schedule with
+delayed_event set.
+
+But as there is already a job in the queue this fails, and the immediate
+job we wanted with delayed_event set doesn't occur until 10s later.
+
+And that call acts as if connector state has changed, reprobing modes.
+This has a side effect of waking up a display that has been blanked.
+
+Make sure we cancel the old job before submitting the immediate one.
+
+Fixes: 162b6a57ac50 ("drm/probe-helper: don't lose hotplug event")
+Acked-by: Daniel Vetter <daniel@ffwll.ch>
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+[Maxime: Switched to mod_delayed_work]
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230127154052.452524-1-maxime@cerno.tech
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_probe_helper.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c
+index d45f43feaf862..4c8bb93a89fb2 100644
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -460,8 +460,9 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
+ */
+ dev->mode_config.delayed_event = true;
+ if (dev->mode_config.poll_enabled)
+- schedule_delayed_work(&dev->mode_config.output_poll_work,
+- 0);
++ mod_delayed_work(system_wq,
++ &dev->mode_config.output_poll_work,
++ 0);
+ }
+
+ /* Re-enable polling in case the global poll config changed. */
+--
+2.39.2
+
--- /dev/null
+From 8a31f8aa4c23ad254dcdeb227f8e70356ad806f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Jan 2023 15:17:34 -0800
+Subject: drm/rockchip: Drop unbalanced obj unref
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 8ee3b0e85f6ccd9e6c527bc50eaba774c3bb18d0 ]
+
+In the error path, rockchip_drm_gem_object_mmap() is dropping an obj
+reference that it doesn't own.
+
+Fixes: 41315b793e13 ("drm/rockchip: use drm_gem_mmap helpers")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230119231734.2884543-1-robdclark@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_gem.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+index 291e89b4045f3..96cc794147b5f 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
+@@ -249,9 +249,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
+ else
+ ret = rockchip_drm_gem_object_mmap_dma(obj, vma);
+
+- if (ret)
+- drm_gem_vm_close(vma);
+-
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 5ea113537c3ad63df94b93bcf76715bf128b26a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 09:55:17 -0300
+Subject: drm/vgem: add missing mutex_destroy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mcanal@igalia.com>
+
+[ Upstream commit 7c18189b14b33c1fbf76480b1bd217877c086e67 ]
+
+vgem_fence_open() instantiates a mutex for a particular fence
+instance, but never destroys it by calling mutex_destroy() in
+vgem_fence_close().
+
+So, add the missing mutex_destroy() to guarantee proper resource
+destruction.
+
+Fixes: 407779848445 ("drm/vgem: Attach sw fences to exported vGEM dma-buf (ioctl)")
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20230202125517.427976-1-mcanal@igalia.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vgem/vgem_fence.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c
+index 9268f6fc3f662..92895937aba9b 100644
+--- a/drivers/gpu/drm/vgem/vgem_fence.c
++++ b/drivers/gpu/drm/vgem/vgem_fence.c
+@@ -249,4 +249,5 @@ void vgem_fence_close(struct vgem_file *vfile)
+ {
+ idr_for_each(&vfile->fence_idr, __vgem_fence_idr_fini, vfile);
+ idr_destroy(&vfile->fence_idr);
++ mutex_destroy(&vfile->fence_mutex);
+ }
+--
+2.39.2
+
--- /dev/null
+From bd14e421bfde4b8206cdc5583c233a31f5cd7efe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 09:17:28 +0800
+Subject: EDAC/skx: Fix overflows on the DRAM row address mapping arrays
+
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+
+[ Upstream commit 71b1e3ba3fed5a34c5fac6d3a15c2634b04c1eb7 ]
+
+The current DRAM row address mapping arrays skx_{open,close}_row[]
+only support ranks with sizes up to 16G. Decoding a rank address
+to a DRAM row address for a 32G rank by using either one of the
+above arrays by the skx_edac driver, will result in an overflow on
+the array.
+
+For a 32G rank, the most significant DRAM row address bit (the
+bit17) is mapped from the bit34 of the rank address. Add this new
+mapping item to both arrays to fix the overflow issue.
+
+Fixes: 4ec656bdf43a ("EDAC, skx_edac: Add EDAC driver for Skylake")
+Reported-by: Feng Xu <feng.f.xu@intel.com>
+Tested-by: Feng Xu <feng.f.xu@intel.com>
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Link: https://lore.kernel.org/all/20230211011728.71764-1-qiuxu.zhuo@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/skx_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/skx_base.c b/drivers/edac/skx_base.c
+index b1d717cb8df9f..f382cc70f9aaa 100644
+--- a/drivers/edac/skx_base.c
++++ b/drivers/edac/skx_base.c
+@@ -459,7 +459,7 @@ static bool skx_rir_decode(struct decoded_addr *res)
+ }
+
+ static u8 skx_close_row[] = {
+- 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
++ 15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33, 34
+ };
+
+ static u8 skx_close_column[] = {
+@@ -467,7 +467,7 @@ static u8 skx_close_column[] = {
+ };
+
+ static u8 skx_open_row[] = {
+- 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
++ 14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33, 34
+ };
+
+ static u8 skx_open_column[] = {
+--
+2.39.2
+
--- /dev/null
+From 134c3f0c64d2ab7f3da07ce6a3ae33a0a0796561 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 14:18:10 +0800
+Subject: erofs: fix potential overflow calculating xattr_isize
+
+From: Jingbo Xu <jefflexu@linux.alibaba.com>
+
+[ Upstream commit 1b3567a1969b26f709d82a874498c0754ea841c3 ]
+
+Given on-disk i_xattr_icount is 16 bits and xattr_isize is calculated
+from i_xattr_icount multiplying 4, xattr_isize has a theoretical maximum
+of 256K (64K * 4).
+
+Thus declare xattr_isize as unsigned int to avoid the potential overflow.
+
+Fixes: bfb8674dc044 ("staging: erofs: add erofs in-memory stuffs")
+Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
+Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20230414061810.6479-1-jefflexu@linux.alibaba.com
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/internal.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/erofs/internal.h b/fs/erofs/internal.h
+index 544a453f3076c..cc7a42682814c 100644
+--- a/fs/erofs/internal.h
++++ b/fs/erofs/internal.h
+@@ -226,7 +226,7 @@ struct erofs_inode {
+
+ unsigned char datalayout;
+ unsigned char inode_isize;
+- unsigned short xattr_isize;
++ unsigned int xattr_isize;
+
+ unsigned int xattr_shared_count;
+ unsigned int *xattr_shared_xattrs;
+--
+2.39.2
+
--- /dev/null
+From a342e4f65ab07d9e2f436f0f109f6be8c2edfa6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 01:37:14 +0800
+Subject: erofs: stop parsing non-compact HEAD index if clusterofs is invalid
+
+From: Gao Xiang <hsiangkao@linux.alibaba.com>
+
+[ Upstream commit cc4efd3dd2ac9f89143e5d881609747ecff04164 ]
+
+Syzbot generated a crafted image [1] with a non-compact HEAD index of
+clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,
+which causes the following unexpected behavior as below:
+
+ BUG: unable to handle page fault for address: fffff52101a3fff9
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 23ffed067 P4D 23ffed067 PUD 0
+ Oops: 0000 [#1] PREEMPT SMP KASAN
+ CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0
+ Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
+ Workqueue: erofs_worker z_erofs_decompressqueue_work
+ RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40
+ ...
+ Call Trace:
+ <TASK>
+ z_erofs_decompressqueue_work+0x99/0xe0
+ process_one_work+0x8f6/0x1170
+ worker_thread+0xa63/0x1210
+ kthread+0x270/0x300
+ ret_from_fork+0x1f/0x30
+
+Note that normal images or images using compact indexes are not
+impacted. Let's fix this now.
+
+[1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com
+
+Reported-and-tested-by: syzbot+aafb3f37cfeb6534c4ac@syzkaller.appspotmail.com
+Fixes: 02827e1796b3 ("staging: erofs: add erofs_map_blocks_iter")
+Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support")
+Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Link: https://lore.kernel.org/r/20230410173714.104604-1-hsiangkao@linux.alibaba.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/erofs/zmap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c
+index fff5741007214..b5ee58fdd82f3 100644
+--- a/fs/erofs/zmap.c
++++ b/fs/erofs/zmap.c
+@@ -179,6 +179,10 @@ static int vle_legacy_load_cluster_from_disk(struct z_erofs_maprecorder *m,
+ case Z_EROFS_VLE_CLUSTER_TYPE_PLAIN:
+ case Z_EROFS_VLE_CLUSTER_TYPE_HEAD:
+ m->clusterofs = le16_to_cpu(di->di_clusterofs);
++ if (m->clusterofs >= 1 << vi->z_logical_clusterbits) {
++ DBG_BUGON(1);
++ return -EFSCORRUPTED;
++ }
+ m->pblk = le32_to_cpu(di->di_u.blkaddr);
+ break;
+ default:
+--
+2.39.2
+
--- /dev/null
+From c58676a3fdb2208fe55bea74b01e67c09b1c0f28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Apr 2023 11:16:27 +0000
+Subject: ext4: fix use-after-free read in ext4_find_extent for bigalloc +
+ inline
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 835659598c67907b98cd2aa57bb951dfaf675c69 ]
+
+Syzbot found the following issue:
+loop0: detected capacity change from 0 to 2048
+EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none.
+==================================================================
+BUG: KASAN: use-after-free in ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]
+BUG: KASAN: use-after-free in ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931
+Read of size 4 at addr ffff888073644750 by task syz-executor420/5067
+
+CPU: 0 PID: 5067 Comm: syz-executor420 Not tainted 6.2.0-rc1-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
+ print_address_description+0x74/0x340 mm/kasan/report.c:306
+ print_report+0x107/0x1f0 mm/kasan/report.c:417
+ kasan_report+0xcd/0x100 mm/kasan/report.c:517
+ ext4_ext_binsearch_idx fs/ext4/extents.c:768 [inline]
+ ext4_find_extent+0x76e/0xd90 fs/ext4/extents.c:931
+ ext4_clu_mapped+0x117/0x970 fs/ext4/extents.c:5809
+ ext4_insert_delayed_block fs/ext4/inode.c:1696 [inline]
+ ext4_da_map_blocks fs/ext4/inode.c:1806 [inline]
+ ext4_da_get_block_prep+0x9e8/0x13c0 fs/ext4/inode.c:1870
+ ext4_block_write_begin+0x6a8/0x2290 fs/ext4/inode.c:1098
+ ext4_da_write_begin+0x539/0x760 fs/ext4/inode.c:3082
+ generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772
+ ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285
+ ext4_file_write_iter+0x1d0/0x18f0
+ call_write_iter include/linux/fs.h:2186 [inline]
+ new_sync_write fs/read_write.c:491 [inline]
+ vfs_write+0x7dc/0xc50 fs/read_write.c:584
+ ksys_write+0x177/0x2a0 fs/read_write.c:637
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+RIP: 0033:0x7f4b7a9737b9
+RSP: 002b:00007ffc5cac3668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4b7a9737b9
+RDX: 00000000175d9003 RSI: 0000000020000200 RDI: 0000000000000004
+RBP: 00007f4b7a933050 R08: 0000000000000000 R09: 0000000000000000
+R10: 000000000000079f R11: 0000000000000246 R12: 00007f4b7a9330e0
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ </TASK>
+
+Above issue is happens when enable bigalloc and inline data feature. As
+commit 131294c35ed6 fixed delayed allocation bug in ext4_clu_mapped for
+bigalloc + inline. But it only resolved issue when has inline data, if
+inline data has been converted to extent(ext4_da_convert_inline_data_to_extent)
+before writepages, there is no EXT4_STATE_MAY_INLINE_DATA flag. However
+i_data is still store inline data in this scene. Then will trigger UAF
+when find extent.
+To resolve above issue, there is need to add judge "ext4_has_inline_data(inode)"
+in ext4_clu_mapped().
+
+Fixes: 131294c35ed6 ("ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline")
+Reported-by: syzbot+bf4bb7731ef73b83a3b4@syzkaller.appspotmail.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Tested-by: Tudor Ambarus <tudor.ambarus@linaro.org>
+Link: https://lore.kernel.org/r/20230406111627.1916759-1-tudor.ambarus@linaro.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/extents.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 27760c39f70ec..478c35d453784 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -6027,7 +6027,8 @@ int ext4_clu_mapped(struct inode *inode, ext4_lblk_t lclu)
+ * mapped - no physical clusters have been allocated, and the
+ * file has no extents
+ */
+- if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))
++ if (ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ||
++ ext4_has_inline_data(inode))
+ return 0;
+
+ /* search for the extent closest to the first block in the cluster */
+--
+2.39.2
+
--- /dev/null
+From 6b377026264d7ddcd890775b34890f58b9ec36d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Feb 2023 22:45:50 +0800
+Subject: f2fs: handle dqget error in f2fs_transfer_project_quota()
+
+From: Yangtao Li <frank.li@vivo.com>
+
+[ Upstream commit 8051692f5f23260215bfe9a72e712d93606acc5f ]
+
+We should set the error code when dqget() failed.
+
+Fixes: 2c1d03056991 ("f2fs: support F2FS_IOC_FS{GET,SET}XATTR")
+Signed-off-by: Yangtao Li <frank.li@vivo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index ef08ef0170306..8d4e66f36cf7e 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2821,15 +2821,16 @@ int f2fs_transfer_project_quota(struct inode *inode, kprojid_t kprojid)
+ struct dquot *transfer_to[MAXQUOTAS] = {};
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ struct super_block *sb = sbi->sb;
+- int err = 0;
++ int err;
+
+ transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid));
+- if (!IS_ERR(transfer_to[PRJQUOTA])) {
+- err = __dquot_transfer(inode, transfer_to);
+- if (err)
+- set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
+- dqput(transfer_to[PRJQUOTA]);
+- }
++ if (IS_ERR(transfer_to[PRJQUOTA]))
++ return PTR_ERR(transfer_to[PRJQUOTA]);
++
++ err = __dquot_transfer(inode, transfer_to);
++ if (err)
++ set_sbi_flag(sbi, SBI_QUOTA_NEED_REPAIR);
++ dqput(transfer_to[PRJQUOTA]);
+ return err;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 75e310c1aeac340b978aee05b5566b33b4b8dd01 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 20:44:26 +0530
+Subject: firmware: qcom_scm: Clear download bit during reboot
+
+From: Mukesh Ojha <quic_mojha@quicinc.com>
+
+[ Upstream commit 781d32d1c9709fd25655c4e3e3e15370ae4ae4db ]
+
+During normal restart of a system download bit should
+be cleared irrespective of whether download mode is
+set or not.
+
+Fixes: 8c1b7dc9ba22 ("firmware: qcom: scm: Expose download-mode control")
+Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/1678979666-551-1-git-send-email-quic_mojha@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/qcom_scm.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
+index b9fdc20b4eb9b..eda25d506059b 100644
+--- a/drivers/firmware/qcom_scm.c
++++ b/drivers/firmware/qcom_scm.c
+@@ -585,8 +585,7 @@ static int qcom_scm_probe(struct platform_device *pdev)
+ static void qcom_scm_shutdown(struct platform_device *pdev)
+ {
+ /* Clean shutdown, disable download mode to allow normal restart */
+- if (download_mode)
+- qcom_scm_set_download_mode(false);
++ qcom_scm_set_download_mode(false);
+ }
+
+ static const struct of_device_id qcom_scm_dt_match[] = {
+--
+2.39.2
+
--- /dev/null
+From 2c62d0b429114185a4f1465f38700e04cf804fe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:32:35 +0100
+Subject: firmware: raspberrypi: Introduce devm_rpi_firmware_get()
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit f663204c9a1f8d6fcc590667d9d7a9f44e064644 ]
+
+It'll simplify the firmware handling for most consumers.
+
+Suggested-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/raspberrypi.c | 29 ++++++++++++++++++++++
+ include/soc/bcm2835/raspberrypi-firmware.h | 8 ++++++
+ 2 files changed, 37 insertions(+)
+
+diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
+index eb3b052a407ec..6a60b5bde0c98 100644
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -232,6 +232,13 @@ void rpi_firmware_put(struct rpi_firmware *fw)
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_put);
+
++static void devm_rpi_firmware_put(void *data)
++{
++ struct rpi_firmware *fw = data;
++
++ rpi_firmware_put(fw);
++}
++
+ static int rpi_firmware_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -320,6 +327,28 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_get);
+
++/**
++ * devm_rpi_firmware_get - Get pointer to rpi_firmware structure.
++ * @firmware_node: Pointer to the firmware Device Tree node.
++ *
++ * Returns NULL is the firmware device is not ready.
++ */
++struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
++ struct device_node *firmware_node)
++{
++ struct rpi_firmware *fw;
++
++ fw = rpi_firmware_get(firmware_node);
++ if (!fw)
++ return NULL;
++
++ if (devm_add_action_or_reset(dev, devm_rpi_firmware_put, fw))
++ return NULL;
++
++ return fw;
++}
++EXPORT_SYMBOL_GPL(devm_rpi_firmware_get);
++
+ static const struct of_device_id rpi_firmware_of_match[] = {
+ { .compatible = "raspberrypi,bcm2835-firmware", },
+ {},
+diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
+index f11e9d3f6fd30..cf6e58fa5266b 100644
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -142,6 +142,8 @@ int rpi_firmware_property_list(struct rpi_firmware *fw,
+ void *data, size_t tag_size);
+ void rpi_firmware_put(struct rpi_firmware *fw);
+ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
++struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
++ struct device_node *firmware_node);
+ #else
+ static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,
+ void *data, size_t len)
+@@ -160,6 +162,12 @@ static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware
+ {
+ return NULL;
+ }
++
++static inline struct rpi_firmware *devm_rpi_firmware_get(struct device *dev,
++ struct device_node *firmware_node)
++{
++ return NULL;
++}
+ #endif
+
+ #endif /* __SOC_RASPBERRY_FIRMWARE_H__ */
+--
+2.39.2
+
--- /dev/null
+From ae86726623c6dcf40b3489019ad5e905be7ee3aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:32:34 +0100
+Subject: firmware: raspberrypi: Keep count of all consumers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit 1e7c57355a3bc617fc220234889e49fe722a6305 ]
+
+When unbinding the firmware device we need to make sure it has no
+consumers left. Otherwise we'd leave them with a firmware handle
+pointing at freed memory.
+
+Keep a reference count of all consumers and introduce rpi_firmware_put()
+which will permit automatically decrease the reference count upon
+unbinding consumer drivers.
+
+Suggested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/raspberrypi.c | 40 ++++++++++++++++++++--
+ include/soc/bcm2835/raspberrypi-firmware.h | 2 ++
+ 2 files changed, 39 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
+index da26a584dca06..eb3b052a407ec 100644
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -7,6 +7,7 @@
+ */
+
+ #include <linux/dma-mapping.h>
++#include <linux/kref.h>
+ #include <linux/mailbox_client.h>
+ #include <linux/module.h>
+ #include <linux/of_platform.h>
+@@ -27,6 +28,8 @@ struct rpi_firmware {
+ struct mbox_chan *chan; /* The property channel. */
+ struct completion c;
+ u32 enabled;
++
++ struct kref consumers;
+ };
+
+ static DEFINE_MUTEX(transaction_lock);
+@@ -214,12 +217,31 @@ static void rpi_register_clk_driver(struct device *dev)
+ -1, NULL, 0);
+ }
+
++static void rpi_firmware_delete(struct kref *kref)
++{
++ struct rpi_firmware *fw = container_of(kref, struct rpi_firmware,
++ consumers);
++
++ mbox_free_channel(fw->chan);
++ kfree(fw);
++}
++
++void rpi_firmware_put(struct rpi_firmware *fw)
++{
++ kref_put(&fw->consumers, rpi_firmware_delete);
++}
++EXPORT_SYMBOL_GPL(rpi_firmware_put);
++
+ static int rpi_firmware_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+ struct rpi_firmware *fw;
+
+- fw = devm_kzalloc(dev, sizeof(*fw), GFP_KERNEL);
++ /*
++ * Memory will be freed by rpi_firmware_delete() once all users have
++ * released their firmware handles. Don't use devm_kzalloc() here.
++ */
++ fw = kzalloc(sizeof(*fw), GFP_KERNEL);
+ if (!fw)
+ return -ENOMEM;
+
+@@ -236,6 +258,7 @@ static int rpi_firmware_probe(struct platform_device *pdev)
+ }
+
+ init_completion(&fw->c);
++ kref_init(&fw->consumers);
+
+ platform_set_drvdata(pdev, fw);
+
+@@ -264,7 +287,8 @@ static int rpi_firmware_remove(struct platform_device *pdev)
+ rpi_hwmon = NULL;
+ platform_device_unregister(rpi_clk);
+ rpi_clk = NULL;
+- mbox_free_channel(fw->chan);
++
++ rpi_firmware_put(fw);
+
+ return 0;
+ }
+@@ -273,16 +297,26 @@ static int rpi_firmware_remove(struct platform_device *pdev)
+ * rpi_firmware_get - Get pointer to rpi_firmware structure.
+ * @firmware_node: Pointer to the firmware Device Tree node.
+ *
++ * The reference to rpi_firmware has to be released with rpi_firmware_put().
++ *
+ * Returns NULL is the firmware device is not ready.
+ */
+ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
+ {
+ struct platform_device *pdev = of_find_device_by_node(firmware_node);
++ struct rpi_firmware *fw;
+
+ if (!pdev)
+ return NULL;
+
+- return platform_get_drvdata(pdev);
++ fw = platform_get_drvdata(pdev);
++ if (!fw)
++ return NULL;
++
++ if (!kref_get_unless_zero(&fw->consumers))
++ return NULL;
++
++ return fw;
+ }
+ EXPORT_SYMBOL_GPL(rpi_firmware_get);
+
+diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h
+index 7800e12ee042c..f11e9d3f6fd30 100644
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -140,6 +140,7 @@ int rpi_firmware_property(struct rpi_firmware *fw,
+ u32 tag, void *data, size_t len);
+ int rpi_firmware_property_list(struct rpi_firmware *fw,
+ void *data, size_t tag_size);
++void rpi_firmware_put(struct rpi_firmware *fw);
+ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node);
+ #else
+ static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag,
+@@ -154,6 +155,7 @@ static inline int rpi_firmware_property_list(struct rpi_firmware *fw,
+ return -ENOSYS;
+ }
+
++static inline void rpi_firmware_put(struct rpi_firmware *fw) { }
+ static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
+ {
+ return NULL;
+--
+2.39.2
+
--- /dev/null
+From bb3075eeabd18803278697eac20d97bd3b09ca56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 17:27:03 +0300
+Subject: firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit e1d6ca042e62c2a69513235f8629eb6e62ca79c5 ]
+
+The svc_create_memory_pool() function returns error pointers. It never
+returns NULL. Fix the check.
+
+Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Link: https://lore.kernel.org/r/5f9a8cb4-5a4f-460b-9cdc-2fae6c5b7922@kili.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/stratix10-svc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
+index 08c422380a00d..7122bc6ea796b 100644
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -981,8 +981,8 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+ return ret;
+
+ genpool = svc_create_memory_pool(pdev, sh_memory);
+- if (!genpool)
+- return -ENOMEM;
++ if (IS_ERR(genpool))
++ return PTR_ERR(genpool);
+
+ /* allocate service controller and supporting channel */
+ controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL);
+--
+2.39.2
+
--- /dev/null
+From 1aa21e635d8ae9fd463051ac5d9c261817b82629 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 15:03:08 +0100
+Subject: fpga: bridge: fix kernel-doc parameter description
+
+From: Marco Pagani <marpagan@redhat.com>
+
+[ Upstream commit 7ef1a2c1c9dffa177ecc3ea50b7f5ee63a621137 ]
+
+Fix the kernel-doc description for the "struct fpga_image_info *info"
+parameter of the fpga_bridge_get() function.
+
+Fixes: 060ac5c8fa7b ("fpga: bridge: kernel-doc fixes")
+Signed-off-by: Marco Pagani <marpagan@redhat.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Acked-by: Xu Yilun <yilun.xu@intel.com>
+Link: https://lore.kernel.org/r/20230301140309.512578-1-marpagan@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/fpga-bridge.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c
+index 4bab9028940a8..aea4ceeed5363 100644
+--- a/drivers/fpga/fpga-bridge.c
++++ b/drivers/fpga/fpga-bridge.c
+@@ -115,7 +115,7 @@ static int fpga_bridge_dev_match(struct device *dev, const void *data)
+ /**
+ * fpga_bridge_get - get an exclusive reference to a fpga bridge
+ * @dev: parent device that fpga bridge was registered with
+- * @info: fpga manager info
++ * @info: fpga image specific information
+ *
+ * Given a device, get an exclusive reference to a fpga bridge.
+ *
+--
+2.39.2
+
--- /dev/null
+From 2f2b33aa4f6f98bbe49c0a885c6db8b8c40170e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Mar 2021 11:49:15 +1300
+Subject: genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
+
+From: Barry Song <song.bao.hua@hisilicon.com>
+
+[ Upstream commit cbe16f35bee6880becca6f20d2ebf6b457148552 ]
+
+Many drivers don't want interrupts enabled automatically via request_irq().
+So they are handling this issue by either way of the below two:
+
+(1)
+ irq_set_status_flags(irq, IRQ_NOAUTOEN);
+ request_irq(dev, irq...);
+
+(2)
+ request_irq(dev, irq...);
+ disable_irq(irq);
+
+The code in the second way is silly and unsafe. In the small time gap
+between request_irq() and disable_irq(), interrupts can still come.
+
+The code in the first way is safe though it's subobtimal.
+
+Add a new IRQF_NO_AUTOEN flag which can be handed in by drivers to
+request_irq() and request_nmi(). It prevents the automatic enabling of the
+requested interrupt/nmi in the same safe way as #1 above. With that the
+various usage sites of #1 and #2 above can be simplified and corrected.
+
+Signed-off-by: Barry Song <song.bao.hua@hisilicon.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: dmitry.torokhov@gmail.com
+Link: https://lore.kernel.org/r/20210302224916.13980-2-song.bao.hua@hisilicon.com
+Stable-dep-of: 39db65a0a17b ("ASoC: es8316: Handle optional IRQ assignment")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/interrupt.h | 4 ++++
+ kernel/irq/manage.c | 11 +++++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
+index 30e92536c78cc..01517747214a4 100644
+--- a/include/linux/interrupt.h
++++ b/include/linux/interrupt.h
+@@ -61,6 +61,9 @@
+ * interrupt handler after suspending interrupts. For system
+ * wakeup devices users need to implement wakeup detection in
+ * their interrupt handlers.
++ * IRQF_NO_AUTOEN - Don't enable IRQ or NMI automatically when users request it.
++ * Users will enable it explicitly by enable_irq() or enable_nmi()
++ * later.
+ */
+ #define IRQF_SHARED 0x00000080
+ #define IRQF_PROBE_SHARED 0x00000100
+@@ -74,6 +77,7 @@
+ #define IRQF_NO_THREAD 0x00010000
+ #define IRQF_EARLY_RESUME 0x00020000
+ #define IRQF_COND_SUSPEND 0x00040000
++#define IRQF_NO_AUTOEN 0x00080000
+
+ #define IRQF_TIMER (__IRQF_TIMER | IRQF_NO_SUSPEND | IRQF_NO_THREAD)
+
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 79214f9836243..2a8a5e1779c9c 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1610,7 +1610,8 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
+ irqd_set(&desc->irq_data, IRQD_NO_BALANCING);
+ }
+
+- if (irq_settings_can_autoenable(desc)) {
++ if (!(new->flags & IRQF_NO_AUTOEN) &&
++ irq_settings_can_autoenable(desc)) {
+ irq_startup(desc, IRQ_RESEND, IRQ_START_COND);
+ } else {
+ /*
+@@ -2041,10 +2042,15 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
+ * which interrupt is which (messes up the interrupt freeing
+ * logic etc).
+ *
++ * Also shared interrupts do not go well with disabling auto enable.
++ * The sharing interrupt might request it while it's still disabled
++ * and then wait for interrupts forever.
++ *
+ * Also IRQF_COND_SUSPEND only makes sense for shared interrupts and
+ * it cannot be set along with IRQF_NO_SUSPEND.
+ */
+ if (((irqflags & IRQF_SHARED) && !dev_id) ||
++ ((irqflags & IRQF_SHARED) && (irqflags & IRQF_NO_AUTOEN)) ||
+ (!(irqflags & IRQF_SHARED) && (irqflags & IRQF_COND_SUSPEND)) ||
+ ((irqflags & IRQF_NO_SUSPEND) && (irqflags & IRQF_COND_SUSPEND)))
+ return -EINVAL;
+@@ -2200,7 +2206,8 @@ int request_nmi(unsigned int irq, irq_handler_t handler,
+
+ desc = irq_to_desc(irq);
+
+- if (!desc || irq_settings_can_autoenable(desc) ||
++ if (!desc || (irq_settings_can_autoenable(desc) &&
++ !(irqflags & IRQF_NO_AUTOEN)) ||
+ !irq_settings_can_request(desc) ||
+ WARN_ON(irq_settings_is_per_cpu_devid(desc)) ||
+ !irq_supports_nmi(desc))
+--
+2.39.2
+
--- /dev/null
+From 409f9c42b164cf2ff17081c2174438e15d390854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:42:58 -0800
+Subject: ia64: mm/contig: fix section mismatch warning/error
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 58deeb4ef3b054498747d0929d94ac53ab90981f ]
+
+alloc_per_cpu_data() is called by find_memory(), which is marked as
+__init. Therefore alloc_per_cpu_data() can also be marked as __init to
+remedy this modpost problem.
+
+WARNING: modpost: vmlinux.o: section mismatch in reference: alloc_per_cpu_data (section: .text) -> memblock_alloc_try_nid (section: .init.text)
+
+Link: https://lkml.kernel.org/r/20230223034258.12917-1-rdunlap@infradead.org
+Fixes: 4b9ddc7cf272 ("[IA64] Fix section mismatch in contig.c version of per_cpu_init()")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/mm/contig.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
+index 5b00dc3898e19..f2b40bcd2495d 100644
+--- a/arch/ia64/mm/contig.c
++++ b/arch/ia64/mm/contig.c
+@@ -81,7 +81,7 @@ void *per_cpu_init(void)
+ return __per_cpu_start + __per_cpu_offset[smp_processor_id()];
+ }
+
+-static inline void
++static inline __init void
+ alloc_per_cpu_data(void)
+ {
+ size_t size = PERCPU_PAGE_SIZE * num_possible_cpus();
+--
+2.39.2
+
--- /dev/null
+From e6112b523beac87bbcbb93309e5f05f414f924fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 19:43:09 -0800
+Subject: ia64: salinfo: placate defined-but-not-used warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 0de155752b152d6bcd96b5b5bf20af336abd183a ]
+
+When CONFIG_PROC_FS is not set, proc_salinfo_show() is not used. Mark the
+function as __maybe_unused to quieten the warning message.
+
+../arch/ia64/kernel/salinfo.c:584:12: warning: 'proc_salinfo_show' defined but not used [-Wunused-function]
+ 584 | static int proc_salinfo_show(struct seq_file *m, void *v)
+ | ^~~~~~~~~~~~~~~~~
+
+Link: https://lkml.kernel.org/r/20230223034309.13375-1-rdunlap@infradead.org
+Fixes: 3f3942aca6da ("proc: introduce proc_create_single{,_data}")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/ia64/kernel/salinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/ia64/kernel/salinfo.c b/arch/ia64/kernel/salinfo.c
+index b392c0a503468..0ec8b55b28ac0 100644
+--- a/arch/ia64/kernel/salinfo.c
++++ b/arch/ia64/kernel/salinfo.c
+@@ -581,7 +581,7 @@ static int salinfo_cpu_pre_down(unsigned int cpu)
+ * 'data' contains an integer that corresponds to the feature we're
+ * testing
+ */
+-static int proc_salinfo_show(struct seq_file *m, void *v)
++static int __maybe_unused proc_salinfo_show(struct seq_file *m, void *v)
+ {
+ unsigned long data = (unsigned long)v;
+ seq_puts(m, (sal_platform_features & data) ? "1\n" : "0\n");
+--
+2.39.2
+
--- /dev/null
+From f6a75872318bdc2d87b264093213801be18fd13a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Apr 2023 12:52:39 -0400
+Subject: IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
+
+From: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+
+[ Upstream commit 9fe8fec5e43d5a80f43cbf61aaada1b047a1eb61 ]
+
+hfi1_mmu_rb_remove_unless_exact() did not move mmu_rb_node objects in
+mmu_rb_handler->lru_list after getting a cache hit on an mmu_rb_node.
+
+As a result, hfi1_mmu_rb_evict() was not guaranteed to evict truly
+least-recently used nodes.
+
+This could be a performance issue for an application when that
+application:
+- Uses some long-lived buffers frequently.
+- Uses a large number of buffers once.
+- Hits the mmu_rb_handler cache size or pinned-page limits, forcing
+ mmu_rb_handler cache entries to be evicted.
+
+In this case, the one-time use buffers cause the long-lived buffer
+entries to eventually filter to the end of the LRU list where
+hfi1_mmu_rb_evict() will consider evicting a frequently-used long-lived
+entry instead of evicting one of the one-time use entries.
+
+Fix this by inserting new mmu_rb_node at the tail of
+mmu_rb_handler->lru_list and move mmu_rb_ndoe to the tail of
+mmu_rb_handler->lru_list when the mmu_rb_node is a hit in
+hfi1_mmu_rb_remove_unless_exact(). Change hfi1_mmu_rb_evict() to evict
+from the head of mmu_rb_handler->lru_list instead of the tail.
+
+Fixes: 0636e9ab8355 ("IB/hfi1: Add cache evict LRU list")
+Signed-off-by: Brendan Cunningham <bcunningham@cornelisnetworks.com>
+Signed-off-by: Patrick Kelsey <pat.kelsey@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/168088635931.3027109.10423156330761536044.stgit@252.162.96.66.static.eigbox.net
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/mmu_rb.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
+index 14d2a90964c3c..a5631286c8e05 100644
+--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
++++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
+@@ -173,7 +173,7 @@ int hfi1_mmu_rb_insert(struct mmu_rb_handler *handler,
+ goto unlock;
+ }
+ __mmu_int_rb_insert(mnode, &handler->root);
+- list_add(&mnode->list, &handler->lru_list);
++ list_add_tail(&mnode->list, &handler->lru_list);
+
+ ret = handler->ops->insert(handler->ops_arg, mnode);
+ if (ret) {
+@@ -220,8 +220,10 @@ bool hfi1_mmu_rb_remove_unless_exact(struct mmu_rb_handler *handler,
+ spin_lock_irqsave(&handler->lock, flags);
+ node = __mmu_rb_search(handler, addr, len);
+ if (node) {
+- if (node->addr == addr && node->len == len)
++ if (node->addr == addr && node->len == len) {
++ list_move_tail(&node->list, &handler->lru_list);
+ goto unlock;
++ }
+ __mmu_int_rb_remove(node, &handler->root);
+ list_del(&node->list); /* remove from LRU list */
+ ret = true;
+@@ -242,8 +244,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ INIT_LIST_HEAD(&del_list);
+
+ spin_lock_irqsave(&handler->lock, flags);
+- list_for_each_entry_safe_reverse(rbnode, ptr, &handler->lru_list,
+- list) {
++ list_for_each_entry_safe(rbnode, ptr, &handler->lru_list, list) {
+ if (handler->ops->evict(handler->ops_arg, rbnode, evict_arg,
+ &stop)) {
+ __mmu_int_rb_remove(rbnode, &handler->root);
+@@ -255,9 +256,7 @@ void hfi1_mmu_rb_evict(struct mmu_rb_handler *handler, void *evict_arg)
+ }
+ spin_unlock_irqrestore(&handler->lock, flags);
+
+- while (!list_empty(&del_list)) {
+- rbnode = list_first_entry(&del_list, struct mmu_rb_node, list);
+- list_del(&rbnode->list);
++ list_for_each_entry_safe(rbnode, ptr, &del_list, list) {
+ handler->ops->remove(handler->ops_arg, rbnode);
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From fa11ab740d31699da60604908bb4482c6f66056b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Mar 2023 16:34:28 +0100
+Subject: iio: light: max44009: add missing OF device matching
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit b29c49026c3c05a11f845dba17cad0b3ba06836d ]
+
+The driver currently matches only via i2c_device_id, but also has
+of_device_id table:
+
+ drivers/iio/light/max44009.c:545:34: error: ‘max44009_of_match’ defined but not used [-Werror=unused-const-variable=]
+
+Fixes: 6aef699a7d7e ("iio: light: add driver for MAX44009")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230312153429.371702-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/light/max44009.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/iio/light/max44009.c b/drivers/iio/light/max44009.c
+index 00ba15499638d..5103b1061a77b 100644
+--- a/drivers/iio/light/max44009.c
++++ b/drivers/iio/light/max44009.c
+@@ -529,6 +529,12 @@ static int max44009_probe(struct i2c_client *client,
+ return devm_iio_device_register(&client->dev, indio_dev);
+ }
+
++static const struct of_device_id max44009_of_match[] = {
++ { .compatible = "maxim,max44009" },
++ { }
++};
++MODULE_DEVICE_TABLE(of, max44009_of_match);
++
+ static const struct i2c_device_id max44009_id[] = {
+ { "max44009", 0 },
+ { }
+@@ -538,18 +544,13 @@ MODULE_DEVICE_TABLE(i2c, max44009_id);
+ static struct i2c_driver max44009_driver = {
+ .driver = {
+ .name = MAX44009_DRV_NAME,
++ .of_match_table = max44009_of_match,
+ },
+ .probe = max44009_probe,
+ .id_table = max44009_id,
+ };
+ module_i2c_driver(max44009_driver);
+
+-static const struct of_device_id max44009_of_match[] = {
+- { .compatible = "maxim,max44009" },
+- { }
+-};
+-MODULE_DEVICE_TABLE(of, max44009_of_match);
+-
+ MODULE_AUTHOR("Robert Eshleman <bobbyeshleman@gmail.com>");
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("MAX44009 ambient light sensor driver");
+--
+2.39.2
+
--- /dev/null
+From dc471fc933f8b7ad22cd7f1883bdd16f30c89531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 23:05:20 -0700
+Subject: Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 5bca3688bdbc3b58a2894b8671a8e2378efe28bd ]
+
+rpi_firmware_get() take reference, we need to release it in error paths
+as well. Use devm_rpi_firmware_get() helper to handling the resources.
+Also remove the existing rpi_firmware_put().
+
+Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver")
+Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
+Link: https://lore.kernel.org/r/20221223074657.810346-1-linmq006@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/raspberrypi-ts.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
+index 4740a7c412364..8135a80226fd6 100644
+--- a/drivers/input/touchscreen/raspberrypi-ts.c
++++ b/drivers/input/touchscreen/raspberrypi-ts.c
+@@ -137,7 +137,7 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ return -ENOENT;
+ }
+
+- fw = rpi_firmware_get(fw_node);
++ fw = devm_rpi_firmware_get(&pdev->dev, fw_node);
+ of_node_put(fw_node);
+ if (!fw)
+ return -EPROBE_DEFER;
+@@ -164,7 +164,6 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ touchbuf = (u32)ts->fw_regs_phys;
+ error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF,
+ &touchbuf, sizeof(touchbuf));
+- rpi_firmware_put(fw);
+ if (error || touchbuf != 0) {
+ dev_warn(dev, "Failed to set touchbuf, %d\n", error);
+ return error;
+--
+2.39.2
+
--- /dev/null
+From c4cbafd9e5f95285b8cff238920e36a69e5023fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jan 2021 13:32:41 +0100
+Subject: input: raspberrypi-ts: Release firmware handle when not needed
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit 3b8ddff780b7d12e99ae39177f84b9003097777a ]
+
+There is no use for the firmware interface after getting the touch
+buffer address, so release it.
+
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Stable-dep-of: 5bca3688bdbc ("Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/raspberrypi-ts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
+index 69881265d1218..4740a7c412364 100644
+--- a/drivers/input/touchscreen/raspberrypi-ts.c
++++ b/drivers/input/touchscreen/raspberrypi-ts.c
+@@ -164,7 +164,7 @@ static int rpi_ts_probe(struct platform_device *pdev)
+ touchbuf = (u32)ts->fw_regs_phys;
+ error = rpi_firmware_property(fw, RPI_FIRMWARE_FRAMEBUFFER_SET_TOUCHBUF,
+ &touchbuf, sizeof(touchbuf));
+-
++ rpi_firmware_put(fw);
+ if (error || touchbuf != 0) {
+ dev_warn(dev, "Failed to set touchbuf, %d\n", error);
+ return error;
+--
+2.39.2
+
--- /dev/null
+From a163a09c4fc24945c4e7933f8134d7e4f760de0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 20:40:35 +0800
+Subject: ipv4: Fix potential uninit variable access bug in __ip_make_skb()
+
+From: Ziyang Xuan <william.xuanziyang@huawei.com>
+
+[ Upstream commit 99e5acae193e369b71217efe6f1dad42f3f18815 ]
+
+Like commit ea30388baebc ("ipv6: Fix an uninit variable access bug in
+__ip6_make_skb()"). icmphdr does not in skb linear region under the
+scenario of SOCK_RAW socket. Access icmp_hdr(skb)->type directly will
+trigger the uninit variable access bug.
+
+Use a local variable icmp_type to carry the correct value in different
+scenarios.
+
+Fixes: 96793b482540 ("[IPV4]: Add ICMPMsgStats MIB (RFC 4293)")
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_output.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 418e939878004..08ccb501ff0cc 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1559,9 +1559,19 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ cork->dst = NULL;
+ skb_dst_set(skb, &rt->dst);
+
+- if (iph->protocol == IPPROTO_ICMP)
+- icmp_out_count(net, ((struct icmphdr *)
+- skb_transport_header(skb))->type);
++ if (iph->protocol == IPPROTO_ICMP) {
++ u8 icmp_type;
++
++ /* For such sockets, transhdrlen is zero when do ip_append_data(),
++ * so icmphdr does not in skb linear region and can not get icmp_type
++ * by icmp_hdr(skb)->type.
++ */
++ if (sk->sk_type == SOCK_RAW && !inet_sk(sk)->hdrincl)
++ icmp_type = fl4->fl4_icmp_type;
++ else
++ icmp_type = icmp_hdr(skb)->type;
++ icmp_out_count(net, icmp_type);
++ }
+
+ ip_cork_release(cork);
+ out:
+--
+2.39.2
+
--- /dev/null
+From f4a5832dd7371a20bbe511cadbaba3ee98b569ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:22 +0000
+Subject: ixgbe: Allow flow hash to be set via ethtool
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit 4f3ed1293feb9502dc254b05802faf1ad3317ac6 ]
+
+ixgbe currently returns `EINVAL` whenever the flowhash it set by ethtool
+because the ethtool code in the kernel passes a non-zero value for hfunc
+that ixgbe should allow.
+
+When ethtool is called with `ETHTOOL_SRXFHINDIR`,
+`ethtool_set_rxfh_indir` will call ixgbe's set_rxfh function
+with `ETH_RSS_HASH_NO_CHANGE`. This value should be accepted.
+
+When ethtool is called with `ETHTOOL_SRSSH`, `ethtool_set_rxfh` will
+call ixgbe's set_rxfh function with `rxfh.hfunc`, which appears to be
+hardcoded in ixgbe to always be `ETH_RSS_HASH_TOP`. This value should
+also be accepted.
+
+Before this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this patch:
+
+$ sudo ethtool -L eth1 combined 10
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 0 1 2 3 4 5
+ 16: 6 7 8 9 0 1 2 3
+ 24: 4 5 6 7 8 9 0 1
+ ...
+
+Fixes: 1c7cf0784e4d ("ixgbe: support for ethtool set_rxfh")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index 7c52ae8ac005b..babe16ece5aa6 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -3008,8 +3008,8 @@ static int ixgbe_set_rxfh(struct net_device *netdev, const u32 *indir,
+ int i;
+ u32 reta_entries = ixgbe_rss_indir_tbl_entries(adapter);
+
+- if (hfunc)
+- return -EINVAL;
++ if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP)
++ return -EOPNOTSUPP;
+
+ /* Fill out the redirection table */
+ if (indir) {
+--
+2.39.2
+
--- /dev/null
+From fc8fe622bf70bcc74633122e13e567e1bbe3ec6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 19:12:23 +0000
+Subject: ixgbe: Enable setting RSS table to default values
+
+From: Joe Damato <jdamato@fastly.com>
+
+[ Upstream commit e85d3d55875f7a1079edfbc4e4e98d6f8aea9ac7 ]
+
+ethtool uses `ETHTOOL_GRXRINGS` to compute how many queues are supported
+by RSS. The driver should return the smaller of either:
+ - The maximum number of RSS queues the device supports, OR
+ - The number of RX queues configured
+
+Prior to this change, running `ethtool -X $iface default` fails if the
+number of queues configured is larger than the number supported by RSS,
+even though changing the queue count correctly resets the flowhash to
+use all supported queues.
+
+Other drivers (for example, i40e) will succeed but the flow hash will
+reset to support the maximum number of queues supported by RSS, even if
+that amount is smaller than the configured amount.
+
+Prior to this change:
+
+$ sudo ethtool -L eth1 combined 20
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 20 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+ 24: 8 9 10 11 12 13 14 15
+ 32: 0 1 2 3 4 5 6 7
+...
+
+You can see that the flowhash was correctly set to use the maximum
+number of queues supported by the driver (16).
+
+However, asking the NIC to reset to "default" fails:
+
+$ sudo ethtool -X eth1 default
+Cannot set RX flow hash configuration: Invalid argument
+
+After this change, the flowhash can be reset to default which will use
+all of the available RSS queues (16) or the configured queue count,
+whichever is smaller.
+
+Starting with eth1 which has 10 queues and a flowhash distributing to
+all 10 queues:
+
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 10 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 0 1 2 3 4 5
+ 16: 6 7 8 9 0 1 2 3
+...
+
+Increasing the queue count to 48 resets the flowhash to distribute to 16
+queues, as it did before this patch:
+
+$ sudo ethtool -L eth1 combined 48
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+...
+
+Due to the other bugfix in this series, the flowhash can be set to use
+queues 0-5:
+
+$ sudo ethtool -X eth1 equal 5
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 0 1 2
+ 8: 3 4 0 1 2 3 4 0
+ 16: 1 2 3 4 0 1 2 3
+...
+
+Due to this bugfix, the flowhash can be reset to default and use 16
+queues:
+
+$ sudo ethtool -X eth1 default
+$ sudo ethtool -x eth1
+RX flow hash indirection table for eth1 with 16 RX ring(s):
+ 0: 0 1 2 3 4 5 6 7
+ 8: 8 9 10 11 12 13 14 15
+ 16: 0 1 2 3 4 5 6 7
+...
+
+Fixes: 91cd94bfe4f0 ("ixgbe: add basic support for setting and getting nfc controls")
+Signed-off-by: Joe Damato <jdamato@fastly.com>
+Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+index babe16ece5aa6..a43cb7bfcccd7 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+@@ -2542,6 +2542,14 @@ static int ixgbe_get_rss_hash_opts(struct ixgbe_adapter *adapter,
+ return 0;
+ }
+
++static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
++{
++ if (adapter->hw.mac.type < ixgbe_mac_X550)
++ return 16;
++ else
++ return 64;
++}
++
+ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+ u32 *rule_locs)
+ {
+@@ -2550,7 +2558,8 @@ static int ixgbe_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
+
+ switch (cmd->cmd) {
+ case ETHTOOL_GRXRINGS:
+- cmd->data = adapter->num_rx_queues;
++ cmd->data = min_t(int, adapter->num_rx_queues,
++ ixgbe_rss_indir_tbl_max(adapter));
+ ret = 0;
+ break;
+ case ETHTOOL_GRXCLSRLCNT:
+@@ -2952,14 +2961,6 @@ static int ixgbe_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd)
+ return ret;
+ }
+
+-static int ixgbe_rss_indir_tbl_max(struct ixgbe_adapter *adapter)
+-{
+- if (adapter->hw.mac.type < ixgbe_mac_X550)
+- return 16;
+- else
+- return 64;
+-}
+-
+ static u32 ixgbe_get_rxfh_key_size(struct net_device *netdev)
+ {
+ return IXGBE_RSS_KEY_SIZE;
+--
+2.39.2
+
--- /dev/null
+From 223c0d2a86a56a382d88e3c4f83c29a533478201 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Feb 2023 21:39:49 -0800
+Subject: leds: TI_LMU_COMMON: select REGMAP instead of depending on it
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit a61079efc87888587e463afaed82417b162fbd69 ]
+
+REGMAP is a hidden (not user visible) symbol. Users cannot set it
+directly thru "make *config", so drivers should select it instead of
+depending on it if they need it.
+
+Consistently using "select" or "depends on" can also help reduce
+Kconfig circular dependency issues.
+
+Therefore, change the use of "depends on REGMAP" to "select REGMAP".
+
+Fixes: 3fce8e1eb994 ("leds: TI LMU: Add common code for TI LMU devices")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230226053953.4681-5-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
+index 2cbf66d1c3000..34334adcad014 100644
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -802,7 +802,7 @@ config LEDS_SPI_BYTE
+ config LEDS_TI_LMU_COMMON
+ tristate "LED driver for TI LMU"
+ depends on LEDS_CLASS
+- depends on REGMAP
++ select REGMAP
+ help
+ Say Y to enable the LED driver for TI LMU devices.
+ This supports common features between the TI LM3532, LM3631, LM3632,
+--
+2.39.2
+
--- /dev/null
+From 8d7524152da0114cd36c3ba22937077f1f042e85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 19:15:29 -0700
+Subject: linux/vt_buffer.h: allow either builtin or modular for macros
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2b76ffe81e32afd6d318dc4547e2ba8c46207b77 ]
+
+Fix build errors on ARCH=alpha when CONFIG_MDA_CONSOLE=m.
+This allows the ARCH macros to be the only ones defined.
+
+In file included from ../drivers/video/console/mdacon.c:37:
+../arch/alpha/include/asm/vga.h:17:40: error: expected identifier or '(' before 'volatile'
+ 17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+ | ^~~~~~~~
+../include/linux/vt_buffer.h:24:34: note: in definition of macro 'scr_writew'
+ 24 | #define scr_writew(val, addr) (*(addr) = (val))
+ | ^~~~
+../include/linux/vt_buffer.h:24:40: error: expected ')' before '=' token
+ 24 | #define scr_writew(val, addr) (*(addr) = (val))
+ | ^
+../arch/alpha/include/asm/vga.h:17:20: note: in expansion of macro 'scr_writew'
+ 17 | static inline void scr_writew(u16 val, volatile u16 *addr)
+ | ^~~~~~~~~~
+../arch/alpha/include/asm/vga.h:25:29: error: expected identifier or '(' before 'volatile'
+ 25 | static inline u16 scr_readw(volatile const u16 *addr)
+ | ^~~~~~~~
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jirislaby@kernel.org>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-fbdev@vger.kernel.org
+Link: https://lore.kernel.org/r/20230329021529.16188-1-rdunlap@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/vt_buffer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/vt_buffer.h b/include/linux/vt_buffer.h
+index 848db1b1569ff..919d999a8c1db 100644
+--- a/include/linux/vt_buffer.h
++++ b/include/linux/vt_buffer.h
+@@ -16,7 +16,7 @@
+
+ #include <linux/string.h>
+
+-#if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_MDA_CONSOLE)
++#if IS_ENABLED(CONFIG_VGA_CONSOLE) || IS_ENABLED(CONFIG_MDA_CONSOLE)
+ #include <asm/vga.h>
+ #endif
+
+--
+2.39.2
+
--- /dev/null
+From 9abeac1c1c7a79c122951f02c553f90107db001f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 17:42:41 -0800
+Subject: macintosh: via-pmu-led: requires ATA to be set
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 05dce4ba125336875cd3eed3c1503fa81cd2f691 ]
+
+LEDS_TRIGGER_DISK depends on ATA, so selecting LEDS_TRIGGER_DISK
+when ATA is not set/enabled causes a Kconfig warning:
+
+WARNING: unmet direct dependencies detected for LEDS_TRIGGER_DISK
+ Depends on [n]: NEW_LEDS [=y] && LEDS_TRIGGERS [=y] && ATA [=n]
+ Selected by [y]:
+ - ADB_PMU_LED_DISK [=y] && MACINTOSH_DRIVERS [=y] && ADB_PMU_LED [=y] && LEDS_CLASS [=y]
+
+Fix this by making ADB_PMU_LED_DISK depend on ATA.
+
+Seen on both PPC32 and PPC64.
+
+Fixes: 0e865a80c135 ("macintosh: Remove dependency on IDE_GD_ATA if ADB_PMU_LED_DISK is selected")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223014241.20878-1-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
+index b5a534206eddd..1605dcaa89e30 100644
+--- a/drivers/macintosh/Kconfig
++++ b/drivers/macintosh/Kconfig
+@@ -86,6 +86,7 @@ config ADB_PMU_LED
+
+ config ADB_PMU_LED_DISK
+ bool "Use front LED as DISK LED by default"
++ depends on ATA
+ depends on ADB_PMU_LED
+ depends on LEDS_CLASS
+ select LEDS_TRIGGERS
+--
+2.39.2
+
--- /dev/null
+From 880f04e4a98c5dc5a1fb481842cfa5a8c1fb882b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 11:35:58 +0800
+Subject: macintosh/windfarm_smu_sat: Add missing of_node_put()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 631cf002826007ab7415258ee647dcaf8845ad5a ]
+
+We call of_node_get() in wf_sat_probe() after sat is created,
+so we need the of_node_put() before *kfree(sat)*.
+
+Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s")
+Signed-off-by: Liang He <windhl@126.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230330033558.2562778-1-windhl@126.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/macintosh/windfarm_smu_sat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c
+index cb75dc0356167..30d53a535d55d 100644
+--- a/drivers/macintosh/windfarm_smu_sat.c
++++ b/drivers/macintosh/windfarm_smu_sat.c
+@@ -171,6 +171,7 @@ static void wf_sat_release(struct kref *ref)
+
+ if (sat->nr >= 0)
+ sats[sat->nr] = NULL;
++ of_node_put(sat->node);
+ kfree(sat);
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 20d18187ba2bd949d0f37b4e1ac197f997c90286 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:53 +0800
+Subject: md/raid10: fix leak of 'r10bio->remaining' for recovery
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit 26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e ]
+
+raid10_sync_request() will add 'r10bio->remaining' for both rdev and
+replacement rdev. However, if the read io fails, recovery_request_write()
+returns without issuing the write io, in this case, end_sync_request()
+is only called once and 'remaining' is leaked, cause an io hang.
+
+Fix the problem by decreasing 'remaining' according to if 'bio' and
+'repl_bio' is valid.
+
+Fixes: 24afd80d99f8 ("md/raid10: handle recovery of replacement devices.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-5-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 9fcc141e1ad64..dd91385a3526f 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -2229,11 +2229,22 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ {
+ struct r10conf *conf = mddev->private;
+ int d;
+- struct bio *wbio, *wbio2;
++ struct bio *wbio = r10_bio->devs[1].bio;
++ struct bio *wbio2 = r10_bio->devs[1].repl_bio;
++
++ /* Need to test wbio2->bi_end_io before we call
++ * generic_make_request as if the former is NULL,
++ * the latter is free to free wbio2.
++ */
++ if (wbio2 && !wbio2->bi_end_io)
++ wbio2 = NULL;
+
+ if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) {
+ fix_recovery_read_error(r10_bio);
+- end_sync_request(r10_bio);
++ if (wbio->bi_end_io)
++ end_sync_request(r10_bio);
++ if (wbio2)
++ end_sync_request(r10_bio);
+ return;
+ }
+
+@@ -2242,14 +2253,6 @@ static void recovery_request_write(struct mddev *mddev, struct r10bio *r10_bio)
+ * and submit the write request
+ */
+ d = r10_bio->devs[1].devnum;
+- wbio = r10_bio->devs[1].bio;
+- wbio2 = r10_bio->devs[1].repl_bio;
+- /* Need to test wbio2->bi_end_io before we call
+- * generic_make_request as if the former is NULL,
+- * the latter is free to free wbio2.
+- */
+- if (wbio2 && !wbio2->bi_end_io)
+- wbio2 = NULL;
+ if (wbio->bi_end_io) {
+ atomic_inc(&conf->mirrors[d].rdev->nr_pending);
+ md_sync_acct(conf->mirrors[d].rdev->bdev, bio_sectors(wbio));
+--
+2.39.2
+
--- /dev/null
+From a67c07267335575b9bb7fa265e47f78792963e85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:54 +0800
+Subject: md/raid10: fix memleak for 'conf->bio_split'
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit c9ac2acde53f5385de185bccf6aaa91cf9ac1541 ]
+
+In the error path of raid10_run(), 'conf' need be freed, however,
+'conf->bio_split' is missed and memory will be leaked.
+
+Since there are 3 places to free 'conf', factor out a helper to fix the
+problem.
+
+Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-6-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 37 +++++++++++++++++--------------------
+ 1 file changed, 17 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index dd91385a3526f..68447e1525057 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3635,6 +3635,20 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
+ return nc*fc;
+ }
+
++static void raid10_free_conf(struct r10conf *conf)
++{
++ if (!conf)
++ return;
++
++ mempool_exit(&conf->r10bio_pool);
++ kfree(conf->mirrors);
++ kfree(conf->mirrors_old);
++ kfree(conf->mirrors_new);
++ safe_put_page(conf->tmppage);
++ bioset_exit(&conf->bio_split);
++ kfree(conf);
++}
++
+ static struct r10conf *setup_conf(struct mddev *mddev)
+ {
+ struct r10conf *conf = NULL;
+@@ -3717,13 +3731,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ return conf;
+
+ out:
+- if (conf) {
+- mempool_exit(&conf->r10bio_pool);
+- kfree(conf->mirrors);
+- safe_put_page(conf->tmppage);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
+- }
++ raid10_free_conf(conf);
+ return ERR_PTR(err);
+ }
+
+@@ -3937,10 +3945,7 @@ static int raid10_run(struct mddev *mddev)
+
+ out_free_conf:
+ md_unregister_thread(&mddev->thread);
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf);
++ raid10_free_conf(conf);
+ mddev->private = NULL;
+ out:
+ return -EIO;
+@@ -3948,15 +3953,7 @@ static int raid10_run(struct mddev *mddev)
+
+ static void raid10_free(struct mddev *mddev, void *priv)
+ {
+- struct r10conf *conf = priv;
+-
+- mempool_exit(&conf->r10bio_pool);
+- safe_put_page(conf->tmppage);
+- kfree(conf->mirrors);
+- kfree(conf->mirrors_old);
+- kfree(conf->mirrors_new);
+- bioset_exit(&conf->bio_split);
+- kfree(conf);
++ raid10_free_conf(priv);
+ }
+
+ static void raid10_quiesce(struct mddev *mddev, int quiesce)
+--
+2.39.2
+
--- /dev/null
+From 7dc5862542c131a72221eebbb2011921cc38fb55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Mar 2023 15:38:55 +0800
+Subject: md/raid10: fix memleak of md thread
+
+From: Yu Kuai <yukuai3@huawei.com>
+
+[ Upstream commit f0ddb83da3cbbf8a1f9087a642c448ff52ee9abd ]
+
+In raid10_run(), if setup_conf() succeed and raid10_run() failed before
+setting 'mddev->thread', then in the error path 'conf->thread' is not
+freed.
+
+Fix the problem by setting 'mddev->thread' right after setup_conf().
+
+Fixes: 43a521238aca ("md-cluster: choose correct label when clustered layout is not supported")
+Signed-off-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Link: https://lore.kernel.org/r/20230310073855.1337560-7-yukuai1@huaweicloud.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index b37e3cd4e3673..c792683a0dea2 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3769,6 +3769,9 @@ static int raid10_run(struct mddev *mddev)
+ if (!conf)
+ goto out;
+
++ mddev->thread = conf->thread;
++ conf->thread = NULL;
++
+ if (mddev_is_clustered(conf->mddev)) {
+ int fc, fo;
+
+@@ -3781,9 +3784,6 @@ static int raid10_run(struct mddev *mddev)
+ }
+ }
+
+- mddev->thread = conf->thread;
+- conf->thread = NULL;
+-
+ if (mddev->queue) {
+ blk_queue_max_discard_sectors(mddev->queue,
+ mddev->chunk_sectors);
+--
+2.39.2
+
--- /dev/null
+From 3a93f2758554317c08e90b520cd24ebffbe0ba82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Sep 2020 08:51:33 +0200
+Subject: md: update the optimal I/O size on reshape
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 16ef510139315a2147ee7525796f8dbd4e4b7864 ]
+
+The raid5 and raid10 drivers currently update the read-ahead size,
+but not the optimal I/O size on reshape. To prepare for deriving the
+read-ahead size from the optimal I/O size make sure it is updated
+as well.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Song Liu <song@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: f0ddb83da3cb ("md/raid10: fix memleak of md thread")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid10.c | 22 ++++++++++++++--------
+ drivers/md/raid5.c | 10 ++++++++--
+ 2 files changed, 22 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 68447e1525057..b37e3cd4e3673 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -3735,10 +3735,20 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+ return ERR_PTR(err);
+ }
+
++static void raid10_set_io_opt(struct r10conf *conf)
++{
++ int raid_disks = conf->geo.raid_disks;
++
++ if (!(conf->geo.raid_disks % conf->geo.near_copies))
++ raid_disks /= conf->geo.near_copies;
++ blk_queue_io_opt(conf->mddev->queue, (conf->mddev->chunk_sectors << 9) *
++ raid_disks);
++}
++
+ static int raid10_run(struct mddev *mddev)
+ {
+ struct r10conf *conf;
+- int i, disk_idx, chunk_size;
++ int i, disk_idx;
+ struct raid10_info *disk;
+ struct md_rdev *rdev;
+ sector_t size;
+@@ -3774,18 +3784,13 @@ static int raid10_run(struct mddev *mddev)
+ mddev->thread = conf->thread;
+ conf->thread = NULL;
+
+- chunk_size = mddev->chunk_sectors << 9;
+ if (mddev->queue) {
+ blk_queue_max_discard_sectors(mddev->queue,
+ mddev->chunk_sectors);
+ blk_queue_max_write_same_sectors(mddev->queue, 0);
+ blk_queue_max_write_zeroes_sectors(mddev->queue, 0);
+- blk_queue_io_min(mddev->queue, chunk_size);
+- if (conf->geo.raid_disks % conf->geo.near_copies)
+- blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
+- else
+- blk_queue_io_opt(mddev->queue, chunk_size *
+- (conf->geo.raid_disks / conf->geo.near_copies));
++ blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
++ raid10_set_io_opt(conf);
+ }
+
+ rdev_for_each(rdev, mddev) {
+@@ -4748,6 +4753,7 @@ static void end_reshape(struct r10conf *conf)
+ stripe /= conf->geo.near_copies;
+ if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe)
+ conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe;
++ raid10_set_io_opt(conf);
+ }
+ conf->fullsync = 0;
+ }
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index d0c3f49c8c162..113ba084fab45 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -7159,6 +7159,12 @@ static int only_parity(int raid_disk, int algo, int raid_disks, int max_degraded
+ return 0;
+ }
+
++static void raid5_set_io_opt(struct r5conf *conf)
++{
++ blk_queue_io_opt(conf->mddev->queue, (conf->chunk_sectors << 9) *
++ (conf->raid_disks - conf->max_degraded));
++}
++
+ static int raid5_run(struct mddev *mddev)
+ {
+ struct r5conf *conf;
+@@ -7448,8 +7454,7 @@ static int raid5_run(struct mddev *mddev)
+
+ chunk_size = mddev->chunk_sectors << 9;
+ blk_queue_io_min(mddev->queue, chunk_size);
+- blk_queue_io_opt(mddev->queue, chunk_size *
+- (conf->raid_disks - conf->max_degraded));
++ raid5_set_io_opt(conf);
+ mddev->queue->limits.raid_partial_stripes_expensive = 1;
+ /*
+ * We can only discard a whole stripe. It doesn't make sense to
+@@ -8043,6 +8048,7 @@ static void end_reshape(struct r5conf *conf)
+ / PAGE_SIZE);
+ if (conf->mddev->queue->backing_dev_info->ra_pages < 2 * stripe)
+ conf->mddev->queue->backing_dev_info->ra_pages = 2 * stripe;
++ raid5_set_io_opt(conf);
+ }
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From 3e28baf39ea72c82bc8c707053879ee6a72e0e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:00:23 +0100
+Subject: media: av7110: prevent underflow in write_ts_to_decoder()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ]
+
+The buf[4] value comes from the user via ts_play(). It is a value in
+the u8 range. The final length we pass to av7110_ipack_instant_repack()
+is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is
+not negative. It's not clear that passing a negative len value does
+anything bad necessarily, but it's not best practice.
+
+With the new bounds checking the "if (!len)" condition is no longer
+possible or required so remove that.
+
+Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ttpci/av7110_av.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c
+index ea9f7d0058a21..e201d5a56bc65 100644
+--- a/drivers/media/pci/ttpci/av7110_av.c
++++ b/drivers/media/pci/ttpci/av7110_av.c
+@@ -822,10 +822,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s
+ av7110_ipack_flush(ipack);
+
+ if (buf[3] & ADAPT_FIELD) {
++ if (buf[4] > len - 1 - 4)
++ return 0;
+ len -= buf[4] + 1;
+ buf += buf[4] + 1;
+- if (!len)
+- return 0;
+ }
+
+ av7110_ipack_instant_repack(buf + 4, len - 4, ipack);
+--
+2.39.2
+
--- /dev/null
+From 46b53a67dd4ff03b89b980594b5b761b7fda76bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Feb 2023 08:14:42 +0100
+Subject: media: bdisp: Add missing check for create_workqueue
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 2371adeab717d8fe32144a84f3491a03c5838cfb ]
+
+Add the check for the return value of the create_workqueue
+in order to avoid NULL pointer dereference.
+
+Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+index 16a097f93b423..2485a3657c891 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
+@@ -1308,6 +1308,8 @@ static int bdisp_probe(struct platform_device *pdev)
+ init_waitqueue_head(&bdisp->irq_queue);
+ INIT_DELAYED_WORK(&bdisp->timeout_work, bdisp_irq_timeout);
+ bdisp->work_queue = create_workqueue(BDISP_NAME);
++ if (!bdisp->work_queue)
++ return -ENOMEM;
+
+ spin_lock_init(&bdisp->slock);
+ mutex_init(&bdisp->lock);
+--
+2.39.2
+
--- /dev/null
+From a7b9168c4ae9fb01f90d89b46835178a2467e0dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:15:06 +0800
+Subject: media: dm1105: Fix use after free bug in dm1105_remove due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 5abda7a16698d4d1f47af1168d8fa2c640116b4a ]
+
+In dm1105_probe, it called dm1105_ir_init and bound
+&dm1105->ir.work with dm1105_emit_key.
+When it handles IRQ request with dm1105_irq,
+it may call schedule_work to start the work.
+
+When we call dm1105_remove to remove the driver, there
+may be a sequence as follows:
+
+Fix it by finishing the work before cleanup in dm1105_remove
+
+CPU0 CPU1
+
+ |dm1105_emit_key
+dm1105_remove |
+ dm1105_ir_exit |
+ rc_unregister_device |
+ rc_free_device |
+ rc_dev_release |
+ kfree(dev); |
+ |
+ | rc_keydown
+ | //use
+
+Fixes: 34d2f9bf189c ("V4L/DVB: dm1105: use dm1105_dev & dev instead of dm1105dvb")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/dm1105/dm1105.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c
+index bb3a8cc9de0cb..6dbd98a3e5b8f 100644
+--- a/drivers/media/pci/dm1105/dm1105.c
++++ b/drivers/media/pci/dm1105/dm1105.c
+@@ -1179,6 +1179,7 @@ static void dm1105_remove(struct pci_dev *pdev)
+ struct dvb_demux *dvbdemux = &dev->demux;
+ struct dmx_demux *dmx = &dvbdemux->dmx;
+
++ cancel_work_sync(&dev->ir.work);
+ dm1105_ir_exit(dev);
+ dmx->close(dmx);
+ dvb_net_release(&dev->dvbnet);
+--
+2.39.2
+
--- /dev/null
+From 659abf85aadfb02a68c2d565978e3b72c2aae2a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Mar 2023 13:38:33 -0700
+Subject: media: rc: gpio-ir-recv: Fix support for wake-up
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 9c592f8ab114875fdb3b2040f01818e53de44991 ]
+
+The driver was intended from the start to be a wake-up source for the
+system, however due to the absence of a suitable call to
+device_set_wakeup_capable(), the device_may_wakeup() call used to decide
+whether to enable the GPIO interrupt as a wake-up source would never
+happen. Lookup the DT standard "wakeup-source" property and call
+device_init_wakeup() to ensure the device is flagged as being wakeup
+capable.
+
+Reported-by: Matthew Lear <matthew.lear@broadcom.com>
+Fixes: fd0f6851eb46 ("[media] rc: Add support for GPIO based IR Receiver driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/rc/gpio-ir-recv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/rc/gpio-ir-recv.c b/drivers/media/rc/gpio-ir-recv.c
+index a20413008c3cb..f50398b3ed5f4 100644
+--- a/drivers/media/rc/gpio-ir-recv.c
++++ b/drivers/media/rc/gpio-ir-recv.c
+@@ -83,6 +83,8 @@ static int gpio_ir_recv_probe(struct platform_device *pdev)
+ rcdev->map_name = RC_MAP_EMPTY;
+
+ gpio_dev->rcdev = rcdev;
++ if (of_property_read_bool(np, "wakeup-source"))
++ device_init_wakeup(dev, true);
+
+ rc = devm_rc_register_device(dev, rcdev);
+ if (rc < 0) {
+--
+2.39.2
+
--- /dev/null
+From 00499aaeb6d792f88ac22563b59898d144ef9daf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 16:59:34 +0200
+Subject: media: rcar_fdp1: fix pm_runtime_get_sync() usage count
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit 45e75a8c6fa455a5909ac04db76a4b15d6bb8368 ]
+
+The pm_runtime_get_sync() internally increments the
+dev->power.usage_count without decrementing it, even on errors.
+Replace it by the new pm_runtime_resume_and_get(), introduced by:
+commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter")
+in order to properly decrement the usage counter, avoiding
+a potential PM usage counter leak.
+
+Also, right now, the driver is ignoring any troubles when
+trying to do PM resume. So, add the proper error handling
+for the code.
+
+Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index d6eee66c8dd49..9caddc8387b46 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2139,7 +2139,9 @@ static int fdp1_open(struct file *file)
+ }
+
+ /* Perform any power management required */
+- pm_runtime_get_sync(fdp1->dev);
++ ret = pm_runtime_resume_and_get(fdp1->dev);
++ if (ret < 0)
++ goto error_pm;
+
+ v4l2_fh_add(&ctx->fh);
+
+@@ -2149,6 +2151,8 @@ static int fdp1_open(struct file *file)
+ mutex_unlock(&fdp1->dev_mutex);
+ return 0;
+
++error_pm:
++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx);
+ error_ctx:
+ v4l2_ctrl_handler_free(&ctx->hdl);
+ kfree(ctx);
+@@ -2356,7 +2360,9 @@ static int fdp1_probe(struct platform_device *pdev)
+
+ /* Power up the cells to read HW */
+ pm_runtime_enable(&pdev->dev);
+- pm_runtime_get_sync(fdp1->dev);
++ ret = pm_runtime_resume_and_get(fdp1->dev);
++ if (ret < 0)
++ goto disable_pm;
+
+ hw_version = fdp1_read(fdp1, FD1_IP_INTDATA);
+ switch (hw_version) {
+@@ -2385,6 +2391,9 @@ static int fdp1_probe(struct platform_device *pdev)
+
+ return 0;
+
++disable_pm:
++ pm_runtime_disable(fdp1->dev);
++
+ release_m2m:
+ v4l2_m2m_release(fdp1->m2m_dev);
+
+--
+2.39.2
+
--- /dev/null
+From eb5c29b1720c365a388c6e16f2a6c8e75865463c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Jan 2023 11:58:09 +0400
+Subject: media: rcar_fdp1: Fix refcount leak in probe and remove function
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit c766c90faf93897b77c9c5daa603cffab85ba907 ]
+
+rcar_fcp_get() take reference, which should be balanced with
+rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and
+the error paths of fdp1_probe() to fix this.
+
+Fixes: 4710b752e029 ("[media] v4l: Add Renesas R-Car FDP1 Driver")
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+[hverkuil: resolve merge conflict, remove() is now void]
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 0967b10a459b1..af2408b4856e6 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2317,8 +2317,10 @@ static int fdp1_probe(struct platform_device *pdev)
+
+ /* Determine our clock rate */
+ clk = clk_get(&pdev->dev, NULL);
+- if (IS_ERR(clk))
+- return PTR_ERR(clk);
++ if (IS_ERR(clk)) {
++ ret = PTR_ERR(clk);
++ goto put_dev;
++ }
+
+ fdp1->clk_rate = clk_get_rate(clk);
+ clk_put(clk);
+@@ -2327,7 +2329,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ ret = v4l2_device_register(&pdev->dev, &fdp1->v4l2_dev);
+ if (ret) {
+ v4l2_err(&fdp1->v4l2_dev, "Failed to register video device\n");
+- return ret;
++ goto put_dev;
+ }
+
+ /* M2M registration */
+@@ -2397,6 +2399,8 @@ static int fdp1_probe(struct platform_device *pdev)
+ unreg_dev:
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+
++put_dev:
++ rcar_fcp_put(fdp1->fcp);
+ return ret;
+ }
+
+@@ -2408,6 +2412,7 @@ static int fdp1_remove(struct platform_device *pdev)
+ video_unregister_device(&fdp1->vfd);
+ v4l2_device_unregister(&fdp1->v4l2_dev);
+ pm_runtime_disable(&pdev->dev);
++ rcar_fcp_put(fdp1->fcp);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 7e45a8458685b7cbbfceb9bbfb1a390348baab4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Oct 2021 05:09:38 +0200
+Subject: media: rcar_fdp1: Fix the correct variable assignments
+
+From: Tang Bin <tangbin@cmss.chinamobile.com>
+
+[ Upstream commit af88c2adbb72a09ab1bb5c37ba388c98fecca69b ]
+
+In the function fdp1_probe(), when get irq failed, the
+function platform_get_irq() log an error message, so
+remove redundant message here. And the variable type
+of "ret" is int, the "fdp1->irq" is unsigned int, when
+irq failed, this place maybe wrong, thus fix it.
+
+Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 90575a58ad880..0967b10a459b1 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2291,11 +2291,10 @@ static int fdp1_probe(struct platform_device *pdev)
+ return PTR_ERR(fdp1->regs);
+
+ /* Interrupt service routine registration */
+- fdp1->irq = ret = platform_get_irq(pdev, 0);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "cannot find IRQ\n");
++ ret = platform_get_irq(pdev, 0);
++ if (ret < 0)
+ return ret;
+- }
++ fdp1->irq = ret;
+
+ ret = devm_request_irq(&pdev->dev, fdp1->irq, fdp1_irq_handler, 0,
+ dev_name(&pdev->dev), fdp1);
+--
+2.39.2
+
--- /dev/null
+From 562b54437603e8a0c85e6aa9cbe88eb9a120ba33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Sep 2021 07:55:24 +0200
+Subject: media: rcar_fdp1: Make use of the helper function
+ devm_platform_ioremap_resource()
+
+From: Cai Huoqing <caihuoqing@baidu.com>
+
+[ Upstream commit 736cce12fa630e28705de06570d74f0513d948d5 ]
+
+Use the devm_platform_ioremap_resource() helper instead of
+calling platform_get_resource() and devm_ioremap_resource()
+separately
+
+Signed-off-by: Cai Huoqing <caihuoqing@baidu.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 9caddc8387b46..90575a58ad880 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2260,7 +2260,6 @@ static int fdp1_probe(struct platform_device *pdev)
+ struct fdp1_dev *fdp1;
+ struct video_device *vfd;
+ struct device_node *fcp_node;
+- struct resource *res;
+ struct clk *clk;
+ unsigned int i;
+
+@@ -2287,8 +2286,7 @@ static int fdp1_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, fdp1);
+
+ /* Memory-mapped registers */
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- fdp1->regs = devm_ioremap_resource(&pdev->dev, res);
++ fdp1->regs = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(fdp1->regs))
+ return PTR_ERR(fdp1->regs);
+
+--
+2.39.2
+
--- /dev/null
+From d3beecc6673368f6cded2200d2cd83e5a1402344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Apr 2021 16:59:34 +0200
+Subject: media: rcar_fdp1: simplify error check logic at fdp_open()
+
+From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+[ Upstream commit fa9f443f7c962d072d150472e2bb77de39817a9a ]
+
+Avoid some code duplication by moving the common error path
+logic at fdp_open().
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: c766c90faf93 ("media: rcar_fdp1: Fix refcount leak in probe and remove function")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/rcar_fdp1.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/platform/rcar_fdp1.c b/drivers/media/platform/rcar_fdp1.c
+index 97bed45360f08..d6eee66c8dd49 100644
+--- a/drivers/media/platform/rcar_fdp1.c
++++ b/drivers/media/platform/rcar_fdp1.c
+@@ -2121,9 +2121,7 @@ static int fdp1_open(struct file *file)
+
+ if (ctx->hdl.error) {
+ ret = ctx->hdl.error;
+- v4l2_ctrl_handler_free(&ctx->hdl);
+- kfree(ctx);
+- goto done;
++ goto error_ctx;
+ }
+
+ ctx->fh.ctrl_handler = &ctx->hdl;
+@@ -2137,10 +2135,7 @@ static int fdp1_open(struct file *file)
+
+ if (IS_ERR(ctx->fh.m2m_ctx)) {
+ ret = PTR_ERR(ctx->fh.m2m_ctx);
+-
+- v4l2_ctrl_handler_free(&ctx->hdl);
+- kfree(ctx);
+- goto done;
++ goto error_ctx;
+ }
+
+ /* Perform any power management required */
+@@ -2151,6 +2146,12 @@ static int fdp1_open(struct file *file)
+ dprintk(fdp1, "Created instance: %p, m2m_ctx: %p\n",
+ ctx, ctx->fh.m2m_ctx);
+
++ mutex_unlock(&fdp1->dev_mutex);
++ return 0;
++
++error_ctx:
++ v4l2_ctrl_handler_free(&ctx->hdl);
++ kfree(ctx);
+ done:
+ mutex_unlock(&fdp1->dev_mutex);
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 50aea31c68501b7b8db1ac437f36aa2ac884034c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 16:50:23 +0800
+Subject: media: saa7134: fix use after free bug in saa7134_finidev due to race
+ condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 30cf57da176cca80f11df0d9b7f71581fe601389 ]
+
+In saa7134_initdev, it will call saa7134_hwinit1. There are three
+function invoking here: saa7134_video_init1, saa7134_ts_init1
+and saa7134_vbi_init1.
+
+All of them will init a timer with same function. Take
+saa7134_video_init1 as an example. It'll bound &dev->video_q.timeout
+with saa7134_buffer_timeout.
+
+In buffer_activate, the timer funtcion is started.
+
+If we remove the module or device which will call saa7134_finidev
+to make cleanup, there may be a unfinished work. The
+possible sequence is as follows, which will cause a
+typical UAF bug.
+
+Fix it by canceling the timer works accordingly before cleanup in
+saa7134_finidev.
+
+CPU0 CPU1
+
+ |saa7134_buffer_timeout
+saa7134_finidev |
+ kfree(dev); |
+ |
+ | saa7134_buffer_next
+ | //use dev
+
+Fixes: 1e7126b4a86a ("media: saa7134: Convert timers to use timer_setup()")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/saa7134/saa7134-ts.c | 1 +
+ drivers/media/pci/saa7134/saa7134-vbi.c | 1 +
+ drivers/media/pci/saa7134/saa7134-video.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/media/pci/saa7134/saa7134-ts.c b/drivers/media/pci/saa7134/saa7134-ts.c
+index 6a5053126237f..437dbe5e75e29 100644
+--- a/drivers/media/pci/saa7134/saa7134-ts.c
++++ b/drivers/media/pci/saa7134/saa7134-ts.c
+@@ -300,6 +300,7 @@ int saa7134_ts_start(struct saa7134_dev *dev)
+
+ int saa7134_ts_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->ts_q.timeout);
+ saa7134_pgtable_free(dev->pci, &dev->ts_q.pt);
+ return 0;
+ }
+diff --git a/drivers/media/pci/saa7134/saa7134-vbi.c b/drivers/media/pci/saa7134/saa7134-vbi.c
+index 3f0b0933eed69..3e773690468bd 100644
+--- a/drivers/media/pci/saa7134/saa7134-vbi.c
++++ b/drivers/media/pci/saa7134/saa7134-vbi.c
+@@ -185,6 +185,7 @@ int saa7134_vbi_init1(struct saa7134_dev *dev)
+ int saa7134_vbi_fini(struct saa7134_dev *dev)
+ {
+ /* nothing */
++ del_timer_sync(&dev->vbi_q.timeout);
+ return 0;
+ }
+
+diff --git a/drivers/media/pci/saa7134/saa7134-video.c b/drivers/media/pci/saa7134/saa7134-video.c
+index e454a288229b8..ea26c8c57494f 100644
+--- a/drivers/media/pci/saa7134/saa7134-video.c
++++ b/drivers/media/pci/saa7134/saa7134-video.c
+@@ -2154,6 +2154,7 @@ int saa7134_video_init1(struct saa7134_dev *dev)
+
+ void saa7134_video_fini(struct saa7134_dev *dev)
+ {
++ del_timer_sync(&dev->video_q.timeout);
+ /* free stuff */
+ vb2_queue_release(&dev->video_vbq);
+ saa7134_pgtable_free(dev->pci, &dev->video_q.pt);
+--
+2.39.2
+
--- /dev/null
+From 588d064914b56ea46dbeb922a73ddecbc650881a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Oct 2020 14:46:08 +0100
+Subject: media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format.
+
+From: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+
+[ Upstream commit 6ad253cc3436269fc6bcff03d704c672f368da0a ]
+
+MEDIA_BUS_FMT_METADATA_FIXED should be used when
+the same driver handles both sides of the link and
+the bus format is a fixed metadata format that is
+not configurable from userspace.
+The width and height will be set to 0 for this format.
+
+Signed-off-by: Dafna Hirschfeld <dafna.hirschfeld@collabora.com>
+Acked-by: Helen Koike <helen.koike@collabora.com>
+Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Stable-dep-of: eed9496a0501 ("media: av7110: prevent underflow in write_ts_to_decoder()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/uapi/v4l/subdev-formats.rst | 27 +++++++++++++++++++
+ include/uapi/linux/media-bus-format.h | 8 ++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/Documentation/media/uapi/v4l/subdev-formats.rst b/Documentation/media/uapi/v4l/subdev-formats.rst
+index 15e11f27b4c8f..b89a2f6c91552 100644
+--- a/Documentation/media/uapi/v4l/subdev-formats.rst
++++ b/Documentation/media/uapi/v4l/subdev-formats.rst
+@@ -7794,3 +7794,30 @@ formats.
+ - 0x5001
+ - Interleaved raw UYVY and JPEG image format with embedded meta-data
+ used by Samsung S3C73MX camera sensors.
++
++.. _v4l2-mbus-metadata-fmts:
++
++Metadata Formats
++^^^^^^^^^^^^^^^^
++
++This section lists all metadata formats.
++
++The following table lists the existing metadata formats.
++
++.. tabularcolumns:: |p{8.0cm}|p{1.4cm}|p{7.7cm}|
++
++.. flat-table:: Metadata formats
++ :header-rows: 1
++ :stub-columns: 0
++
++ * - Identifier
++ - Code
++ - Comments
++ * .. _MEDIA-BUS-FMT-METADATA-FIXED:
++
++ - MEDIA_BUS_FMT_METADATA_FIXED
++ - 0x7001
++ - This format should be used when the same driver handles
++ both sides of the link and the bus format is a fixed
++ metadata format that is not configurable from userspace.
++ Width and height will be set to 0 for this format.
+diff --git a/include/uapi/linux/media-bus-format.h b/include/uapi/linux/media-bus-format.h
+index 16c1fa2d89a42..052c8308b995c 100644
+--- a/include/uapi/linux/media-bus-format.h
++++ b/include/uapi/linux/media-bus-format.h
+@@ -155,4 +155,12 @@
+ /* HSV - next is 0x6002 */
+ #define MEDIA_BUS_FMT_AHSV8888_1X32 0x6001
+
++/*
++ * This format should be used when the same driver handles
++ * both sides of the link and the bus format is a fixed
++ * metadata format that is not configurable from userspace.
++ * Width and height will be set to 0 for this format.
++ */
++#define MEDIA_BUS_FMT_METADATA_FIXED 0x7001
++
+ #endif /* __LINUX_MEDIA_BUS_FORMAT_H */
+--
+2.39.2
+
--- /dev/null
+From cac8fecd0f869f9f14619d9a28e6b746ce769cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Mar 2023 23:37:15 +0300
+Subject: mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
+
+From: Georgii Kruglov <georgy.kruglov@yandex.ru>
+
+[ Upstream commit 0dd8316037a2a6d85b2be208bef9991de7b42170 ]
+
+If spec_reg is equal to 'SDHCI_PRESENT_STATE', esdhc_readl_fixup()
+fixes up register value and returns it immediately. As a result, the
+further block
+(spec_reg == SDHCI_PRESENT_STATE)
+ &&(esdhc->quirk_ignore_data_inhibit == true),
+is never executed.
+
+The patch merges the second block into the first one.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 1f1929f3f2fa ("mmc: sdhci-of-esdhc: add quirk to ignore command inhibit for data")
+Signed-off-by: Georgii Kruglov <georgy.kruglov@yandex.ru>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/20230321203715.3975-1-georgy.kruglov@yandex.ru
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-of-esdhc.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c
+index 69c133e7ced05..48765208e2953 100644
+--- a/drivers/mmc/host/sdhci-of-esdhc.c
++++ b/drivers/mmc/host/sdhci-of-esdhc.c
+@@ -124,6 +124,7 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ return ret;
+ }
+ }
++
+ /*
+ * The DAT[3:0] line signal levels and the CMD line signal level are
+ * not compatible with standard SDHC register. The line signal levels
+@@ -135,6 +136,16 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ ret = value & 0x000fffff;
+ ret |= (value >> 4) & SDHCI_DATA_LVL_MASK;
+ ret |= (value << 1) & SDHCI_CMD_LVL;
++
++ /*
++ * Some controllers have unreliable Data Line Active
++ * bit for commands with busy signal. This affects
++ * Command Inhibit (data) bit. Just ignore it since
++ * MMC core driver has already polled card status
++ * with CMD13 after any command with busy siganl.
++ */
++ if (esdhc->quirk_ignore_data_inhibit)
++ ret &= ~SDHCI_DATA_INHIBIT;
+ return ret;
+ }
+
+@@ -149,19 +160,6 @@ static u32 esdhc_readl_fixup(struct sdhci_host *host,
+ return ret;
+ }
+
+- /*
+- * Some controllers have unreliable Data Line Active
+- * bit for commands with busy signal. This affects
+- * Command Inhibit (data) bit. Just ignore it since
+- * MMC core driver has already polled card status
+- * with CMD13 after any command with busy siganl.
+- */
+- if ((spec_reg == SDHCI_PRESENT_STATE) &&
+- (esdhc->quirk_ignore_data_inhibit == true)) {
+- ret = value & ~SDHCI_DATA_INHIBIT;
+- return ret;
+- }
+-
+ ret = value;
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From bfa9dce8c5ba9ddd6f20d5b60b238109d61ab987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:34:39 +0530
+Subject: mtd: spi-nor: cadence-quadspi: Don't initialize rx_dma_complete on
+ failure
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 48aae57f0f9f57797772bd462b4d64902b1b4ae1 ]
+
+If driver fails to acquire DMA channel then don't initialize
+rx_dma_complete struct as it won't be used.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200601070444.16923-4-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 7e7736bbbfb3b..ad27d3e4c5dbc 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -1179,6 +1179,7 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+ if (IS_ERR(cqspi->rx_chan)) {
+ dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
+ cqspi->rx_chan = NULL;
++ return;
+ }
+ init_completion(&cqspi->rx_dma_complete);
+ }
+--
+2.39.2
+
--- /dev/null
+From 53031171931595d07ef898b336111560d99a804c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:34:41 +0530
+Subject: mtd: spi-nor: cadence-quadspi: Handle probe deferral while requesting
+ DMA channel
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 935da5e5100f57d843cac4781b21f1c235059aa0 ]
+
+dma_request_chan_by_mask() can throw EPROBE_DEFER if DMA provider
+is not yet probed. Currently driver just falls back to using PIO mode
+(which is less efficient) in this case. Instead return probe deferral
+error as is so that driver will be re probed once DMA provider is
+available.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200601070444.16923-6-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index ad27d3e4c5dbc..2c5a6587f505e 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -1168,7 +1168,7 @@ static void cqspi_controller_init(struct cqspi_st *cqspi)
+ cqspi_controller_enable(cqspi, 1);
+ }
+
+-static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
++static int cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+ {
+ dma_cap_mask_t mask;
+
+@@ -1177,11 +1177,16 @@ static void cqspi_request_mmap_dma(struct cqspi_st *cqspi)
+
+ cqspi->rx_chan = dma_request_chan_by_mask(&mask);
+ if (IS_ERR(cqspi->rx_chan)) {
+- dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
++ int ret = PTR_ERR(cqspi->rx_chan);
++
++ if (ret != -EPROBE_DEFER)
++ dev_err(&cqspi->pdev->dev, "No Rx DMA available\n");
+ cqspi->rx_chan = NULL;
+- return;
++ return ret;
+ }
+ init_completion(&cqspi->rx_dma_complete);
++
++ return 0;
+ }
+
+ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
+@@ -1265,8 +1270,11 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
+ dev_dbg(nor->dev, "using direct mode for %s\n",
+ mtd->name);
+
+- if (!cqspi->rx_chan)
+- cqspi_request_mmap_dma(cqspi);
++ if (!cqspi->rx_chan) {
++ ret = cqspi_request_mmap_dma(cqspi);
++ if (ret == -EPROBE_DEFER)
++ goto err;
++ }
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 19b8f14296e2b3273d9e0cf8565a69a35cccc045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:34:37 +0530
+Subject: mtd: spi-nor: cadence-quadspi: Make driver independent of flash
+ geometry
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 834b4e8d344139ba64cda22099b2b2ef6c9a542d ]
+
+Drop configuration of Flash size, erase size and page size
+configuration. Flash size is needed only if using AHB decoder (BIT 23 of
+CONFIG_REG) which is not used by the driver.
+Erase size and page size are needed if IP is configured to send WREN
+automatically. But since SPI NOR layer takes care of sending WREN, there
+is no need to configure these fields either.
+
+Therefore drop these in preparation to move the driver to spi-mem
+framework where flash geometry is not visible to controller driver.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200601070444.16923-2-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 36 +--------------------------
+ 1 file changed, 1 insertion(+), 35 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 97a5e1eaeefdf..d680e4a272a13 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -77,9 +77,6 @@ struct cqspi_st {
+ dma_addr_t mmap_phys_base;
+
+ int current_cs;
+- int current_page_size;
+- int current_erase_size;
+- int current_addr_width;
+ unsigned long master_ref_clk_hz;
+ bool is_decoded_cs;
+ u32 fifo_depth;
+@@ -736,32 +733,6 @@ static void cqspi_chipselect(struct spi_nor *nor)
+ writel(reg, reg_base + CQSPI_REG_CONFIG);
+ }
+
+-static void cqspi_configure_cs_and_sizes(struct spi_nor *nor)
+-{
+- struct cqspi_flash_pdata *f_pdata = nor->priv;
+- struct cqspi_st *cqspi = f_pdata->cqspi;
+- void __iomem *iobase = cqspi->iobase;
+- unsigned int reg;
+-
+- /* configure page size and block size. */
+- reg = readl(iobase + CQSPI_REG_SIZE);
+- reg &= ~(CQSPI_REG_SIZE_PAGE_MASK << CQSPI_REG_SIZE_PAGE_LSB);
+- reg &= ~(CQSPI_REG_SIZE_BLOCK_MASK << CQSPI_REG_SIZE_BLOCK_LSB);
+- reg &= ~CQSPI_REG_SIZE_ADDRESS_MASK;
+- reg |= (nor->page_size << CQSPI_REG_SIZE_PAGE_LSB);
+- reg |= (ilog2(nor->mtd.erasesize) << CQSPI_REG_SIZE_BLOCK_LSB);
+- reg |= (nor->addr_width - 1);
+- writel(reg, iobase + CQSPI_REG_SIZE);
+-
+- /* configure the chip select */
+- cqspi_chipselect(nor);
+-
+- /* Store the new configuration of the controller */
+- cqspi->current_page_size = nor->page_size;
+- cqspi->current_erase_size = nor->mtd.erasesize;
+- cqspi->current_addr_width = nor->addr_width;
+-}
+-
+ static unsigned int calculate_ticks_for_ns(const unsigned int ref_clk_hz,
+ const unsigned int ns_val)
+ {
+@@ -867,18 +838,13 @@ static void cqspi_configure(struct spi_nor *nor)
+ int switch_cs = (cqspi->current_cs != f_pdata->cs);
+ int switch_ck = (cqspi->sclk != sclk);
+
+- if ((cqspi->current_page_size != nor->page_size) ||
+- (cqspi->current_erase_size != nor->mtd.erasesize) ||
+- (cqspi->current_addr_width != nor->addr_width))
+- switch_cs = 1;
+-
+ if (switch_cs || switch_ck)
+ cqspi_controller_enable(cqspi, 0);
+
+ /* Switch chip select. */
+ if (switch_cs) {
+ cqspi->current_cs = f_pdata->cs;
+- cqspi_configure_cs_and_sizes(nor);
++ cqspi_chipselect(nor);
+ }
+
+ /* Setup baudrate divisor and delays */
+--
+2.39.2
+
--- /dev/null
+From ec929c05175da796f7acf0b05f6f29ffe61cefc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jun 2020 12:34:38 +0530
+Subject: mtd: spi-nor: cadence-quadspi: Provide a way to disable DAC mode
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit a99705079a91e6373122bd0ca2fc129b688fc5b3 ]
+
+Currently direct access mode is used on platforms that have AHB window
+(memory mapped window) larger than flash size. This feature is limited
+to TI platforms as non TI platforms have < 1MB of AHB window.
+Therefore introduce a driver quirk to disable DAC mode and set it for
+non TI compatibles. This is in preparation to move to spi-mem framework
+where flash geometry cannot be known.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Link: https://lore.kernel.org/r/20200601070444.16923-3-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 2087e85bb66e ("spi: cadence-quadspi: fix suspend-resume implementations")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index d680e4a272a13..7e7736bbbfb3b 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -34,6 +34,7 @@
+
+ /* Quirks */
+ #define CQSPI_NEEDS_WR_DELAY BIT(0)
++#define CQSPI_DISABLE_DAC_MODE BIT(1)
+
+ /* Capabilities mask */
+ #define CQSPI_BASE_HWCAPS_MASK \
+@@ -1257,7 +1258,8 @@ static int cqspi_setup_flash(struct cqspi_st *cqspi, struct device_node *np)
+
+ f_pdata->registered = true;
+
+- if (mtd->size <= cqspi->ahb_size) {
++ if (mtd->size <= cqspi->ahb_size &&
++ !(ddata->quirks & CQSPI_DISABLE_DAC_MODE)) {
+ f_pdata->use_direct_mode = true;
+ dev_dbg(nor->dev, "using direct mode for %s\n",
+ mtd->name);
+@@ -1455,6 +1457,7 @@ static const struct dev_pm_ops cqspi__dev_pm_ops = {
+
+ static const struct cqspi_driver_platdata cdns_qspi = {
+ .hwcaps_mask = CQSPI_BASE_HWCAPS_MASK,
++ .quirks = CQSPI_DISABLE_DAC_MODE,
+ };
+
+ static const struct cqspi_driver_platdata k2g_qspi = {
+--
+2.39.2
+
--- /dev/null
+From bd4db9922482e05d50ee97e51b4cd2c3e25c2fa3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 23:28:01 +0800
+Subject: net: amd: Fix link leak when verifying config failed
+
+From: Gencen Gan <gangecen@hust.edu.cn>
+
+[ Upstream commit d325c34d9e7e38d371c0a299d415e9b07f66a1fb ]
+
+After failing to verify configuration, it returns directly without
+releasing link, which may cause memory leak.
+
+Paolo Abeni thinks that the whole code of this driver is quite
+"suboptimal" and looks unmainatained since at least ~15y, so he
+suggests that we could simply remove the whole driver, please
+take it into consideration.
+
+Simon Horman suggests that the fix label should be set to
+"Linux-2.6.12-rc2" considering that the problem has existed
+since the driver was introduced and the commit above doesn't
+seem to exist in net/net-next.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Gan Gecen <gangecen@hust.edu.cn>
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/nmclan_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/nmclan_cs.c b/drivers/net/ethernet/amd/nmclan_cs.c
+index 9c152d85840d7..c9d2a6f150624 100644
+--- a/drivers/net/ethernet/amd/nmclan_cs.c
++++ b/drivers/net/ethernet/amd/nmclan_cs.c
+@@ -652,7 +652,7 @@ static int nmclan_config(struct pcmcia_device *link)
+ } else {
+ pr_notice("mace id not found: %x %x should be 0x40 0x?9\n",
+ sig[0], sig[1]);
+- return -ENODEV;
++ goto failed;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 0bc730adaccd92d6f0863473de3fda23794538e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:06 +0000
+Subject: net/packet: annotate accesses to po->xmit
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b9d83ab8a708f23a4001d60e9d8d0b3be3d9f607 ]
+
+po->xmit can be set from setsockopt(PACKET_QDISC_BYPASS),
+while read locklessly.
+
+Use READ_ONCE()/WRITE_ONCE() to avoid potential load/store
+tearing issues.
+
+Fixes: d346a3fae3ff ("packet: introduce PACKET_QDISC_BYPASS socket option")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 450dc03347725..8636e74557ec2 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -266,7 +266,8 @@ static void packet_cached_dev_reset(struct packet_sock *po)
+
+ static bool packet_use_direct_xmit(const struct packet_sock *po)
+ {
+- return po->xmit == packet_direct_xmit;
++ /* Paired with WRITE_ONCE() in packet_setsockopt() */
++ return READ_ONCE(po->xmit) == packet_direct_xmit;
+ }
+
+ static u16 packet_pick_tx_queue(struct sk_buff *skb)
+@@ -2799,7 +2800,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
+ packet_inc_pending(&po->tx_ring);
+
+ status = TP_STATUS_SEND_REQUEST;
+- err = po->xmit(skb);
++ /* Paired with WRITE_ONCE() in packet_setsockopt() */
++ err = READ_ONCE(po->xmit)(skb);
+ if (unlikely(err != 0)) {
+ if (err > 0)
+ err = net_xmit_errno(err);
+@@ -3002,7 +3004,8 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ virtio_net_hdr_set_proto(skb, &vnet_hdr);
+ }
+
+- err = po->xmit(skb);
++ /* Paired with WRITE_ONCE() in packet_setsockopt() */
++ err = READ_ONCE(po->xmit)(skb);
+ if (unlikely(err != 0)) {
+ if (err > 0)
+ err = net_xmit_errno(err);
+@@ -3949,7 +3952,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
++ /* Paired with all lockless reads of po->xmit */
++ WRITE_ONCE(po->xmit, val ? packet_direct_xmit : dev_queue_xmit);
+ return 0;
+ }
+ default:
+--
+2.39.2
+
--- /dev/null
+From 3b04dee448a9219a13e788b77e06cd7df0232331 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:08 +0000
+Subject: net/packet: convert po->auxdata to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit fd53c297aa7b077ae98a3d3d2d3aa278a1686ba6 ]
+
+po->auxdata can be read while another thread
+is changing its value, potentially raising KCSAN splat.
+
+Convert it to PACKET_SOCK_AUXDATA flag.
+
+Fixes: 8dc419447415 ("[PACKET]: Add optional checksum computation for recvmsg")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 8 +++-----
+ net/packet/diag.c | 2 +-
+ net/packet/internal.h | 4 ++--
+ 3 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 0e88a8dd4530f..13666fe787db7 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3456,7 +3456,7 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+- if (pkt_sk(sk)->auxdata) {
++ if (packet_sock_flag(pkt_sk(sk), PACKET_SOCK_AUXDATA)) {
+ struct tpacket_auxdata aux;
+
+ aux.tp_status = TP_STATUS_USER;
+@@ -3839,9 +3839,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->auxdata = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_AUXDATA, val);
+ return 0;
+ }
+ case PACKET_ORIGDEV:
+@@ -4002,7 +4000,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+
+ break;
+ case PACKET_AUXDATA:
+- val = po->auxdata;
++ val = packet_sock_flag(po, PACKET_SOCK_AUXDATA);
+ break;
+ case PACKET_ORIGDEV:
+ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index e1ac9bb375b31..d704c7bf51b20 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -23,7 +23,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ pinfo.pdi_flags = 0;
+ if (po->running)
+ pinfo.pdi_flags |= PDI_RUNNING;
+- if (po->auxdata)
++ if (packet_sock_flag(po, PACKET_SOCK_AUXDATA))
+ pinfo.pdi_flags |= PDI_AUXDATA;
+ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ pinfo.pdi_flags |= PDI_ORIGDEV;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 23649010e9586..2b2b85dadf8ea 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -117,8 +117,7 @@ struct packet_sock {
+ struct mutex pg_vec_lock;
+ unsigned long flags;
+ unsigned int running; /* bind_lock must be held */
+- unsigned int auxdata:1, /* writer must hold sock lock */
+- has_vnet_hdr:1,
++ unsigned int has_vnet_hdr:1, /* writer must hold sock lock */
+ tp_loss:1,
+ tp_tx_has_off:1;
+ int pressure;
+@@ -145,6 +144,7 @@ static struct packet_sock *pkt_sk(struct sock *sk)
+
+ enum packet_sock_flags {
+ PACKET_SOCK_ORIGDEV,
++ PACKET_SOCK_AUXDATA,
+ };
+
+ static inline void packet_sock_flag_set(struct packet_sock *po,
+--
+2.39.2
+
--- /dev/null
+From 2003e46057f9c8dae5a07c64e759ae98770285e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Mar 2023 01:10:07 +0000
+Subject: net/packet: convert po->origdev to an atomic flag
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ee5675ecdf7a4e713ed21d98a70c2871d6ebed01 ]
+
+syzbot/KCAN reported that po->origdev can be read
+while another thread is changing its value.
+
+We can avoid this splat by converting this field
+to an actual bit.
+
+Following patches will convert remaining 1bit fields.
+
+Fixes: 80feaacb8a64 ("[AF_PACKET]: Add option to return orig_dev to userspace.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 10 ++++------
+ net/packet/diag.c | 2 +-
+ net/packet/internal.h | 22 +++++++++++++++++++++-
+ 3 files changed, 26 insertions(+), 8 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 8636e74557ec2..0e88a8dd4530f 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2125,7 +2125,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll = &PACKET_SKB_CB(skb)->sa.ll;
+ sll->sll_hatype = dev->type;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -2393,7 +2393,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ sll->sll_hatype = dev->type;
+ sll->sll_protocol = skb->protocol;
+ sll->sll_pkttype = skb->pkt_type;
+- if (unlikely(po->origdev))
++ if (unlikely(packet_sock_flag(po, PACKET_SOCK_ORIGDEV)))
+ sll->sll_ifindex = orig_dev->ifindex;
+ else
+ sll->sll_ifindex = dev->ifindex;
+@@ -3853,9 +3853,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- lock_sock(sk);
+- po->origdev = !!val;
+- release_sock(sk);
++ packet_sock_flag_set(po, PACKET_SOCK_ORIGDEV, val);
+ return 0;
+ }
+ case PACKET_VNET_HDR:
+@@ -4007,7 +4005,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ val = po->auxdata;
+ break;
+ case PACKET_ORIGDEV:
+- val = po->origdev;
++ val = packet_sock_flag(po, PACKET_SOCK_ORIGDEV);
+ break;
+ case PACKET_VNET_HDR:
+ val = po->has_vnet_hdr;
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index 07812ae5ca073..e1ac9bb375b31 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -25,7 +25,7 @@ static int pdiag_put_info(const struct packet_sock *po, struct sk_buff *nlskb)
+ pinfo.pdi_flags |= PDI_RUNNING;
+ if (po->auxdata)
+ pinfo.pdi_flags |= PDI_AUXDATA;
+- if (po->origdev)
++ if (packet_sock_flag(po, PACKET_SOCK_ORIGDEV))
+ pinfo.pdi_flags |= PDI_ORIGDEV;
+ if (po->has_vnet_hdr)
+ pinfo.pdi_flags |= PDI_VNETHDR;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 907f4cd2a7188..23649010e9586 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -115,9 +115,9 @@ struct packet_sock {
+ int copy_thresh;
+ spinlock_t bind_lock;
+ struct mutex pg_vec_lock;
++ unsigned long flags;
+ unsigned int running; /* bind_lock must be held */
+ unsigned int auxdata:1, /* writer must hold sock lock */
+- origdev:1,
+ has_vnet_hdr:1,
+ tp_loss:1,
+ tp_tx_has_off:1;
+@@ -143,4 +143,24 @@ static struct packet_sock *pkt_sk(struct sock *sk)
+ return (struct packet_sock *)sk;
+ }
+
++enum packet_sock_flags {
++ PACKET_SOCK_ORIGDEV,
++};
++
++static inline void packet_sock_flag_set(struct packet_sock *po,
++ enum packet_sock_flags flag,
++ bool val)
++{
++ if (val)
++ set_bit(flag, &po->flags);
++ else
++ clear_bit(flag, &po->flags);
++}
++
++static inline bool packet_sock_flag(const struct packet_sock *po,
++ enum packet_sock_flags flag)
++{
++ return test_bit(flag, &po->flags);
++}
++
+ #endif
+--
+2.39.2
+
--- /dev/null
+From c861e501d544f65a7c35d5567024b4b5447d4edd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 17:13:19 +0200
+Subject: netfilter: nf_tables: don't write table validation state without
+ mutex
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 9a32e9850686599ed194ccdceb6cd3dd56b2d9b9 ]
+
+The ->cleanup callback needs to be removed, this doesn't work anymore as
+the transaction mutex is already released in the ->abort function.
+
+Just do it after a successful validation pass, this either happens
+from commit or abort phases where transaction mutex is held.
+
+Fixes: f102d66b335a ("netfilter: nf_tables: use dedicated mutex to guard transactions")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netfilter/nfnetlink.h | 1 -
+ net/netfilter/nf_tables_api.c | 8 ++------
+ net/netfilter/nfnetlink.c | 2 --
+ 3 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
+index f6267e2883f26..41de4156540a9 100644
+--- a/include/linux/netfilter/nfnetlink.h
++++ b/include/linux/netfilter/nfnetlink.h
+@@ -39,7 +39,6 @@ struct nfnetlink_subsystem {
+ int (*commit)(struct net *net, struct sk_buff *skb);
+ int (*abort)(struct net *net, struct sk_buff *skb,
+ enum nfnl_abort_action action);
+- void (*cleanup)(struct net *net);
+ bool (*valid_genid)(struct net *net, u32 genid);
+ };
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 140c24f1b6c60..1a5294eb340c0 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -6491,6 +6491,8 @@ static int nf_tables_validate(struct net *net)
+ if (nft_table_validate(net, table) < 0)
+ return -EAGAIN;
+ }
++
++ nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+ break;
+ }
+
+@@ -7172,11 +7174,6 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
+ return 0;
+ }
+
+-static void nf_tables_cleanup(struct net *net)
+-{
+- nft_validate_state_update(net, NFT_VALIDATE_SKIP);
+-}
+-
+ static int nf_tables_abort(struct net *net, struct sk_buff *skb,
+ enum nfnl_abort_action action)
+ {
+@@ -7208,7 +7205,6 @@ static const struct nfnetlink_subsystem nf_tables_subsys = {
+ .cb = nf_tables_cb,
+ .commit = nf_tables_commit,
+ .abort = nf_tables_abort,
+- .cleanup = nf_tables_cleanup,
+ .valid_genid = nf_tables_valid_genid,
+ .owner = THIS_MODULE,
+ };
+diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
+index 81c86a156c6c0..e3f6e27a9a06d 100644
+--- a/net/netfilter/nfnetlink.c
++++ b/net/netfilter/nfnetlink.c
+@@ -512,8 +512,6 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
+ goto replay_abort;
+ }
+ }
+- if (ss->cleanup)
+- ss->cleanup(net);
+
+ nfnl_err_deliver(&err_list, oskb);
+ kfree_skb(skb);
+--
+2.39.2
+
--- /dev/null
+From e4edf7d23c6805c9038886c53987a6b01b8a0e66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 11:52:55 -0700
+Subject: netlink: Use copy_to_user() for optval in netlink_getsockopt().
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit d913d32cc2707e9cd24fe6fa6d7d470e9c728980 ]
+
+Brad Spencer provided a detailed report [0] that when calling getsockopt()
+for AF_NETLINK, some SOL_NETLINK options set only 1 byte even though such
+options require at least sizeof(int) as length.
+
+The options return a flag value that fits into 1 byte, but such behaviour
+confuses users who do not initialise the variable before calling
+getsockopt() and do not strictly check the returned value as char.
+
+Currently, netlink_getsockopt() uses put_user() to copy data to optlen and
+optval, but put_user() casts the data based on the pointer, char *optval.
+As a result, only 1 byte is set to optval.
+
+To avoid this behaviour, we need to use copy_to_user() or cast optval for
+put_user().
+
+Note that this changes the behaviour on big-endian systems, but we document
+that the size of optval is int in the man page.
+
+ $ man 7 netlink
+ ...
+ Socket options
+ To set or get a netlink socket option, call getsockopt(2) to read
+ or setsockopt(2) to write the option with the option level argument
+ set to SOL_NETLINK. Unless otherwise noted, optval is a pointer to
+ an int.
+
+Fixes: 9a4595bc7e67 ("[NETLINK]: Add set/getsockopt options to support more than 32 groups")
+Fixes: be0c22a46cfb ("netlink: add NETLINK_BROADCAST_ERROR socket option")
+Fixes: 38938bfe3489 ("netlink: add NETLINK_NO_ENOBUFS socket flag")
+Fixes: 0a6a3a23ea6e ("netlink: add NETLINK_CAP_ACK socket option")
+Fixes: 2d4bc93368f5 ("netlink: extended ACK reporting")
+Fixes: 89d35528d17d ("netlink: Add new socket option to enable strict checking on dumps")
+Reported-by: Brad Spencer <bspencer@blackberry.com>
+Link: https://lore.kernel.org/netdev/ZD7VkNWFfp22kTDt@datsun.rim.net/
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
+Link: https://lore.kernel.org/r/20230421185255.94606-1-kuniyu@amazon.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netlink/af_netlink.c | 75 ++++++++++++----------------------------
+ 1 file changed, 23 insertions(+), 52 deletions(-)
+
+diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
+index a232fcbd721c4..00f040fb46b9c 100644
+--- a/net/netlink/af_netlink.c
++++ b/net/netlink/af_netlink.c
+@@ -1743,7 +1743,8 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ {
+ struct sock *sk = sock->sk;
+ struct netlink_sock *nlk = nlk_sk(sk);
+- int len, val, err;
++ unsigned int flag;
++ int len, val;
+
+ if (level != SOL_NETLINK)
+ return -ENOPROTOOPT;
+@@ -1755,39 +1756,17 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+
+ switch (optname) {
+ case NETLINK_PKTINFO:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_PKTINFO ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_PKTINFO;
+ break;
+ case NETLINK_BROADCAST_ERROR:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_BROADCAST_SEND_ERROR ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_BROADCAST_SEND_ERROR;
+ break;
+ case NETLINK_NO_ENOBUFS:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_RECV_NO_ENOBUFS ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_RECV_NO_ENOBUFS;
+ break;
+ case NETLINK_LIST_MEMBERSHIPS: {
+- int pos, idx, shift;
++ int pos, idx, shift, err = 0;
+
+- err = 0;
+ netlink_lock_table();
+ for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
+ if (len - pos < sizeof(u32))
+@@ -1804,40 +1783,32 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
+ if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
+ err = -EFAULT;
+ netlink_unlock_table();
+- break;
++ return err;
+ }
+ case NETLINK_CAP_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_CAP_ACK ? 1 : 0;
+- if (put_user(len, optlen) ||
+- put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_CAP_ACK;
+ break;
+ case NETLINK_EXT_ACK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_EXT_ACK ? 1 : 0;
+- if (put_user(len, optlen) || put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_EXT_ACK;
+ break;
+ case NETLINK_GET_STRICT_CHK:
+- if (len < sizeof(int))
+- return -EINVAL;
+- len = sizeof(int);
+- val = nlk->flags & NETLINK_F_STRICT_CHK ? 1 : 0;
+- if (put_user(len, optlen) || put_user(val, optval))
+- return -EFAULT;
+- err = 0;
++ flag = NETLINK_F_STRICT_CHK;
+ break;
+ default:
+- err = -ENOPROTOOPT;
++ return -ENOPROTOOPT;
+ }
+- return err;
++
++ if (len < sizeof(int))
++ return -EINVAL;
++
++ len = sizeof(int);
++ val = nlk->flags & flag ? 1 : 0;
++
++ if (put_user(len, optlen) ||
++ copy_to_user(optval, &val, len))
++ return -EFAULT;
++
++ return 0;
+ }
+
+ static void netlink_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
+--
+2.39.2
+
--- /dev/null
+From edf6643474d219d280abbd9c2f278c682510b8dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 18:45:53 -0400
+Subject: NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 40882deb83c29d8df4470d4e5e7f137b6acf7ad1 ]
+
+The spec requires that we always at least send a RECLAIM_COMPLETE when
+we're done establishing the lease and recovering any state.
+
+Fixes: fce5c838e133 ("nfs41: RECLAIM_COMPLETE functionality")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 2ee30ffeb6b97..01b1856705941 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -66,6 +66,8 @@
+
+ #define OPENOWNER_POOL_SIZE 8
+
++static void nfs4_state_start_reclaim_reboot(struct nfs_client *clp);
++
+ const nfs4_stateid zero_stateid = {
+ { .data = { 0 } },
+ .type = NFS4_SPECIAL_STATEID_TYPE,
+@@ -329,6 +331,8 @@ int nfs41_init_clientid(struct nfs_client *clp, const struct cred *cred)
+ status = nfs4_proc_create_session(clp, cred);
+ if (status != 0)
+ goto out;
++ if (!(clp->cl_exchange_flags & EXCHGID4_FLAG_CONFIRMED_R))
++ nfs4_state_start_reclaim_reboot(clp);
+ nfs41_finish_session_reset(clp);
+ nfs_mark_client_ready(clp, NFS_CS_READY);
+ out:
+--
+2.39.2
+
--- /dev/null
+From 5794f2107d20a408e17a4767dc02e754fbc9abda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 16:49:04 +0800
+Subject: nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W}
+ usage"
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 4f86a6ff6fbd891232dda3ca97fd1b9630b59809 ]
+
+fcloop_fcp_op() could be called from flush request's ->end_io(flush_end_io) in
+which the spinlock of fq->mq_flush_lock is grabbed with irq saved/disabled.
+
+So fcloop_fcp_op() can't call spin_unlock_irq(&tfcp_req->reqlock) simply
+which enables irq unconditionally.
+
+Fixes the warning by switching to spin_lock_irqsave()/spin_unlock_irqrestore()
+
+Fixes: c38dbbfab1bc ("nvme-fcloop: fix inconsistent lock state warnings")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Tested-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/fcloop.c | 48 ++++++++++++++++++++----------------
+ 1 file changed, 27 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
+index b50b53db37462..34345c45a3e52 100644
+--- a/drivers/nvme/target/fcloop.c
++++ b/drivers/nvme/target/fcloop.c
+@@ -431,10 +431,11 @@ fcloop_fcp_recv_work(struct work_struct *work)
+ struct fcloop_fcpreq *tfcp_req =
+ container_of(work, struct fcloop_fcpreq, fcp_rcv_work);
+ struct nvmefc_fcp_req *fcpreq = tfcp_req->fcpreq;
++ unsigned long flags;
+ int ret = 0;
+ bool aborted = false;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ switch (tfcp_req->inistate) {
+ case INI_IO_START:
+ tfcp_req->inistate = INI_IO_ACTIVE;
+@@ -443,11 +444,11 @@ fcloop_fcp_recv_work(struct work_struct *work)
+ aborted = true;
+ break;
+ default:
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ WARN_ON(1);
+ return;
+ }
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (unlikely(aborted))
+ ret = -ECANCELED;
+@@ -468,8 +469,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ container_of(work, struct fcloop_fcpreq, abort_rcv_work);
+ struct nvmefc_fcp_req *fcpreq;
+ bool completed = false;
++ unsigned long flags;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ fcpreq = tfcp_req->fcpreq;
+ switch (tfcp_req->inistate) {
+ case INI_IO_ABORTED:
+@@ -478,11 +480,11 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ completed = true;
+ break;
+ default:
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ WARN_ON(1);
+ return;
+ }
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (unlikely(completed)) {
+ /* remove reference taken in original abort downcall */
+@@ -494,9 +496,9 @@ fcloop_fcp_abort_recv_work(struct work_struct *work)
+ nvmet_fc_rcv_fcp_abort(tfcp_req->tport->targetport,
+ &tfcp_req->tgt_fcp_req);
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->fcpreq = NULL;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ fcloop_call_host_done(fcpreq, tfcp_req, -ECANCELED);
+ /* call_host_done releases reference for abort downcall */
+@@ -512,11 +514,12 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work)
+ struct fcloop_fcpreq *tfcp_req =
+ container_of(work, struct fcloop_fcpreq, tio_done_work);
+ struct nvmefc_fcp_req *fcpreq;
++ unsigned long flags;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ fcpreq = tfcp_req->fcpreq;
+ tfcp_req->inistate = INI_IO_COMPLETED;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ fcloop_call_host_done(fcpreq, tfcp_req, tfcp_req->status);
+ }
+@@ -620,13 +623,14 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ u32 rsplen = 0, xfrlen = 0;
+ int fcp_err = 0, active, aborted;
+ u8 op = tgt_fcpreq->op;
++ unsigned long flags;
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ fcpreq = tfcp_req->fcpreq;
+ active = tfcp_req->active;
+ aborted = tfcp_req->aborted;
+ tfcp_req->active = true;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (unlikely(active))
+ /* illegal - call while i/o active */
+@@ -634,9 +638,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+
+ if (unlikely(aborted)) {
+ /* target transport has aborted i/o prior */
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->active = false;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ tgt_fcpreq->transferred_length = 0;
+ tgt_fcpreq->fcp_error = -ECANCELED;
+ tgt_fcpreq->done(tgt_fcpreq);
+@@ -693,9 +697,9 @@ fcloop_fcp_op(struct nvmet_fc_target_port *tgtport,
+ break;
+ }
+
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->active = false;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ tgt_fcpreq->transferred_length = xfrlen;
+ tgt_fcpreq->fcp_error = fcp_err;
+@@ -709,15 +713,16 @@ fcloop_tgt_fcp_abort(struct nvmet_fc_target_port *tgtport,
+ struct nvmefc_tgt_fcp_req *tgt_fcpreq)
+ {
+ struct fcloop_fcpreq *tfcp_req = tgt_fcp_req_to_fcpreq(tgt_fcpreq);
++ unsigned long flags;
+
+ /*
+ * mark aborted only in case there were 2 threads in transport
+ * (one doing io, other doing abort) and only kills ops posted
+ * after the abort request
+ */
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ tfcp_req->aborted = true;
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ tfcp_req->status = NVME_SC_INTERNAL;
+
+@@ -753,6 +758,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ struct fcloop_ini_fcpreq *inireq = fcpreq->private;
+ struct fcloop_fcpreq *tfcp_req;
+ bool abortio = true;
++ unsigned long flags;
+
+ spin_lock(&inireq->inilock);
+ tfcp_req = inireq->tfcp_req;
+@@ -765,7 +771,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ return;
+
+ /* break initiator/target relationship for io */
+- spin_lock_irq(&tfcp_req->reqlock);
++ spin_lock_irqsave(&tfcp_req->reqlock, flags);
+ switch (tfcp_req->inistate) {
+ case INI_IO_START:
+ case INI_IO_ACTIVE:
+@@ -775,11 +781,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport,
+ abortio = false;
+ break;
+ default:
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+ WARN_ON(1);
+ return;
+ }
+- spin_unlock_irq(&tfcp_req->reqlock);
++ spin_unlock_irqrestore(&tfcp_req->reqlock, flags);
+
+ if (abortio)
+ /* leave the reference while the work item is scheduled */
+--
+2.39.2
+
--- /dev/null
+From 236c8cc5fc4089b54f6671ec3411b49f19d17e44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Apr 2023 14:57:20 -0700
+Subject: nvme: fix async event trace event
+
+From: Keith Busch <kbusch@kernel.org>
+
+[ Upstream commit 6622b76fe922b94189499a90ccdb714a4a8d0773 ]
+
+Mixing AER Event Type and Event Info has masking clashes. Just print the
+event type, but also include the event info of the AER result in the
+trace.
+
+Fixes: 09bd1ff4b15143b ("nvme-core: add async event trace helper")
+Reported-by: Nate Thornton <nate.thornton@samsung.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Minwoo Im <minwoo.im@samsung.com>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 5 +----
+ drivers/nvme/host/trace.h | 15 ++++++---------
+ 2 files changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index fa5753de56582..9144ed14b0741 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3990,8 +3990,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ {
+ u32 aer_notice_type = nvme_aer_subtype(result);
+
+- trace_nvme_async_event(ctrl, aer_notice_type);
+-
+ switch (aer_notice_type) {
+ case NVME_AER_NOTICE_NS_CHANGED:
+ set_bit(NVME_AER_NOTICE_NS_CHANGED, &ctrl->events);
+@@ -4023,7 +4021,6 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+
+ static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl)
+ {
+- trace_nvme_async_event(ctrl, NVME_AER_ERROR);
+ dev_warn(ctrl->device, "resetting controller due to AER\n");
+ nvme_reset_ctrl(ctrl);
+ }
+@@ -4038,6 +4035,7 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS)
+ return;
+
++ trace_nvme_async_event(ctrl, result);
+ switch (aer_type) {
+ case NVME_AER_NOTICE:
+ nvme_handle_aen_notice(ctrl, result);
+@@ -4055,7 +4053,6 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ case NVME_AER_SMART:
+ case NVME_AER_CSS:
+ case NVME_AER_VS:
+- trace_nvme_async_event(ctrl, aer_type);
+ ctrl->aen_result = result;
+ break;
+ default:
+diff --git a/drivers/nvme/host/trace.h b/drivers/nvme/host/trace.h
+index 35bac7a254227..700fdce2ecf15 100644
+--- a/drivers/nvme/host/trace.h
++++ b/drivers/nvme/host/trace.h
+@@ -127,15 +127,12 @@ TRACE_EVENT(nvme_async_event,
+ ),
+ TP_printk("nvme%d: NVME_AEN=%#08x [%s]",
+ __entry->ctrl_id, __entry->result,
+- __print_symbolic(__entry->result,
+- aer_name(NVME_AER_NOTICE_NS_CHANGED),
+- aer_name(NVME_AER_NOTICE_ANA),
+- aer_name(NVME_AER_NOTICE_FW_ACT_STARTING),
+- aer_name(NVME_AER_NOTICE_DISC_CHANGED),
+- aer_name(NVME_AER_ERROR),
+- aer_name(NVME_AER_SMART),
+- aer_name(NVME_AER_CSS),
+- aer_name(NVME_AER_VS))
++ __print_symbolic(__entry->result & 0x7,
++ aer_name(NVME_AER_ERROR),
++ aer_name(NVME_AER_SMART),
++ aer_name(NVME_AER_NOTICE),
++ aer_name(NVME_AER_CSS),
++ aer_name(NVME_AER_VS))
+ )
+ );
+
+--
+2.39.2
+
--- /dev/null
+From 7971598401be4e45d41b5d5d206327afe010d874 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jun 2022 11:52:21 -0700
+Subject: nvme: handle the persistent internal error AER
+
+From: Michael Kelley <mikelley@microsoft.com>
+
+[ Upstream commit 2c61c97fb12b806e1c8eb15f04c277ad097ec95e ]
+
+In the NVM Express Revision 1.4 spec, Figure 145 describes possible
+values for an AER with event type "Error" (value 000b). For a
+Persistent Internal Error (value 03h), the host should perform a
+controller reset.
+
+Add support for this error using code that already exists for
+doing a controller reset. As part of this support, introduce
+two utility functions for parsing the AER type and subtype.
+
+This new support was tested in a lab environment where we can
+generate the persistent internal error on demand, and observe
+both the Linux side and NVMe controller side to see that the
+controller reset has been done.
+
+Signed-off-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 6622b76fe922 ("nvme: fix async event trace event")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 31 +++++++++++++++++++++++++++++--
+ include/linux/nvme.h | 4 ++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 029a89aead53e..fa5753de56582 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3976,9 +3976,19 @@ static void nvme_fw_act_work(struct work_struct *work)
+ nvme_get_fw_slot_info(ctrl);
+ }
+
++static u32 nvme_aer_type(u32 result)
++{
++ return result & 0x7;
++}
++
++static u32 nvme_aer_subtype(u32 result)
++{
++ return (result & 0xff00) >> 8;
++}
++
+ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ {
+- u32 aer_notice_type = (result & 0xff00) >> 8;
++ u32 aer_notice_type = nvme_aer_subtype(result);
+
+ trace_nvme_async_event(ctrl, aer_notice_type);
+
+@@ -4011,11 +4021,19 @@ static void nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
+ }
+ }
+
++static void nvme_handle_aer_persistent_error(struct nvme_ctrl *ctrl)
++{
++ trace_nvme_async_event(ctrl, NVME_AER_ERROR);
++ dev_warn(ctrl->device, "resetting controller due to AER\n");
++ nvme_reset_ctrl(ctrl);
++}
++
+ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ volatile union nvme_result *res)
+ {
+ u32 result = le32_to_cpu(res->u32);
+- u32 aer_type = result & 0x07;
++ u32 aer_type = nvme_aer_type(result);
++ u32 aer_subtype = nvme_aer_subtype(result);
+
+ if (le16_to_cpu(status) >> 1 != NVME_SC_SUCCESS)
+ return;
+@@ -4025,6 +4043,15 @@ void nvme_complete_async_event(struct nvme_ctrl *ctrl, __le16 status,
+ nvme_handle_aen_notice(ctrl, result);
+ break;
+ case NVME_AER_ERROR:
++ /*
++ * For a persistent internal error, don't run async_event_work
++ * to submit a new AER. The controller reset will do it.
++ */
++ if (aer_subtype == NVME_AER_ERROR_PERSIST_INT_ERR) {
++ nvme_handle_aer_persistent_error(ctrl);
++ return;
++ }
++ fallthrough;
+ case NVME_AER_SMART:
+ case NVME_AER_CSS:
+ case NVME_AER_VS:
+diff --git a/include/linux/nvme.h b/include/linux/nvme.h
+index ff0ee07b1e8f4..dd2801c28b99c 100644
+--- a/include/linux/nvme.h
++++ b/include/linux/nvme.h
+@@ -522,6 +522,10 @@ enum {
+ NVME_AER_VS = 7,
+ };
+
++enum {
++ NVME_AER_ERROR_PERSIST_INT_ERR = 0x03,
++};
++
+ enum {
+ NVME_AER_NOTICE_NS_CHANGED = 0x00,
+ NVME_AER_NOTICE_FW_ACT_STARTING = 0x01,
+--
+2.39.2
+
--- /dev/null
+From 98e505fce42c58443bbb281db8c89525ba80ba1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 18:21:09 +0100
+Subject: of: Fix modalias string generation
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit b19a4266c52de78496fe40f0b37580a3b762e67d ]
+
+The helper generating an OF based modalias (of_device_get_modalias())
+works fine, but due to the use of snprintf() internally it needs a
+buffer one byte longer than what should be needed just for the entire
+string (excluding the '\0'). Most users of this helper are sysfs hooks
+providing the modalias string to users. They all provide a PAGE_SIZE
+buffer which is way above the number of bytes required to fit the
+modalias string and hence do not suffer from this issue.
+
+There is another user though, of_device_request_module(), which is only
+called by drivers/usb/common/ulpi.c. This request module function is
+faulty, but maybe because in most cases there is an alternative, ULPI
+driver users have not noticed it.
+
+In this function, of_device_get_modalias() is called twice. The first
+time without buffer just to get the number of bytes required by the
+modalias string (excluding the null byte), and a second time, after
+buffer allocation, to fill the buffer. The allocation asks for an
+additional byte, in order to store the trailing '\0'. However, the
+buffer *length* provided to of_device_get_modalias() excludes this extra
+byte. The internal use of snprintf() with a length that is exactly the
+number of bytes to be written has the effect of using the last available
+byte to store a '\0', which then smashes the last character of the
+modalias string.
+
+Provide the actual size of the buffer to of_device_get_modalias() to fix
+this issue.
+
+Note: the "str[size - 1] = '\0';" line is not really needed as snprintf
+will anyway end the string with a null byte, but there is a possibility
+that this function might be called on a struct device_node without
+compatible, in this case snprintf() would not be executed. So we keep it
+just to avoid possible unbounded strings.
+
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Peter Chen <peter.chen@kernel.org>
+Fixes: 9c829c097f2f ("of: device: Support loading a module with OF based modalias")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230404172148.82422-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/device.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index da81583920103..7fb870097a849 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -246,12 +246,15 @@ int of_device_request_module(struct device *dev)
+ if (size < 0)
+ return size;
+
+- str = kmalloc(size + 1, GFP_KERNEL);
++ /* Reserve an additional byte for the trailing '\0' */
++ size++;
++
++ str = kmalloc(size, GFP_KERNEL);
+ if (!str)
+ return -ENOMEM;
+
+ of_device_get_modalias(dev, str, size);
+- str[size] = '\0';
++ str[size - 1] = '\0';
+ ret = request_module(str);
+ kfree(str);
+
+--
+2.39.2
+
--- /dev/null
+From 446d45209762924a7cf8bfb93c4163e20231f06f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Feb 2023 19:14:06 +0900
+Subject: openrisc: Properly store r31 to pt_regs on unhandled exceptions
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 812489ac4dd91144a74ce65ecf232252a2e406fb ]
+
+In commit 91993c8c2ed5 ("openrisc: use shadow registers to save regs on
+exception") the unhandled exception path was changed to do an early
+store of r30 instead of r31. The entry code was not updated and r31 is
+not getting stored to pt_regs.
+
+This patch updates the entry handler to store r31 instead of r30. We
+also remove some misleading commented out store r30 and r31
+instructrions.
+
+I noticed this while working on adding floating point exception
+handling, This issue probably would never impact anything since we kill
+the process or Oops right away on unhandled exceptions.
+
+Fixes: 91993c8c2ed5 ("openrisc: use shadow registers to save regs on exception")
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index 6b27cf4a0d786..8db433947d393 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -173,7 +173,6 @@ handler: ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+ /* r30 already save */ ;\
+-/* l.sw PT_GPR30(r1),r30*/ ;\
+ l.sw PT_GPR31(r1),r31 ;\
+ TRACE_IRQS_OFF_ENTRY ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+@@ -211,9 +210,8 @@ handler: ;\
+ l.sw PT_GPR27(r1),r27 ;\
+ l.sw PT_GPR28(r1),r28 ;\
+ l.sw PT_GPR29(r1),r29 ;\
+- /* r31 already saved */ ;\
+- l.sw PT_GPR30(r1),r30 ;\
+-/* l.sw PT_GPR31(r1),r31 */ ;\
++ /* r30 already saved */ ;\
++ l.sw PT_GPR31(r1),r31 ;\
+ /* Store -1 in orig_gpr11 for non-syscall exceptions */ ;\
+ l.addi r30,r0,-1 ;\
+ l.sw PT_ORIG_GPR11(r1),r30 ;\
+--
+2.39.2
+
--- /dev/null
+From 68d4695314cc9abe473a4b7415bf1b568c694a93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 17:56:31 +0100
+Subject: PCI: imx6: Install the fault handler only on compatible match
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 5f5ac460dfe7f4e11f99de9870f240e39189cf72 ]
+
+commit bb38919ec56e ("PCI: imx6: Add support for i.MX6 PCIe controller")
+added a fault hook to this driver in the probe function. So it was only
+installed if needed.
+
+commit bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO")
+moved it from probe to driver init which installs the hook unconditionally
+as soon as the driver is compiled into a kernel.
+
+When this driver is compiled as a module, the hook is not registered
+until after the driver has been matched with a .compatible and
+loaded.
+
+commit 415b6185c541 ("PCI: imx6: Fix config read timeout handling")
+extended the fault handling code.
+
+commit 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ")
+added some protection for non-ARM architectures, but this does not
+protect non-i.MX ARM architectures.
+
+Since fault handlers can be triggered on any architecture for different
+reasons, there is no guarantee that they will be triggered only for the
+assumed situation, leading to improper error handling (i.MX6-specific
+imx6q_pcie_abort_handler) on foreign systems.
+
+I had seen strange L3 imprecise external abort messages several times on
+OMAP4 and OMAP5 devices and couldn't make sense of them until I realized
+they were related to this unused imx6q driver because I had
+CONFIG_PCI_IMX6=y.
+
+Note that CONFIG_PCI_IMX6=y is useful for kernel binaries that are designed
+to run on different ARM SoC and be differentiated only by device tree
+binaries. So turning off CONFIG_PCI_IMX6 is not a solution.
+
+Therefore we check the compatible in the init function before registering
+the fault handler.
+
+Link: https://lore.kernel.org/r/e1bcfc3078c82b53aa9b78077a89955abe4ea009.1678380991.git.hns@goldelico.com
+Fixes: bde4a5a00e76 ("PCI: imx6: Allow probe deferral by reset GPIO")
+Fixes: 415b6185c541 ("PCI: imx6: Fix config read timeout handling")
+Fixes: 2d8ed461dbc9 ("PCI: imx6: Add support for i.MX8MQ")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Richard Zhu <hongxing.zhu@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
+index b34b52b364d5f..30c259f63239d 100644
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -1295,6 +1295,13 @@ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_SYNOPSYS, 0xabcd,
+ static int __init imx6_pcie_init(void)
+ {
+ #ifdef CONFIG_ARM
++ struct device_node *np;
++
++ np = of_find_matching_node(NULL, imx6_pcie_of_match);
++ if (!np)
++ return -ENODEV;
++ of_node_put(np);
++
+ /*
+ * Since probe() can be deferred we need to make sure that
+ * hook_fault_code is not called after __init memory is freed
+--
+2.39.2
+
--- /dev/null
+From 59eb16693eece509d4a070529440dff26f8d4a7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 10:35:08 +0800
+Subject: perf/core: Fix hardlockup failure caused by perf throttle
+
+From: Yang Jihong <yangjihong1@huawei.com>
+
+[ Upstream commit 15def34e2635ab7e0e96f1bc32e1b69609f14942 ]
+
+commit e050e3f0a71bf ("perf: Fix broken interrupt rate throttling")
+introduces a change in throttling threshold judgment. Before this,
+compare hwc->interrupts and max_samples_per_tick, then increase
+hwc->interrupts by 1, but this commit reverses order of these two
+behaviors, causing the semantics of max_samples_per_tick to change.
+In literal sense of "max_samples_per_tick", if hwc->interrupts ==
+max_samples_per_tick, it should not be throttled, therefore, the judgment
+condition should be changed to "hwc->interrupts > max_samples_per_tick".
+
+In fact, this may cause the hardlockup to fail, The minimum value of
+max_samples_per_tick may be 1, in this case, the return value of
+__perf_event_account_interrupt function is 1.
+As a result, nmi_watchdog gets throttled, which would stop PMU (Use x86
+architecture as an example, see x86_pmu_handle_irq).
+
+Fixes: e050e3f0a71b ("perf: Fix broken interrupt rate throttling")
+Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20230227023508.102230-1-yangjihong1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 1ef924d6a385e..41a8a5f749409 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -8166,8 +8166,8 @@ __perf_event_account_interrupt(struct perf_event *event, int throttle)
+ hwc->interrupts = 1;
+ } else {
+ hwc->interrupts++;
+- if (unlikely(throttle
+- && hwc->interrupts >= max_samples_per_tick)) {
++ if (unlikely(throttle &&
++ hwc->interrupts > max_samples_per_tick)) {
+ __this_cpu_inc(perf_throttled_count);
+ tick_dep_set_cpu(smp_processor_id(), TICK_DEP_BIT_PERF_EVENTS);
+ hwc->interrupts = MAX_INTERRUPTS;
+--
+2.39.2
+
--- /dev/null
+From 2a7523904f7e958aa2b50770a46e0013043da1e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Nov 2022 19:16:34 +0800
+Subject: phy: tegra: xusb: Add missing tegra_xusb_port_unregister for
+ usb2_port and ulpi_port
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+[ Upstream commit e024854048e733391b31fe5a398704b31b9af803 ]
+
+The tegra_xusb_port_unregister should be called when usb2_port
+and ulpi_port map fails in tegra_xusb_add_usb2_port() or in
+tegra_xusb_add_ulpi_port(), fix it.
+
+Fixes: 53d2a715c240 ("phy: Add Tegra XUSB pad controller support")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Link: https://lore.kernel.org/r/20221129111634.1547747-1-cuigaosheng1@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/tegra/xusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index bf5d80b97597b..efe7abf459fda 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -606,6 +606,7 @@ static int tegra_xusb_add_usb2_port(struct tegra_xusb_padctl *padctl,
+ usb2->base.lane = usb2->base.ops->map(&usb2->base);
+ if (IS_ERR(usb2->base.lane)) {
+ err = PTR_ERR(usb2->base.lane);
++ tegra_xusb_port_unregister(&usb2->base);
+ goto out;
+ }
+
+@@ -658,6 +659,7 @@ static int tegra_xusb_add_ulpi_port(struct tegra_xusb_padctl *padctl,
+ ulpi->base.lane = ulpi->base.ops->map(&ulpi->base);
+ if (IS_ERR(ulpi->base.lane)) {
+ err = PTR_ERR(ulpi->base.lane);
++ tegra_xusb_port_unregister(&ulpi->base);
+ goto out;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From e5798cade24489d251923d9794914d0b23e4686b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jul 2020 16:32:13 -0700
+Subject: PM: domains: Fix up terminology with parent/child
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 8d87ae48ced2dffd5e7247d19eb4c88be6f1c6f1 ]
+
+The genpd infrastructure uses the terms master/slave, but such uses have
+no external exposures (not even in Documentation/driver-api/pm/*) and are
+not mandated by nor associated with any external specifications. Change
+the language used through-out to parent/child.
+
+There was one possible exception in the debugfs node
+"pm_genpd/pm_genpd_summary" but its path has no hits outside of the
+kernel itself when performing a code search[1], and it seems even this
+single usage has been non-functional since it was introduced due to a
+typo in the Python ("apend" instead of correct "append"). Fix the typo
+while we're at it.
+
+Link: https://codesearch.debian.net/ # [1]
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Stable-dep-of: f19c3c2959e4 ("scripts/gdb: bail early if there are no generic PD")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/domain.c | 194 +++++++++++++--------------
+ drivers/base/power/domain_governor.c | 12 +-
+ include/linux/pm_domain.h | 12 +-
+ scripts/gdb/linux/genpd.py | 12 +-
+ 4 files changed, 115 insertions(+), 115 deletions(-)
+
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index 4f63a8bc72604..edb791354421b 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -263,18 +263,18 @@ static int _genpd_reeval_performance_state(struct generic_pm_domain *genpd,
+ /*
+ * Traverse all sub-domains within the domain. This can be
+ * done without any additional locking as the link->performance_state
+- * field is protected by the master genpd->lock, which is already taken.
++ * field is protected by the parent genpd->lock, which is already taken.
+ *
+ * Also note that link->performance_state (subdomain's performance state
+- * requirement to master domain) is different from
+- * link->slave->performance_state (current performance state requirement
++ * requirement to parent domain) is different from
++ * link->child->performance_state (current performance state requirement
+ * of the devices/sub-domains of the subdomain) and so can have a
+ * different value.
+ *
+ * Note that we also take vote from powered-off sub-domains into account
+ * as the same is done for devices right now.
+ */
+- list_for_each_entry(link, &genpd->master_links, master_node) {
++ list_for_each_entry(link, &genpd->parent_links, parent_node) {
+ if (link->performance_state > state)
+ state = link->performance_state;
+ }
+@@ -285,40 +285,40 @@ static int _genpd_reeval_performance_state(struct generic_pm_domain *genpd,
+ static int _genpd_set_performance_state(struct generic_pm_domain *genpd,
+ unsigned int state, int depth)
+ {
+- struct generic_pm_domain *master;
++ struct generic_pm_domain *parent;
+ struct gpd_link *link;
+- int master_state, ret;
++ int parent_state, ret;
+
+ if (state == genpd->performance_state)
+ return 0;
+
+- /* Propagate to masters of genpd */
+- list_for_each_entry(link, &genpd->slave_links, slave_node) {
+- master = link->master;
++ /* Propagate to parents of genpd */
++ list_for_each_entry(link, &genpd->child_links, child_node) {
++ parent = link->parent;
+
+- if (!master->set_performance_state)
++ if (!parent->set_performance_state)
+ continue;
+
+- /* Find master's performance state */
++ /* Find parent's performance state */
+ ret = dev_pm_opp_xlate_performance_state(genpd->opp_table,
+- master->opp_table,
++ parent->opp_table,
+ state);
+ if (unlikely(ret < 0))
+ goto err;
+
+- master_state = ret;
++ parent_state = ret;
+
+- genpd_lock_nested(master, depth + 1);
++ genpd_lock_nested(parent, depth + 1);
+
+ link->prev_performance_state = link->performance_state;
+- link->performance_state = master_state;
+- master_state = _genpd_reeval_performance_state(master,
+- master_state);
+- ret = _genpd_set_performance_state(master, master_state, depth + 1);
++ link->performance_state = parent_state;
++ parent_state = _genpd_reeval_performance_state(parent,
++ parent_state);
++ ret = _genpd_set_performance_state(parent, parent_state, depth + 1);
+ if (ret)
+ link->performance_state = link->prev_performance_state;
+
+- genpd_unlock(master);
++ genpd_unlock(parent);
+
+ if (ret)
+ goto err;
+@@ -333,26 +333,26 @@ static int _genpd_set_performance_state(struct generic_pm_domain *genpd,
+
+ err:
+ /* Encountered an error, lets rollback */
+- list_for_each_entry_continue_reverse(link, &genpd->slave_links,
+- slave_node) {
+- master = link->master;
++ list_for_each_entry_continue_reverse(link, &genpd->child_links,
++ child_node) {
++ parent = link->parent;
+
+- if (!master->set_performance_state)
++ if (!parent->set_performance_state)
+ continue;
+
+- genpd_lock_nested(master, depth + 1);
++ genpd_lock_nested(parent, depth + 1);
+
+- master_state = link->prev_performance_state;
+- link->performance_state = master_state;
++ parent_state = link->prev_performance_state;
++ link->performance_state = parent_state;
+
+- master_state = _genpd_reeval_performance_state(master,
+- master_state);
+- if (_genpd_set_performance_state(master, master_state, depth + 1)) {
++ parent_state = _genpd_reeval_performance_state(parent,
++ parent_state);
++ if (_genpd_set_performance_state(parent, parent_state, depth + 1)) {
+ pr_err("%s: Failed to roll back to %d performance state\n",
+- master->name, master_state);
++ parent->name, parent_state);
+ }
+
+- genpd_unlock(master);
++ genpd_unlock(parent);
+ }
+
+ return ret;
+@@ -552,7 +552,7 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on,
+
+ /*
+ * If sd_count > 0 at this point, one of the subdomains hasn't
+- * managed to call genpd_power_on() for the master yet after
++ * managed to call genpd_power_on() for the parent yet after
+ * incrementing it. In that case genpd_power_on() will wait
+ * for us to drop the lock, so we can call .power_off() and let
+ * the genpd_power_on() restore power for us (this shouldn't
+@@ -566,22 +566,22 @@ static int genpd_power_off(struct generic_pm_domain *genpd, bool one_dev_on,
+ genpd->status = GPD_STATE_POWER_OFF;
+ genpd_update_accounting(genpd);
+
+- list_for_each_entry(link, &genpd->slave_links, slave_node) {
+- genpd_sd_counter_dec(link->master);
+- genpd_lock_nested(link->master, depth + 1);
+- genpd_power_off(link->master, false, depth + 1);
+- genpd_unlock(link->master);
++ list_for_each_entry(link, &genpd->child_links, child_node) {
++ genpd_sd_counter_dec(link->parent);
++ genpd_lock_nested(link->parent, depth + 1);
++ genpd_power_off(link->parent, false, depth + 1);
++ genpd_unlock(link->parent);
+ }
+
+ return 0;
+ }
+
+ /**
+- * genpd_power_on - Restore power to a given PM domain and its masters.
++ * genpd_power_on - Restore power to a given PM domain and its parents.
+ * @genpd: PM domain to power up.
+ * @depth: nesting count for lockdep.
+ *
+- * Restore power to @genpd and all of its masters so that it is possible to
++ * Restore power to @genpd and all of its parents so that it is possible to
+ * resume a device belonging to it.
+ */
+ static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth)
+@@ -594,20 +594,20 @@ static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth)
+
+ /*
+ * The list is guaranteed not to change while the loop below is being
+- * executed, unless one of the masters' .power_on() callbacks fiddles
++ * executed, unless one of the parents' .power_on() callbacks fiddles
+ * with it.
+ */
+- list_for_each_entry(link, &genpd->slave_links, slave_node) {
+- struct generic_pm_domain *master = link->master;
++ list_for_each_entry(link, &genpd->child_links, child_node) {
++ struct generic_pm_domain *parent = link->parent;
+
+- genpd_sd_counter_inc(master);
++ genpd_sd_counter_inc(parent);
+
+- genpd_lock_nested(master, depth + 1);
+- ret = genpd_power_on(master, depth + 1);
+- genpd_unlock(master);
++ genpd_lock_nested(parent, depth + 1);
++ ret = genpd_power_on(parent, depth + 1);
++ genpd_unlock(parent);
+
+ if (ret) {
+- genpd_sd_counter_dec(master);
++ genpd_sd_counter_dec(parent);
+ goto err;
+ }
+ }
+@@ -623,12 +623,12 @@ static int genpd_power_on(struct generic_pm_domain *genpd, unsigned int depth)
+
+ err:
+ list_for_each_entry_continue_reverse(link,
+- &genpd->slave_links,
+- slave_node) {
+- genpd_sd_counter_dec(link->master);
+- genpd_lock_nested(link->master, depth + 1);
+- genpd_power_off(link->master, false, depth + 1);
+- genpd_unlock(link->master);
++ &genpd->child_links,
++ child_node) {
++ genpd_sd_counter_dec(link->parent);
++ genpd_lock_nested(link->parent, depth + 1);
++ genpd_power_off(link->parent, false, depth + 1);
++ genpd_unlock(link->parent);
+ }
+
+ return ret;
+@@ -943,13 +943,13 @@ static bool genpd_present(const struct generic_pm_domain *genpd)
+ #ifdef CONFIG_PM_SLEEP
+
+ /**
+- * genpd_sync_power_off - Synchronously power off a PM domain and its masters.
++ * genpd_sync_power_off - Synchronously power off a PM domain and its parents.
+ * @genpd: PM domain to power off, if possible.
+ * @use_lock: use the lock.
+ * @depth: nesting count for lockdep.
+ *
+ * Check if the given PM domain can be powered off (during system suspend or
+- * hibernation) and do that if so. Also, in that case propagate to its masters.
++ * hibernation) and do that if so. Also, in that case propagate to its parents.
+ *
+ * This function is only called in "noirq" and "syscore" stages of system power
+ * transitions. The "noirq" callbacks may be executed asynchronously, thus in
+@@ -974,21 +974,21 @@ static void genpd_sync_power_off(struct generic_pm_domain *genpd, bool use_lock,
+
+ genpd->status = GPD_STATE_POWER_OFF;
+
+- list_for_each_entry(link, &genpd->slave_links, slave_node) {
+- genpd_sd_counter_dec(link->master);
++ list_for_each_entry(link, &genpd->child_links, child_node) {
++ genpd_sd_counter_dec(link->parent);
+
+ if (use_lock)
+- genpd_lock_nested(link->master, depth + 1);
++ genpd_lock_nested(link->parent, depth + 1);
+
+- genpd_sync_power_off(link->master, use_lock, depth + 1);
++ genpd_sync_power_off(link->parent, use_lock, depth + 1);
+
+ if (use_lock)
+- genpd_unlock(link->master);
++ genpd_unlock(link->parent);
+ }
+ }
+
+ /**
+- * genpd_sync_power_on - Synchronously power on a PM domain and its masters.
++ * genpd_sync_power_on - Synchronously power on a PM domain and its parents.
+ * @genpd: PM domain to power on.
+ * @use_lock: use the lock.
+ * @depth: nesting count for lockdep.
+@@ -1005,16 +1005,16 @@ static void genpd_sync_power_on(struct generic_pm_domain *genpd, bool use_lock,
+ if (genpd_status_on(genpd))
+ return;
+
+- list_for_each_entry(link, &genpd->slave_links, slave_node) {
+- genpd_sd_counter_inc(link->master);
++ list_for_each_entry(link, &genpd->child_links, child_node) {
++ genpd_sd_counter_inc(link->parent);
+
+ if (use_lock)
+- genpd_lock_nested(link->master, depth + 1);
++ genpd_lock_nested(link->parent, depth + 1);
+
+- genpd_sync_power_on(link->master, use_lock, depth + 1);
++ genpd_sync_power_on(link->parent, use_lock, depth + 1);
+
+ if (use_lock)
+- genpd_unlock(link->master);
++ genpd_unlock(link->parent);
+ }
+
+ _genpd_power_on(genpd, false);
+@@ -1454,12 +1454,12 @@ static void genpd_update_cpumask(struct generic_pm_domain *genpd,
+ if (!genpd_is_cpu_domain(genpd))
+ return;
+
+- list_for_each_entry(link, &genpd->slave_links, slave_node) {
+- struct generic_pm_domain *master = link->master;
++ list_for_each_entry(link, &genpd->child_links, child_node) {
++ struct generic_pm_domain *parent = link->parent;
+
+- genpd_lock_nested(master, depth + 1);
+- genpd_update_cpumask(master, cpu, set, depth + 1);
+- genpd_unlock(master);
++ genpd_lock_nested(parent, depth + 1);
++ genpd_update_cpumask(parent, cpu, set, depth + 1);
++ genpd_unlock(parent);
+ }
+
+ if (set)
+@@ -1647,17 +1647,17 @@ static int genpd_add_subdomain(struct generic_pm_domain *genpd,
+ goto out;
+ }
+
+- list_for_each_entry(itr, &genpd->master_links, master_node) {
+- if (itr->slave == subdomain && itr->master == genpd) {
++ list_for_each_entry(itr, &genpd->parent_links, parent_node) {
++ if (itr->child == subdomain && itr->parent == genpd) {
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+
+- link->master = genpd;
+- list_add_tail(&link->master_node, &genpd->master_links);
+- link->slave = subdomain;
+- list_add_tail(&link->slave_node, &subdomain->slave_links);
++ link->parent = genpd;
++ list_add_tail(&link->parent_node, &genpd->parent_links);
++ link->child = subdomain;
++ list_add_tail(&link->child_node, &subdomain->child_links);
+ if (genpd_status_on(subdomain))
+ genpd_sd_counter_inc(genpd);
+
+@@ -1671,7 +1671,7 @@ static int genpd_add_subdomain(struct generic_pm_domain *genpd,
+
+ /**
+ * pm_genpd_add_subdomain - Add a subdomain to an I/O PM domain.
+- * @genpd: Master PM domain to add the subdomain to.
++ * @genpd: Leader PM domain to add the subdomain to.
+ * @subdomain: Subdomain to be added.
+ */
+ int pm_genpd_add_subdomain(struct generic_pm_domain *genpd,
+@@ -1689,7 +1689,7 @@ EXPORT_SYMBOL_GPL(pm_genpd_add_subdomain);
+
+ /**
+ * pm_genpd_remove_subdomain - Remove a subdomain from an I/O PM domain.
+- * @genpd: Master PM domain to remove the subdomain from.
++ * @genpd: Leader PM domain to remove the subdomain from.
+ * @subdomain: Subdomain to be removed.
+ */
+ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
+@@ -1704,19 +1704,19 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd,
+ genpd_lock(subdomain);
+ genpd_lock_nested(genpd, SINGLE_DEPTH_NESTING);
+
+- if (!list_empty(&subdomain->master_links) || subdomain->device_count) {
++ if (!list_empty(&subdomain->parent_links) || subdomain->device_count) {
+ pr_warn("%s: unable to remove subdomain %s\n",
+ genpd->name, subdomain->name);
+ ret = -EBUSY;
+ goto out;
+ }
+
+- list_for_each_entry_safe(link, l, &genpd->master_links, master_node) {
+- if (link->slave != subdomain)
++ list_for_each_entry_safe(link, l, &genpd->parent_links, parent_node) {
++ if (link->child != subdomain)
+ continue;
+
+- list_del(&link->master_node);
+- list_del(&link->slave_node);
++ list_del(&link->parent_node);
++ list_del(&link->child_node);
+ kfree(link);
+ if (genpd_status_on(subdomain))
+ genpd_sd_counter_dec(genpd);
+@@ -1781,8 +1781,8 @@ int pm_genpd_init(struct generic_pm_domain *genpd,
+ if (IS_ERR_OR_NULL(genpd))
+ return -EINVAL;
+
+- INIT_LIST_HEAD(&genpd->master_links);
+- INIT_LIST_HEAD(&genpd->slave_links);
++ INIT_LIST_HEAD(&genpd->parent_links);
++ INIT_LIST_HEAD(&genpd->child_links);
+ INIT_LIST_HEAD(&genpd->dev_list);
+ genpd_lock_init(genpd);
+ genpd->gov = gov;
+@@ -1858,15 +1858,15 @@ static int genpd_remove(struct generic_pm_domain *genpd)
+ return -EBUSY;
+ }
+
+- if (!list_empty(&genpd->master_links) || genpd->device_count) {
++ if (!list_empty(&genpd->parent_links) || genpd->device_count) {
+ genpd_unlock(genpd);
+ pr_err("%s: unable to remove %s\n", __func__, genpd->name);
+ return -EBUSY;
+ }
+
+- list_for_each_entry_safe(link, l, &genpd->slave_links, slave_node) {
+- list_del(&link->master_node);
+- list_del(&link->slave_node);
++ list_for_each_entry_safe(link, l, &genpd->child_links, child_node) {
++ list_del(&link->parent_node);
++ list_del(&link->child_node);
+ kfree(link);
+ }
+
+@@ -2793,12 +2793,12 @@ static int genpd_summary_one(struct seq_file *s,
+
+ /*
+ * Modifications on the list require holding locks on both
+- * master and slave, so we are safe.
++ * parent and child, so we are safe.
+ * Also genpd->name is immutable.
+ */
+- list_for_each_entry(link, &genpd->master_links, master_node) {
+- seq_printf(s, "%s", link->slave->name);
+- if (!list_is_last(&link->master_node, &genpd->master_links))
++ list_for_each_entry(link, &genpd->parent_links, parent_node) {
++ seq_printf(s, "%s", link->child->name);
++ if (!list_is_last(&link->parent_node, &genpd->parent_links))
+ seq_puts(s, ", ");
+ }
+
+@@ -2826,7 +2826,7 @@ static int summary_show(struct seq_file *s, void *data)
+ struct generic_pm_domain *genpd;
+ int ret = 0;
+
+- seq_puts(s, "domain status slaves\n");
++ seq_puts(s, "domain status children\n");
+ seq_puts(s, " /device runtime status\n");
+ seq_puts(s, "----------------------------------------------------------------------\n");
+
+@@ -2881,8 +2881,8 @@ static int sub_domains_show(struct seq_file *s, void *data)
+ if (ret)
+ return -ERESTARTSYS;
+
+- list_for_each_entry(link, &genpd->master_links, master_node)
+- seq_printf(s, "%s\n", link->slave->name);
++ list_for_each_entry(link, &genpd->parent_links, parent_node)
++ seq_printf(s, "%s\n", link->child->name);
+
+ genpd_unlock(genpd);
+ return ret;
+diff --git a/drivers/base/power/domain_governor.c b/drivers/base/power/domain_governor.c
+index daa8c7689f7e6..490ed7deb99a7 100644
+--- a/drivers/base/power/domain_governor.c
++++ b/drivers/base/power/domain_governor.c
+@@ -135,8 +135,8 @@ static bool __default_power_down_ok(struct dev_pm_domain *pd,
+ *
+ * All subdomains have been powered off already at this point.
+ */
+- list_for_each_entry(link, &genpd->master_links, master_node) {
+- struct generic_pm_domain *sd = link->slave;
++ list_for_each_entry(link, &genpd->parent_links, parent_node) {
++ struct generic_pm_domain *sd = link->child;
+ s64 sd_max_off_ns = sd->max_off_time_ns;
+
+ if (sd_max_off_ns < 0)
+@@ -217,13 +217,13 @@ static bool default_power_down_ok(struct dev_pm_domain *pd)
+ }
+
+ /*
+- * We have to invalidate the cached results for the masters, so
++ * We have to invalidate the cached results for the parents, so
+ * use the observation that default_power_down_ok() is not
+- * going to be called for any master until this instance
++ * going to be called for any parent until this instance
+ * returns.
+ */
+- list_for_each_entry(link, &genpd->slave_links, slave_node)
+- link->master->max_off_time_changed = true;
++ list_for_each_entry(link, &genpd->child_links, child_node)
++ link->parent->max_off_time_changed = true;
+
+ genpd->max_off_time_ns = -1;
+ genpd->max_off_time_changed = false;
+diff --git a/include/linux/pm_domain.h b/include/linux/pm_domain.h
+index baf02ff91a31a..3dffbfa627082 100644
+--- a/include/linux/pm_domain.h
++++ b/include/linux/pm_domain.h
+@@ -95,8 +95,8 @@ struct generic_pm_domain {
+ struct device dev;
+ struct dev_pm_domain domain; /* PM domain operations */
+ struct list_head gpd_list_node; /* Node in the global PM domains list */
+- struct list_head master_links; /* Links with PM domain as a master */
+- struct list_head slave_links; /* Links with PM domain as a slave */
++ struct list_head parent_links; /* Links with PM domain as a parent */
++ struct list_head child_links;/* Links with PM domain as a child */
+ struct list_head dev_list; /* List of devices */
+ struct dev_power_governor *gov;
+ struct work_struct power_off_work;
+@@ -151,10 +151,10 @@ static inline struct generic_pm_domain *pd_to_genpd(struct dev_pm_domain *pd)
+ }
+
+ struct gpd_link {
+- struct generic_pm_domain *master;
+- struct list_head master_node;
+- struct generic_pm_domain *slave;
+- struct list_head slave_node;
++ struct generic_pm_domain *parent;
++ struct list_head parent_node;
++ struct generic_pm_domain *child;
++ struct list_head child_node;
+
+ /* Sub-domain's per-master domain performance state */
+ unsigned int performance_state;
+diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py
+index 6ca93bd2949e8..39cd1abd85590 100644
+--- a/scripts/gdb/linux/genpd.py
++++ b/scripts/gdb/linux/genpd.py
+@@ -49,17 +49,17 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary'''
+ else:
+ status_string = 'off-{}'.format(genpd['state_idx'])
+
+- slave_names = []
++ child_names = []
+ for link in list_for_each_entry(
+- genpd['master_links'],
++ genpd['parent_links'],
+ device_link_type.get_type().pointer(),
+- 'master_node'):
+- slave_names.apend(link['slave']['name'])
++ 'parent_node'):
++ child_names.append(link['child']['name'])
+
+ gdb.write('%-30s %-15s %s\n' % (
+ genpd['name'].string(),
+ status_string,
+- ', '.join(slave_names)))
++ ', '.join(child_names)))
+
+ # Print devices in domain
+ for pm_data in list_for_each_entry(genpd['dev_list'],
+@@ -70,7 +70,7 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary'''
+ gdb.write(' %-50s %s\n' % (kobj_path, rtpm_status_str(dev)))
+
+ def invoke(self, arg, from_tty):
+- gdb.write('domain status slaves\n');
++ gdb.write('domain status children\n');
+ gdb.write(' /device runtime status\n');
+ gdb.write('----------------------------------------------------------------------\n');
+ for genpd in list_for_each_entry(
+--
+2.39.2
+
--- /dev/null
+From 7a052dd0fa455ccb8c0a48e3876ea3fb1a8f2327 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 23:56:57 +0100
+Subject: power: supply: generic-adc-battery: fix unit scaling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sebastian Reichel <sre@kernel.org>
+
+[ Upstream commit 44263f50065969f2344808388bd589740f026167 ]
+
+power-supply properties are reported in µV, µA and µW.
+The IIO API provides mV, mA, mW, so the values need to
+be multiplied by 1000.
+
+Fixes: e60fea794e6e ("power: battery: Generic battery driver using IIO")
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
+Signed-off-by: Sebastian Reichel <sre@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/generic-adc-battery.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/power/supply/generic-adc-battery.c b/drivers/power/supply/generic-adc-battery.c
+index 97b0e873e87d2..c2d6378bb897d 100644
+--- a/drivers/power/supply/generic-adc-battery.c
++++ b/drivers/power/supply/generic-adc-battery.c
+@@ -138,6 +138,9 @@ static int read_channel(struct gab *adc_bat, enum power_supply_property psp,
+ result);
+ if (ret < 0)
+ pr_err("read channel error\n");
++ else
++ *result *= 1000;
++
+ return ret;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 7f648d83e6a78eb668282d4e4afc3dc333c10950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:13 -0800
+Subject: powerpc/mpc512x: fix resource printk format warning
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7538c97e2b80ff6b7a8ea2ecf16a04355461b439 ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+../arch/powerpc/platforms/512x/clock-commonclk.c: In function 'mpc5121_clk_provide_backwards_compat':
+../arch/powerpc/platforms/512x/clock-commonclk.c:989:44: error: format '%x' expects argument of type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+ 989 | snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
+ | ^~~~~~~~~ ~~~~~~~~~
+ | |
+ | resource_size_t {aka long long unsigned int}
+
+Prevents 24 such warnings.
+
+Fixes: 01f25c371658 ("clk: mpc512x: add backwards compat to the CCF code")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-2-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/512x/clock-commonclk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/platforms/512x/clock-commonclk.c b/arch/powerpc/platforms/512x/clock-commonclk.c
+index 30342b60aa63f..42c3d40355d90 100644
+--- a/arch/powerpc/platforms/512x/clock-commonclk.c
++++ b/arch/powerpc/platforms/512x/clock-commonclk.c
+@@ -984,7 +984,7 @@ static void mpc5121_clk_provide_migration_support(void)
+
+ #define NODE_PREP do { \
+ of_address_to_resource(np, 0, &res); \
+- snprintf(devname, sizeof(devname), "%08x.%s", res.start, np->name); \
++ snprintf(devname, sizeof(devname), "%pa.%s", &res.start, np->name); \
+ } while (0)
+
+ #define NODE_CHK(clkname, clkitem, regnode, regflag) do { \
+--
+2.39.2
+
--- /dev/null
+From 73e021bc793aaf1eb862de80b781233930ebc152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 15:33:41 -0600
+Subject: powerpc/rtas: use memmove for potentially overlapping buffer copy
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit 271208ee5e335cb1ad280d22784940daf7ddf820 ]
+
+Using memcpy() isn't safe when buf is identical to rtas_err_buf, which
+can happen during boot before slab is up. Full context which may not
+be obvious from the diff:
+
+ if (altbuf) {
+ buf = altbuf;
+ } else {
+ buf = rtas_err_buf;
+ if (slab_is_available())
+ buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ }
+ if (buf)
+ memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+
+This was found by inspection and I'm not aware of it causing problems
+in practice. It appears to have been introduced by commit
+033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel"); the
+old ppc64 version of this code did not have this problem.
+
+Use memmove() instead.
+
+Fixes: 033ef338b6e0 ("powerpc: Merge rtas.c into arch/powerpc/kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230220-rtas-queue-for-6-4-v1-2-010e4416f13f@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index ee810df7d522d..0793579f2bb9b 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -398,7 +398,7 @@ static char *__fetch_rtas_last_error(char *altbuf)
+ buf = kmalloc(RTAS_ERROR_LOG_MAX, GFP_ATOMIC);
+ }
+ if (buf)
+- memcpy(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
++ memmove(buf, rtas_err_buf, RTAS_ERROR_LOG_MAX);
+ }
+
+ return buf;
+--
+2.39.2
+
--- /dev/null
+From 87b56281b8f030c1cad8ff3deac635154dec9237 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:16 -0800
+Subject: powerpc/sysdev/tsi108: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 55d8bd02cc1b9f1063993b5c42c9cabf4af67dea ]
+
+Use "%pa" format specifier for resource_size_t to avoid a compiler
+printk format warning.
+
+ arch/powerpc/sysdev/tsi108_pci.c: In function 'tsi108_setup_pci':
+ include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t'
+
+Fixes: c4342ff92bed ("[POWERPC] Update mpc7448hpc2 board irq support using device tree")
+Fixes: 2b9d7467a6db ("[POWERPC] Add tsi108 pci and platform device data register function")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[mpe: Use pr_info() and unsplit string]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-5-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/tsi108_pci.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/tsi108_pci.c b/arch/powerpc/sysdev/tsi108_pci.c
+index 49f9541954f8d..3664ffcbb313c 100644
+--- a/arch/powerpc/sysdev/tsi108_pci.c
++++ b/arch/powerpc/sysdev/tsi108_pci.c
+@@ -216,9 +216,8 @@ int __init tsi108_setup_pci(struct device_node *dev, u32 cfg_phys, int primary)
+
+ (hose)->ops = &tsi108_direct_pci_ops;
+
+- printk(KERN_INFO "Found tsi108 PCI host bridge at 0x%08x. "
+- "Firmware bus number: %d->%d\n",
+- rsrc.start, hose->first_busno, hose->last_busno);
++ pr_info("Found tsi108 PCI host bridge at 0x%pa. Firmware bus number: %d->%d\n",
++ &rsrc.start, hose->first_busno, hose->last_busno);
+
+ /* Interpret the "ranges" property */
+ /* This also maps the I/O region and sets isa_io/mem_base */
+--
+2.39.2
+
--- /dev/null
+From 0dd79f74c2d6dd2f1e8a2cd1cf68c3185811e463 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Feb 2023 23:01:14 -0800
+Subject: powerpc/wii: fix resource printk format warnings
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7b69600d4da0049244e9be2f5ef5a2f8e04fcd9a ]
+
+Use "%pa" format specifier for resource_size_t to avoid compiler
+printk format warnings.
+
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c: In function 'flipper_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/flipper-pic.c:148:9: note: in expansion of macro 'pr_info'
+ 148 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+ | ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c: In function 'hlwd_pic_init':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 2 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/hlwd-pic.c:174:9: note: in expansion of macro 'pr_info'
+ 174 | pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
+ | ^~~~~~~
+
+../arch/powerpc/platforms/embedded6xx/wii.c: In function 'wii_ioremap_hw_regs':
+../include/linux/kern_levels.h:5:25: error: format '%x' expects argument of type 'unsigned int', but argument 3 has type 'resource_size_t' {aka 'long long unsigned int'} [-Werror=format=]
+../arch/powerpc/platforms/embedded6xx/wii.c:77:17: note: in expansion of macro 'pr_info'
+ 77 | pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+ | ^~~~~~~
+
+Fixes: 028ee972f032 ("powerpc: gamecube/wii: flipper interrupt controller support")
+Fixes: 9c21025c7845 ("powerpc: wii: hollywood interrupt controller support")
+Fixes: 5a7ee3198dfa ("powerpc: wii: platform support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230223070116.660-3-rdunlap@infradead.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/embedded6xx/flipper-pic.c | 2 +-
+ arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 2 +-
+ arch/powerpc/platforms/embedded6xx/wii.c | 4 ++--
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/platforms/embedded6xx/flipper-pic.c b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+index d39a9213a3e69..7dd2e2f97aae5 100644
+--- a/arch/powerpc/platforms/embedded6xx/flipper-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/flipper-pic.c
+@@ -144,7 +144,7 @@ static struct irq_domain * __init flipper_pic_init(struct device_node *np)
+ }
+ io_base = ioremap(res.start, resource_size(&res));
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __flipper_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+index de10c13de15c6..c6b492ebb7662 100644
+--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c
+@@ -173,7 +173,7 @@ static struct irq_domain *hlwd_pic_init(struct device_node *np)
+ return NULL;
+ }
+
+- pr_info("controller at 0x%08x mapped to 0x%p\n", res.start, io_base);
++ pr_info("controller at 0x%pa mapped to 0x%p\n", &res.start, io_base);
+
+ __hlwd_quiesce(io_base);
+
+diff --git a/arch/powerpc/platforms/embedded6xx/wii.c b/arch/powerpc/platforms/embedded6xx/wii.c
+index 67e48b0a164e3..c691453dfd3fe 100644
+--- a/arch/powerpc/platforms/embedded6xx/wii.c
++++ b/arch/powerpc/platforms/embedded6xx/wii.c
+@@ -89,8 +89,8 @@ static void __iomem *wii_ioremap_hw_regs(char *name, char *compatible)
+
+ hw_regs = ioremap(res.start, resource_size(&res));
+ if (hw_regs) {
+- pr_info("%s at 0x%08x mapped to 0x%p\n", name,
+- res.start, hw_regs);
++ pr_info("%s at 0x%pa mapped to 0x%p\n", name,
++ &res.start, hw_regs);
+ }
+
+ out_put:
+--
+2.39.2
+
--- /dev/null
+From 95afb9d1d58013ec5a44930957c4567c47ca361a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 20:40:43 +0000
+Subject: pstore: Revert pmsg_lock back to a normal mutex
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: John Stultz <jstultz@google.com>
+
+[ Upstream commit 5239a89b06d6b199f133bf0ffea421683187f257 ]
+
+This reverts commit 76d62f24db07f22ccf9bc18ca793c27d4ebef721.
+
+So while priority inversion on the pmsg_lock is an occasional
+problem that an rt_mutex would help with, in uses where logging
+is writing to pmsg heavily from multiple threads, the pmsg_lock
+can be heavily contended.
+
+After this change landed, it was reported that cases where the
+mutex locking overhead was commonly adding on the order of 10s
+of usecs delay had suddenly jumped to ~msec delay with rtmutex.
+
+It seems the slight differences in the locks under this level
+of contention causes the normal mutexes to utilize the spinning
+optimizations, while the rtmutexes end up in the sleeping
+slowpath (which allows additional threads to pile on trying
+to take the lock).
+
+In this case, it devolves to a worse case senerio where the lock
+acquisition and scheduling overhead dominates, and each thread
+is waiting on the order of ~ms to do ~us of work.
+
+Obviously, having tons of threads all contending on a single
+lock for logging is non-optimal, so the proper fix is probably
+reworking pstore pmsg to have per-cpu buffers so we don't have
+contention.
+
+Additionally, Steven Rostedt has provided some furhter
+optimizations for rtmutexes that improves the rtmutex spinning
+path, but at least in my testing, I still see the test tripping
+into the sleeping path on rtmutexes while utilizing the spinning
+path with mutexes.
+
+But in the short term, lets revert the change to the rt_mutex
+and go back to normal mutexes to avoid a potentially major
+performance regression. And we can work on optimizations to both
+rtmutexes and finer-grained locking for pstore pmsg in the
+future.
+
+Cc: Wei Wang <wvw@google.com>
+Cc: Midas Chien<midaschieh@google.com>
+Cc: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Anton Vorontsov <anton@enomsg.org>
+Cc: "Guilherme G. Piccoli" <gpiccoli@igalia.com>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: kernel-team@android.com
+Fixes: 76d62f24db07 ("pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion")
+Reported-by: "Chunhui Li (李春辉)" <chunhui.li@mediatek.com>
+Signed-off-by: John Stultz <jstultz@google.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230308204043.2061631-1-jstultz@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/pmsg.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/fs/pstore/pmsg.c b/fs/pstore/pmsg.c
+index 18cf94b597e05..d8542ec2f38c6 100644
+--- a/fs/pstore/pmsg.c
++++ b/fs/pstore/pmsg.c
+@@ -7,10 +7,9 @@
+ #include <linux/device.h>
+ #include <linux/fs.h>
+ #include <linux/uaccess.h>
+-#include <linux/rtmutex.h>
+ #include "internal.h"
+
+-static DEFINE_RT_MUTEX(pmsg_lock);
++static DEFINE_MUTEX(pmsg_lock);
+
+ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ size_t count, loff_t *ppos)
+@@ -29,9 +28,9 @@ static ssize_t write_pmsg(struct file *file, const char __user *buf,
+ if (!access_ok(buf, count))
+ return -EFAULT;
+
+- rt_mutex_lock(&pmsg_lock);
++ mutex_lock(&pmsg_lock);
+ ret = psinfo->write_user(&record, buf);
+- rt_mutex_unlock(&pmsg_lock);
++ mutex_unlock(&pmsg_lock);
+ return ret ? ret : count;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d81c59bcc6a7949d6fc8e0d36236d8688430fdab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Aug 2021 21:24:29 +0800
+Subject: pwm: mtk-disp: Adjust the clocks to avoid them mismatch
+
+From: Jitao Shi <jitao.shi@mediatek.com>
+
+[ Upstream commit d7a4e582587d97a586b1f7709e3bddcf35928e96 ]
+
+The clks "main" and "mm" are prepared in .probe() (and unprepared in
+.remove()). This results in the clocks being on during suspend which
+results in unnecessarily increased power consumption.
+
+Remove the clock operations from .probe() and .remove(). Add the
+clk_prepare_enable() in .enable() and the clk_disable_unprepare() in
+.disable().
+
+Signed-off-by: Jitao Shi <jitao.shi@mediatek.com>
+[thierry.reding@gmail.com: squashed in fixup patch]
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 91 +++++++++++++++++---------------------
+ 1 file changed, 41 insertions(+), 50 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index af63aaab8e153..a594a0fdddd7b 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -74,6 +74,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ u64 div, rate;
+ int err;
+
++ err = clk_prepare_enable(mdp->clk_main);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
++ return err;
++ }
++
++ err = clk_prepare_enable(mdp->clk_mm);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++ clk_disable_unprepare(mdp->clk_main);
++ return err;
++ }
++
+ /*
+ * Find period, high_width and clk_div to suit duty_ns and period_ns.
+ * Calculate proper div value to keep period value in the bound.
+@@ -87,8 +100,11 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ rate = clk_get_rate(mdp->clk_main);
+ clk_div = div_u64(rate * period_ns, NSEC_PER_SEC) >>
+ PWM_PERIOD_BIT_WIDTH;
+- if (clk_div > PWM_CLKDIV_MAX)
++ if (clk_div > PWM_CLKDIV_MAX) {
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+ return -EINVAL;
++ }
+
+ div = NSEC_PER_SEC * (clk_div + 1);
+ period = div64_u64(rate * period_ns, div);
+@@ -98,16 +114,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ high_width = div64_u64(rate * duty_ns, div);
+ value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+
+- err = clk_enable(mdp->clk_main);
+- if (err < 0)
+- return err;
+-
+- err = clk_enable(mdp->clk_mm);
+- if (err < 0) {
+- clk_disable(mdp->clk_main);
+- return err;
+- }
+-
+ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+ PWM_CLKDIV_MASK,
+ clk_div << PWM_CLKDIV_SHIFT);
+@@ -122,10 +128,21 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ mtk_disp_pwm_update_bits(mdp, mdp->data->commit,
+ mdp->data->commit_mask,
+ 0x0);
++ } else {
++ /*
++ * For MT2701, disable double buffer before writing register
++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++ */
++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++ mdp->data->bls_debug_mask,
++ mdp->data->bls_debug_mask);
++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++ mdp->data->con0_sel,
++ mdp->data->con0_sel);
+ }
+
+- clk_disable(mdp->clk_mm);
+- clk_disable(mdp->clk_main);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+
+ return 0;
+ }
+@@ -135,13 +152,16 @@ static int mtk_disp_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
+ struct mtk_disp_pwm *mdp = to_mtk_disp_pwm(chip);
+ int err;
+
+- err = clk_enable(mdp->clk_main);
+- if (err < 0)
++ err = clk_prepare_enable(mdp->clk_main);
++ if (err < 0) {
++ dev_err(chip->dev, "Can't enable mdp->clk_main: %pe\n", ERR_PTR(err));
+ return err;
++ }
+
+- err = clk_enable(mdp->clk_mm);
++ err = clk_prepare_enable(mdp->clk_mm);
+ if (err < 0) {
+- clk_disable(mdp->clk_main);
++ dev_err(chip->dev, "Can't enable mdp->clk_mm: %pe\n", ERR_PTR(err));
++ clk_disable_unprepare(mdp->clk_main);
+ return err;
+ }
+
+@@ -158,8 +178,8 @@ static void mtk_disp_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ mtk_disp_pwm_update_bits(mdp, DISP_PWM_EN, mdp->data->enable_mask,
+ 0x0);
+
+- clk_disable(mdp->clk_mm);
+- clk_disable(mdp->clk_main);
++ clk_disable_unprepare(mdp->clk_mm);
++ clk_disable_unprepare(mdp->clk_main);
+ }
+
+ static const struct pwm_ops mtk_disp_pwm_ops = {
+@@ -194,14 +214,6 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ if (IS_ERR(mdp->clk_mm))
+ return PTR_ERR(mdp->clk_mm);
+
+- ret = clk_prepare(mdp->clk_main);
+- if (ret < 0)
+- return ret;
+-
+- ret = clk_prepare(mdp->clk_mm);
+- if (ret < 0)
+- goto disable_clk_main;
+-
+ mdp->chip.dev = &pdev->dev;
+ mdp->chip.ops = &mtk_disp_pwm_ops;
+ mdp->chip.base = -1;
+@@ -209,32 +221,13 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+
+ ret = pwmchip_add(&mdp->chip);
+ if (ret < 0) {
+- dev_err(&pdev->dev, "pwmchip_add() failed: %d\n", ret);
+- goto disable_clk_mm;
++ dev_err(&pdev->dev, "pwmchip_add() failed: %pe\n", ERR_PTR(ret));
++ return ret;
+ }
+
+ platform_set_drvdata(pdev, mdp);
+
+- /*
+- * For MT2701, disable double buffer before writing register
+- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+- */
+- if (!mdp->data->has_commit) {
+- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+- mdp->data->bls_debug_mask,
+- mdp->data->bls_debug_mask);
+- mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+- mdp->data->con0_sel,
+- mdp->data->con0_sel);
+- }
+-
+ return 0;
+-
+-disable_clk_mm:
+- clk_unprepare(mdp->clk_mm);
+-disable_clk_main:
+- clk_unprepare(mdp->clk_main);
+- return ret;
+ }
+
+ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+@@ -242,8 +235,6 @@ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+ struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev);
+
+ pwmchip_remove(&mdp->chip);
+- clk_unprepare(mdp->clk_mm);
+- clk_unprepare(mdp->clk_main);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From d6c10c8d532ea3b5828458316e81399a00aff4c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Apr 2023 15:30:53 +0200
+Subject: pwm: mtk-disp: Disable shadow registers before setting backlight
+ values
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+
+[ Upstream commit 36dd7f530ae7d9ce9e853ffb8aa337de65c6600b ]
+
+If shadow registers usage is not desired, disable that before performing
+any write to CON0/1 registers in the .apply() callback, otherwise we may
+lose clkdiv or period/width updates.
+
+Fixes: cd4b45ac449a ("pwm: Add MediaTek MT2701 display PWM driver support")
+Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
+Tested-by: Alexandre Mergnat <amergnat@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index a594a0fdddd7b..327c780d433da 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -114,6 +114,19 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ high_width = div64_u64(rate * duty_ns, div);
+ value = period | (high_width << PWM_HIGH_WIDTH_SHIFT);
+
++ if (mdp->data->bls_debug && !mdp->data->has_commit) {
++ /*
++ * For MT2701, disable double buffer before writing register
++ * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
++ */
++ mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
++ mdp->data->bls_debug_mask,
++ mdp->data->bls_debug_mask);
++ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
++ mdp->data->con0_sel,
++ mdp->data->con0_sel);
++ }
++
+ mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+ PWM_CLKDIV_MASK,
+ clk_div << PWM_CLKDIV_SHIFT);
+@@ -128,17 +141,6 @@ static int mtk_disp_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ mtk_disp_pwm_update_bits(mdp, mdp->data->commit,
+ mdp->data->commit_mask,
+ 0x0);
+- } else {
+- /*
+- * For MT2701, disable double buffer before writing register
+- * and select manual mode and use PWM_PERIOD/PWM_HIGH_WIDTH.
+- */
+- mtk_disp_pwm_update_bits(mdp, mdp->data->bls_debug,
+- mdp->data->bls_debug_mask,
+- mdp->data->bls_debug_mask);
+- mtk_disp_pwm_update_bits(mdp, mdp->data->con0,
+- mdp->data->con0_sel,
+- mdp->data->con0_sel);
+ }
+
+ clk_disable_unprepare(mdp->clk_mm);
+--
+2.39.2
+
--- /dev/null
+From a920c3b70bde7e3c51a8daee857e9da0d7b11a72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jul 2021 18:28:27 +0200
+Subject: pwm: mtk-disp: Don't check the return code of pwmchip_remove()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 9b7b5736ffd5da6f8f6329ebe5f1829cbcf8afae ]
+
+pwmchip_remove() returns always 0. Don't use the value to make it
+possible to eventually change the function to return void. Also the
+driver core ignores the return value of mtk_disp_pwm_remove().
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Stable-dep-of: 36dd7f530ae7 ("pwm: mtk-disp: Disable shadow registers before setting backlight values")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-mtk-disp.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pwm/pwm-mtk-disp.c b/drivers/pwm/pwm-mtk-disp.c
+index 83b8be0209b74..af63aaab8e153 100644
+--- a/drivers/pwm/pwm-mtk-disp.c
++++ b/drivers/pwm/pwm-mtk-disp.c
+@@ -240,13 +240,12 @@ static int mtk_disp_pwm_probe(struct platform_device *pdev)
+ static int mtk_disp_pwm_remove(struct platform_device *pdev)
+ {
+ struct mtk_disp_pwm *mdp = platform_get_drvdata(pdev);
+- int ret;
+
+- ret = pwmchip_remove(&mdp->chip);
++ pwmchip_remove(&mdp->chip);
+ clk_unprepare(mdp->clk_mm);
+ clk_unprepare(mdp->clk_main);
+
+- return ret;
++ return 0;
+ }
+
+ static const struct mtk_pwm_data mt2701_pwm_data = {
+--
+2.39.2
+
--- /dev/null
+From f5b1c41b8e70b67136b265cff7813a7cfcb4c0a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 12:51:27 +0300
+Subject: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit d50b3c73f1ac20dabc53dc6e9d64ce9c79a331eb ]
+
+The ucmd->log_sq_bb_count variable is controlled by the user so this
+shift can wrap. Fix it by using check_shl_overflow() in the same way
+that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined
+behavior in hns_roce_set_user_sq_size()").
+
+Fixes: 839041329fd3 ("IB/mlx4: Sanity check userspace send queue sizes")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Link: https://lore.kernel.org/r/a8dfbd1d-c019-4556-930b-bab1ded73b10@kili.mountain
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/qp.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index bca5358f3ef29..4523eb85ec698 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -438,9 +438,13 @@ static int set_user_sq_size(struct mlx4_ib_dev *dev,
+ struct mlx4_ib_qp *qp,
+ struct mlx4_ib_create_qp *ucmd)
+ {
++ u32 cnt;
++
+ /* Sanity check SQ size before proceeding */
+- if ((1 << ucmd->log_sq_bb_count) > dev->dev->caps.max_wqes ||
+- ucmd->log_sq_stride >
++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &cnt) ||
++ cnt > dev->dev->caps.max_wqes)
++ return -EINVAL;
++ if (ucmd->log_sq_stride >
+ ilog2(roundup_pow_of_two(dev->dev->caps.max_sq_desc_sz)) ||
+ ucmd->log_sq_stride < MLX4_IB_MIN_SQ_STRIDE)
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 363ad7f4e105ffde00bb59b85d5e195aad892d1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 04:39:06 +0300
+Subject: RDMA/mlx5: Use correct device num_ports when modify DC
+
+From: Mark Zhang <markzhang@nvidia.com>
+
+[ Upstream commit 746aa3c8cb1a650ff2583497ac646e505831b9b9 ]
+
+Just like other QP types, when modify DC, the port_num should be compared
+with dev->num_ports, instead of HCA_CAP.num_ports. Otherwise Multi-port
+vHCA on DC may not work.
+
+Fixes: 776a3906b692 ("IB/mlx5: Add support for DC target QP")
+Link: https://lore.kernel.org/r/20230420013906.1244185-1-markzhang@nvidia.com
+Signed-off-by: Mark Zhang <markzhang@nvidia.com>
+Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 6edd30c92156e..51623431b879a 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -3821,7 +3821,7 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+ return -EINVAL;
+
+ if (attr->port_num == 0 ||
+- attr->port_num > MLX5_CAP_GEN(dev->mdev, num_ports)) {
++ attr->port_num > dev->num_ports) {
+ mlx5_ib_dbg(dev, "invalid port number %d. number of ports is %d\n",
+ attr->port_num, dev->num_ports);
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From b0cece5e8974b6d086ff7fc18620b927947b14c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 15:44:08 +0300
+Subject: RDMA/rdmavt: Delete unnecessary NULL check
+
+From: Natalia Petrova <n.petrova@fintech.ru>
+
+[ Upstream commit b73a0b80c69de77d8d4942abb37066531c0169b2 ]
+
+There is no need to check 'rdi->qp_dev' for NULL. The field 'qp_dev'
+is created in rvt_register_device() which will fail if the 'qp_dev'
+allocation fails in rvt_driver_qp_init(). Overwise this pointer
+doesn't changed and passed to rvt_qp_exit() by the next step.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0acb0cc7ecc1 ("IB/rdmavt: Initialize and teardown of qpn table")
+Signed-off-by: Natalia Petrova <n.petrova@fintech.ru>
+Link: https://lore.kernel.org/r/20230303124408.16685-1-n.petrova@fintech.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rdmavt/qp.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
+index e97c13967174c..905e2eaed0951 100644
+--- a/drivers/infiniband/sw/rdmavt/qp.c
++++ b/drivers/infiniband/sw/rdmavt/qp.c
+@@ -505,8 +505,6 @@ void rvt_qp_exit(struct rvt_dev_info *rdi)
+ if (qps_inuse)
+ rvt_pr_err(rdi, "QP memory leak! %u still in use\n",
+ qps_inuse);
+- if (!rdi->qp_dev)
+- return;
+
+ kfree(rdi->qp_dev->qp_table);
+ free_qpn_table(&rdi->qp_dev->qpn_table);
+--
+2.39.2
+
--- /dev/null
+From 11ef2f6c63dc5b612254cee9de511c6cd2ab226c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 01:17:51 -0800
+Subject: RDMA/siw: Fix potential page_array out of range access
+
+From: Daniil Dulov <d.dulov@aladdin.ru>
+
+[ Upstream commit 271bfcfb83a9f77cbae3d6e1a16e3c14132922f0 ]
+
+When seg is equal to MAX_ARRAY, the loop should break, otherwise
+it will result in out of range access.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: b9be6f18cf9e ("rdma/siw: transmit path")
+Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
+Link: https://lore.kernel.org/r/20230227091751.589612-1-d.dulov@aladdin.ru
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_qp_tx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/siw/siw_qp_tx.c
+index 2b5120a13e376..42d03bd1622d5 100644
+--- a/drivers/infiniband/sw/siw/siw_qp_tx.c
++++ b/drivers/infiniband/sw/siw/siw_qp_tx.c
+@@ -548,7 +548,7 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, struct socket *s)
+ data_len -= plen;
+ fp_off = 0;
+
+- if (++seg > (int)MAX_ARRAY) {
++ if (++seg >= (int)MAX_ARRAY) {
+ siw_dbg_qp(tx_qp(c_tx), "to many fragments\n");
+ siw_unmap_pages(page_array, kmap_mask);
+ wqe->processed -= c_tx->bytes_unsent;
+--
+2.39.2
+
--- /dev/null
+From 6ac8f6d27ea75628077684596318a35098947d24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Apr 2023 14:10:13 +0900
+Subject: RDMA/siw: Remove namespace check from siw_netdev_event()
+
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+
+[ Upstream commit 266e9b3475ba82212062771fdbc40be0e3c06ec8 ]
+
+syzbot is reporting that siw_netdev_event(NETDEV_UNREGISTER) cannot destroy
+siw_device created after unshare(CLONE_NEWNET) due to net namespace check.
+It seems that this check was by error there and should be removed.
+
+Reported-by: syzbot <syzbot+5e70d01ee8985ae62a3b@syzkaller.appspotmail.com>
+Link: https://syzkaller.appspot.com/bug?extid=5e70d01ee8985ae62a3b
+Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
+Suggested-by: Leon Romanovsky <leon@kernel.org>
+Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface")
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Link: https://lore.kernel.org/r/a44e9ac5-44e2-d575-9e30-02483cc7ffd1@I-love.SAKURA.ne.jp
+Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/siw/siw_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
+index dbbf8c6c16d38..a462c2fc6f311 100644
+--- a/drivers/infiniband/sw/siw/siw_main.c
++++ b/drivers/infiniband/sw/siw/siw_main.c
+@@ -472,9 +472,6 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event,
+
+ dev_dbg(&netdev->dev, "siw: event %lu\n", event);
+
+- if (dev_net(netdev) != &init_net)
+- return NOTIFY_OK;
+-
+ base_dev = ib_device_get_by_netdev(netdev, RDMA_DRIVER_SIW);
+ if (!base_dev)
+ return NOTIFY_OK;
+--
+2.39.2
+
--- /dev/null
+From fd1279bd6f0148f4822b78c76d22d458e5248be4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 14:33:54 -0700
+Subject: regulator: core: Avoid lockdep reports when resolving supplies
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit cba6cfdc7c3f1516f0d08ddfb24e689af0932573 ]
+
+An automated bot told me that there was a potential lockdep problem
+with regulators. This was on the chromeos-5.15 kernel, but I see
+nothing that would be different downstream compared to upstream. The
+bot said:
+ ============================================
+ WARNING: possible recursive locking detected
+ 5.15.104-lockdep-17461-gc1e499ed6604 #1 Not tainted
+ --------------------------------------------
+ kworker/u16:4/115 is trying to acquire lock:
+ ffffff8083110170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: create_regulator+0x398/0x7ec
+
+ but task is already holding lock:
+ ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(regulator_ww_class_mutex);
+ lock(regulator_ww_class_mutex);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+ 4 locks held by kworker/u16:4/115:
+ #0: ffffff808006a948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x520/0x1348
+ #1: ffffffc00e0a7cc0 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x55c/0x1348
+ #2: ffffff80828a2260 (&dev->mutex){....}-{3:3}, at: __device_attach_async_helper+0xd0/0x2a4
+ #3: ffffff808378e170 (regulator_ww_class_mutex){+.+.}-{3:3}, at: ww_mutex_trylock+0x3c/0x7b8
+
+ stack backtrace:
+ CPU: 2 PID: 115 Comm: kworker/u16:4 Not tainted 5.15.104-lockdep-17461-gc1e499ed6604 #1 9292e52fa83c0e23762b2b3aa1bacf5787a4d5da
+ Hardware name: Google Quackingstick (rev0+) (DT)
+ Workqueue: events_unbound async_run_entry_fn
+ Call trace:
+ dump_backtrace+0x0/0x4ec
+ show_stack+0x34/0x50
+ dump_stack_lvl+0xdc/0x11c
+ dump_stack+0x1c/0x48
+ __lock_acquire+0x16d4/0x6c74
+ lock_acquire+0x208/0x750
+ __mutex_lock_common+0x11c/0x11f8
+ ww_mutex_lock+0xc0/0x440
+ create_regulator+0x398/0x7ec
+ regulator_resolve_supply+0x654/0x7c4
+ regulator_register_resolve_supply+0x30/0x120
+ class_for_each_device+0x1b8/0x230
+ regulator_register+0x17a4/0x1f40
+ devm_regulator_register+0x60/0xd0
+ reg_fixed_voltage_probe+0x728/0xaec
+ platform_probe+0x150/0x1c8
+ really_probe+0x274/0xa20
+ __driver_probe_device+0x1dc/0x3f4
+ driver_probe_device+0x78/0x1c0
+ __device_attach_driver+0x1ac/0x2c8
+ bus_for_each_drv+0x11c/0x190
+ __device_attach_async_helper+0x1e4/0x2a4
+ async_run_entry_fn+0xa0/0x3ac
+ process_one_work+0x638/0x1348
+ worker_thread+0x4a8/0x9c4
+ kthread+0x2e4/0x3a0
+ ret_from_fork+0x10/0x20
+
+The problem was first reported soon after we made many of the
+regulators probe asynchronously, though nothing I've seen implies that
+the problems couldn't have also happened even without that.
+
+I haven't personally been able to reproduce the lockdep issue, but the
+issue does look somewhat legitimate. Specifically, it looks like in
+regulator_resolve_supply() we are holding a "rdev" lock while calling
+set_supply() -> create_regulator() which grabs the lock of a
+_different_ "rdev" (the one for our supply). This is not necessarily
+safe from a lockdep perspective since there is no documented ordering
+between these two locks.
+
+In reality, we should always be locking a regulator before the
+supplying regulator, so I don't expect there to be any real deadlocks
+in practice. However, the regulator framework in general doesn't
+express this to lockdep.
+
+Let's fix the issue by simply grabbing the two locks involved in the
+same way we grab multiple locks elsewhere in the regulator framework:
+using the "wound/wait" mechanisms.
+
+Fixes: eaa7995c529b ("regulator: core: avoid regulator_resolve_supply() race condition")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230329143317.RFC.v2.2.I30d8e1ca10cfbe5403884cdd192253a2e063eb9e@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 91 ++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 83 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 1cdf924c0111b..06da271ad5dd3 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -217,6 +217,78 @@ void regulator_unlock(struct regulator_dev *rdev)
+ }
+ EXPORT_SYMBOL_GPL(regulator_unlock);
+
++/**
++ * regulator_lock_two - lock two regulators
++ * @rdev1: first regulator
++ * @rdev2: second regulator
++ * @ww_ctx: w/w mutex acquire context
++ *
++ * Locks both rdevs using the regulator_ww_class.
++ */
++static void regulator_lock_two(struct regulator_dev *rdev1,
++ struct regulator_dev *rdev2,
++ struct ww_acquire_ctx *ww_ctx)
++{
++ struct regulator_dev *tmp;
++ int ret;
++
++ ww_acquire_init(ww_ctx, ®ulator_ww_class);
++
++ /* Try to just grab both of them */
++ ret = regulator_lock_nested(rdev1, ww_ctx);
++ WARN_ON(ret);
++ ret = regulator_lock_nested(rdev2, ww_ctx);
++ if (ret != -EDEADLOCK) {
++ WARN_ON(ret);
++ goto exit;
++ }
++
++ while (true) {
++ /*
++ * Start of loop: rdev1 was locked and rdev2 was contended.
++ * Need to unlock rdev1, slowly lock rdev2, then try rdev1
++ * again.
++ */
++ regulator_unlock(rdev1);
++
++ ww_mutex_lock_slow(&rdev2->mutex, ww_ctx);
++ rdev2->ref_cnt++;
++ rdev2->mutex_owner = current;
++ ret = regulator_lock_nested(rdev1, ww_ctx);
++
++ if (ret == -EDEADLOCK) {
++ /* More contention; swap which needs to be slow */
++ tmp = rdev1;
++ rdev1 = rdev2;
++ rdev2 = tmp;
++ } else {
++ WARN_ON(ret);
++ break;
++ }
++ }
++
++exit:
++ ww_acquire_done(ww_ctx);
++}
++
++/**
++ * regulator_unlock_two - unlock two regulators
++ * @rdev1: first regulator
++ * @rdev2: second regulator
++ * @ww_ctx: w/w mutex acquire context
++ *
++ * The inverse of regulator_lock_two().
++ */
++
++static void regulator_unlock_two(struct regulator_dev *rdev1,
++ struct regulator_dev *rdev2,
++ struct ww_acquire_ctx *ww_ctx)
++{
++ regulator_unlock(rdev2);
++ regulator_unlock(rdev1);
++ ww_acquire_fini(ww_ctx);
++}
++
+ static bool regulator_supply_is_couple(struct regulator_dev *rdev)
+ {
+ struct regulator_dev *c_rdev;
+@@ -1419,8 +1491,8 @@ static int set_machine_constraints(struct regulator_dev *rdev)
+
+ /**
+ * set_supply - set regulator supply regulator
+- * @rdev: regulator name
+- * @supply_rdev: supply regulator name
++ * @rdev: regulator (locked)
++ * @supply_rdev: supply regulator (locked))
+ *
+ * Called by platform initialisation code to set the supply regulator for this
+ * regulator. This ensures that a regulators supply will also be enabled by the
+@@ -1592,6 +1664,8 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ struct regulator *regulator;
+ int err = 0;
+
++ lockdep_assert_held_once(&rdev->mutex.base);
++
+ if (dev) {
+ char buf[REG_STR_SIZE];
+ int size;
+@@ -1619,9 +1693,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
+ regulator->rdev = rdev;
+ regulator->supply_name = supply_name;
+
+- regulator_lock(rdev);
+ list_add(®ulator->list, &rdev->consumer_list);
+- regulator_unlock(rdev);
+
+ if (dev) {
+ regulator->dev = dev;
+@@ -1787,6 +1859,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ {
+ struct regulator_dev *r;
+ struct device *dev = rdev->dev.parent;
++ struct ww_acquire_ctx ww_ctx;
+ int ret = 0;
+
+ /* No supply to resolve? */
+@@ -1853,23 +1926,23 @@ static int regulator_resolve_supply(struct regulator_dev *rdev)
+ * between rdev->supply null check and setting rdev->supply in
+ * set_supply() from concurrent tasks.
+ */
+- regulator_lock(rdev);
++ regulator_lock_two(rdev, r, &ww_ctx);
+
+ /* Supply just resolved by a concurrent task? */
+ if (rdev->supply) {
+- regulator_unlock(rdev);
++ regulator_unlock_two(rdev, r, &ww_ctx);
+ put_device(&r->dev);
+ goto out;
+ }
+
+ ret = set_supply(rdev, r);
+ if (ret < 0) {
+- regulator_unlock(rdev);
++ regulator_unlock_two(rdev, r, &ww_ctx);
+ put_device(&r->dev);
+ goto out;
+ }
+
+- regulator_unlock(rdev);
++ regulator_unlock_two(rdev, r, &ww_ctx);
+
+ /*
+ * In set_machine_constraints() we may have turned this regulator on
+@@ -1984,7 +2057,9 @@ struct regulator *_regulator_get(struct device *dev, const char *id,
+ return regulator;
+ }
+
++ regulator_lock(rdev);
+ regulator = create_regulator(rdev, dev, id);
++ regulator_unlock(rdev);
+ if (regulator == NULL) {
+ regulator = ERR_PTR(-ENOMEM);
+ module_put(rdev->owner);
+--
+2.39.2
+
--- /dev/null
+From 064dc52130a2222faae19e7b286a5d40519cab7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Mar 2023 14:33:53 -0700
+Subject: regulator: core: Consistently set mutex_owner when using
+ ww_mutex_lock_slow()
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit b83a1772be854f87602de14726737d3e5b06e1f4 ]
+
+When a codepath locks a rdev using ww_mutex_lock_slow() directly then
+that codepath is responsible for incrementing the "ref_cnt" and also
+setting the "mutex_owner" to "current".
+
+The regulator core consistently got that right for "ref_cnt" but
+didn't always get it right for "mutex_owner". Let's fix this.
+
+It's unlikely that this truly matters because the "mutex_owner" is
+only needed if we're going to do subsequent locking of the same
+rdev. However, even though it's not truly needed it seems less
+surprising if we consistently set "mutex_owner" properly.
+
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20230329143317.RFC.v2.1.I4e9d433ea26360c06dd1381d091c82bb1a4ce843@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 0179716f74d74..1cdf924c0111b 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -344,6 +344,7 @@ static void regulator_lock_dependent(struct regulator_dev *rdev,
+ ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx);
+ old_contended_rdev = new_contended_rdev;
+ old_contended_rdev->ref_cnt++;
++ old_contended_rdev->mutex_owner = current;
+ }
+
+ err = regulator_lock_recursive(rdev,
+@@ -5659,6 +5660,7 @@ static void regulator_summary_lock(struct ww_acquire_ctx *ww_ctx)
+ ww_mutex_lock_slow(&new_contended_rdev->mutex, ww_ctx);
+ old_contended_rdev = new_contended_rdev;
+ old_contended_rdev->ref_cnt++;
++ old_contended_rdev->mutex_owner = current;
+ }
+
+ err = regulator_summary_lock_all(ww_ctx,
+--
+2.39.2
+
--- /dev/null
+From cd1e13ccb49394ced4130d5ee829653b840a4916 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 11:35:29 +0800
+Subject: regulator: stm32-pwr: fix of_iomap leak
+
+From: YAN SHI <m202071378@hust.edu.cn>
+
+[ Upstream commit c4a413e56d16a2ae84e6d8992f215c4dcc7fac20 ]
+
+Smatch reports:
+drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn:
+'base' from of_iomap() not released on lines: 151,166.
+
+In stm32_pwr_regulator_probe(), base is not released
+when devm_kzalloc() fails to allocate memory or
+devm_regulator_register() fails to register a new regulator device,
+which may cause a leak.
+
+To fix this issue, replace of_iomap() with
+devm_platform_ioremap_resource(). devm_platform_ioremap_resource()
+is a specialized function for platform devices.
+It allows 'base' to be automatically released whether the probe
+function succeeds or fails.
+
+Besides, use IS_ERR(base) instead of !base
+as the return value of devm_platform_ioremap_resource()
+can either be a pointer to the remapped memory or
+an ERR_PTR() encoded error code if the operation fails.
+
+Fixes: dc62f951a6a8 ("regulator: stm32-pwr: Fix return value check in stm32_pwr_regulator_probe()")
+Signed-off-by: YAN SHI <m202071378@hust.edu.cn>
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/oe-kbuild-all/202304111750.o2643eJN-lkp@intel.com/
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230412033529.18890-1-m202071378@hust.edu.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/stm32-pwr.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/regulator/stm32-pwr.c b/drivers/regulator/stm32-pwr.c
+index e0e627b0106e0..b94da49923767 100644
+--- a/drivers/regulator/stm32-pwr.c
++++ b/drivers/regulator/stm32-pwr.c
+@@ -129,17 +129,16 @@ static const struct regulator_desc stm32_pwr_desc[] = {
+
+ static int stm32_pwr_regulator_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
+ struct stm32_pwr_reg *priv;
+ void __iomem *base;
+ struct regulator_dev *rdev;
+ struct regulator_config config = { };
+ int i, ret = 0;
+
+- base = of_iomap(np, 0);
+- if (!base) {
++ base = devm_platform_ioremap_resource(pdev, 0);
++ if (IS_ERR(base)) {
+ dev_err(&pdev->dev, "Unable to map IO memory\n");
+- return -ENOMEM;
++ return PTR_ERR(base);
+ }
+
+ config.dev = &pdev->dev;
+--
+2.39.2
+
--- /dev/null
+From 0a5005ead11b547f6023ede291af4c758ea55ee2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 18:30:06 +0800
+Subject: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove
+ due to unfinished work"
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit db2bf510bd5d57f064d9e1db395ed86a08320c54 ]
+
+This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f.
+
+This patch introduces a possible null-ptr-def problem. Revert it. And the
+fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth:
+btsdio: fix use after free bug in btsdio_remove due to race condition").
+
+Fixes: 1e9ac114c442 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/btsdio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
+index 81125fb180351..fd9571d5fdac9 100644
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -343,7 +343,6 @@ static void btsdio_remove(struct sdio_func *func)
+
+ BT_DBG("func %p", func);
+
+- cancel_work_sync(&data->work);
+ if (!data)
+ return;
+
+--
+2.39.2
+
--- /dev/null
+From 757a4a731e6def744e125e06cb1817768502e42f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 22:21:42 +0100
+Subject: rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 0e6255fa3f649170da6bd1a544680589cfae1131 ]
+
+The VRTC alarm register can be programmed with an amount of seconds
+after which the SoC will be woken up by the VRTC timer again. We are
+already converting the alarm time from meson_vrtc_set_alarm() to
+"seconds since 1970". This means we also need to use "seconds since
+1970" for the current time.
+
+This fixes a problem where setting the alarm to one minute in the future
+results in the firmware (which handles wakeup) to output (on the serial
+console) that the system will be woken up in billions of seconds.
+ktime_get_raw_ts64() returns the time since boot, not since 1970. Switch
+to ktime_get_real_ts64() to fix the calculation of the alarm time and to
+make the SoC wake up at the specified date/time. Also the firmware
+(which manages suspend) now prints either 59 or 60 seconds until wakeup
+(depending on how long it takes for the system to enter suspend).
+
+Fixes: 6ef35398e827 ("rtc: Add Amlogic Virtual Wake RTC")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/20230320212142.2355062-1-martin.blumenstingl@googlemail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-meson-vrtc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-meson-vrtc.c b/drivers/rtc/rtc-meson-vrtc.c
+index 89e5ba0dae69f..1cf98542578fc 100644
+--- a/drivers/rtc/rtc-meson-vrtc.c
++++ b/drivers/rtc/rtc-meson-vrtc.c
+@@ -23,7 +23,7 @@ static int meson_vrtc_read_time(struct device *dev, struct rtc_time *tm)
+ struct timespec64 time;
+
+ dev_dbg(dev, "%s\n", __func__);
+- ktime_get_raw_ts64(&time);
++ ktime_get_real_ts64(&time);
+ rtc_time64_to_tm(time.tv_sec, tm);
+
+ return 0;
+@@ -101,7 +101,7 @@ static int __maybe_unused meson_vrtc_suspend(struct device *dev)
+ long alarm_secs;
+ struct timespec64 time;
+
+- ktime_get_raw_ts64(&time);
++ ktime_get_real_ts64(&time);
+ local_time = time.tv_sec;
+
+ dev_dbg(dev, "alarm_time = %lus, local_time=%lus\n",
+--
+2.39.2
+
--- /dev/null
+From 28426b625504035c48bb3b523fcd367aca5118e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Mar 2023 10:40:21 +0100
+Subject: rtc: omap: include header for omap_rtc_power_off_program prototype
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit f69c2b5420497b7a54181ce170d682cbeb1f119f ]
+
+Non-static functions should have a prototype:
+
+ drivers/rtc/rtc-omap.c:410:5: error: no previous prototype for ‘omap_rtc_power_off_program’ [-Werror=missing-prototypes]
+
+Fixes: 6256f7f7f217 ("rtc: OMAP: Add support for rtc-only mode")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20230311094021.79730-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-omap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
+index a2941c875a064..bf502fcd60772 100644
+--- a/drivers/rtc/rtc-omap.c
++++ b/drivers/rtc/rtc-omap.c
+@@ -26,6 +26,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/rtc.h>
++#include <linux/rtc/rtc-omap.h>
+
+ /*
+ * The OMAP RTC is a year/month/day/hours/minutes/seconds BCD clock
+--
+2.39.2
+
--- /dev/null
+From 60a9dea6a3eb5d60066f379e88be058adf7aad61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 15:42:31 -0500
+Subject: rtlwifi: Replace RT_TRACE with rtl_dbg
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit f108a420e50a62e0bc5cdcd7d4a2440986b526e3 ]
+
+The macro name RT_TRACE makes it seem that it is used for tracing, when
+is actually used for debugging. Change the name to rtl_dbg. Any Sparse
+errors exposed by this change were also fixed.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200723204244.24457-3-Larry.Finger@lwfinger.net
+Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/base.c | 144 +++++-----
+ drivers/net/wireless/realtek/rtlwifi/cam.c | 82 +++---
+ drivers/net/wireless/realtek/rtlwifi/core.c | 259 ++++++++---------
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 4 +-
+ drivers/net/wireless/realtek/rtlwifi/efuse.c | 72 ++---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 282 +++++++++----------
+ drivers/net/wireless/realtek/rtlwifi/ps.c | 98 +++----
+ drivers/net/wireless/realtek/rtlwifi/regd.c | 18 +-
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 18 +-
+ 9 files changed, 488 insertions(+), 489 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c
+index c9ad6761032ae..8fb0b54738ca9 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/base.c
++++ b/drivers/net/wireless/realtek/rtlwifi/base.c
+@@ -195,8 +195,8 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
+ } else {
+ if (get_rf_type(rtlphy) == RF_1T2R ||
+ get_rf_type(rtlphy) == RF_2T2R) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "1T2R or 2T2R\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "1T2R or 2T2R\n");
+ ht_cap->mcs.rx_mask[0] = 0xFF;
+ ht_cap->mcs.rx_mask[1] = 0xFF;
+ ht_cap->mcs.rx_mask[4] = 0x01;
+@@ -204,7 +204,7 @@ static void _rtl_init_hw_ht_capab(struct ieee80211_hw *hw,
+ ht_cap->mcs.rx_highest =
+ cpu_to_le16(MAX_BIT_RATE_40MHZ_MCS15);
+ } else if (get_rf_type(rtlphy) == RF_1T1R) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "1T1R\n");
+
+ ht_cap->mcs.rx_mask[0] = 0xFF;
+ ht_cap->mcs.rx_mask[1] = 0x00;
+@@ -1324,7 +1324,7 @@ bool rtl_tx_mgmt_proc(struct ieee80211_hw *hw, struct sk_buff *skb)
+ rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+ }
+ if (ieee80211_is_auth(fc)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
+
+ mac->link_state = MAC80211_LINKING;
+ /* Dul mac */
+@@ -1385,7 +1385,7 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ if (mac->act_scanning)
+ return false;
+
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+ "%s ACT_ADDBAREQ From :%pM\n",
+ is_tx ? "Tx" : "Rx", hdr->addr2);
+ RT_PRINT_DATA(rtlpriv, COMP_INIT, DBG_DMESG, "req\n",
+@@ -1400,8 +1400,8 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ rcu_read_lock();
+ sta = rtl_find_sta(hw, hdr->addr3);
+ if (sta == NULL) {
+- RT_TRACE(rtlpriv, COMP_SEND | COMP_RECV,
+- DBG_DMESG, "sta is NULL\n");
++ rtl_dbg(rtlpriv, COMP_SEND | COMP_RECV,
++ DBG_DMESG, "sta is NULL\n");
+ rcu_read_unlock();
+ return true;
+ }
+@@ -1428,13 +1428,13 @@ bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ }
+ break;
+ case ACT_ADDBARSP:
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "%s ACT_ADDBARSP From :%pM\n",
+- is_tx ? "Tx" : "Rx", hdr->addr2);
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "%s ACT_ADDBARSP From :%pM\n",
++ is_tx ? "Tx" : "Rx", hdr->addr2);
+ break;
+ case ACT_DELBA:
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "ACT_ADDBADEL From :%pM\n", hdr->addr2);
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "ACT_ADDBADEL From :%pM\n", hdr->addr2);
+ break;
+ }
+ break;
+@@ -1519,9 +1519,9 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
+ /* 68 : UDP BOOTP client
+ * 67 : UDP BOOTP server
+ */
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV),
+- DBG_DMESG, "dhcp %s !!\n",
+- (is_tx) ? "Tx" : "Rx");
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV),
++ DBG_DMESG, "dhcp %s !!\n",
++ (is_tx) ? "Tx" : "Rx");
+
+ if (is_tx)
+ setup_special_tx(rtlpriv, ppsc,
+@@ -1540,8 +1540,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx,
+ rtlpriv->btcoexist.btc_info.in_4way = true;
+ rtlpriv->btcoexist.btc_info.in_4way_ts = jiffies;
+
+- RT_TRACE(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
+- "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx");
++ rtl_dbg(rtlpriv, (COMP_SEND | COMP_RECV), DBG_DMESG,
++ "802.1X %s EAPOL pkt!!\n", (is_tx) ? "Tx" : "Rx");
+
+ if (is_tx) {
+ rtlpriv->ra.is_special_data = true;
+@@ -1583,12 +1583,12 @@ static void rtl_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb,
+ info = IEEE80211_SKB_CB(skb);
+ ieee80211_tx_info_clear_status(info);
+ if (ack) {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
+- "tx report: ack\n");
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
++ "tx report: ack\n");
+ info->flags |= IEEE80211_TX_STAT_ACK;
+ } else {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
+- "tx report: not ack\n");
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_LOUD,
++ "tx report: not ack\n");
+ info->flags &= ~IEEE80211_TX_STAT_ACK;
+ }
+ ieee80211_tx_status_irqsafe(hw, skb);
+@@ -1626,8 +1626,8 @@ static u16 rtl_get_tx_report_sn(struct ieee80211_hw *hw,
+ tx_report->last_sent_time = jiffies;
+ tx_info->sn = sn;
+ tx_info->send_time = tx_report->last_sent_time;
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
+- "Send TX-Report sn=0x%X\n", sn);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
++ "Send TX-Report sn=0x%X\n", sn);
+
+ return sn;
+ }
+@@ -1674,9 +1674,9 @@ void rtl_tx_report_handler(struct ieee80211_hw *hw, u8 *tmp_buf, u8 c2h_cmd_len)
+ break;
+ }
+ }
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
+- "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n",
+- st, sn, retry);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_DMESG,
++ "Recv TX-Report st=0x%02X sn=0x%X retry=0x%X\n",
++ st, sn, retry);
+ }
+ EXPORT_SYMBOL_GPL(rtl_tx_report_handler);
+
+@@ -1689,9 +1689,9 @@ bool rtl_check_tx_report_acked(struct ieee80211_hw *hw)
+ return true;
+
+ if (time_before(tx_report->last_sent_time + 3 * HZ, jiffies)) {
+- RT_TRACE(rtlpriv, COMP_TX_REPORT, DBG_WARNING,
+- "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n",
+- tx_report->last_sent_sn, tx_report->last_recv_sn);
++ rtl_dbg(rtlpriv, COMP_TX_REPORT, DBG_WARNING,
++ "Check TX-Report timeout!! s_sn=0x%X r_sn=0x%X\n",
++ tx_report->last_sent_sn, tx_report->last_recv_sn);
+ return true; /* 3 sec. (timeout) seen as acked */
+ }
+
+@@ -1707,8 +1707,8 @@ void rtl_wait_tx_report_acked(struct ieee80211_hw *hw, u32 wait_ms)
+ if (rtl_check_tx_report_acked(hw))
+ break;
+ usleep_range(1000, 2000);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "Wait 1ms (%d/%d) to disable key.\n", i, wait_ms);
+ }
+ }
+
+@@ -1770,9 +1770,9 @@ int rtl_tx_agg_start(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ return -ENXIO;
+ tid_data = &sta_entry->tids[tid];
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d seq:%d\n", sta->addr, tid,
+- *ssn);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d seq:%d\n", sta->addr, tid,
++ *ssn);
+
+ tid_data->agg.agg_state = RTL_AGG_START;
+
+@@ -1789,8 +1789,8 @@ int rtl_tx_agg_stop(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1829,8 +1829,8 @@ int rtl_rx_agg_start(struct ieee80211_hw *hw,
+ return -ENXIO;
+ tid_data = &sta_entry->tids[tid];
+
+- RT_TRACE(rtlpriv, COMP_RECV, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_RECV, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ tid_data->agg.rx_agg_state = RTL_RX_AGG_START;
+ return 0;
+@@ -1845,8 +1845,8 @@ int rtl_rx_agg_stop(struct ieee80211_hw *hw,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1866,8 +1866,8 @@ int rtl_tx_agg_oper(struct ieee80211_hw *hw,
+ if (sta == NULL)
+ return -EINVAL;
+
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG,
+- "on ra = %pM tid = %d\n", sta->addr, tid);
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG,
++ "on ra = %pM tid = %d\n", sta->addr, tid);
+
+ if (unlikely(tid >= MAX_TID_COUNT))
+ return -EINVAL;
+@@ -1887,9 +1887,9 @@ void rtl_rx_ampdu_apply(struct rtl_priv *rtlpriv)
+ btc_ops->btc_get_ampdu_cfg(rtlpriv, &reject_agg,
+ &ctrl_agg_size, &agg_size);
+
+- RT_TRACE(rtlpriv, COMP_BT_COEXIST, DBG_DMESG,
+- "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d",
+- reject_agg, ctrl_agg_size, agg_size);
++ rtl_dbg(rtlpriv, COMP_BT_COEXIST, DBG_DMESG,
++ "Set RX AMPDU: coex - reject=%d, ctrl_agg_size=%d, size=%d",
++ reject_agg, ctrl_agg_size, agg_size);
+
+ rtlpriv->hw->max_rx_aggregation_subframes =
+ (ctrl_agg_size ? agg_size : IEEE80211_MAX_AMPDU_BUF_HT);
+@@ -1977,9 +1977,9 @@ void rtl_scan_list_expire(struct ieee80211_hw *hw)
+ list_del(&entry->list);
+ rtlpriv->scan_list.num--;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "BSSID=%pM is expire in scan list (total=%d)\n",
+- entry->bssid, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "BSSID=%pM is expire in scan list (total=%d)\n",
++ entry->bssid, rtlpriv->scan_list.num);
+ kfree(entry);
+ }
+
+@@ -2013,9 +2013,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ if (memcmp(entry->bssid, hdr->addr3, ETH_ALEN) == 0) {
+ list_del_init(&entry->list);
+ entry_found = true;
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "Update BSSID=%pM to scan list (total=%d)\n",
+- hdr->addr3, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "Update BSSID=%pM to scan list (total=%d)\n",
++ hdr->addr3, rtlpriv->scan_list.num);
+ break;
+ }
+ }
+@@ -2029,9 +2029,9 @@ void rtl_collect_scan_list(struct ieee80211_hw *hw, struct sk_buff *skb)
+ memcpy(entry->bssid, hdr->addr3, ETH_ALEN);
+ rtlpriv->scan_list.num++;
+
+- RT_TRACE(rtlpriv, COMP_SCAN, DBG_LOUD,
+- "Add BSSID=%pM to scan list (total=%d)\n",
+- hdr->addr3, rtlpriv->scan_list.num);
++ rtl_dbg(rtlpriv, COMP_SCAN, DBG_LOUD,
++ "Add BSSID=%pM to scan list (total=%d)\n",
++ hdr->addr3, rtlpriv->scan_list.num);
+ }
+
+ entry->age = jiffies;
+@@ -2191,8 +2191,8 @@ void rtl_watchdog_wq_callback(void *data)
+ if ((rtlpriv->link_info.bcn_rx_inperiod +
+ rtlpriv->link_info.num_rx_inperiod) == 0) {
+ rtlpriv->link_info.roam_times++;
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "AP off for %d s\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "AP off for %d s\n",
+ (rtlpriv->link_info.roam_times * 2));
+
+ /* if we can't recv beacon for 10s,
+@@ -2305,11 +2305,11 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw,
+
+ switch (cmd_id) {
+ case C2H_DBG:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "[C2H], C2H_DBG!!\n");
+ break;
+ case C2H_TXBF:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_TXBF!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_TXBF!!\n");
+ break;
+ case C2H_TX_REPORT:
+ rtl_tx_report_handler(hw, cmd_buf, cmd_len);
+@@ -2319,20 +2319,20 @@ static void rtl_c2h_content_parsing(struct ieee80211_hw *hw,
+ hal_ops->c2h_ra_report_handler(hw, cmd_buf, cmd_len);
+ break;
+ case C2H_BT_INFO:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_BT_INFO!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_BT_INFO!!\n");
+ if (rtlpriv->cfg->ops->get_btc_status())
+ btc_ops->btc_btinfo_notify(rtlpriv, cmd_buf, cmd_len);
+ break;
+ case C2H_BT_MP:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], C2H_BT_MP!!\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], C2H_BT_MP!!\n");
+ if (rtlpriv->cfg->ops->get_btc_status())
+ btc_ops->btc_btmpinfo_notify(rtlpriv, cmd_buf, cmd_len);
+ break;
+ default:
+- RT_TRACE(rtlpriv, COMP_FW, DBG_TRACE,
+- "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_TRACE,
++ "[C2H], Unknown packet!! cmd_id(%#X)!\n", cmd_id);
+ break;
+ }
+ }
+@@ -2356,8 +2356,8 @@ void rtl_c2hcmd_launcher(struct ieee80211_hw *hw, int exec)
+ if (!skb)
+ break;
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n",
+- *((u8 *)skb->cb));
++ rtl_dbg(rtlpriv, COMP_FW, DBG_DMESG, "C2H rx_desc_shift=%d\n",
++ *((u8 *)skb->cb));
+ RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_DMESG,
+ "C2H data: ", skb->data, skb->len);
+
+@@ -2702,29 +2702,29 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
+ (memcmp(mac->bssid, ap5_6, 3) == 0) ||
+ vendor == PEER_ATH) {
+ vendor = PEER_ATH;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ath find\n");
+ } else if ((memcmp(mac->bssid, ap4_4, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_5, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_1, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_2, 3) == 0) ||
+ (memcmp(mac->bssid, ap4_3, 3) == 0) ||
+ vendor == PEER_RAL) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>ral find\n");
+ vendor = PEER_RAL;
+ } else if (memcmp(mac->bssid, ap6_1, 3) == 0 ||
+ vendor == PEER_CISCO) {
+ vendor = PEER_CISCO;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>cisco find\n");
+ } else if ((memcmp(mac->bssid, ap3_1, 3) == 0) ||
+ (memcmp(mac->bssid, ap3_2, 3) == 0) ||
+ (memcmp(mac->bssid, ap3_3, 3) == 0) ||
+ vendor == PEER_BROAD) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>broad find\n");
+ vendor = PEER_BROAD;
+ } else if (memcmp(mac->bssid, ap7_1, 3) == 0 ||
+ vendor == PEER_MARV) {
+ vendor = PEER_MARV;
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "=>marv find\n");
+ }
+
+ mac->vendor = vendor;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/cam.c b/drivers/net/wireless/realtek/rtlwifi/cam.c
+index bf0e0bb1f99ba..7aa28da39409b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/cam.c
++++ b/drivers/net/wireless/realtek/rtlwifi/cam.c
+@@ -43,14 +43,14 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE %x: %x\n",
+- rtlpriv->cfg->maps[WCAMI], target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "The Key ID is %d\n", entry_no);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE %x: %x\n",
+- rtlpriv->cfg->maps[RWCAM], target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE %x: %x\n",
++ rtlpriv->cfg->maps[WCAMI], target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "The Key ID is %d\n", entry_no);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE %x: %x\n",
++ rtlpriv->cfg->maps[RWCAM], target_command);
+
+ } else if (entry_i == 1) {
+
+@@ -64,10 +64,10 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A4: %x\n", target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A0: %x\n", target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A4: %x\n", target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A0: %x\n", target_command);
+
+ } else {
+
+@@ -83,15 +83,15 @@ static void rtl_cam_program_entry(struct ieee80211_hw *hw, u32 entry_no,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM],
+ target_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A4: %x\n", target_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "WRITE A0: %x\n", target_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A4: %x\n", target_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "WRITE A0: %x\n", target_command);
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "after set key, usconfig:%x\n", us_config);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "after set key, usconfig:%x\n", us_config);
+ }
+
+ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+@@ -101,14 +101,14 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+ u32 us_config;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n",
+- ul_entry_idx, ul_key_id, ul_enc_alg,
+- ul_default_key, mac_addr);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "EntryNo:%x, ulKeyId=%x, ulEncAlg=%x, ulUseDK=%x MacAddr %pM\n",
++ ul_entry_idx, ul_key_id, ul_enc_alg,
++ ul_default_key, mac_addr);
+
+ if (ul_key_id == TOTAL_CAM_ENTRY) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "ulKeyId exceed!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "ulKeyId exceed!\n");
+ return 0;
+ }
+
+@@ -120,7 +120,7 @@ u8 rtl_cam_add_one_entry(struct ieee80211_hw *hw, u8 *mac_addr,
+ rtl_cam_program_entry(hw, ul_entry_idx, mac_addr,
+ (u8 *)key_content, us_config);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "end\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "end\n");
+
+ return 1;
+
+@@ -133,7 +133,7 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw,
+ u32 ul_command;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "key_idx:%d\n", ul_key_id);
+
+ ul_command = ul_key_id * CAM_CONTENT_COUNT;
+ ul_command = ul_command | BIT(31) | BIT(16);
+@@ -141,10 +141,10 @@ int rtl_cam_delete_one_entry(struct ieee80211_hw *hw,
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], 0);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_delete_one_entry(): WRITE A4: %x\n", 0);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_delete_one_entry(): WRITE A0: %x\n", ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A4: %x\n", __func__, 0);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+
+ return 0;
+
+@@ -195,10 +195,10 @@ void rtl_cam_mark_invalid(struct ieee80211_hw *hw, u8 uc_index)
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_mark_invalid(): WRITE A4: %x\n", ul_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "rtl_cam_mark_invalid(): WRITE A0: %x\n", ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A4: %x\n", __func__, ul_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+ }
+ EXPORT_SYMBOL(rtl_cam_mark_invalid);
+
+@@ -245,12 +245,10 @@ void rtl_cam_empty_entry(struct ieee80211_hw *hw, u8 uc_index)
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[WCAMI], ul_content);
+ rtl_write_dword(rtlpriv, rtlpriv->cfg->maps[RWCAM], ul_command);
+
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "rtl_cam_empty_entry(): WRITE A4: %x\n",
+- ul_content);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_LOUD,
+- "rtl_cam_empty_entry(): WRITE A0: %x\n",
+- ul_command);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "%s: WRITE A4: %x\n", __func__, ul_content);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_LOUD,
++ "%s: WRITE A0: %x\n", __func__, ul_command);
+ }
+
+ }
+@@ -313,8 +311,8 @@ void rtl_cam_del_entry(struct ieee80211_hw *hw, u8 *sta_addr)
+ /* Remove from HW Security CAM */
+ eth_zero_addr(rtlpriv->sec.hwsec_cam_sta_addr[i]);
+ rtlpriv->sec.hwsec_cam_bitmap &= ~(BIT(0) << i);
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "&&&&&&&&&del entry %d\n", i);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "&&&&&&&&&del entry %d\n", i);
+ }
+ }
+ return;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c
+index f73e690bbe8e0..c4c89aade8fbc 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/core.c
++++ b/drivers/net/wireless/realtek/rtlwifi/core.c
+@@ -76,8 +76,8 @@ static void rtl_fw_do_work(const struct firmware *firmware, void *context,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ int err;
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+- "Firmware callback routine entered!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
++ "Firmware callback routine entered!\n");
+ complete(&rtlpriv->firmware_loading_complete);
+ if (!firmware) {
+ if (rtlpriv->cfg->alt_fw_name) {
+@@ -214,8 +214,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ u8 retry_limit = 0x30;
+
+ if (mac->vif) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "vif has been set!! mac->vif = 0x%p\n", mac->vif);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "vif has been set!! mac->vif = 0x%p\n", mac->vif);
+ return -EOPNOTSUPP;
+ }
+
+@@ -230,16 +230,16 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ /*fall through*/
+ case NL80211_IFTYPE_STATION:
+ if (mac->beacon_enabled == 1) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_STATION\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_STATION\n");
+ mac->beacon_enabled = 0;
+ rtlpriv->cfg->ops->update_interrupt_mask(hw, 0,
+ rtlpriv->cfg->maps[RTL_IBSS_INT_MASKS]);
+ }
+ break;
+ case NL80211_IFTYPE_ADHOC:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_ADHOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_ADHOC\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -256,8 +256,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ mac->p2p = P2P_ROLE_GO;
+ /*fall through*/
+ case NL80211_IFTYPE_AP:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_AP\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_AP\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -271,8 +271,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ retry_limit = 0x07;
+ break;
+ case NL80211_IFTYPE_MESH_POINT:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "NL80211_IFTYPE_MESH_POINT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "NL80211_IFTYPE_MESH_POINT\n");
+
+ mac->link_state = MAC80211_LINKED;
+ rtlpriv->cfg->ops->set_bcn_reg(hw);
+@@ -293,8 +293,8 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
+ }
+
+ if (mac->p2p) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "p2p role %x\n", vif->type);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "p2p role %x\n", vif->type);
+ mac->basic_rates = 0xff0;/*disable cck rate for p2p*/
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BASIC_RATE,
+ (u8 *)(&mac->basic_rates));
+@@ -360,8 +360,8 @@ static int rtl_op_change_interface(struct ieee80211_hw *hw,
+ vif->type = new_type;
+ vif->p2p = p2p;
+ ret = rtl_op_add_interface(hw, vif);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "p2p %x\n", p2p);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "p2p %x\n", p2p);
+ return ret;
+ }
+
+@@ -435,8 +435,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw,
+ memset(mask, 0, MAX_WOL_BIT_MASK_SIZE);
+ if (patterns[i].pattern_len < 0 ||
+ patterns[i].pattern_len > MAX_WOL_PATTERN_SIZE) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_WARNING,
+- "Pattern[%d] is too long\n", i);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_WARNING,
++ "Pattern[%d] is too long\n", i);
+ continue;
+ }
+ pattern_os = patterns[i].pattern;
+@@ -515,8 +515,8 @@ static void _rtl_add_wowlan_patterns(struct ieee80211_hw *hw,
+ "pattern to hw\n", content, len);
+ /* 3. calculate crc */
+ rtl_pattern.crc = _calculate_wol_pattern_crc(content, len);
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "CRC_Remainder = 0x%x\n", rtl_pattern.crc);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "CRC_Remainder = 0x%x\n", rtl_pattern.crc);
+
+ /* 4. write crc & mask_for_hw to hw */
+ rtlpriv->cfg->ops->add_wowlan_pattern(hw, &rtl_pattern, i);
+@@ -531,7 +531,7 @@ static int rtl_op_suspend(struct ieee80211_hw *hw,
+ struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
+ struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
+ if (WARN_ON(!wow))
+ return -EINVAL;
+
+@@ -557,7 +557,7 @@ static int rtl_op_resume(struct ieee80211_hw *hw)
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+ time64_t now;
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG, "\n");
+ rtlhal->driver_is_goingto_unload = false;
+ rtlhal->enter_pnp_sleep = false;
+ rtlhal->wake_from_pnp_sleep = true;
+@@ -588,8 +588,8 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
+
+ mutex_lock(&rtlpriv->locks.conf_mutex);
+ if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) { /* BIT(2)*/
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "IEEE80211_CONF_CHANGE_LISTEN_INTERVAL\n");
+ }
+
+ /*For IPS */
+@@ -632,9 +632,9 @@ static int rtl_op_config(struct ieee80211_hw *hw, u32 changed)
+ }
+
+ if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n",
+- hw->conf.long_frame_max_tx_count);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "IEEE80211_CONF_CHANGE_RETRY_LIMITS %x\n",
++ hw->conf.long_frame_max_tx_count);
+ /* brought up everything changes (changed == ~0) indicates first
+ * open, so use our default value instead of that of wiphy.
+ */
+@@ -809,13 +809,13 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (*new_flags & FIF_ALLMULTI) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AM] |
+ rtlpriv->cfg->maps[MAC_RCR_AB];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive multicast frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive multicast frame\n");
+ } else {
+ mac->rx_conf &= ~(rtlpriv->cfg->maps[MAC_RCR_AM] |
+ rtlpriv->cfg->maps[MAC_RCR_AB]);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive multicast frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive multicast frame\n");
+ }
+ update_rcr = true;
+ }
+@@ -823,12 +823,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (changed_flags & FIF_FCSFAIL) {
+ if (*new_flags & FIF_FCSFAIL) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACRC32];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive FCS error frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive FCS error frame\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACRC32];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive FCS error frame\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive FCS error frame\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -855,12 +855,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (*new_flags & FIF_CONTROL) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_ACF];
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive control frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive control frame.\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_ACF];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive control frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive control frame.\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -869,12 +869,12 @@ static void rtl_op_configure_filter(struct ieee80211_hw *hw,
+ if (changed_flags & FIF_OTHER_BSS) {
+ if (*new_flags & FIF_OTHER_BSS) {
+ mac->rx_conf |= rtlpriv->cfg->maps[MAC_RCR_AAP];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Enable receive other BSS's frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Enable receive other BSS's frame.\n");
+ } else {
+ mac->rx_conf &= ~rtlpriv->cfg->maps[MAC_RCR_AAP];
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "Disable receive other BSS's frame.\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "Disable receive other BSS's frame.\n");
+ }
+ if (!update_rcr)
+ update_rcr = true;
+@@ -923,7 +923,7 @@ static int rtl_op_sta_add(struct ieee80211_hw *hw,
+ sta->supp_rates[0] &= 0xfffffff0;
+
+ memcpy(sta_entry->mac_addr, sta->addr, ETH_ALEN);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
+ "Add sta addr is %pM\n", sta->addr);
+ rtlpriv->cfg->ops->update_rate_tbl(hw, sta, 0, true);
+ }
+@@ -939,8 +939,8 @@ static int rtl_op_sta_remove(struct ieee80211_hw *hw,
+ struct rtl_sta_info *sta_entry;
+
+ if (sta) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "Remove sta addr is %pM\n", sta->addr);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "Remove sta addr is %pM\n", sta->addr);
+ sta_entry = (struct rtl_sta_info *)sta->drv_priv;
+ sta_entry->wireless_mode = 0;
+ sta_entry->ratr_index = 0;
+@@ -988,8 +988,8 @@ static int rtl_op_conf_tx(struct ieee80211_hw *hw,
+ int aci;
+
+ if (queue >= AC_MAX) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "queue number %d is incorrect!\n", queue);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "queue number %d is incorrect!\n", queue);
+ return -EINVAL;
+ }
+
+@@ -1034,8 +1034,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ (changed & BSS_CHANGED_BEACON_ENABLED &&
+ bss_conf->enable_beacon)) {
+ if (mac->beacon_enabled == 0) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_BEACON_ENABLED\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_BEACON_ENABLED\n");
+
+ /*start hw beacon interrupt. */
+ /*rtlpriv->cfg->ops->set_bcn_reg(hw); */
+@@ -1052,8 +1052,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if ((changed & BSS_CHANGED_BEACON_ENABLED &&
+ !bss_conf->enable_beacon)) {
+ if (mac->beacon_enabled == 1) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "ADHOC DISABLE BEACON\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "ADHOC DISABLE BEACON\n");
+
+ mac->beacon_enabled = 0;
+ rtlpriv->cfg->ops->update_interrupt_mask(hw, 0,
+@@ -1062,8 +1062,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+ }
+ if (changed & BSS_CHANGED_BEACON_INT) {
+- RT_TRACE(rtlpriv, COMP_BEACON, DBG_TRACE,
+- "BSS_CHANGED_BEACON_INT\n");
++ rtl_dbg(rtlpriv, COMP_BEACON, DBG_TRACE,
++ "BSS_CHANGED_BEACON_INT\n");
+ mac->beacon_interval = bss_conf->beacon_int;
+ rtlpriv->cfg->ops->set_bcn_intv(hw);
+ }
+@@ -1102,8 +1102,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ rcu_read_unlock();
+ goto out;
+ }
+- RT_TRACE(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD,
+- "send PS STATIC frame\n");
++ rtl_dbg(rtlpriv, COMP_EASY_CONCURRENT, DBG_LOUD,
++ "send PS STATIC frame\n");
+ if (rtlpriv->dm.supp_phymode_switch) {
+ if (sta->ht_cap.ht_supported)
+ rtl_send_smps_action(hw, sta,
+@@ -1143,8 +1143,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ HW_VAR_KEEP_ALIVE,
+ (u8 *)(&keep_alive));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_ASSOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_ASSOC\n");
+ } else {
+ struct cfg80211_bss *bss = NULL;
+
+@@ -1161,14 +1161,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ IEEE80211_BSS_TYPE_ESS,
+ IEEE80211_PRIVACY_OFF);
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "bssid = %pMF\n", mac->bssid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "bssid = %pMF\n", mac->bssid);
+
+ if (bss) {
+ cfg80211_unlink_bss(hw->wiphy, bss);
+ cfg80211_put_bss(hw->wiphy, bss);
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "cfg80211_unlink !!\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "cfg80211_unlink !!\n");
+ }
+
+ eth_zero_addr(mac->bssid);
+@@ -1179,8 +1179,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if (rtlpriv->cfg->ops->chk_switch_dmdp)
+ rtlpriv->cfg->ops->chk_switch_dmdp(hw);
+ }
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "BSS_CHANGED_UN_ASSOC\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "BSS_CHANGED_UN_ASSOC\n");
+ }
+ rtlpriv->cfg->ops->set_network_type(hw, vif->type);
+ /* For FW LPS:
+@@ -1198,14 +1198,14 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+
+ if (changed & BSS_CHANGED_ERP_CTS_PROT) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_ERP_CTS_PROT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_ERP_CTS_PROT\n");
+ mac->use_cts_protect = bss_conf->use_cts_prot;
+ }
+
+ if (changed & BSS_CHANGED_ERP_PREAMBLE) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
+- "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n",
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD,
++ "BSS_CHANGED_ERP_PREAMBLE use short preamble:%x\n",
+ bss_conf->use_short_preamble);
+
+ mac->short_preamble = bss_conf->use_short_preamble;
+@@ -1214,8 +1214,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ }
+
+ if (changed & BSS_CHANGED_ERP_SLOT) {
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_ERP_SLOT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_ERP_SLOT\n");
+
+ if (bss_conf->use_short_slot)
+ mac->slot_time = RTL_SLOT_TIME_9;
+@@ -1229,8 +1229,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ if (changed & BSS_CHANGED_HT) {
+ struct ieee80211_sta *sta = NULL;
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "BSS_CHANGED_HT\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "BSS_CHANGED_HT\n");
+
+ rcu_read_lock();
+ sta = ieee80211_find_sta(vif, (u8 *)bss_conf->bssid);
+@@ -1261,8 +1261,8 @@ static void rtl_op_bss_info_changed(struct ieee80211_hw *hw,
+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_BSSID,
+ (u8 *)bss_conf->bssid);
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_DMESG,
+- "bssid: %pM\n", bss_conf->bssid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_DMESG,
++ "bssid: %pM\n", bss_conf->bssid);
+
+ mac->vendor = PEER_UNKNOWN;
+ memcpy(mac->bssid, bss_conf->bssid, ETH_ALEN);
+@@ -1393,27 +1393,27 @@ static int rtl_op_ampdu_action(struct ieee80211_hw *hw,
+
+ switch (action) {
+ case IEEE80211_AMPDU_TX_START:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_START: TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_START: TID:%d\n", tid);
+ return rtl_tx_agg_start(hw, vif, sta, tid, ssn);
+ case IEEE80211_AMPDU_TX_STOP_CONT:
+ case IEEE80211_AMPDU_TX_STOP_FLUSH:
+ case IEEE80211_AMPDU_TX_STOP_FLUSH_CONT:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_STOP: TID:%d\n", tid);
+ return rtl_tx_agg_stop(hw, vif, sta, tid);
+ case IEEE80211_AMPDU_TX_OPERATIONAL:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_TX_OPERATIONAL:TID:%d\n", tid);
+ rtl_tx_agg_oper(hw, sta, tid);
+ break;
+ case IEEE80211_AMPDU_RX_START:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_RX_START:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_RX_START:TID:%d\n", tid);
+ return rtl_rx_agg_start(hw, sta, tid);
+ case IEEE80211_AMPDU_RX_STOP:
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_TRACE,
+- "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid);
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_TRACE,
++ "IEEE80211_AMPDU_RX_STOP:TID:%d\n", tid);
+ return rtl_rx_agg_stop(hw, sta, tid);
+ default:
+ pr_err("IEEE80211_AMPDU_ERR!!!!:\n");
+@@ -1429,7 +1429,7 @@ static void rtl_op_sw_scan_start(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
+ mac->act_scanning = true;
+ if (rtlpriv->link_info.higher_busytraffic) {
+ mac->skip_scan = true;
+@@ -1467,7 +1467,7 @@ static void rtl_op_sw_scan_complete(struct ieee80211_hw *hw,
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+
+- RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_MAC80211, DBG_LOUD, "\n");
+ mac->act_scanning = false;
+ mac->skip_scan = false;
+
+@@ -1517,8 +1517,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->btcoexist.btc_info.in_4way = false;
+
+ if (rtlpriv->cfg->mod_params->sw_crypto || rtlpriv->sec.use_sw_sec) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "not open hw encryption\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "not open hw encryption\n");
+ return -ENOSPC; /*User disabled HW-crypto */
+ }
+ /* To support IBSS, use sw-crypto for GTK */
+@@ -1526,10 +1526,10 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ vif->type == NL80211_IFTYPE_MESH_POINT) &&
+ !(key->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+ return -ENOSPC;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "%s hardware based encryption for keyidx: %d, mac: %pM\n",
+- cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
+- sta ? sta->addr : bcast_addr);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "%s hardware based encryption for keyidx: %d, mac: %pM\n",
++ cmd == SET_KEY ? "Using" : "Disabling", key->keyidx,
++ sta ? sta->addr : bcast_addr);
+ rtlpriv->sec.being_setkey = true;
+ rtl_ips_nic_on(hw);
+ mutex_lock(&rtlpriv->locks.conf_mutex);
+@@ -1538,28 +1538,28 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ switch (key->cipher) {
+ case WLAN_CIPHER_SUITE_WEP40:
+ key_type = WEP40_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP40\n");
+ break;
+ case WLAN_CIPHER_SUITE_WEP104:
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:WEP104\n");
+ key_type = WEP104_ENCRYPTION;
+ break;
+ case WLAN_CIPHER_SUITE_TKIP:
+ key_type = TKIP_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:TKIP\n");
+ break;
+ case WLAN_CIPHER_SUITE_CCMP:
+ key_type = AESCCMP_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CCMP\n");
+ break;
+ case WLAN_CIPHER_SUITE_AES_CMAC:
+ /* HW don't support CMAC encryption,
+ * use software CMAC encryption
+ */
+ key_type = AESCMAC_ENCRYPTION;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n");
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "HW don't support CMAC encryption, use software CMAC encryption\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG, "alg:CMAC\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "HW don't support CMAC encryption, use software CMAC encryption\n");
+ err = -EOPNOTSUPP;
+ goto out_unlock;
+ default:
+@@ -1605,9 +1605,9 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ key_type == WEP104_ENCRYPTION))
+ wep_only = true;
+ rtlpriv->sec.pairwise_enc_algorithm = key_type;
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n",
+- key_type);
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set enable_hw_sec, key_type:%x(OPEN:0 WEP40:1 TKIP:2 AES:4 WEP104:5)\n",
++ key_type);
+ rtlpriv->cfg->ops->enable_hw_sec(hw);
+ }
+ }
+@@ -1615,8 +1615,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ switch (cmd) {
+ case SET_KEY:
+ if (wep_only) {
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set WEP(group/pairwise) key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set WEP(group/pairwise) key\n");
+ /* Pairwise key with an assigned MAC address. */
+ rtlpriv->sec.pairwise_enc_algorithm = key_type;
+ rtlpriv->sec.group_enc_algorithm = key_type;
+@@ -1626,8 +1626,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->sec.key_len[key_idx] = key->keylen;
+ eth_zero_addr(mac_addr);
+ } else if (group_key) { /* group key */
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set group key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set group key\n");
+ /* group key */
+ rtlpriv->sec.group_enc_algorithm = key_type;
+ /*set local buf about group key. */
+@@ -1636,8 +1636,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ rtlpriv->sec.key_len[key_idx] = key->keylen;
+ memcpy(mac_addr, bcast_addr, ETH_ALEN);
+ } else { /* pairwise key */
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "set pairwise key\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "set pairwise key\n");
+ if (!sta) {
+ WARN_ONCE(true,
+ "rtlwifi: pairwise key without mac_addr\n");
+@@ -1669,8 +1669,8 @@ static int rtl_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ key->flags |= IEEE80211_KEY_FLAG_SW_MGMT_TX;
+ break;
+ case DISABLE_KEY:
+- RT_TRACE(rtlpriv, COMP_SEC, DBG_DMESG,
+- "disable key delete one entry\n");
++ rtl_dbg(rtlpriv, COMP_SEC, DBG_DMESG,
++ "disable key delete one entry\n");
+ /*set local buf about wep key. */
+ if (vif->type == NL80211_IFTYPE_AP ||
+ vif->type == NL80211_IFTYPE_MESH_POINT) {
+@@ -1718,9 +1718,9 @@ static void rtl_op_rfkill_poll(struct ieee80211_hw *hw)
+ if (unlikely(radio_state != rtlpriv->rfkill.rfkill_state)) {
+ rtlpriv->rfkill.rfkill_state = radio_state;
+
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "wireless radio switch turned %s\n",
+- radio_state ? "on" : "off");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "wireless radio switch turned %s\n",
++ radio_state ? "on" : "off");
+
+ blocked = (rtlpriv->rfkill.rfkill_state == 1) ? 0 : 1;
+ wiphy_rfkill_set_hw_state(hw->wiphy, blocked);
+@@ -1765,26 +1765,27 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+
+ do {
+ cfg_cmd = pwrcfgcmd[ary_idx];
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n",
+- GET_PWR_CFG_OFFSET(cfg_cmd),
+- GET_PWR_CFG_CUT_MASK(cfg_cmd),
+- GET_PWR_CFG_FAB_MASK(cfg_cmd),
+- GET_PWR_CFG_INTF_MASK(cfg_cmd),
+- GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd),
+- GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd));
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: offset(%#x),cut_msk(%#x), famsk(%#x), interface_msk(%#x), base(%#x), cmd(%#x), msk(%#x), value(%#x)\n",
++ __func__,
++ GET_PWR_CFG_OFFSET(cfg_cmd),
++ GET_PWR_CFG_CUT_MASK(cfg_cmd),
++ GET_PWR_CFG_FAB_MASK(cfg_cmd),
++ GET_PWR_CFG_INTF_MASK(cfg_cmd),
++ GET_PWR_CFG_BASE(cfg_cmd), GET_PWR_CFG_CMD(cfg_cmd),
++ GET_PWR_CFG_MASK(cfg_cmd), GET_PWR_CFG_VALUE(cfg_cmd));
+
+ if ((GET_PWR_CFG_FAB_MASK(cfg_cmd)&faversion) &&
+ (GET_PWR_CFG_CUT_MASK(cfg_cmd)&cut_version) &&
+ (GET_PWR_CFG_INTF_MASK(cfg_cmd)&interface_type)) {
+ switch (GET_PWR_CFG_CMD(cfg_cmd)) {
+ case PWR_CMD_READ:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
+ "rtl_hal_pwrseqcmdparsing(): PWR_CMD_READ\n");
+ break;
+ case PWR_CMD_WRITE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "%s(): PWR_CMD_WRITE\n", __func__);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s(): PWR_CMD_WRITE\n", __func__);
+ offset = GET_PWR_CFG_OFFSET(cfg_cmd);
+
+ /*Read the value from system register*/
+@@ -1797,7 +1798,7 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ rtl_write_byte(rtlpriv, offset, value);
+ break;
+ case PWR_CMD_POLLING:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
+ "rtl_hal_pwrseqcmdparsing(): PWR_CMD_POLLING\n");
+ polling_bit = false;
+ offset = GET_PWR_CFG_OFFSET(cfg_cmd);
+@@ -1818,8 +1819,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ } while (!polling_bit);
+ break;
+ case PWR_CMD_DELAY:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_DELAY\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: PWR_CMD_DELAY\n", __func__);
+ if (GET_PWR_CFG_VALUE(cfg_cmd) ==
+ PWRSEQ_DELAY_US)
+ udelay(GET_PWR_CFG_OFFSET(cfg_cmd));
+@@ -1827,8 +1828,8 @@ bool rtl_hal_pwrseqcmdparsing(struct rtl_priv *rtlpriv, u8 cut_version,
+ mdelay(GET_PWR_CFG_OFFSET(cfg_cmd));
+ break;
+ case PWR_CMD_END:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE,
+- "rtl_hal_pwrseqcmdparsing(): PWR_CMD_END\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE,
++ "%s: PWR_CMD_END\n", __func__);
+ return true;
+ default:
+ WARN_ONCE(true,
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index ec0da33da4f89..a7a5d8fa3cc0c 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -404,8 +404,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ &path, &addr, &bitmask, &data);
+
+ if (num != 4) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "Format is <path> <addr> <mask> <data>\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "Format is <path> <addr> <mask> <data>\n");
+ return count;
+ }
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/efuse.c b/drivers/net/wireless/realtek/rtlwifi/efuse.c
+index 264667203f6f1..305d438180187 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/efuse.c
++++ b/drivers/net/wireless/realtek/rtlwifi/efuse.c
+@@ -120,8 +120,8 @@ void efuse_write_1byte(struct ieee80211_hw *hw, u16 address, u8 value)
+ const u32 efuse_len =
+ rtlpriv->cfg->maps[EFUSE_REAL_CONTENT_SIZE];
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n",
+- address, value);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "Addr=%x Data =%x\n",
++ address, value);
+
+ if (address < efuse_len) {
+ rtl_write_byte(rtlpriv, rtlpriv->cfg->maps[EFUSE_CTRL], value);
+@@ -211,9 +211,9 @@ void read_efuse(struct ieee80211_hw *hw, u16 _offset, u16 _size_byte, u8 *pbuf)
+ u8 efuse_usage;
+
+ if ((_offset + _size_byte) > rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]) {
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "read_efuse(): Invalid offset(%#x) with read bytes(%#x)!!\n",
+- _offset, _size_byte);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "%s: Invalid offset(%#x) with read bytes(%#x)!!\n",
++ __func__, _offset, _size_byte);
+ return;
+ }
+
+@@ -376,9 +376,9 @@ bool efuse_shadow_update_chk(struct ieee80211_hw *hw)
+ (EFUSE_MAX_SIZE - rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN]))
+ result = false;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse_shadow_update_chk(): totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n",
+- totalbytes, hdr_num, words_need, efuse_used);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "%s: totalbytes(%#x), hdr_num(%#x), words_need(%#x), efuse_used(%d)\n",
++ __func__, totalbytes, hdr_num, words_need, efuse_used);
+
+ return result;
+ }
+@@ -416,7 +416,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ u8 word_en = 0x0F;
+ u8 first_pg = false;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
+
+ if (!efuse_shadow_update_chk(hw)) {
+ efuse_read_all_map(hw, &rtlefuse->efuse_map[EFUSE_INIT_MAP][0]);
+@@ -424,8 +424,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ &rtlefuse->efuse_map[EFUSE_INIT_MAP][0],
+ rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]);
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse out of capacity!!\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "efuse out of capacity!!\n");
+ return false;
+ }
+ efuse_power_switch(hw, true, true);
+@@ -464,8 +464,8 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+
+ if (!efuse_pg_packet_write(hw, (u8) offset, word_en,
+ tmpdata)) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "PG section(%#x) fail!!\n", offset);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "PG section(%#x) fail!!\n", offset);
+ break;
+ }
+ }
+@@ -478,7 +478,7 @@ bool efuse_shadow_update(struct ieee80211_hw *hw)
+ &rtlefuse->efuse_map[EFUSE_INIT_MAP][0],
+ rtlpriv->cfg->maps[EFUSE_HWSET_MAX_SIZE]);
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD, "\n");
+ return true;
+ }
+
+@@ -616,8 +616,8 @@ static int efuse_one_byte_write(struct ieee80211_hw *hw, u16 addr, u8 data)
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u8 tmpidx = 0;
+
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "Addr = %x Data=%x\n", addr, data);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "Addr = %x Data=%x\n", addr, data);
+
+ rtl_write_byte(rtlpriv,
+ rtlpriv->cfg->maps[EFUSE_CTRL] + 1, (u8) (addr & 0xff));
+@@ -997,8 +997,8 @@ static int efuse_pg_packet_write(struct ieee80211_hw *hw,
+
+ if (efuse_addr >= (EFUSE_MAX_SIZE -
+ rtlpriv->cfg->maps[EFUSE_OOB_PROTECT_BYTES_LEN])) {
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "efuse_addr(%#x) Out of size!!\n", efuse_addr);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "efuse_addr(%#x) Out of size!!\n", efuse_addr);
+ }
+
+ return true;
+@@ -1038,8 +1038,8 @@ static u8 enable_efuse_data_write(struct ieee80211_hw *hw,
+ u8 tmpdata[8];
+
+ memset(tmpdata, 0xff, PGPKT_DATA_SIZE);
+- RT_TRACE(rtlpriv, COMP_EFUSE, DBG_LOUD,
+- "word_en = %x efuse_addr=%x\n", word_en, efuse_addr);
++ rtl_dbg(rtlpriv, COMP_EFUSE, DBG_LOUD,
++ "word_en = %x efuse_addr=%x\n", word_en, efuse_addr);
+
+ if (!(word_en & BIT(0))) {
+ tmpaddr = start_addr;
+@@ -1242,11 +1242,11 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv,
+
+ eeprom_id = *((u16 *)&hwinfo[0]);
+ if (eeprom_id != params[0]) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "EEPROM ID(%#x) is invalid!!\n", eeprom_id);
+ rtlefuse->autoload_failflag = true;
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "Autoload OK\n");
+ rtlefuse->autoload_failflag = false;
+ }
+
+@@ -1257,30 +1257,30 @@ int rtl_get_hwinfo(struct ieee80211_hw *hw, struct rtl_priv *rtlpriv,
+ rtlefuse->eeprom_did = *(u16 *)&hwinfo[params[2]];
+ rtlefuse->eeprom_svid = *(u16 *)&hwinfo[params[3]];
+ rtlefuse->eeprom_smid = *(u16 *)&hwinfo[params[4]];
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROMId = 0x%4x\n", eeprom_id);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROMId = 0x%4x\n", eeprom_id);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM VID = 0x%4x\n", rtlefuse->eeprom_vid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM DID = 0x%4x\n", rtlefuse->eeprom_did);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SVID = 0x%4x\n", rtlefuse->eeprom_svid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM SMID = 0x%4x\n", rtlefuse->eeprom_smid);
+
+ for (i = 0; i < 6; i += 2) {
+ usvalue = *(u16 *)&hwinfo[params[5] + i];
+ *((u16 *)(&rtlefuse->dev_addr[i])) = usvalue;
+ }
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%pM\n", rtlefuse->dev_addr);
+
+ rtlefuse->eeprom_channelplan = *&hwinfo[params[6]];
+ rtlefuse->eeprom_version = *(u16 *)&hwinfo[params[7]];
+ rtlefuse->txpwr_fromeprom = true;
+ rtlefuse->eeprom_oemid = *&hwinfo[params[8]];
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "EEPROM Customer ID: 0x%2x\n", rtlefuse->eeprom_oemid);
+
+ /* set channel plan to world wide 13 */
+ rtlefuse->channel_plan = params[9];
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 25335bd2873b6..9006aa4446b3b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -204,8 +204,8 @@ static void rtl_pci_disable_aspm(struct ieee80211_hw *hw)
+ return;
+
+ if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "PCI(Bridge) UNKNOWN\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "PCI(Bridge) UNKNOWN\n");
+
+ return;
+ }
+@@ -254,8 +254,8 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
+ return;
+
+ if (pcibridge_vendor == PCI_BRIDGE_VENDOR_UNKNOWN) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_TRACE,
+- "PCI(Bridge) UNKNOWN\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_TRACE,
++ "PCI(Bridge) UNKNOWN\n");
+ return;
+ }
+
+@@ -271,10 +271,10 @@ static void rtl_pci_enable_aspm(struct ieee80211_hw *hw)
+ pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
+ u_pcibridge_aspmsetting);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "PlatformEnableASPM(): Write reg[%x] = %x\n",
+- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
+- u_pcibridge_aspmsetting);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "PlatformEnableASPM(): Write reg[%x] = %x\n",
++ (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
++ u_pcibridge_aspmsetting);
+
+ udelay(50);
+
+@@ -331,11 +331,11 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ list_for_each_entry(tpriv, &rtlpriv->glb_var->glb_priv_list,
+ list) {
+ tpcipriv = (struct rtl_pci_priv *)tpriv->priv;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "pcipriv->ndis_adapter.funcnumber %x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "pcipriv->ndis_adapter.funcnumber %x\n",
+ pcipriv->ndis_adapter.funcnumber);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "tpcipriv->ndis_adapter.funcnumber %x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "tpcipriv->ndis_adapter.funcnumber %x\n",
+ tpcipriv->ndis_adapter.funcnumber);
+
+ if (pcipriv->ndis_adapter.busnumber ==
+@@ -350,8 +350,8 @@ static bool rtl_pci_check_buddy_priv(struct ieee80211_hw *hw,
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "find_buddy_priv %d\n", find_buddy_priv);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "find_buddy_priv %d\n", find_buddy_priv);
+
+ if (find_buddy_priv)
+ *buddy_priv = tpriv;
+@@ -388,8 +388,8 @@ static void rtl_pci_parse_configuration(struct pci_dev *pdev,
+ pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &linkctrl_reg);
+ pcipriv->ndis_adapter.linkctrl_reg = (u8)linkctrl_reg;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n",
+- pcipriv->ndis_adapter.linkctrl_reg);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, "Link Control Register =%x\n",
++ pcipriv->ndis_adapter.linkctrl_reg);
+
+ pci_read_config_byte(pdev, 0x98, &tmp);
+ tmp |= BIT(4);
+@@ -557,11 +557,11 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ if (rtlpriv->rtlhal.earlymode_enable)
+ skb_pull(skb, EM_HDR_LEN);
+
+- RT_TRACE(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE,
+- "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n",
+- ring->idx,
+- skb_queue_len(&ring->queue),
+- *(u16 *)(skb->data + 22));
++ rtl_dbg(rtlpriv, (COMP_INTR | COMP_SEND), DBG_TRACE,
++ "new ring->idx:%d, free: skb_queue_len:%d, free: seq:%x\n",
++ ring->idx,
++ skb_queue_len(&ring->queue),
++ *(u16 *)(skb->data + 22));
+
+ if (prio == TXCMD_QUEUE) {
+ dev_kfree_skb(skb);
+@@ -608,10 +608,10 @@ static void _rtl_pci_tx_isr(struct ieee80211_hw *hw, int prio)
+ }
+
+ if ((ring->entries - skb_queue_len(&ring->queue)) <= 4) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
+- "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
+- prio, ring->idx,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
++ "more desc left, wake skb_queue@%d, ring->idx = %d, skb_queue_len = 0x%x\n",
++ prio, ring->idx,
++ skb_queue_len(&ring->queue));
+
+ ieee80211_wake_queue(hw, skb_get_queue_mapping(skb));
+ }
+@@ -801,9 +801,9 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
+ skb_reserve(skb, stats.rx_drvinfo_size +
+ stats.rx_bufshift);
+ } else {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "skb->end - skb->tail = %d, len is %d\n",
+- skb->end - skb->tail, len);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "skb->end - skb->tail = %d, len is %d\n",
++ skb->end - skb->tail, len);
+ dev_kfree_skb_any(skb);
+ goto new_trx_end;
+ }
+@@ -925,67 +925,67 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+
+ /*<1> beacon related */
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDOK])
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "beacon ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "beacon ok interrupt!\n");
+
+ if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_TBDER]))
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "beacon err interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "beacon err interrupt!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BDOK])
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "beacon interrupt!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BCNINT]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "prepare beacon for interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "prepare beacon for interrupt!\n");
+ tasklet_schedule(&rtlpriv->works.irq_prepare_bcn_tasklet);
+ }
+
+ /*<2> Tx related */
+ if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_TXFOVW]))
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "IMR_TXFOVW!\n");
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_MGNTDOK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "Manage ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "Manage ok interrupt!\n");
+ _rtl_pci_tx_isr(hw, MGNT_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_HIGHDOK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "HIGH_QUEUE ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "HIGH_QUEUE ok interrupt!\n");
+ _rtl_pci_tx_isr(hw, HIGH_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BKDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "BK Tx OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "BK Tx OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, BK_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_BEDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "BE TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "BE TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, BE_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VIDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "VI TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "VI TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, VI_QUEUE);
+ }
+
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_VODOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "Vo TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "Vo TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, VO_QUEUE);
+ }
+
+@@ -993,8 +993,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ if (intvec.intd & rtlpriv->cfg->maps[RTL_IMR_H2CDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "H2C TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "H2C TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, H2C_QUEUE);
+ }
+ }
+@@ -1003,34 +1003,34 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_COMDOK]) {
+ rtlpriv->link_info.num_tx_inperiod++;
+
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "CMD TX OK interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "CMD TX OK interrupt!\n");
+ _rtl_pci_tx_isr(hw, TXCMD_QUEUE);
+ }
+ }
+
+ /*<3> Rx related */
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_ROK]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE, "Rx ok interrupt!\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ if (unlikely(intvec.inta & rtlpriv->cfg->maps[RTL_IMR_RDU])) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "rx descriptor unavailable!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "rx descriptor unavailable!\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ if (unlikely(intvec.intb & rtlpriv->cfg->maps[RTL_IMR_RXFOVW])) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING, "rx overflow !\n");
+ _rtl_pci_rx_interrupt(hw);
+ }
+
+ /*<4> fw related*/
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8723AE) {
+ if (intvec.inta & rtlpriv->cfg->maps[RTL_IMR_C2HCMD]) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "firmware interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "firmware interrupt!\n");
+ queue_delayed_work(rtlpriv->works.rtl_wq,
+ &rtlpriv->works.fwevt_wq, 0);
+ }
+@@ -1046,8 +1046,8 @@ static irqreturn_t _rtl_pci_interrupt(int irq, void *dev_id)
+ rtlhal->hw_type == HARDWARE_TYPE_RTL8723BE) {
+ if (unlikely(intvec.inta &
+ rtlpriv->cfg->maps[RTL_IMR_HSISR_IND])) {
+- RT_TRACE(rtlpriv, COMP_INTR, DBG_TRACE,
+- "hsisr interrupt!\n");
++ rtl_dbg(rtlpriv, COMP_INTR, DBG_TRACE,
++ "hsisr interrupt!\n");
+ _rtl_pci_hs_interrupt(hw);
+ }
+ }
+@@ -1251,8 +1251,8 @@ static int _rtl_pci_init_tx_ring(struct ieee80211_hw *hw,
+ rtlpci->tx_ring[prio].entries = entries;
+ skb_queue_head_init(&rtlpci->tx_ring[prio].queue);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n",
+- prio, desc);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "queue:%d, ring_addr:%p\n",
++ prio, desc);
+
+ /* init every desc in this ring */
+ if (!rtlpriv->use_new_trx_flow) {
+@@ -1649,10 +1649,10 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+ true, HW_DESC_OWN);
+
+ if (own == 1 && hw_queue != BEACON_QUEUE) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
+- hw_queue, ring->idx, idx,
+- skb_queue_len(&ring->queue));
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "No more TX desc@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
++ hw_queue, ring->idx, idx,
++ skb_queue_len(&ring->queue));
+
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock,
+ flags);
+@@ -1662,8 +1662,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+
+ if (rtlpriv->cfg->ops->get_available_desc &&
+ rtlpriv->cfg->ops->get_available_desc(hw, hw_queue) == 0) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "get_available_desc fail\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "get_available_desc fail\n");
+ spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags);
+ return skb->len;
+ }
+@@ -1686,8 +1686,8 @@ static int rtl_pci_tx(struct ieee80211_hw *hw,
+
+ if ((ring->entries - skb_queue_len(&ring->queue)) < 2 &&
+ hw_queue != BEACON_QUEUE) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
+- "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_LOUD,
++ "less desc left, stop skb_queue@%d, ring->idx = %d, idx = %d, skb_queue_len = 0x%x\n",
+ hw_queue, ring->idx, idx,
+ skb_queue_len(&ring->queue));
+
+@@ -1794,8 +1794,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+
+ err = rtlpriv->cfg->ops->hw_init(hw);
+ if (err) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Failed to config hardware!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Failed to config hardware!\n");
+ kfree(rtlpriv->btcoexist.btc_context);
+ kfree(rtlpriv->btcoexist.wifi_only_context);
+ return err;
+@@ -1804,7 +1804,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+ &rtlmac->retry_long);
+
+ rtlpriv->cfg->ops->enable_interrupt(hw);
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD, "enable_interrupt OK\n");
+
+ rtl_init_rx_config(hw);
+
+@@ -1815,7 +1815,7 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
+
+ rtlpci->up_first_time = false;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "%s OK\n", __func__);
+ return 0;
+ }
+
+@@ -1909,71 +1909,71 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ deviceid == RTL_PCI_8171_DID) {
+ switch (revisionid) {
+ case RTL_PCI_REVISION_ID_8192PCIE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192 PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192 PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192E;
+ return false;
+ case RTL_PCI_REVISION_ID_8192SE:
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192SE is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192SE is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE;
+ break;
+ default:
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Err: Unknown device - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Err: Unknown device - vid/did=%x/%x\n",
++ venderid, deviceid);
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192SE;
+ break;
+ }
+ } else if (deviceid == RTL_PCI_8723AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8723AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8723AE PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8723AE PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8192CET_DID ||
+ deviceid == RTL_PCI_8192CE_DID ||
+ deviceid == RTL_PCI_8191CE_DID ||
+ deviceid == RTL_PCI_8188CE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192CE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192C PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192C PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8192DE_DID ||
+ deviceid == RTL_PCI_8192DE_DID2) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192DE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "8192D PCI-E is found - vid/did=%x/%x\n",
+- venderid, deviceid);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "8192D PCI-E is found - vid/did=%x/%x\n",
++ venderid, deviceid);
+ } else if (deviceid == RTL_PCI_8188EE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8188EE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8188EE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8188EE\n");
+ } else if (deviceid == RTL_PCI_8723BE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8723BE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8723BE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8723BE\n");
+ } else if (deviceid == RTL_PCI_8192EE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8192EE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8192EE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8192EE\n");
+ } else if (deviceid == RTL_PCI_8821AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8821AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8821AE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8821AE\n");
+ } else if (deviceid == RTL_PCI_8812AE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8812AE;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8812AE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8812AE\n");
+ } else if (deviceid == RTL_PCI_8822BE_DID) {
+ rtlhal->hw_type = HARDWARE_TYPE_RTL8822BE;
+ rtlhal->bandset = BAND_ON_BOTH;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find adapter, Hardware type is 8822BE\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find adapter, Hardware type is 8822BE\n");
+ } else {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Err: Unknown device - vid/did=%x/%x\n",
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Err: Unknown device - vid/did=%x/%x\n",
+ venderid, deviceid);
+
+ rtlhal->hw_type = RTL_DEFAULT_HARDWARE_TYPE;
+@@ -1982,17 +1982,17 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192DE) {
+ if (revisionid == 0 || revisionid == 1) {
+ if (revisionid == 0) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find 92DE MAC0\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find 92DE MAC0\n");
+ rtlhal->interfaceindex = 0;
+ } else if (revisionid == 1) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Find 92DE MAC1\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Find 92DE MAC1\n");
+ rtlhal->interfaceindex = 1;
+ }
+ } else {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n",
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "Unknown device - VendorID/DeviceID=%x/%x, Revision=%x\n",
+ venderid, deviceid, revisionid);
+ rtlhal->interfaceindex = 0;
+ }
+@@ -2026,9 +2026,9 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ for (tmp = 0; tmp < PCI_BRIDGE_VENDOR_MAX; tmp++) {
+ if (bridge_pdev->vendor == pcibridge_vendors[tmp]) {
+ pcipriv->ndis_adapter.pcibridge_vendor = tmp;
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Pci Bridge Vendor is found index: %d\n",
+- tmp);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Pci Bridge Vendor is found index: %d\n",
++ tmp);
+ break;
+ }
+ }
+@@ -2056,22 +2056,22 @@ static bool _rtl_pci_find_adapter(struct pci_dev *pdev,
+ }
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n",
+- pcipriv->ndis_adapter.busnumber,
+- pcipriv->ndis_adapter.devnumber,
+- pcipriv->ndis_adapter.funcnumber,
+- pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "pcidev busnumber:devnumber:funcnumber:vendor:link_ctl %d:%d:%d:%x:%x\n",
++ pcipriv->ndis_adapter.busnumber,
++ pcipriv->ndis_adapter.devnumber,
++ pcipriv->ndis_adapter.funcnumber,
++ pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
+- pcipriv->ndis_adapter.pcibridge_busnum,
+- pcipriv->ndis_adapter.pcibridge_devnum,
+- pcipriv->ndis_adapter.pcibridge_funcnum,
+- pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
+- pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
+- pcipriv->ndis_adapter.pcibridge_linkctrlreg,
+- pcipriv->ndis_adapter.amd_l1_patch);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
++ pcipriv->ndis_adapter.pcibridge_busnum,
++ pcipriv->ndis_adapter.pcibridge_devnum,
++ pcipriv->ndis_adapter.pcibridge_funcnum,
++ pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
++ pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
++ pcipriv->ndis_adapter.pcibridge_linkctrlreg,
++ pcipriv->ndis_adapter.amd_l1_patch);
+
+ rtl_pci_parse_configuration(pdev, hw);
+ list_add_tail(&rtlpriv->list, &rtlpriv->glb_var->glb_priv_list);
+@@ -2099,8 +2099,8 @@ static int rtl_pci_intr_mode_msi(struct ieee80211_hw *hw)
+
+ rtlpci->using_msi = true;
+
+- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
+- "MSI Interrupt Mode!\n");
++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
++ "MSI Interrupt Mode!\n");
+ return 0;
+ }
+
+@@ -2117,8 +2117,8 @@ static int rtl_pci_intr_mode_legacy(struct ieee80211_hw *hw)
+ return ret;
+
+ rtlpci->using_msi = false;
+- RT_TRACE(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
+- "Pin-based Interrupt Mode!\n");
++ rtl_dbg(rtlpriv, COMP_INIT | COMP_INTR, DBG_DMESG,
++ "Pin-based Interrupt Mode!\n");
+ return 0;
+ }
+
+@@ -2245,10 +2245,10 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ goto fail2;
+ }
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
+- pmem_start, pmem_len, pmem_flags,
+- rtlpriv->io.pci_mem_start);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "mem mapped space: start: 0x%08lx len:%08lx flags:%08lx, after map:0x%08lx\n",
++ pmem_start, pmem_len, pmem_flags,
++ rtlpriv->io.pci_mem_start);
+
+ /* Disable Clk Request */
+ pci_write_config_byte(pdev, 0x81, 0);
+@@ -2310,9 +2310,9 @@ int rtl_pci_probe(struct pci_dev *pdev,
+ rtlpci = rtl_pcidev(pcipriv);
+ err = rtl_pci_intr_mode_decide(hw);
+ if (err) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "%s: failed to register IRQ handler\n",
+- wiphy_name(hw->wiphy));
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "%s: failed to register IRQ handler\n",
++ wiphy_name(hw->wiphy));
+ goto fail3;
+ }
+ rtlpci->irq_alloc = 1;
+diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
+index fff8dda140238..9a4601a71eae0 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/ps.c
++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
+@@ -19,8 +19,8 @@ bool rtl_ps_enable_nic(struct ieee80211_hw *hw)
+ rtlpriv->intf_ops->reset_trx_ring(hw);
+
+ if (is_hal_stop(rtlhal))
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "Driver is already down!\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "Driver is already down!\n");
+
+ /*<2> Enable Adapter */
+ if (rtlpriv->cfg->ops->hw_init(hw))
+@@ -81,9 +81,9 @@ static bool rtl_ps_set_rf_state(struct ieee80211_hw *hw,
+ if (ppsc->rfchange_inprogress) {
+ spin_unlock(&rtlpriv->locks.rf_ps_lock);
+
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "RF Change in progress! Wait to set..state_toset(%d).\n",
+- state_toset);
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "RF Change in progress! Wait to set..state_toset(%d).\n",
++ state_toset);
+
+ /* Set RF after the previous action is done. */
+ while (ppsc->rfchange_inprogress) {
+@@ -195,8 +195,8 @@ void rtl_ips_nic_off_wq_callback(void *data)
+ enum rf_pwrstate rtstate;
+
+ if (mac->opmode != NL80211_IFTYPE_STATION) {
+- RT_TRACE(rtlpriv, COMP_ERR, DBG_WARNING,
+- "not station return\n");
++ rtl_dbg(rtlpriv, COMP_ERR, DBG_WARNING,
++ "not station return\n");
+ return;
+ }
+
+@@ -232,8 +232,8 @@ void rtl_ips_nic_off_wq_callback(void *data)
+ !ppsc->swrf_processing &&
+ (mac->link_state == MAC80211_NOLINK) &&
+ !mac->act_scanning) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
+- "IPSEnter(): Turn off RF\n");
++ rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
++ "IPSEnter(): Turn off RF\n");
+
+ ppsc->inactive_pwrstate = ERFOFF;
+ ppsc->in_powersavemode = true;
+@@ -311,8 +311,8 @@ static bool rtl_get_fwlps_doze(struct ieee80211_hw *hw)
+ ppsc->last_delaylps_stamp_jiffies);
+
+ if (ps_timediff < 2000) {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Delay enter Fw LPS for DHCP, ARP, or EAPOL exchanging state\n");
+ return false;
+ }
+
+@@ -357,9 +357,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
+
+ if ((ppsc->fwctrl_lps) && ppsc->report_linked) {
+ if (ppsc->dot11_psmode == EACTIVE) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "FW LPS leave ps_mode:%x\n",
+- FW_PS_ACTIVE_MODE);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "FW LPS leave ps_mode:%x\n",
++ FW_PS_ACTIVE_MODE);
+ enter_fwlps = false;
+ ppsc->pwr_mode = FW_PS_ACTIVE_MODE;
+ ppsc->smart_ps = 0;
+@@ -372,9 +372,9 @@ void rtl_lps_set_psmode(struct ieee80211_hw *hw, u8 rt_psmode)
+ rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode);
+ } else {
+ if (rtl_get_fwlps_doze(hw)) {
+- RT_TRACE(rtlpriv, COMP_RF, DBG_DMESG,
+- "FW LPS enter ps_mode:%x\n",
+- ppsc->fwctrl_psmode);
++ rtl_dbg(rtlpriv, COMP_RF, DBG_DMESG,
++ "FW LPS enter ps_mode:%x\n",
++ ppsc->fwctrl_psmode);
+ if (rtlpriv->cfg->ops->get_btc_status())
+ rtlpriv->btcoexist.btc_ops->btc_lps_notify(rtlpriv, rt_psmode);
+ enter_fwlps = true;
+@@ -424,8 +424,8 @@ static void rtl_lps_enter_core(struct ieee80211_hw *hw)
+ * bt_ccoexist may ask to enter lps.
+ * In normal case, this constraint move to rtl_lps_set_psmode().
+ */
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Enter 802.11 power save mode...\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Enter 802.11 power save mode...\n");
+ rtl_lps_set_psmode(hw, EAUTOPS);
+
+ mutex_unlock(&rtlpriv->locks.lps_mutex);
+@@ -453,8 +453,8 @@ static void rtl_lps_leave_core(struct ieee80211_hw *hw)
+ RT_CLEAR_PS_LEVEL(ppsc, RT_PS_LEVEL_ASPM);
+ }
+
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
+- "Busy Traffic,Leave 802.11 power save..\n");
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_LOUD,
++ "Busy Traffic,Leave 802.11 power save..\n");
+
+ rtl_lps_set_psmode(hw, EACTIVE);
+ }
+@@ -538,8 +538,8 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
+ queue_delayed_work(rtlpriv->works.rtl_wq,
+ &rtlpriv->works.ps_work, MSECS(5));
+ } else {
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "u_bufferd: %x, m_buffered: %x\n", u_buffed, m_buffed);
+ }
+ }
+ EXPORT_SYMBOL_GPL(rtl_swlps_beacon);
+@@ -634,9 +634,9 @@ void rtl_swlps_rf_sleep(struct ieee80211_hw *hw)
+ /* this print should always be dtim_conter = 0 &
+ * sleep = dtim_period, that meaons, we should
+ * awake before every dtim */
+- RT_TRACE(rtlpriv, COMP_POWER, DBG_DMESG,
+- "dtim_counter:%x will sleep :%d beacon_intv\n",
+- rtlpriv->psc.dtim_counter, sleep_intv);
++ rtl_dbg(rtlpriv, COMP_POWER, DBG_DMESG,
++ "dtim_counter:%x will sleep :%d beacon_intv\n",
++ rtlpriv->psc.dtim_counter, sleep_intv);
+
+ /* we tested that 40ms is enough for sw & hw sw delay */
+ queue_delayed_work(rtlpriv->works.rtl_wq, &rtlpriv->works.ps_rfon_wq,
+@@ -748,9 +748,9 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+ if (ie[0] == 12) {
+ find_p2p_ps_ie = true;
+ if ((noa_len - 2) % 13 != 0) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
+- "P2P notice of absence: invalid length.%d\n",
+- noa_len);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
++ "P2P notice of absence: invalid length.%d\n",
++ noa_len);
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
+@@ -761,8 +761,8 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
+ noa_index = ie[3];
+ if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
+ P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "update NOA ie.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "update NOA ie.\n");
+ p2pinfo->noa_index = noa_index;
+ p2pinfo->opp_ps = (ie[4] >> 7);
+ p2pinfo->ctwindow = ie[4] & 0x7F;
+@@ -833,7 +833,7 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+ if (ie == NULL)
+ return;
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "action frame find P2P IE.\n");
+ /*to find noa ie*/
+ while (ie + 1 < end) {
+ noa_len = READEF2BYTE((__le16 *)&ie[1]);
+@@ -841,13 +841,13 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
+ return;
+
+ if (ie[0] == 12) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "find NOA IE.\n");
+ RT_PRINT_DATA(rtlpriv, COMP_FW, DBG_LOUD, "noa ie ",
+ ie, noa_len);
+ if ((noa_len - 2) % 13 != 0) {
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "P2P notice of absence: invalid length.%d\n",
+- noa_len);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "P2P notice of absence: invalid length.%d\n",
++ noa_len);
+ return;
+ } else {
+ noa_num = (noa_len - 2) / 13;
+@@ -905,7 +905,7 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state)
+ struct rtl_ps_ctl *rtlps = rtl_psc(rtl_priv(hw));
+ struct rtl_p2p_ps_info *p2pinfo = &(rtlpriv->psc.p2p_ps_info);
+
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n" , p2p_ps_state);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, " p2p state %x\n", p2p_ps_state);
+ switch (p2p_ps_state) {
+ case P2P_PS_DISABLE:
+ p2pinfo->p2p_ps_state = p2p_ps_state;
+@@ -957,18 +957,18 @@ void rtl_p2p_ps_cmd(struct ieee80211_hw *hw , u8 p2p_ps_state)
+ default:
+ break;
+ }
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "ctwindow %x oppps %x\n",
+- p2pinfo->ctwindow , p2pinfo->opp_ps);
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
+- "count %x duration %x index %x interval %x start time %x noa num %x\n",
+- p2pinfo->noa_count_type[0],
+- p2pinfo->noa_duration[0],
+- p2pinfo->noa_index,
+- p2pinfo->noa_interval[0],
+- p2pinfo->noa_start_time[0],
+- p2pinfo->noa_num);
+- RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD, "end\n");
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "ctwindow %x oppps %x\n",
++ p2pinfo->ctwindow, p2pinfo->opp_ps);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD,
++ "count %x duration %x index %x interval %x start time %x noa num %x\n",
++ p2pinfo->noa_count_type[0],
++ p2pinfo->noa_duration[0],
++ p2pinfo->noa_index,
++ p2pinfo->noa_interval[0],
++ p2pinfo->noa_start_time[0],
++ p2pinfo->noa_num);
++ rtl_dbg(rtlpriv, COMP_FW, DBG_LOUD, "end\n");
+ }
+
+ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
+diff --git a/drivers/net/wireless/realtek/rtlwifi/regd.c b/drivers/net/wireless/realtek/rtlwifi/regd.c
+index 8be31e0ad8788..4cf8face0bbd1 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -393,13 +393,13 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ rtlpriv->regd.country_code =
+ channel_plan_to_country_code(rtlpriv->efuse.channel_plan);
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG,
+- "rtl: EEPROM regdomain: 0x%0x country code: %d\n",
+- rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code);
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG,
++ "rtl: EEPROM regdomain: 0x%0x country code: %d\n",
++ rtlpriv->efuse.channel_plan, rtlpriv->regd.country_code);
+
+ if (rtlpriv->regd.country_code >= COUNTRY_CODE_MAX) {
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_DMESG,
+- "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n");
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_DMESG,
++ "rtl: EEPROM indicates invalid country code, world wide 13 should be used\n");
+
+ rtlpriv->regd.country_code = COUNTRY_CODE_WORLD_WIDE_13;
+ }
+@@ -414,9 +414,9 @@ int rtl_regd_init(struct ieee80211_hw *hw,
+ rtlpriv->regd.alpha2[1] = '0';
+ }
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_TRACE,
+- "rtl: Country alpha2 being used: %c%c\n",
+- rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]);
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_TRACE,
++ "rtl: Country alpha2 being used: %c%c\n",
++ rtlpriv->regd.alpha2[0], rtlpriv->regd.alpha2[1]);
+
+ _rtl_regd_init_wiphy(&rtlpriv->regd, wiphy, reg_notifier);
+
+@@ -428,7 +428,7 @@ void rtl_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request)
+ struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+
+- RT_TRACE(rtlpriv, COMP_REGD, DBG_LOUD, "\n");
++ rtl_dbg(rtlpriv, COMP_REGD, DBG_LOUD, "\n");
+
+ _rtl_reg_notifier_apply(wiphy, request, &rtlpriv->regd);
+ }
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index 9bcb187d37dcd..fc1548ad434f6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -259,15 +259,15 @@ static int _rtl_usb_init_tx(struct ieee80211_hw *hw)
+ ? USB_HIGH_SPEED_BULK_SIZE
+ : USB_FULL_SPEED_BULK_SIZE;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n",
+- rtlusb->max_bulk_out_size);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG, "USB Max Bulk-out Size=%d\n",
++ rtlusb->max_bulk_out_size);
+
+ for (i = 0; i < __RTL_TXQ_NUM; i++) {
+ u32 ep_num = rtlusb->ep_map.ep_mapping[i];
+
+ if (!ep_num) {
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "Invalid endpoint map setting!\n");
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "Invalid endpoint map setting!\n");
+ return -EINVAL;
+ }
+ }
+@@ -337,10 +337,10 @@ static int _rtl_usb_init(struct ieee80211_hw *hw)
+ else if (usb_endpoint_dir_out(pep_desc))
+ rtlusb->out_ep_nums++;
+
+- RT_TRACE(rtlpriv, COMP_INIT, DBG_DMESG,
+- "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
+- pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
+- pep_desc->bInterval);
++ rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
++ "USB EP(0x%02x), MaxPacketSize=%d, Interval=%d\n",
++ pep_desc->bEndpointAddress, pep_desc->wMaxPacketSize,
++ pep_desc->bInterval);
+ }
+ if (rtlusb->in_ep_nums < rtlpriv->cfg->usb_interface_cfg->in_ep_num) {
+ pr_err("Too few input end points found\n");
+@@ -931,7 +931,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw,
+
+ memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
+ if (ieee80211_is_auth(fc)) {
+- RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
++ rtl_dbg(rtlpriv, COMP_SEND, DBG_DMESG, "MAC80211_LINKING\n");
+ }
+
+ if (rtlpriv->psc.sw_ps_enabled) {
+--
+2.39.2
+
--- /dev/null
+From a71d97039f704bd291729c180e79d40d556defae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 15:42:30 -0500
+Subject: rtlwifi: Start changing RT_TRACE into rtl_dbg
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit 78a7245d84300cd616dbce26e6fc42a039a62279 ]
+
+The macro name RT_TRACE makes it seem that it is used for tracing, when
+is actually used for debugging. Change the name to RT_DEBUG.
+
+This step creates the new macro while keeping the old RT_TRACE to allow
+building. It will be removed at the end of the patch series.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Link: https://lore.kernel.org/r/20200723204244.24457-2-Larry.Finger@lwfinger.net
+Stable-dep-of: 905a9241e4e8 ("wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.h | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.h b/drivers/net/wireless/realtek/rtlwifi/debug.h
+index 69f169d4d4aec..dbfb4d67ca31f 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.h
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.h
+@@ -160,6 +160,10 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level,
+ const char *titlestring,
+ const void *hexdata, int hexdatalen);
+
++#define rtl_dbg(rtlpriv, comp, level, fmt, ...) \
++ _rtl_dbg_trace(rtlpriv, comp, level, \
++ fmt, ##__VA_ARGS__)
++
+ #define RT_TRACE(rtlpriv, comp, level, fmt, ...) \
+ _rtl_dbg_trace(rtlpriv, comp, level, \
+ fmt, ##__VA_ARGS__)
+@@ -176,6 +180,13 @@ void _rtl_dbg_print_data(struct rtl_priv *rtlpriv, u64 comp, int level,
+
+ struct rtl_priv;
+
++__printf(4, 5)
++static inline void rtl_dbg(struct rtl_priv *rtlpriv,
++ u64 comp, int level,
++ const char *fmt, ...)
++{
++}
++
+ __printf(4, 5)
+ static inline void RT_TRACE(struct rtl_priv *rtlpriv,
+ u64 comp, int level,
+--
+2.39.2
+
--- /dev/null
+From 3553e5c35c78a2d528eaa78af46a5f814d986e94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 12:32:11 +0100
+Subject: scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
+
+From: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+[ Upstream commit a02d83f9947d8f71904eda4de046630c3eb6802c ]
+
+Currently, kernel would set MSG_CTRUNC flag if msg_control buffer
+wasn't provided and SO_PASSCRED was set or if there was pending SCM_RIGHTS.
+
+For some reason we have no corresponding check for SO_PASSSEC.
+
+In the recvmsg(2) doc we have:
+ MSG_CTRUNC
+ indicates that some control data was discarded due to lack
+ of space in the buffer for ancillary data.
+
+So, we need to set MSG_CTRUNC flag for all types of SCM.
+
+This change can break applications those don't check MSG_CTRUNC flag.
+
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: Leon Romanovsky <leon@kernel.org>
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>
+
+v2:
+- commit message was rewritten according to Eric's suggestion
+Acked-by: Paul Moore <paul@paul-moore.com>
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/scm.h | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 1ce365f4c2560..585adc1346bd0 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -105,16 +105,27 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc
+ }
+ }
+ }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return test_bit(SOCK_PASSSEC, &sock->flags);
++}
+ #else
+ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
+ { }
++
++static inline bool scm_has_secdata(struct socket *sock)
++{
++ return false;
++}
+ #endif /* CONFIG_SECURITY_NETWORK */
+
+ static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
+ struct scm_cookie *scm, int flags)
+ {
+ if (!msg->msg_control) {
+- if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
++ if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp ||
++ scm_has_secdata(sock))
+ msg->msg_flags |= MSG_CTRUNC;
+ scm_destroy(scm);
+ return;
+--
+2.39.2
+
--- /dev/null
+From 46cc4c2d5c50c7648d2ddae2abfd62ba7cfa134d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 15:52:45 -0700
+Subject: scripts/gdb: bail early if there are no clocks
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 1d7adbc74c009057ed9dc3112f388e91a9c79acc ]
+
+Avoid generating an exception if there are no clocks registered:
+
+(gdb) lx-clk-summary
+ enable prepare protect
+ clock count count count rate
+------------------------------------------------------------------------
+Python Exception <class 'gdb.error'>: No symbol "clk_root_list" in
+current context.
+Error occurred in Python: No symbol "clk_root_list" in current context.
+
+Link: https://lkml.kernel.org/r/20230323225246.3302977-1-f.fainelli@gmail.com
+Fixes: d1e9710b63d8 ("scripts/gdb: initial clk support: lx-clk-summary")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Leonard Crestez <leonard.crestez@nxp.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/clk.py | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/gdb/linux/clk.py b/scripts/gdb/linux/clk.py
+index 061aecfa294e6..7a01fdc3e8446 100644
+--- a/scripts/gdb/linux/clk.py
++++ b/scripts/gdb/linux/clk.py
+@@ -41,6 +41,8 @@ are cached and potentially out of date"""
+ self.show_subtree(child, level + 1)
+
+ def invoke(self, arg, from_tty):
++ if utils.gdb_eval_or_none("clk_root_list") is None:
++ raise gdb.GdbError("No clocks registered")
+ gdb.write(" enable prepare protect \n")
+ gdb.write(" clock count count count rate \n")
+ gdb.write("------------------------------------------------------------------------\n")
+--
+2.39.2
+
--- /dev/null
+From d35af9c340be6a55d7444359ff7bf0998e9fe1f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Mar 2023 16:16:57 -0700
+Subject: scripts/gdb: bail early if there are no generic PD
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit f19c3c2959e465209ade1a7a699e6cbf4359ce78 ]
+
+Avoid generating an exception if there are no generic power domain(s)
+registered:
+
+(gdb) lx-genpd-summary
+domain status children
+ /device runtime status
+----------------------------------------------------------------------
+Python Exception <class 'gdb.error'>: No symbol "gpd_list" in current context.
+Error occurred in Python: No symbol "gpd_list" in current context.
+(gdb) quit
+
+[f.fainelli@gmail.com: correctly invoke gdb_eval_or_none]
+ Link: https://lkml.kernel.org/r/20230327185746.3856407-1-f.fainelli@gmail.com
+Link: https://lkml.kernel.org/r/20230323231659.3319941-1-f.fainelli@gmail.com
+Fixes: 8207d4a88e1e ("scripts/gdb: add lx-genpd-summary command")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Leonard Crestez <leonard.crestez@nxp.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/genpd.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/genpd.py b/scripts/gdb/linux/genpd.py
+index 39cd1abd85590..b53649c0a77a6 100644
+--- a/scripts/gdb/linux/genpd.py
++++ b/scripts/gdb/linux/genpd.py
+@@ -5,7 +5,7 @@
+ import gdb
+ import sys
+
+-from linux.utils import CachedType
++from linux.utils import CachedType, gdb_eval_or_none
+ from linux.lists import list_for_each_entry
+
+ generic_pm_domain_type = CachedType('struct generic_pm_domain')
+@@ -70,6 +70,8 @@ Output is similar to /sys/kernel/debug/pm_genpd/pm_genpd_summary'''
+ gdb.write(' %-50s %s\n' % (kobj_path, rtpm_status_str(dev)))
+
+ def invoke(self, arg, from_tty):
++ if gdb_eval_or_none("&gpd_list") is None:
++ raise gdb.GdbError("No power domain(s) registered")
+ gdb.write('domain status children\n');
+ gdb.write(' /device runtime status\n');
+ gdb.write('----------------------------------------------------------------------\n');
+--
+2.39.2
+
--- /dev/null
+From c21aea6c9ea58cb00e1e0532e021963e97745411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Apr 2023 15:21:32 +0800
+Subject: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
+
+From: Shuchang Li <lishuchang@hust.edu.cn>
+
+[ Upstream commit 91a0c0c1413239d0548b5aac4c82f38f6d53a91e ]
+
+When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4)
+returns false, drbl_regs_memmap_p is not remapped. This passes a NULL
+pointer to iounmap(), which can trigger a WARN() on certain arches.
+
+When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4)
+returns true, drbl_regs_memmap_p may has been remapped and
+ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a
+NULL pointer to iounmap().
+
+To fix these issues, we need to add null checks before iounmap(), and
+change some goto labels.
+
+Fixes: 1351e69fc6db ("scsi: lpfc: Add push-to-adapter support to sli4")
+Signed-off-by: Shuchang Li <lishuchang@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230404072133.1022-1-lishuchang@hust.edu.cn
+Reviewed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 8930696021fbd..af5238ab63094 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -10226,7 +10226,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ goto out_iounmap_all;
+ } else {
+ error = -ENOMEM;
+- goto out_iounmap_all;
++ goto out_iounmap_ctrl;
+ }
+ }
+
+@@ -10244,7 +10244,7 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ dev_err(&pdev->dev,
+ "ioremap failed for SLI4 HBA dpp registers.\n");
+ error = -ENOMEM;
+- goto out_iounmap_ctrl;
++ goto out_iounmap_all;
+ }
+ phba->pci_bar4_memmap_p = phba->sli4_hba.dpp_regs_memmap_p;
+ }
+@@ -10269,9 +10269,11 @@ lpfc_sli4_pci_mem_setup(struct lpfc_hba *phba)
+ return 0;
+
+ out_iounmap_all:
+- iounmap(phba->sli4_hba.drbl_regs_memmap_p);
++ if (phba->sli4_hba.drbl_regs_memmap_p)
++ iounmap(phba->sli4_hba.drbl_regs_memmap_p);
+ out_iounmap_ctrl:
+- iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
++ if (phba->sli4_hba.ctrl_regs_memmap_p)
++ iounmap(phba->sli4_hba.ctrl_regs_memmap_p);
+ out_iounmap_conf:
+ iounmap(phba->sli4_hba.conf_regs_memmap_p);
+
+--
+2.39.2
+
--- /dev/null
+From a26ad1e50ce256d7f50ad74f19d4714d51c9215a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Mar 2023 17:51:09 +0000
+Subject: scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
+
+From: Danila Chernetsov <listdansp@mail.ru>
+
+[ Upstream commit 75cb113cd43f06aaf4f1bda0069cfd5b98e909eb ]
+
+When cmdid == CMDID_INT_CMDS, the 'cmds' pointer is NULL but is
+dereferenced below.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 0f2bb84d2a68 ("[SCSI] megaraid: simplify internal command handling")
+Signed-off-by: Danila Chernetsov <listdansp@mail.ru>
+Link: https://lore.kernel.org/r/20230317175109.18585-1-listdansp@mail.ru
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 8b1ba690039b7..8c88190673c2a 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1439,6 +1439,7 @@ mega_cmd_done(adapter_t *adapter, u8 completed[], int nstatus, int status)
+ */
+ if (cmdid == CMDID_INT_CMDS) {
+ scb = &adapter->int_scb;
++ cmd = scb->cmd;
+
+ list_del_init(&scb->list);
+ scb->state = SCB_FREE;
+--
+2.39.2
+
--- /dev/null
+From 974ad31dfdb432abe99900601f65b5aa699ce726 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Mar 2023 20:56:19 -0500
+Subject: scsi: target: iscsit: Fix TAS handling during conn cleanup
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit cc79da306ebb2edb700c3816b90219223182ac3c ]
+
+Fix a bug added in commit f36199355c64 ("scsi: target: iscsi: Fix cmd abort
+fabric stop race").
+
+If CMD_T_TAS is set on the se_cmd we must call iscsit_free_cmd() to do the
+last put on the cmd and free it, because the connection is down and we will
+not up sending the response and doing the put from the normal I/O
+path.
+
+Add a check for CMD_T_TAS in iscsit_release_commands_from_conn() so we now
+detect this case and run iscsit_free_cmd().
+
+Fixes: f36199355c64 ("scsi: target: iscsi: Fix cmd abort fabric stop race")
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Link: https://lore.kernel.org/r/20230319015620.96006-9-michael.christie@oracle.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/iscsi/iscsi_target.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 3403667a9592f..8b8afa95fbbae 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4084,9 +4084,12 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ struct se_cmd *se_cmd = &cmd->se_cmd;
+
+- if (se_cmd->se_tfo != NULL) {
+- spin_lock_irq(&se_cmd->t_state_lock);
+- if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!se_cmd->se_tfo)
++ continue;
++
++ spin_lock_irq(&se_cmd->t_state_lock);
++ if (se_cmd->transport_state & CMD_T_ABORTED) {
++ if (!(se_cmd->transport_state & CMD_T_TAS))
+ /*
+ * LIO's abort path owns the cleanup for this,
+ * so put it back on the list and let
+@@ -4094,11 +4097,10 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ */
+ list_move_tail(&cmd->i_conn_node,
+ &conn->conn_cmd_list);
+- } else {
+- se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+- }
+- spin_unlock_irq(&se_cmd->t_state_lock);
++ } else {
++ se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+ }
++ spin_unlock_irq(&se_cmd->t_state_lock);
+ }
+ spin_unlock_bh(&conn->cmd_lock);
+
+--
+2.39.2
+
--- /dev/null
+From 1917433b422bd7e893b6adff1e031485cc218ea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:29:11 -0400
+Subject: selinux: ensure av_permissions.h is built when needed
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 4ce1f694eb5d8ca607fed8542d32a33b4f1217a5 ]
+
+The Makefile rule responsible for building flask.h and
+av_permissions.h only lists flask.h as a target which means that
+av_permissions.h is only generated when flask.h needs to be
+generated. This patch fixes this by adding av_permissions.h as a
+target to the rule.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index c0dfb9f3db692..c371634f35a3b 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -22,5 +22,5 @@ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
++$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+--
+2.39.2
+
--- /dev/null
+From a8287e8247951cf3146bdcd6e1480f8a9a2165a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 15:59:19 +0200
+Subject: selinux: fix Makefile dependencies of flask.h
+
+From: Ondrej Mosnacek <omosnace@redhat.com>
+
+[ Upstream commit bcab1adeaad4b39a1e04cb98979a367d08253f03 ]
+
+Make the flask.h target depend on the genheaders binary instead of
+classmap.h to ensure that it is rebuilt if any of the dependencies of
+genheaders are changed.
+
+Notably this fixes flask.h not being rebuilt when
+initial_sid_to_string.h is modified.
+
+Fixes: 8753f6bec352 ("selinux: generate flask headers during kernel build")
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/security/selinux/Makefile b/security/selinux/Makefile
+index ccf9504093841..c0dfb9f3db692 100644
+--- a/security/selinux/Makefile
++++ b/security/selinux/Makefile
+@@ -19,8 +19,8 @@ ccflags-y := -I$(srctree)/security/selinux -I$(srctree)/security/selinux/include
+ $(addprefix $(obj)/,$(selinux-y)): $(obj)/flask.h
+
+ quiet_cmd_flask = GEN $(obj)/flask.h $(obj)/av_permissions.h
+- cmd_flask = scripts/selinux/genheaders/genheaders $(obj)/flask.h $(obj)/av_permissions.h
++ cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
+
+ targets += flask.h av_permissions.h
+-$(obj)/flask.h: $(src)/include/classmap.h FORCE
++$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
+ $(call if_changed,flask)
+--
+2.39.2
+
--- /dev/null
+From 4c04db012894c16fcbff609c34807e99d2c93942 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Apr 2023 10:02:39 -0700
+Subject: serial: 8250: Add missing wakeup event reporting
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 0ba9e3a13c6adfa99e32b2576d20820ab10ad48a ]
+
+An 8250 UART configured as a wake-up source would not have reported
+itself through sysfs as being the source of wake-up, correct that.
+
+Fixes: b3b708fa2780 ("wake up from a serial port")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20230414170241.2016255-1-f.fainelli@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_port.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 907130244e1f5..3d369481d4db1 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -19,6 +19,7 @@
+ #include <linux/moduleparam.h>
+ #include <linux/ioport.h>
+ #include <linux/init.h>
++#include <linux/irq.h>
+ #include <linux/console.h>
+ #include <linux/sysrq.h>
+ #include <linux/delay.h>
+@@ -1840,6 +1841,7 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ unsigned char status;
+ unsigned long flags;
+ struct uart_8250_port *up = up_to_u8250p(port);
++ struct tty_port *tport = &port->state->port;
+ bool skip_rx = false;
+
+ if (iir & UART_IIR_NO_INT)
+@@ -1863,6 +1865,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir)
+ skip_rx = true;
+
+ if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) {
++ if (irqd_is_wakeup_set(irq_get_irq_data(port->irq)))
++ pm_wakeup_event(tport->tty->dev, 0);
+ if (!up->dma || handle_rx_dma(up, iir))
+ status = serial8250_rx_chars(up, status);
+ }
+--
+2.39.2
+
ubifs-fix-memleak-when-insert_old_idx-failed.patch
ubi-fix-return-value-overwrite-issue-in-try_write_vid_and_data.patch
ubifs-free-memory-for-tmpfile-name.patch
+selinux-fix-makefile-dependencies-of-flask.h.patch
+selinux-ensure-av_permissions.h-is-built-when-needed.patch
+tpm-tpm_tis-do-not-skip-reset-of-original-interrupt-.patch
+erofs-stop-parsing-non-compact-head-index-if-cluster.patch
+erofs-fix-potential-overflow-calculating-xattr_isize.patch
+drm-rockchip-drop-unbalanced-obj-unref.patch
+drm-vgem-add-missing-mutex_destroy.patch
+drm-probe-helper-cancel-previous-job-before-starting.patch
+arm64-dts-renesas-r8a77990-remove-bogus-voltages-fro.patch
+arm64-dts-renesas-r8a774c0-remove-bogus-voltages-fro.patch
+edac-skx-fix-overflows-on-the-dram-row-address-mappi.patch
+arm-dts-qcom-ipq4019-fix-the-pci-i-o-port-range.patch
+arm-dts-qcom-ipq8064-reduce-pci-io-size-to-64k.patch
+arm-dts-qcom-ipq8064-fix-the-pci-i-o-port-range.patch
+media-bdisp-add-missing-check-for-create_workqueue.patch
+media-uapi-add-media_bus_fmt_metadata_fixed-media-bu.patch
+media-av7110-prevent-underflow-in-write_ts_to_decode.patch
+firmware-qcom_scm-clear-download-bit-during-reboot.patch
+drm-msm-fix-unbalanced-pm_runtime_enable-in-adreno_g.patch
+drm-msm-adreno-defer-enabling-runpm-until-hw_init.patch
+drm-msm-adreno-drop-bogus-pm_runtime_set_active.patch
+mmc-sdhci-of-esdhc-fix-quirk-to-ignore-command-inhib.patch
+drm-lima-lima_drv-add-missing-unwind-goto-in-lima_pd.patch
+regulator-core-consistently-set-mutex_owner-when-usi.patch
+regulator-core-avoid-lockdep-reports-when-resolving-.patch
+x86-apic-fix-atomic-update-of-offset-in-reserve_eilv.patch
+media-dm1105-fix-use-after-free-bug-in-dm1105_remove.patch
+media-saa7134-fix-use-after-free-bug-in-saa7134_fini.patch
+media-rcar_fdp1-simplify-error-check-logic-at-fdp_op.patch
+media-rcar_fdp1-fix-pm_runtime_get_sync-usage-count.patch
+media-rcar_fdp1-make-use-of-the-helper-function-devm.patch
+media-rcar_fdp1-fix-the-correct-variable-assignments.patch
+media-rcar_fdp1-fix-refcount-leak-in-probe-and-remov.patch
+media-rc-gpio-ir-recv-fix-support-for-wake-up.patch
+regulator-stm32-pwr-fix-of_iomap-leak.patch
+x86-ioapic-don-t-return-0-from-arch_dynirq_lower_bou.patch
+arm64-kgdb-set-pstate.ss-to-1-to-re-enable-single-st.patch
+debugobject-prevent-init-race-with-static-objects.patch
+timekeeping-split-jiffies-seqlock.patch
+tick-sched-use-tick_next_period-for-lockless-quick-c.patch
+tick-sched-reduce-seqcount-held-scope-in-tick_do_upd.patch
+tick-sched-optimize-tick_do_update_jiffies64-further.patch
+tick-get-rid-of-tick_period.patch
+tick-common-align-tick-period-with-the-hz-tick.patch
+wifi-ath6kl-minor-fix-for-allocation-size.patch
+wifi-ath9k-hif_usb-fix-memory-leak-of-remain_skbs.patch
+wifi-ath5k-fix-an-off-by-one-check-in-ath5k_eeprom_r.patch
+wifi-ath6kl-reduce-warn-to-dev_dbg-in-callback.patch
+tools-bpftool-remove-invalid-json-escape.patch
+wifi-rtw88-mac-return-the-original-error-from-rtw_pw.patch
+wifi-rtw88-mac-return-the-original-error-from-rtw_ma.patch
+scm-fix-msg_ctrunc-setting-condition-for-so_passsec.patch
+vlan-partially-enable-siocshwtstamp-in-container.patch
+net-packet-annotate-accesses-to-po-xmit.patch
+net-packet-convert-po-origdev-to-an-atomic-flag.patch
+net-packet-convert-po-auxdata-to-an-atomic-flag.patch
+scsi-target-iscsit-fix-tas-handling-during-conn-clea.patch
+scsi-megaraid-fix-mega_cmd_done-cmdid_int_cmds.patch
+f2fs-handle-dqget-error-in-f2fs_transfer_project_quo.patch
+rtlwifi-start-changing-rt_trace-into-rtl_dbg.patch
+rtlwifi-replace-rt_trace-with-rtl_dbg.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch
+wifi-rtlwifi-fix-incorrect-error-codes-in-rtl_debugf.patch-16446
+bpftool-fix-bug-for-long-instructions-in-program-cfg.patch
+crypto-drbg-make-drbg_prepare_hrng-handle-jent-insta.patch
+crypto-drbg-only-fail-when-jent-is-unavailable-in-fi.patch
+scsi-lpfc-fix-ioremap-issues-in-lpfc_sli4_pci_mem_se.patch
+bpf-sockmap-fix-deadlocks-in-the-sockhash-and-sockma.patch
+nvme-handle-the-persistent-internal-error-aer.patch
+nvme-fix-async-event-trace-event.patch
+nvme-fcloop-fix-inconsistent-in-hardirq-w-hardirq-on.patch
+bpf-sockmap-revert-buggy-deadlock-fix-in-the-sockhas.patch
+md-raid10-fix-leak-of-r10bio-remaining-for-recovery.patch
+md-raid10-fix-memleak-for-conf-bio_split.patch
+md-update-the-optimal-i-o-size-on-reshape.patch
+md-raid10-fix-memleak-of-md-thread.patch
+wifi-iwlwifi-make-the-loop-for-card-preparation-effe.patch
+wifi-iwlwifi-mvm-check-firmware-response-size.patch
+ixgbe-allow-flow-hash-to-be-set-via-ethtool.patch
+ixgbe-enable-setting-rss-table-to-default-values.patch
+bpf-don-t-efault-for-getsockopt-with-optval-null.patch
+netfilter-nf_tables-don-t-write-table-validation-sta.patch
+ipv4-fix-potential-uninit-variable-access-bug-in-__i.patch
+revert-bluetooth-btsdio-fix-use-after-free-bug-in-bt.patch
+netlink-use-copy_to_user-for-optval-in-netlink_getso.patch
+net-amd-fix-link-leak-when-verifying-config-failed.patch
+tcp-udp-fix-memleaks-of-sk-and-zerocopy-skbs-with-tx.patch
+pstore-revert-pmsg_lock-back-to-a-normal-mutex.patch
+usb-host-xhci-rcar-remove-leftover-quirk-handling.patch
+fpga-bridge-fix-kernel-doc-parameter-description.patch
+iio-light-max44009-add-missing-of-device-matching.patch
+spi-imx-fsl-lpspi-convert-to-gpio-descriptors.patch
+spi-imx-enable-runtime-pm-support.patch
+spi-spi-imx-using-pm_runtime_resume_and_get-instead-.patch
+spi-imx-don-t-skip-cleanup-in-remove-s-error-path.patch
+usb-gadget-udc-renesas_usb3-fix-use-after-free-bug-i.patch
+pci-imx6-install-the-fault-handler-only-on-compatibl.patch
+genirq-add-irqf_no_autoen-for-request_irq-nmi.patch
+asoc-es8316-use-irqf_no_autoen-when-requesting-the-i.patch
+asoc-es8316-handle-optional-irq-assignment.patch
+linux-vt_buffer.h-allow-either-builtin-or-modular-fo.patch
+spi-qup-don-t-skip-cleanup-in-remove-s-error-path.patch
+spi-fsl-spi-fix-cpm-qe-mode-litte-endian.patch
+vmci_host-fix-a-race-condition-in-vmci_host_poll-cau.patch
+of-fix-modalias-string-generation.patch
+ia64-mm-contig-fix-section-mismatch-warning-error.patch
+ia64-salinfo-placate-defined-but-not-used-warning.patch
+scripts-gdb-bail-early-if-there-are-no-clocks.patch
+pm-domains-fix-up-terminology-with-parent-child.patch
+scripts-gdb-bail-early-if-there-are-no-generic-pd.patch
+mtd-spi-nor-cadence-quadspi-make-driver-independent-.patch
+mtd-spi-nor-cadence-quadspi-provide-a-way-to-disable.patch
+mtd-spi-nor-cadence-quadspi-don-t-initialize-rx_dma_.patch
+mtd-spi-nor-cadence-quadspi-handle-probe-deferral-wh.patch
+spi-cadence-quadspi-fix-suspend-resume-implementatio.patch
+uapi-linux-const.h-prefer-iso-friendly-__typeof__.patch
+sh-sq-fix-incorrect-element-size-for-allocating-bitm.patch
+usb-chipidea-fix-missing-goto-in-ci_hdrc_probe.patch
+usb-mtu3-fix-kernel-panic-at-qmu-transfer-done-irq-h.patch
+firmware-stratix10-svc-fix-an-null-vs-is_err-bug-in-.patch
+tty-serial-fsl_lpuart-adjust-buffer-length-to-the-in.patch
+serial-8250-add-missing-wakeup-event-reporting.patch
+staging-rtl8192e-fix-w_disable-does-not-work-after-s.patch
+spmi-add-a-check-for-remove-callback-when-removing-a.patch
+spi-bcm63xx-remove-pm_sleep-based-conditional-compil.patch
+macintosh-windfarm_smu_sat-add-missing-of_node_put.patch
+powerpc-mpc512x-fix-resource-printk-format-warning.patch
+powerpc-wii-fix-resource-printk-format-warnings.patch
+powerpc-sysdev-tsi108-fix-resource-printk-format-war.patch
+macintosh-via-pmu-led-requires-ata-to-be-set.patch
+powerpc-rtas-use-memmove-for-potentially-overlapping.patch
+perf-core-fix-hardlockup-failure-caused-by-perf-thro.patch
+rdma-siw-fix-potential-page_array-out-of-range-acces.patch
+rdma-rdmavt-delete-unnecessary-null-check.patch
+rtc-omap-include-header-for-omap_rtc_power_off_progr.patch
+rdma-mlx4-prevent-shift-wrapping-in-set_user_sq_size.patch
+rtc-meson-vrtc-use-ktime_get_real_ts64-to-get-the-cu.patch
+power-supply-generic-adc-battery-fix-unit-scaling.patch
+clk-add-missing-of_node_put-in-assigned-clocks-prope.patch
+rdma-siw-remove-namespace-check-from-siw_netdev_even.patch
+ib-hfi1-fix-sdma-mmu_rb_node-not-being-evicted-in-lr.patch
+nfsv4.1-always-send-a-reclaim_complete-after-establi.patch
+firmware-raspberrypi-keep-count-of-all-consumers.patch
+firmware-raspberrypi-introduce-devm_rpi_firmware_get.patch
+input-raspberrypi-ts-release-firmware-handle-when-no.patch
+input-raspberrypi-ts-fix-refcount-leak-in-rpi_ts_pro.patch
+sunrpc-remove-the-maximum-number-of-retries-in-call_.patch
+rdma-mlx5-use-correct-device-num_ports-when-modify-d.patch
+clocksource-drivers-davinci-avoid-trailing-n-hidden-.patch
+clocksource-davinci-axe-a-pointless-__gfp_nofail.patch
+clocksource-drivers-davinci-fix-memory-leak-in-davin.patch
+openrisc-properly-store-r31-to-pt_regs-on-unhandled-.patch
+ext4-fix-use-after-free-read-in-ext4_find_extent-for.patch
+leds-ti_lmu_common-select-regmap-instead-of-dependin.patch
+treewide-remove-redundant-is_err-before-error-code-c.patch
+dmaengine-mv_xor_v2-fix-an-error-code.patch
+pwm-mtk-disp-don-t-check-the-return-code-of-pwmchip_.patch
+pwm-mtk-disp-adjust-the-clocks-to-avoid-them-mismatc.patch
+pwm-mtk-disp-disable-shadow-registers-before-setting.patch
+phy-tegra-xusb-add-missing-tegra_xusb_port_unregiste.patch
+dmaengine-dw-edma-fix-to-change-for-continuous-trans.patch
+dmaengine-dw-edma-fix-to-enable-to-issue-dma-request.patch
+dmaengine-at_xdmac-do-not-enable-all-cyclic-channels.patch
+afs-fix-updating-of-i_size-with-dv-jump-from-server.patch
--- /dev/null
+From 29279e4cd25a185e2392da28bf22051f333d0438 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Apr 2023 13:48:52 +0200
+Subject: sh: sq: Fix incorrect element size for allocating bitmap buffer
+
+From: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+
+[ Upstream commit 80f746e2bd0e1da3fdb49a53570e54a1a225faac ]
+
+The Store Queue code allocates a bitmap buffer with the size of
+multiple of sizeof(long) in sq_api_init(). While the buffer size
+is calculated correctly, the code uses the wrong element size to
+allocate the buffer which results in the allocated bitmap buffer
+being too small.
+
+Fix this by allocating the buffer with kcalloc() with element size
+sizeof(long) instead of kzalloc() whose elements size defaults to
+sizeof(char).
+
+Fixes: d7c30c682a27 ("sh: Store Queue API rework.")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
+Link: https://lore.kernel.org/r/20230419114854.528677-1-glaubitz@physik.fu-berlin.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/kernel/cpu/sh4/sq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/sh/kernel/cpu/sh4/sq.c b/arch/sh/kernel/cpu/sh4/sq.c
+index 934ff84844fa0..c633fe4d70398 100644
+--- a/arch/sh/kernel/cpu/sh4/sq.c
++++ b/arch/sh/kernel/cpu/sh4/sq.c
+@@ -380,7 +380,7 @@ static int __init sq_api_init(void)
+ if (unlikely(!sq_cache))
+ return ret;
+
+- sq_bitmap = kzalloc(size, GFP_KERNEL);
++ sq_bitmap = kcalloc(size, sizeof(long), GFP_KERNEL);
+ if (unlikely(!sq_bitmap))
+ goto out;
+
+--
+2.39.2
+
--- /dev/null
+From 0b751c26b7553edd5a4c8a85e53ee87ee95192af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Apr 2023 17:46:15 +0530
+Subject: spi: bcm63xx: remove PM_SLEEP based conditional compilation
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 25f0617109496e1aff49594fbae5644286447a0f ]
+
+Get rid of conditional compilation based on CONFIG_PM_SLEEP because
+it may introduce build issues with certain configs where it maybe disabled
+This is because if above config is not enabled the suspend-resume
+functions are never part of the code but the bcm63xx_spi_pm_ops struct
+still inits them to non-existent suspend-resume functions.
+
+Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver")
+
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230420121615.967487-1-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm63xx.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
+index fdd7eaa0b8ede..7628987e11a7c 100644
+--- a/drivers/spi/spi-bcm63xx.c
++++ b/drivers/spi/spi-bcm63xx.c
+@@ -614,7 +614,6 @@ static int bcm63xx_spi_remove(struct platform_device *pdev)
+ return 0;
+ }
+
+-#ifdef CONFIG_PM_SLEEP
+ static int bcm63xx_spi_suspend(struct device *dev)
+ {
+ struct spi_master *master = dev_get_drvdata(dev);
+@@ -641,7 +640,6 @@ static int bcm63xx_spi_resume(struct device *dev)
+
+ return 0;
+ }
+-#endif
+
+ static const struct dev_pm_ops bcm63xx_spi_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(bcm63xx_spi_suspend, bcm63xx_spi_resume)
+--
+2.39.2
+
--- /dev/null
+From 0c94a130f13247eb1697a96b68604c55223328d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 14:40:27 +0530
+Subject: spi: cadence-quadspi: fix suspend-resume implementations
+
+From: Dhruva Gole <d-gole@ti.com>
+
+[ Upstream commit 2087e85bb66ee3652dafe732bb9b9b896229eafc ]
+
+The cadence QSPI driver misbehaves after performing a full system suspend
+resume:
+...
+spi-nor spi0.0: resume() failed
+...
+This results in a flash connected via OSPI interface after system suspend-
+resume to be unusable.
+fix these suspend and resume functions.
+
+Fixes: 140623410536 ("mtd: spi-nor: Add driver for Cadence Quad SPI Flash Controller")
+Signed-off-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20230417091027.966146-3-d-gole@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/spi-nor/cadence-quadspi.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c
+index 2c5a6587f505e..7bdc558d85601 100644
+--- a/drivers/mtd/spi-nor/cadence-quadspi.c
++++ b/drivers/mtd/spi-nor/cadence-quadspi.c
+@@ -1441,17 +1441,30 @@ static int cqspi_remove(struct platform_device *pdev)
+ static int cqspi_suspend(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
++ int ret;
+
++ ret = spi_master_suspend(master);
+ cqspi_controller_enable(cqspi, 0);
+- return 0;
++
++ clk_disable_unprepare(cqspi->clk);
++
++ return ret;
+ }
+
+ static int cqspi_resume(struct device *dev)
+ {
+ struct cqspi_st *cqspi = dev_get_drvdata(dev);
++ struct spi_master *master = dev_get_drvdata(dev);
+
+- cqspi_controller_enable(cqspi, 1);
+- return 0;
++ clk_prepare_enable(cqspi->clk);
++ cqspi_wait_idle(cqspi);
++ cqspi_controller_init(cqspi);
++
++ cqspi->current_cs = -1;
++ cqspi->sclk = 0;
++
++ return spi_master_resume(master);
+ }
+
+ static const struct dev_pm_ops cqspi__dev_pm_ops = {
+--
+2.39.2
+
--- /dev/null
+From ee5d5fc09b2a9bf2294a5b2d14277c429b447761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Apr 2023 19:59:46 +0200
+Subject: spi: fsl-spi: Fix CPM/QE mode Litte Endian
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit c20c57d9868d7f9fd1b2904c7801b07e128f6322 ]
+
+CPM has the same problem as QE so for CPM also use the fix added
+by commit 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian"):
+
+ CPM mode uses Little Endian so words > 8 bits are byte swapped.
+ Workaround this by always enforcing wordsize 8 for 16 and 32 bits
+ words. Unfortunately this will not work for LSB transfers
+ where wordsize is > 8 bits so disable these for now.
+
+Also limit the workaround to 16 and 32 bits words because it can
+only work for multiples of 8-bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Cc: Joakim Tjernlund <Joakim.Tjernlund@infinera.com>
+Fixes: 0398fb70940e ("spi/spi_mpc8xxx: Fix QE mode Litte Endian")
+Link: https://lore.kernel.org/r/1b7d3e84b1128f42c1887dd2fb9cdf390f541bc1.1680371809.git.christophe.leroy@csgroup.eu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 02b999d48ca19..ae805f91eafa5 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -208,8 +208,8 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ struct spi_device *spi,
+ int bits_per_word)
+ {
+- /* QE uses Little Endian for words > 8
+- * so transform all words > 8 into 8 bits
++ /* CPM/QE uses Little Endian for words > 8
++ * so transform 16 and 32 bits words into 8 bits
+ * Unfortnatly that doesn't work for LSB so
+ * reject these for now */
+ /* Note: 32 bits word, LSB works iff
+@@ -217,9 +217,11 @@ static int mspi_apply_qe_mode_quirks(struct spi_mpc8xxx_cs *cs,
+ if (spi->mode & SPI_LSB_FIRST &&
+ bits_per_word > 8)
+ return -EINVAL;
+- if (bits_per_word > 8)
++ if (bits_per_word <= 8)
++ return bits_per_word;
++ if (bits_per_word == 16 || bits_per_word == 32)
+ return 8; /* pretend its 8 bits */
+- return bits_per_word;
++ return -EINVAL;
+ }
+
+ static int fsl_spi_setup_transfer(struct spi_device *spi,
+@@ -249,7 +251,7 @@ static int fsl_spi_setup_transfer(struct spi_device *spi,
+ bits_per_word = mspi_apply_cpu_mode_quirks(cs, spi,
+ mpc8xxx_spi,
+ bits_per_word);
+- else if (mpc8xxx_spi->flags & SPI_QE)
++ else
+ bits_per_word = mspi_apply_qe_mode_quirks(cs, spi,
+ bits_per_word);
+
+--
+2.39.2
+
--- /dev/null
+From ca27eb15976c4e9cc19355dcc1b41b4f39d4479e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 07:57:32 +0100
+Subject: spi: imx: Don't skip cleanup in remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 11951c9e3f364d7ae3b568a0e52c8335d43066b5 ]
+
+Returning early in a platform driver's remove callback is wrong. In this
+case the dma resources are not released in the error path. this is never
+retried later and so this is a permanent leak. To fix this, only skip
+hardware disabling if waking the device fails.
+
+Fixes: d593574aff0a ("spi: imx: do not access registers while clocks disabled")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230306065733.2170662-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 780c234257ca8..ffd370abdab35 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1737,13 +1737,11 @@ static int spi_imx_remove(struct platform_device *pdev)
+
+ spi_bitbang_stop(&spi_imx->bitbang);
+
+- ret = pm_runtime_resume_and_get(spi_imx->dev);
+- if (ret < 0) {
+- dev_err(spi_imx->dev, "failed to enable clock\n");
+- return ret;
+- }
+-
+- writel(0, spi_imx->base + MXC_CSPICTRL);
++ ret = pm_runtime_get_sync(spi_imx->dev);
++ if (ret >= 0)
++ writel(0, spi_imx->base + MXC_CSPICTRL);
++ else
++ dev_warn(spi_imx->dev, "failed to enable clock, skip hw disable\n");
+
+ pm_runtime_dont_use_autosuspend(spi_imx->dev);
+ pm_runtime_put_sync(spi_imx->dev);
+--
+2.39.2
+
--- /dev/null
+From 7516b7ec64e1fc1ae822d99e2b36c9ca74bc2dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Jul 2020 14:33:54 +0800
+Subject: spi: imx: enable runtime pm support
+
+From: Clark Wang <xiaoning.wang@nxp.com>
+
+[ Upstream commit 525c9e5a32bd7951eae3f06d9d077fea51718a6c ]
+
+Enable runtime pm support for spi-imx driver.
+
+Signed-off-by: Clark Wang <xiaoning.wang@nxp.com>
+Link: https://lore.kernel.org/r/20200727063354.17031-1-xiaoning.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 121 ++++++++++++++++++++++++++++++------------
+ 1 file changed, 88 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 90793fc321358..95f1746a85d9d 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -13,7 +13,9 @@
+ #include <linux/irq.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
++#include <linux/pinctrl/consumer.h>
+ #include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
+ #include <linux/slab.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/spi_bitbang.h>
+@@ -30,6 +32,8 @@ static bool use_dma = true;
+ module_param(use_dma, bool, 0644);
+ MODULE_PARM_DESC(use_dma, "Enable usage of DMA when available (default)");
+
++#define MXC_RPM_TIMEOUT 2000 /* 2000ms */
++
+ #define MXC_CSPIRXDATA 0x00
+ #define MXC_CSPITXDATA 0x04
+ #define MXC_CSPICTRL 0x08
+@@ -1532,20 +1536,16 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg)
+ struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+ int ret;
+
+- ret = clk_enable(spi_imx->clk_per);
+- if (ret)
+- return ret;
+-
+- ret = clk_enable(spi_imx->clk_ipg);
+- if (ret) {
+- clk_disable(spi_imx->clk_per);
++ ret = pm_runtime_get_sync(spi_imx->dev);
++ if (ret < 0) {
++ dev_err(spi_imx->dev, "failed to enable clock\n");
+ return ret;
+ }
+
+ ret = spi_imx->devtype_data->prepare_message(spi_imx, msg);
+ if (ret) {
+- clk_disable(spi_imx->clk_ipg);
+- clk_disable(spi_imx->clk_per);
++ pm_runtime_mark_last_busy(spi_imx->dev);
++ pm_runtime_put_autosuspend(spi_imx->dev);
+ }
+
+ return ret;
+@@ -1556,8 +1556,8 @@ spi_imx_unprepare_message(struct spi_master *master, struct spi_message *msg)
+ {
+ struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+
+- clk_disable(spi_imx->clk_ipg);
+- clk_disable(spi_imx->clk_per);
++ pm_runtime_mark_last_busy(spi_imx->dev);
++ pm_runtime_put_autosuspend(spi_imx->dev);
+ return 0;
+ }
+
+@@ -1676,13 +1676,15 @@ static int spi_imx_probe(struct platform_device *pdev)
+ goto out_master_put;
+ }
+
+- ret = clk_prepare_enable(spi_imx->clk_per);
+- if (ret)
+- goto out_master_put;
++ pm_runtime_enable(spi_imx->dev);
++ pm_runtime_set_autosuspend_delay(spi_imx->dev, MXC_RPM_TIMEOUT);
++ pm_runtime_use_autosuspend(spi_imx->dev);
+
+- ret = clk_prepare_enable(spi_imx->clk_ipg);
+- if (ret)
+- goto out_put_per;
++ ret = pm_runtime_get_sync(spi_imx->dev);
++ if (ret < 0) {
++ dev_err(spi_imx->dev, "failed to enable clock\n");
++ goto out_runtime_pm_put;
++ }
+
+ spi_imx->spi_clk = clk_get_rate(spi_imx->clk_per);
+ /*
+@@ -1692,7 +1694,7 @@ static int spi_imx_probe(struct platform_device *pdev)
+ if (spi_imx->devtype_data->has_dmamode) {
+ ret = spi_imx_sdma_init(&pdev->dev, spi_imx, master);
+ if (ret == -EPROBE_DEFER)
+- goto out_clk_put;
++ goto out_runtime_pm_put;
+
+ if (ret < 0)
+ dev_err(&pdev->dev, "dma setup error %d, use pio\n",
+@@ -1707,19 +1709,20 @@ static int spi_imx_probe(struct platform_device *pdev)
+ ret = spi_bitbang_start(&spi_imx->bitbang);
+ if (ret) {
+ dev_err(&pdev->dev, "bitbang start failed with %d\n", ret);
+- goto out_clk_put;
++ goto out_runtime_pm_put;
+ }
+
+ dev_info(&pdev->dev, "probed\n");
+
+- clk_disable(spi_imx->clk_ipg);
+- clk_disable(spi_imx->clk_per);
++ pm_runtime_mark_last_busy(spi_imx->dev);
++ pm_runtime_put_autosuspend(spi_imx->dev);
++
+ return ret;
+
+-out_clk_put:
+- clk_disable_unprepare(spi_imx->clk_ipg);
+-out_put_per:
+- clk_disable_unprepare(spi_imx->clk_per);
++out_runtime_pm_put:
++ pm_runtime_dont_use_autosuspend(spi_imx->dev);
++ pm_runtime_put_sync(spi_imx->dev);
++ pm_runtime_disable(spi_imx->dev);
+ out_master_put:
+ spi_master_put(master);
+
+@@ -1734,30 +1737,82 @@ static int spi_imx_remove(struct platform_device *pdev)
+
+ spi_bitbang_stop(&spi_imx->bitbang);
+
+- ret = clk_enable(spi_imx->clk_per);
++ ret = pm_runtime_get_sync(spi_imx->dev);
++ if (ret < 0) {
++ dev_err(spi_imx->dev, "failed to enable clock\n");
++ return ret;
++ }
++
++ writel(0, spi_imx->base + MXC_CSPICTRL);
++
++ pm_runtime_dont_use_autosuspend(spi_imx->dev);
++ pm_runtime_put_sync(spi_imx->dev);
++ pm_runtime_disable(spi_imx->dev);
++
++ spi_imx_sdma_exit(spi_imx);
++ spi_master_put(master);
++
++ return 0;
++}
++
++static int __maybe_unused spi_imx_runtime_resume(struct device *dev)
++{
++ struct spi_master *master = dev_get_drvdata(dev);
++ struct spi_imx_data *spi_imx;
++ int ret;
++
++ spi_imx = spi_master_get_devdata(master);
++
++ ret = clk_prepare_enable(spi_imx->clk_per);
+ if (ret)
+ return ret;
+
+- ret = clk_enable(spi_imx->clk_ipg);
++ ret = clk_prepare_enable(spi_imx->clk_ipg);
+ if (ret) {
+- clk_disable(spi_imx->clk_per);
++ clk_disable_unprepare(spi_imx->clk_per);
+ return ret;
+ }
+
+- writel(0, spi_imx->base + MXC_CSPICTRL);
+- clk_disable_unprepare(spi_imx->clk_ipg);
++ return 0;
++}
++
++static int __maybe_unused spi_imx_runtime_suspend(struct device *dev)
++{
++ struct spi_master *master = dev_get_drvdata(dev);
++ struct spi_imx_data *spi_imx;
++
++ spi_imx = spi_master_get_devdata(master);
++
+ clk_disable_unprepare(spi_imx->clk_per);
+- spi_imx_sdma_exit(spi_imx);
+- spi_master_put(master);
++ clk_disable_unprepare(spi_imx->clk_ipg);
++
++ return 0;
++}
+
++static int __maybe_unused spi_imx_suspend(struct device *dev)
++{
++ pinctrl_pm_select_sleep_state(dev);
+ return 0;
+ }
+
++static int __maybe_unused spi_imx_resume(struct device *dev)
++{
++ pinctrl_pm_select_default_state(dev);
++ return 0;
++}
++
++static const struct dev_pm_ops imx_spi_pm = {
++ SET_RUNTIME_PM_OPS(spi_imx_runtime_suspend,
++ spi_imx_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(spi_imx_suspend, spi_imx_resume)
++};
++
+ static struct platform_driver spi_imx_driver = {
+ .driver = {
+ .name = DRIVER_NAME,
+ .of_match_table = spi_imx_dt_ids,
+- },
++ .pm = &imx_spi_pm,
++ },
+ .id_table = spi_imx_devtype,
+ .probe = spi_imx_probe,
+ .remove = spi_imx_remove,
+--
+2.39.2
+
--- /dev/null
+From 7704957f62ff7625f79205362f543662d486f93e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 22:02:52 +0200
+Subject: spi: imx/fsl-lpspi: Convert to GPIO descriptors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 8cdcd8aeee2819199ec7f68114b77b04c10611d3 ]
+
+This converts the two Freescale i.MX SPI drivers
+Freescale i.MX (CONFIG_SPI_IMX) and Freescale i.MX LPSPI
+(CONFIG_SPI_FSL_LPSPI) to use GPIO descriptors handled in
+the SPI core for GPIO chip selects whether defined in
+the device tree or a board file.
+
+The reason why both are converted at the same time is
+that they were both using the same platform data and
+platform device population helpers when using
+board files intertwining the code so this gives a cleaner
+cut.
+
+The platform device creation was passing a platform data
+container from each boardfile down to the driver using
+struct spi_imx_master from <linux/platform_data/spi-imx.h>,
+but this was only conveying the number of chipselects and
+an int * array of the chipselect GPIO numbers.
+
+The imx27 and imx31 platforms had code passing the
+now-unused platform data when creating the platform devices,
+this has been repurposed to pass around GPIO descriptor
+tables. The platform data struct that was just passing an
+array of integers and number of chip selects for the GPIO
+lines has been removed.
+
+The number of chipselects used to be passed from the board
+file, because this number also limits the number of native
+chipselects that the platform can use. To deal with this we
+just augment the i.MX (CONFIG_SPI_IMX) driver to support 3
+chipselects if the platform does not define "num-cs" as a
+device property (such as from the device tree). This covers
+all the legacy boards as these use <= 3 native chip selects
+(or GPIO lines, and in that case the number of chip selects
+is determined by the core from the number of available
+GPIO lines). Any new boards should use device tree, so
+this is a reasonable simplification to cover all old
+boards.
+
+The LPSPI driver never assigned the number of chipselects
+and thus always fall back to the core default of 1 chip
+select if no GPIOs are defined in the device tree.
+
+The Freescale i.MX driver was already partly utilizing
+the SPI core to obtain the GPIO numbers from the device tree,
+so this completes the transtion to let the core handle all
+of it.
+
+All board files and the core i.MX boardfile registration
+code is augmented to account for these changes.
+
+This has been compile-tested with the imx_v4_v5_defconfig
+and the imx_v6_v7_defconfig.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Shawn Guo <shawnguo@kernel.org>
+Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Cc: Robin Gong <yibin.gong@nxp.com>
+Cc: Trent Piepho <tpiepho@impinj.com>
+Cc: Clark Wang <xiaoning.wang@nxp.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Sascha Hauer <s.hauer@pengutronix.de>
+Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: NXP Linux Team <linux-imx@nxp.com>
+Link: https://lore.kernel.org/r/20200625200252.207614-1-linus.walleij@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-imx/devices-imx27.h | 10 +--
+ arch/arm/mach-imx/devices-imx31.h | 10 +--
+ arch/arm/mach-imx/devices/devices-common.h | 5 +-
+ arch/arm/mach-imx/devices/platform-spi_imx.c | 9 +-
+ arch/arm/mach-imx/mach-mx27_3ds.c | 40 ++++++---
+ arch/arm/mach-imx/mach-mx31_3ds.c | 13 +--
+ arch/arm/mach-imx/mach-mx31lilly.c | 14 +--
+ arch/arm/mach-imx/mach-mx31lite.c | 19 +---
+ arch/arm/mach-imx/mach-mx31moboard.c | 12 +--
+ arch/arm/mach-imx/mach-pca100.c | 21 +++--
+ arch/arm/mach-imx/mach-pcm037_eet.c | 7 +-
+ drivers/spi/spi-fsl-lpspi.c | 47 +---------
+ drivers/spi/spi-imx.c | 92 ++++----------------
+ include/linux/platform_data/spi-imx.h | 33 -------
+ 14 files changed, 88 insertions(+), 244 deletions(-)
+ delete mode 100644 include/linux/platform_data/spi-imx.h
+
+diff --git a/arch/arm/mach-imx/devices-imx27.h b/arch/arm/mach-imx/devices-imx27.h
+index f89f4ae0e1ca6..583a1d773d682 100644
+--- a/arch/arm/mach-imx/devices-imx27.h
++++ b/arch/arm/mach-imx/devices-imx27.h
+@@ -75,11 +75,11 @@ extern const struct imx_mxc_w1_data imx27_mxc_w1_data;
+ imx_add_mxc_w1(&imx27_mxc_w1_data)
+
+ extern const struct imx_spi_imx_data imx27_cspi_data[];
+-#define imx27_add_cspi(id, pdata) \
+- imx_add_spi_imx(&imx27_cspi_data[id], pdata)
+-#define imx27_add_spi_imx0(pdata) imx27_add_cspi(0, pdata)
+-#define imx27_add_spi_imx1(pdata) imx27_add_cspi(1, pdata)
+-#define imx27_add_spi_imx2(pdata) imx27_add_cspi(2, pdata)
++#define imx27_add_cspi(id, gtable) \
++ imx_add_spi_imx(&imx27_cspi_data[id], gtable)
++#define imx27_add_spi_imx0(gtable) imx27_add_cspi(0, gtable)
++#define imx27_add_spi_imx1(gtable) imx27_add_cspi(1, gtable)
++#define imx27_add_spi_imx2(gtable) imx27_add_cspi(2, gtable)
+
+ extern const struct imx_pata_imx_data imx27_pata_imx_data;
+ #define imx27_add_pata_imx() \
+diff --git a/arch/arm/mach-imx/devices-imx31.h b/arch/arm/mach-imx/devices-imx31.h
+index 5a4ba35a47ed0..f7cc623725322 100644
+--- a/arch/arm/mach-imx/devices-imx31.h
++++ b/arch/arm/mach-imx/devices-imx31.h
+@@ -69,11 +69,11 @@ extern const struct imx_mxc_w1_data imx31_mxc_w1_data;
+ imx_add_mxc_w1(&imx31_mxc_w1_data)
+
+ extern const struct imx_spi_imx_data imx31_cspi_data[];
+-#define imx31_add_cspi(id, pdata) \
+- imx_add_spi_imx(&imx31_cspi_data[id], pdata)
+-#define imx31_add_spi_imx0(pdata) imx31_add_cspi(0, pdata)
+-#define imx31_add_spi_imx1(pdata) imx31_add_cspi(1, pdata)
+-#define imx31_add_spi_imx2(pdata) imx31_add_cspi(2, pdata)
++#define imx31_add_cspi(id, gtable) \
++ imx_add_spi_imx(&imx31_cspi_data[id], gtable)
++#define imx31_add_spi_imx0(gtable) imx31_add_cspi(0, gtable)
++#define imx31_add_spi_imx1(gtable) imx31_add_cspi(1, gtable)
++#define imx31_add_spi_imx2(gtable) imx31_add_cspi(2, gtable)
+
+ extern const struct imx_pata_imx_data imx31_pata_imx_data;
+ #define imx31_add_pata_imx() \
+diff --git a/arch/arm/mach-imx/devices/devices-common.h b/arch/arm/mach-imx/devices/devices-common.h
+index 2a685adec1df7..f8f3e4967c31f 100644
+--- a/arch/arm/mach-imx/devices/devices-common.h
++++ b/arch/arm/mach-imx/devices/devices-common.h
+@@ -6,6 +6,7 @@
+ #include <linux/kernel.h>
+ #include <linux/platform_device.h>
+ #include <linux/init.h>
++#include <linux/gpio/machine.h>
+ #include <linux/platform_data/dma-imx-sdma.h>
+
+ extern struct device mxc_aips_bus;
+@@ -276,7 +277,6 @@ struct platform_device *__init imx_add_sdhci_esdhc_imx(
+ const struct imx_sdhci_esdhc_imx_data *data,
+ const struct esdhc_platform_data *pdata);
+
+-#include <linux/platform_data/spi-imx.h>
+ struct imx_spi_imx_data {
+ const char *devid;
+ int id;
+@@ -285,8 +285,7 @@ struct imx_spi_imx_data {
+ int irq;
+ };
+ struct platform_device *__init imx_add_spi_imx(
+- const struct imx_spi_imx_data *data,
+- const struct spi_imx_master *pdata);
++ const struct imx_spi_imx_data *data, struct gpiod_lookup_table *gtable);
+
+ struct platform_device *imx_add_imx_dma(char *name, resource_size_t iobase,
+ int irq, int irq_err);
+diff --git a/arch/arm/mach-imx/devices/platform-spi_imx.c b/arch/arm/mach-imx/devices/platform-spi_imx.c
+index f2cafa52c1872..27747bf628a31 100644
+--- a/arch/arm/mach-imx/devices/platform-spi_imx.c
++++ b/arch/arm/mach-imx/devices/platform-spi_imx.c
+@@ -3,6 +3,7 @@
+ * Copyright (C) 2009-2010 Pengutronix
+ * Uwe Kleine-Koenig <u.kleine-koenig@pengutronix.de>
+ */
++#include <linux/gpio/machine.h>
+ #include "../hardware.h"
+ #include "devices-common.h"
+
+@@ -57,8 +58,7 @@ const struct imx_spi_imx_data imx35_cspi_data[] __initconst = {
+ #endif /* ifdef CONFIG_SOC_IMX35 */
+
+ struct platform_device *__init imx_add_spi_imx(
+- const struct imx_spi_imx_data *data,
+- const struct spi_imx_master *pdata)
++ const struct imx_spi_imx_data *data, struct gpiod_lookup_table *gtable)
+ {
+ struct resource res[] = {
+ {
+@@ -71,7 +71,8 @@ struct platform_device *__init imx_add_spi_imx(
+ .flags = IORESOURCE_IRQ,
+ },
+ };
+-
++ if (gtable)
++ gpiod_add_lookup_table(gtable);
+ return imx_add_platform_device(data->devid, data->id,
+- res, ARRAY_SIZE(res), pdata, sizeof(*pdata));
++ res, ARRAY_SIZE(res), NULL, 0);
+ }
+diff --git a/arch/arm/mach-imx/mach-mx27_3ds.c b/arch/arm/mach-imx/mach-mx27_3ds.c
+index 7b8325fb5b413..51204521b903b 100644
+--- a/arch/arm/mach-imx/mach-mx27_3ds.c
++++ b/arch/arm/mach-imx/mach-mx27_3ds.c
+@@ -304,18 +304,34 @@ static struct imx_ssi_platform_data mx27_3ds_ssi_pdata = {
+ };
+
+ /* SPI */
+-static int spi1_chipselect[] = {SPI1_SS0};
+-
+-static const struct spi_imx_master spi1_pdata __initconst = {
+- .chipselect = spi1_chipselect,
+- .num_chipselect = ARRAY_SIZE(spi1_chipselect),
++static struct gpiod_lookup_table mx27_spi1_gpiod_table = {
++ .dev_id = "imx27-cspi.0", /* Actual device name for spi1 */
++ .table = {
++ /*
++ * The i.MX27 has the i.MX21 GPIO controller, the SPI1 CS GPIO
++ * SPI1_SS0 is numbered IMX_GPIO_NR(4, 28).
++ *
++ * This is in "bank 4" which is subtracted by one in the macro
++ * so this is actually bank 3 on "imx21-gpio.3".
++ */
++ GPIO_LOOKUP_IDX("imx21-gpio.3", 28, "cs", 0, GPIO_ACTIVE_LOW),
++ { },
++ },
+ };
+
+-static int spi2_chipselect[] = {SPI2_SS0};
+-
+-static const struct spi_imx_master spi2_pdata __initconst = {
+- .chipselect = spi2_chipselect,
+- .num_chipselect = ARRAY_SIZE(spi2_chipselect),
++static struct gpiod_lookup_table mx27_spi2_gpiod_table = {
++ .dev_id = "imx27-cspi.1", /* Actual device name for spi2 */
++ .table = {
++ /*
++ * The i.MX27 has the i.MX21 GPIO controller, the SPI2 CS GPIO
++ * SPI2_SS0 is numbered IMX_GPIO_NR(4, 21).
++ *
++ * This is in "bank 4" which is subtracted by one in the macro
++ * so this is actually bank 3 on "imx21-gpio.3".
++ */
++ GPIO_LOOKUP_IDX("imx21-gpio.3", 21, "cs", 0, GPIO_ACTIVE_LOW),
++ { },
++ },
+ };
+
+ static struct imx_fb_videomode mx27_3ds_modes[] = {
+@@ -389,8 +405,8 @@ static void __init mx27pdk_init(void)
+ imx27_add_imx_keypad(&mx27_3ds_keymap_data);
+ imx27_add_imx2_wdt();
+
+- imx27_add_spi_imx1(&spi2_pdata);
+- imx27_add_spi_imx0(&spi1_pdata);
++ imx27_add_spi_imx1(&mx27_spi2_gpiod_table);
++ imx27_add_spi_imx0(&mx27_spi1_gpiod_table);
+
+ imx27_add_imx_i2c(0, &mx27_3ds_i2c0_data);
+ imx27_add_imx_fb(&mx27_3ds_fb_data);
+diff --git a/arch/arm/mach-imx/mach-mx31_3ds.c b/arch/arm/mach-imx/mach-mx31_3ds.c
+index 716d2ad511035..99295ce8d0549 100644
+--- a/arch/arm/mach-imx/mach-mx31_3ds.c
++++ b/arch/arm/mach-imx/mach-mx31_3ds.c
+@@ -364,15 +364,6 @@ static struct imx_ssi_platform_data mx31_3ds_ssi_pdata = {
+ .flags = IMX_SSI_DMA | IMX_SSI_NET,
+ };
+
+-/* SPI */
+-static const struct spi_imx_master spi0_pdata __initconst = {
+- .num_chipselect = 3,
+-};
+-
+-static const struct spi_imx_master spi1_pdata __initconst = {
+- .num_chipselect = 3,
+-};
+-
+ static struct spi_board_info mx31_3ds_spi_devs[] __initdata = {
+ {
+ .modalias = "mc13783",
+@@ -548,14 +539,14 @@ static void __init mx31_3ds_init(void)
+ imx31_add_imx_uart0(&uart_pdata);
+ imx31_add_mxc_nand(&mx31_3ds_nand_board_info);
+
+- imx31_add_spi_imx1(&spi1_pdata);
++ imx31_add_spi_imx1(NULL);
+
+ imx31_add_imx_keypad(&mx31_3ds_keymap_data);
+
+ imx31_add_imx2_wdt();
+ imx31_add_imx_i2c0(&mx31_3ds_i2c0_data);
+
+- imx31_add_spi_imx0(&spi0_pdata);
++ imx31_add_spi_imx0(NULL);
+ imx31_add_ipu_core();
+ imx31_add_mx3_sdc_fb(&mx3fb_pdata);
+
+diff --git a/arch/arm/mach-imx/mach-mx31lilly.c b/arch/arm/mach-imx/mach-mx31lilly.c
+index 8f725248299e1..4b955ccc92cdc 100644
+--- a/arch/arm/mach-imx/mach-mx31lilly.c
++++ b/arch/arm/mach-imx/mach-mx31lilly.c
+@@ -215,16 +215,6 @@ static void __init lilly1131_usb_init(void)
+ imx31_add_mxc_ehci_hs(2, &usbh2_pdata);
+ }
+
+-/* SPI */
+-
+-static const struct spi_imx_master spi0_pdata __initconst = {
+- .num_chipselect = 3,
+-};
+-
+-static const struct spi_imx_master spi1_pdata __initconst = {
+- .num_chipselect = 3,
+-};
+-
+ static struct mc13xxx_platform_data mc13783_pdata __initdata = {
+ .flags = MC13XXX_USE_RTC | MC13XXX_USE_TOUCHSCREEN,
+ };
+@@ -281,8 +271,8 @@ static void __init mx31lilly_board_init(void)
+ mxc_iomux_alloc_pin(MX31_PIN_CSPI2_SS1__SS1, "SPI2_SS1");
+ mxc_iomux_alloc_pin(MX31_PIN_CSPI2_SS2__SS2, "SPI2_SS2");
+
+- imx31_add_spi_imx0(&spi0_pdata);
+- imx31_add_spi_imx1(&spi1_pdata);
++ imx31_add_spi_imx0(NULL);
++ imx31_add_spi_imx1(NULL);
+
+ regulator_register_fixed(0, dummy_supplies, ARRAY_SIZE(dummy_supplies));
+ }
+diff --git a/arch/arm/mach-imx/mach-mx31lite.c b/arch/arm/mach-imx/mach-mx31lite.c
+index c0055f57c02dd..aaccf52f7ac16 100644
+--- a/arch/arm/mach-imx/mach-mx31lite.c
++++ b/arch/arm/mach-imx/mach-mx31lite.c
+@@ -73,11 +73,6 @@ static const struct imxuart_platform_data uart_pdata __initconst = {
+ .flags = IMXUART_HAVE_RTSCTS,
+ };
+
+-/* SPI */
+-static const struct spi_imx_master spi0_pdata __initconst = {
+- .num_chipselect = 3,
+-};
+-
+ static const struct mxc_nand_platform_data
+ mx31lite_nand_board_info __initconst = {
+ .width = 1,
+@@ -111,16 +106,6 @@ static struct platform_device smsc911x_device = {
+ },
+ };
+
+-/*
+- * SPI
+- *
+- * The MC13783 is the only hard-wired SPI device on the module.
+- */
+-
+-static const struct spi_imx_master spi1_pdata __initconst = {
+- .num_chipselect = 1,
+-};
+-
+ static struct mc13xxx_platform_data mc13783_pdata __initdata = {
+ .flags = MC13XXX_USE_RTC,
+ };
+@@ -246,13 +231,13 @@ static void __init mx31lite_init(void)
+ "mx31lite");
+
+ imx31_add_imx_uart0(&uart_pdata);
+- imx31_add_spi_imx0(&spi0_pdata);
++ imx31_add_spi_imx0(NULL);
+
+ /* NOR and NAND flash */
+ platform_device_register(&physmap_flash_device);
+ imx31_add_mxc_nand(&mx31lite_nand_board_info);
+
+- imx31_add_spi_imx1(&spi1_pdata);
++ imx31_add_spi_imx1(NULL);
+
+ regulator_register_fixed(0, dummy_supplies, ARRAY_SIZE(dummy_supplies));
+ }
+diff --git a/arch/arm/mach-imx/mach-mx31moboard.c b/arch/arm/mach-imx/mach-mx31moboard.c
+index 36f08f45b0cad..96845a4eaf57e 100644
+--- a/arch/arm/mach-imx/mach-mx31moboard.c
++++ b/arch/arm/mach-imx/mach-mx31moboard.c
+@@ -143,10 +143,6 @@ static const struct imxi2c_platform_data moboard_i2c1_data __initconst = {
+ .bitrate = 100000,
+ };
+
+-static const struct spi_imx_master moboard_spi1_pdata __initconst = {
+- .num_chipselect = 3,
+-};
+-
+ static struct regulator_consumer_supply sdhc_consumers[] = {
+ {
+ .dev_name = "imx31-mmc.0",
+@@ -287,10 +283,6 @@ static struct spi_board_info moboard_spi_board_info[] __initdata = {
+ },
+ };
+
+-static const struct spi_imx_master moboard_spi2_pdata __initconst = {
+- .num_chipselect = 2,
+-};
+-
+ #define SDHC1_CD IOMUX_TO_GPIO(MX31_PIN_ATA_CS0)
+ #define SDHC1_WP IOMUX_TO_GPIO(MX31_PIN_ATA_CS1)
+
+@@ -514,8 +506,8 @@ static void __init mx31moboard_init(void)
+ imx31_add_imx_i2c0(&moboard_i2c0_data);
+ imx31_add_imx_i2c1(&moboard_i2c1_data);
+
+- imx31_add_spi_imx1(&moboard_spi1_pdata);
+- imx31_add_spi_imx2(&moboard_spi2_pdata);
++ imx31_add_spi_imx1(NULL);
++ imx31_add_spi_imx2(NULL);
+
+ mx31moboard_init_cam();
+
+diff --git a/arch/arm/mach-imx/mach-pca100.c b/arch/arm/mach-imx/mach-pca100.c
+index 2e28e1b5cddfd..27a3678e0658a 100644
+--- a/arch/arm/mach-imx/mach-pca100.c
++++ b/arch/arm/mach-imx/mach-pca100.c
+@@ -14,6 +14,7 @@
+ #include <linux/irq.h>
+ #include <linux/delay.h>
+ #include <linux/gpio.h>
++#include <linux/gpio/machine.h>
+ #include <linux/usb/otg.h>
+ #include <linux/usb/ulpi.h>
+
+@@ -188,11 +189,19 @@ static struct spi_board_info pca100_spi_board_info[] __initdata = {
+ },
+ };
+
+-static int pca100_spi_cs[] = {SPI1_SS0, SPI1_SS1};
+-
+-static const struct spi_imx_master pca100_spi0_data __initconst = {
+- .chipselect = pca100_spi_cs,
+- .num_chipselect = ARRAY_SIZE(pca100_spi_cs),
++static struct gpiod_lookup_table pca100_spi0_gpiod_table = {
++ .dev_id = "imx27-cspi.0", /* Actual device name for spi0 */
++ .table = {
++ /*
++ * The i.MX27 has the i.MX21 GPIO controller, port D is
++ * bank 3 and thus named "imx21-gpio.3".
++ * SPI1_SS0 is GPIO_PORTD + 28
++ * SPI1_SS1 is GPIO_PORTD + 27
++ */
++ GPIO_LOOKUP_IDX("imx21-gpio.3", 28, "cs", 0, GPIO_ACTIVE_LOW),
++ GPIO_LOOKUP_IDX("imx21-gpio.3", 27, "cs", 1, GPIO_ACTIVE_LOW),
++ { },
++ },
+ };
+
+ static void pca100_ac97_warm_reset(struct snd_ac97 *ac97)
+@@ -362,7 +371,7 @@ static void __init pca100_init(void)
+ mxc_gpio_mode(GPIO_PORTD | 27 | GPIO_GPIO | GPIO_IN);
+ spi_register_board_info(pca100_spi_board_info,
+ ARRAY_SIZE(pca100_spi_board_info));
+- imx27_add_spi_imx0(&pca100_spi0_data);
++ imx27_add_spi_imx0(&pca100_spi0_gpiod_table);
+
+ imx27_add_imx_fb(&pca100_fb_data);
+
+diff --git a/arch/arm/mach-imx/mach-pcm037_eet.c b/arch/arm/mach-imx/mach-pcm037_eet.c
+index 51f5142920cf5..8b0e03a595c19 100644
+--- a/arch/arm/mach-imx/mach-pcm037_eet.c
++++ b/arch/arm/mach-imx/mach-pcm037_eet.c
+@@ -52,11 +52,6 @@ static struct spi_board_info pcm037_spi_dev[] = {
+ },
+ };
+
+-/* Platform Data for MXC CSPI */
+-static const struct spi_imx_master pcm037_spi1_pdata __initconst = {
+- .num_chipselect = 2,
+-};
+-
+ /* GPIO-keys input device */
+ static struct gpio_keys_button pcm037_gpio_keys[] = {
+ {
+@@ -163,7 +158,7 @@ int __init pcm037_eet_init_devices(void)
+
+ /* SPI */
+ spi_register_board_info(pcm037_spi_dev, ARRAY_SIZE(pcm037_spi_dev));
+- imx31_add_spi_imx0(&pcm037_spi1_pdata);
++ imx31_add_spi_imx0(NULL);
+
+ imx_add_gpio_keys(&pcm037_gpio_keys_platform_data);
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 58b2da91be1c0..a813c192a018d 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -11,7 +11,6 @@
+ #include <linux/dmaengine.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/err.h>
+-#include <linux/gpio.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/irq.h>
+@@ -19,11 +18,9 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+-#include <linux/of_gpio.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/platform_device.h>
+ #include <linux/platform_data/dma-imx.h>
+-#include <linux/platform_data/spi-imx.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/slab.h>
+ #include <linux/spi/spi.h>
+@@ -227,20 +224,6 @@ static int lpspi_unprepare_xfer_hardware(struct spi_controller *controller)
+ return 0;
+ }
+
+-static int fsl_lpspi_prepare_message(struct spi_controller *controller,
+- struct spi_message *msg)
+-{
+- struct fsl_lpspi_data *fsl_lpspi =
+- spi_controller_get_devdata(controller);
+- struct spi_device *spi = msg->spi;
+- int gpio = fsl_lpspi->chipselect[spi->chip_select];
+-
+- if (gpio_is_valid(gpio))
+- gpio_direction_output(gpio, spi->mode & SPI_CS_HIGH ? 0 : 1);
+-
+- return 0;
+-}
+-
+ static void fsl_lpspi_write_tx_fifo(struct fsl_lpspi_data *fsl_lpspi)
+ {
+ u8 txfifo_cnt;
+@@ -835,13 +818,10 @@ static int fsl_lpspi_init_rpm(struct fsl_lpspi_data *fsl_lpspi)
+
+ static int fsl_lpspi_probe(struct platform_device *pdev)
+ {
+- struct device_node *np = pdev->dev.of_node;
+ struct fsl_lpspi_data *fsl_lpspi;
+ struct spi_controller *controller;
+- struct spi_imx_master *lpspi_platform_info =
+- dev_get_platdata(&pdev->dev);
+ struct resource *res;
+- int i, ret, irq;
++ int ret, irq;
+ u32 temp;
+ bool is_slave;
+
+@@ -871,6 +851,8 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ controller->dev.of_node = pdev->dev.of_node;
+ controller->bus_num = pdev->id;
+ controller->slave_abort = fsl_lpspi_slave_abort;
++ if (!fsl_lpspi->is_slave)
++ controller->use_gpio_descriptors = true;
+
+ ret = devm_spi_register_controller(&pdev->dev, controller);
+ if (ret < 0) {
+@@ -878,29 +860,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ goto out_controller_put;
+ }
+
+- if (!fsl_lpspi->is_slave) {
+- for (i = 0; i < controller->num_chipselect; i++) {
+- int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
+-
+- if (!gpio_is_valid(cs_gpio) && lpspi_platform_info)
+- cs_gpio = lpspi_platform_info->chipselect[i];
+-
+- fsl_lpspi->chipselect[i] = cs_gpio;
+- if (!gpio_is_valid(cs_gpio))
+- continue;
+-
+- ret = devm_gpio_request(&pdev->dev,
+- fsl_lpspi->chipselect[i],
+- DRIVER_NAME);
+- if (ret) {
+- dev_err(&pdev->dev, "can't get cs gpios\n");
+- goto out_controller_put;
+- }
+- }
+- controller->cs_gpios = fsl_lpspi->chipselect;
+- controller->prepare_message = fsl_lpspi_prepare_message;
+- }
+-
+ init_completion(&fsl_lpspi->xfer_done);
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 9d593675257e0..90793fc321358 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -8,7 +8,6 @@
+ #include <linux/dmaengine.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/err.h>
+-#include <linux/gpio.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/irq.h>
+@@ -21,10 +20,9 @@
+ #include <linux/types.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
+-#include <linux/of_gpio.h>
++#include <linux/property.h>
+
+ #include <linux/platform_data/dma-imx.h>
+-#include <linux/platform_data/spi-imx.h>
+
+ #define DRIVER_NAME "spi_imx"
+
+@@ -727,7 +725,7 @@ static int mx31_prepare_transfer(struct spi_imx_data *spi_imx,
+ reg |= MX31_CSPICTRL_POL;
+ if (spi->mode & SPI_CS_HIGH)
+ reg |= MX31_CSPICTRL_SSPOL;
+- if (!gpio_is_valid(spi->cs_gpio))
++ if (!spi->cs_gpiod)
+ reg |= (spi->chip_select) <<
+ (is_imx35_cspi(spi_imx) ? MX35_CSPICTRL_CS_SHIFT :
+ MX31_CSPICTRL_CS_SHIFT);
+@@ -827,7 +825,7 @@ static int mx21_prepare_transfer(struct spi_imx_data *spi_imx,
+ reg |= MX21_CSPICTRL_POL;
+ if (spi->mode & SPI_CS_HIGH)
+ reg |= MX21_CSPICTRL_SSPOL;
+- if (!gpio_is_valid(spi->cs_gpio))
++ if (!spi->cs_gpiod)
+ reg |= spi->chip_select << MX21_CSPICTRL_CS_SHIFT;
+
+ writel(reg, spi_imx->base + MXC_CSPICTRL);
+@@ -1056,20 +1054,6 @@ static const struct of_device_id spi_imx_dt_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(of, spi_imx_dt_ids);
+
+-static void spi_imx_chipselect(struct spi_device *spi, int is_active)
+-{
+- int active = is_active != BITBANG_CS_INACTIVE;
+- int dev_is_lowactive = !(spi->mode & SPI_CS_HIGH);
+-
+- if (spi->mode & SPI_NO_CS)
+- return;
+-
+- if (!gpio_is_valid(spi->cs_gpio))
+- return;
+-
+- gpio_set_value(spi->cs_gpio, dev_is_lowactive ^ active);
+-}
+-
+ static void spi_imx_set_burst_len(struct spi_imx_data *spi_imx, int n_bits)
+ {
+ u32 ctrl;
+@@ -1535,15 +1519,6 @@ static int spi_imx_setup(struct spi_device *spi)
+ dev_dbg(&spi->dev, "%s: mode %d, %u bpw, %d hz\n", __func__,
+ spi->mode, spi->bits_per_word, spi->max_speed_hz);
+
+- if (spi->mode & SPI_NO_CS)
+- return 0;
+-
+- if (gpio_is_valid(spi->cs_gpio))
+- gpio_direction_output(spi->cs_gpio,
+- spi->mode & SPI_CS_HIGH ? 0 : 1);
+-
+- spi_imx_chipselect(spi, BITBANG_CS_INACTIVE);
+-
+ return 0;
+ }
+
+@@ -1601,20 +1576,14 @@ static int spi_imx_probe(struct platform_device *pdev)
+ struct device_node *np = pdev->dev.of_node;
+ const struct of_device_id *of_id =
+ of_match_device(spi_imx_dt_ids, &pdev->dev);
+- struct spi_imx_master *mxc_platform_info =
+- dev_get_platdata(&pdev->dev);
+ struct spi_master *master;
+ struct spi_imx_data *spi_imx;
+ struct resource *res;
+- int i, ret, irq, spi_drctl;
++ int ret, irq, spi_drctl;
+ const struct spi_imx_devtype_data *devtype_data = of_id ? of_id->data :
+ (struct spi_imx_devtype_data *)pdev->id_entry->driver_data;
+ bool slave_mode;
+-
+- if (!np && !mxc_platform_info) {
+- dev_err(&pdev->dev, "can't get the platform data\n");
+- return -EINVAL;
+- }
++ u32 val;
+
+ slave_mode = devtype_data->has_slavemode &&
+ of_property_read_bool(np, "spi-slave");
+@@ -1637,6 +1606,7 @@ static int spi_imx_probe(struct platform_device *pdev)
+
+ master->bits_per_word_mask = SPI_BPW_RANGE_MASK(1, 32);
+ master->bus_num = np ? -1 : pdev->id;
++ master->use_gpio_descriptors = true;
+
+ spi_imx = spi_master_get_devdata(master);
+ spi_imx->bitbang.master = master;
+@@ -1645,28 +1615,17 @@ static int spi_imx_probe(struct platform_device *pdev)
+
+ spi_imx->devtype_data = devtype_data;
+
+- /* Get number of chip selects, either platform data or OF */
+- if (mxc_platform_info) {
+- master->num_chipselect = mxc_platform_info->num_chipselect;
+- if (mxc_platform_info->chipselect) {
+- master->cs_gpios = devm_kcalloc(&master->dev,
+- master->num_chipselect, sizeof(int),
+- GFP_KERNEL);
+- if (!master->cs_gpios)
+- return -ENOMEM;
+-
+- for (i = 0; i < master->num_chipselect; i++)
+- master->cs_gpios[i] = mxc_platform_info->chipselect[i];
+- }
+- } else {
+- u32 num_cs;
+-
+- if (!of_property_read_u32(np, "num-cs", &num_cs))
+- master->num_chipselect = num_cs;
+- /* If not preset, default value of 1 is used */
+- }
++ /*
++ * Get number of chip selects from device properties. This can be
++ * coming from device tree or boardfiles, if it is not defined,
++ * a default value of 3 chip selects will be used, as all the legacy
++ * board files have <= 3 chip selects.
++ */
++ if (!device_property_read_u32(&pdev->dev, "num-cs", &val))
++ master->num_chipselect = val;
++ else
++ master->num_chipselect = 3;
+
+- spi_imx->bitbang.chipselect = spi_imx_chipselect;
+ spi_imx->bitbang.setup_transfer = spi_imx_setupxfer;
+ spi_imx->bitbang.txrx_bufs = spi_imx_transfer;
+ spi_imx->bitbang.master->setup = spi_imx_setup;
+@@ -1751,31 +1710,12 @@ static int spi_imx_probe(struct platform_device *pdev)
+ goto out_clk_put;
+ }
+
+- /* Request GPIO CS lines, if any */
+- if (!spi_imx->slave_mode && master->cs_gpios) {
+- for (i = 0; i < master->num_chipselect; i++) {
+- if (!gpio_is_valid(master->cs_gpios[i]))
+- continue;
+-
+- ret = devm_gpio_request(&pdev->dev,
+- master->cs_gpios[i],
+- DRIVER_NAME);
+- if (ret) {
+- dev_err(&pdev->dev, "Can't get CS GPIO %i\n",
+- master->cs_gpios[i]);
+- goto out_spi_bitbang;
+- }
+- }
+- }
+-
+ dev_info(&pdev->dev, "probed\n");
+
+ clk_disable(spi_imx->clk_ipg);
+ clk_disable(spi_imx->clk_per);
+ return ret;
+
+-out_spi_bitbang:
+- spi_bitbang_stop(&spi_imx->bitbang);
+ out_clk_put:
+ clk_disable_unprepare(spi_imx->clk_ipg);
+ out_put_per:
+diff --git a/include/linux/platform_data/spi-imx.h b/include/linux/platform_data/spi-imx.h
+deleted file mode 100644
+index 328f670d10bd7..0000000000000
+--- a/include/linux/platform_data/spi-imx.h
++++ /dev/null
+@@ -1,33 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-
+-#ifndef __MACH_SPI_H_
+-#define __MACH_SPI_H_
+-
+-/*
+- * struct spi_imx_master - device.platform_data for SPI controller devices.
+- * @chipselect: Array of chipselects for this master or NULL. Numbers >= 0
+- * mean GPIO pins, -ENOENT means internal CSPI chipselect
+- * matching the position in the array. E.g., if chipselect[1] =
+- * -ENOENT then a SPI slave using chip select 1 will use the
+- * native SS1 line of the CSPI. Omitting the array will use
+- * all native chip selects.
+-
+- * Normally you want to use gpio based chip selects as the CSPI
+- * module tries to be intelligent about when to assert the
+- * chipselect: The CSPI module deasserts the chipselect once it
+- * runs out of input data. The other problem is that it is not
+- * possible to mix between high active and low active chipselects
+- * on one single bus using the internal chipselects.
+- * Unfortunately, on some SoCs, Freescale decided to put some
+- * chipselects on dedicated pins which are not usable as gpios,
+- * so we have to support the internal chipselects.
+- *
+- * @num_chipselect: If @chipselect is specified, ARRAY_SIZE(chipselect),
+- * otherwise the number of native chip selects.
+- */
+-struct spi_imx_master {
+- int *chipselect;
+- int num_chipselect;
+-};
+-
+-#endif /* __MACH_SPI_H_*/
+--
+2.39.2
+
--- /dev/null
+From 5ea0abf830a8b0d195255eca54f6af7f788f6217 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Mar 2023 23:03:40 +0200
+Subject: spi: qup: Don't skip cleanup in remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 61f49171a43ab1f80c73c5c88c508770c461e0f2 ]
+
+Returning early in a platform driver's remove callback is wrong. In this
+case the dma resources are not released in the error path. this is never
+retried later and so this is a permanent leak. To fix this, only skip
+hardware disabling if waking the device fails.
+
+Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Link: https://lore.kernel.org/r/20230330210341.2459548-2-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qup.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index ead6c211047d5..ebcf9f4d5679e 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1276,18 +1276,22 @@ static int spi_qup_remove(struct platform_device *pdev)
+ struct spi_qup *controller = spi_master_get_devdata(master);
+ int ret;
+
+- ret = pm_runtime_resume_and_get(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ ret = pm_runtime_get_sync(&pdev->dev);
+
+- ret = spi_qup_set_state(controller, QUP_STATE_RESET);
+- if (ret)
+- return ret;
++ if (ret >= 0) {
++ ret = spi_qup_set_state(controller, QUP_STATE_RESET);
++ if (ret)
++ dev_warn(&pdev->dev, "failed to reset controller (%pe)\n",
++ ERR_PTR(ret));
+
+- spi_qup_release_dma(master);
++ clk_disable_unprepare(controller->cclk);
++ clk_disable_unprepare(controller->iclk);
++ } else {
++ dev_warn(&pdev->dev, "failed to resume, skip hw disable (%pe)\n",
++ ERR_PTR(ret));
++ }
+
+- clk_disable_unprepare(controller->cclk);
+- clk_disable_unprepare(controller->iclk);
++ spi_qup_release_dma(master);
+
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+--
+2.39.2
+
--- /dev/null
+From af1684e36a6be041fe0556a931486ad55ad2b692 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Apr 2022 08:53:42 +0000
+Subject: spi: spi-imx: using pm_runtime_resume_and_get instead of
+ pm_runtime_get_sync
+
+From: Minghao Chi <chi.minghao@zte.com.cn>
+
+[ Upstream commit 7d34ff58f35c82207698f43af79817a05e1342e5 ]
+
+Using pm_runtime_resume_and_get() to replace pm_runtime_get_sync and
+pm_runtime_put_noidle. This change is just to simplify the code, no
+actual functional changes.
+
+Reported-by: Zeal Robot <zealci@zte.com.cn>
+Signed-off-by: Minghao Chi <chi.minghao@zte.com.cn>
+Link: https://lore.kernel.org/r/20220414085343.2541608-1-chi.minghao@zte.com.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: 11951c9e3f36 ("spi: imx: Don't skip cleanup in remove's error path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-imx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index 95f1746a85d9d..780c234257ca8 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -1536,7 +1536,7 @@ spi_imx_prepare_message(struct spi_master *master, struct spi_message *msg)
+ struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+ int ret;
+
+- ret = pm_runtime_get_sync(spi_imx->dev);
++ ret = pm_runtime_resume_and_get(spi_imx->dev);
+ if (ret < 0) {
+ dev_err(spi_imx->dev, "failed to enable clock\n");
+ return ret;
+@@ -1737,7 +1737,7 @@ static int spi_imx_remove(struct platform_device *pdev)
+
+ spi_bitbang_stop(&spi_imx->bitbang);
+
+- ret = pm_runtime_get_sync(spi_imx->dev);
++ ret = pm_runtime_resume_and_get(spi_imx->dev);
+ if (ret < 0) {
+ dev_err(spi_imx->dev, "failed to enable clock\n");
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 23d7d8b3605d4e60103afffe9112c9c4420d9c08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Apr 2023 15:38:34 -0700
+Subject: spmi: Add a check for remove callback when removing a SPMI driver
+
+From: Jishnu Prakash <quic_jprakash@quicinc.com>
+
+[ Upstream commit b56eef3e16d888883fefab47425036de80dd38fc ]
+
+When removing a SPMI driver, there can be a crash due to NULL pointer
+dereference if it does not have a remove callback defined. This is
+one such call trace observed when removing the QCOM SPMI PMIC driver:
+
+ dump_backtrace.cfi_jt+0x0/0x8
+ dump_stack_lvl+0xd8/0x16c
+ panic+0x188/0x498
+ __cfi_slowpath+0x0/0x214
+ __cfi_slowpath+0x1dc/0x214
+ spmi_drv_remove+0x16c/0x1e0
+ device_release_driver_internal+0x468/0x79c
+ driver_detach+0x11c/0x1a0
+ bus_remove_driver+0xc4/0x124
+ driver_unregister+0x58/0x84
+ cleanup_module+0x1c/0xc24 [qcom_spmi_pmic]
+ __do_sys_delete_module+0x3ec/0x53c
+ __arm64_sys_delete_module+0x18/0x28
+ el0_svc_common+0xdc/0x294
+ el0_svc+0x38/0x9c
+ el0_sync_handler+0x8c/0xf0
+ el0_sync+0x1b4/0x1c0
+
+If a driver has all its resources allocated through devm_() APIs and
+does not need any other explicit cleanup, it would not require a
+remove callback to be defined. Hence, add a check for remove callback
+presence before calling it when removing a SPMI driver.
+
+Link: https://lore.kernel.org/r/1671601032-18397-2-git-send-email-quic_jprakash@quicinc.com
+Fixes: 6f00f8c8635f ("mfd: qcom-spmi-pmic: Use devm_of_platform_populate()")
+Fixes: 5a86bf343976 ("spmi: Linux driver framework for SPMI")
+Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lore.kernel.org/r/20230413223834.4084793-7-sboyd@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spmi/spmi.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
+index c16b60f645a4d..8ca7e004a53dc 100644
+--- a/drivers/spmi/spmi.c
++++ b/drivers/spmi/spmi.c
+@@ -348,7 +348,8 @@ static int spmi_drv_remove(struct device *dev)
+ const struct spmi_driver *sdrv = to_spmi_driver(dev->driver);
+
+ pm_runtime_get_sync(dev);
+- sdrv->remove(to_spmi_device(dev));
++ if (sdrv->remove)
++ sdrv->remove(to_spmi_device(dev));
+ pm_runtime_put_noidle(dev);
+
+ pm_runtime_disable(dev);
+--
+2.39.2
+
--- /dev/null
+From cbc1d883348434b9773450e349e23393e9e36b80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 22:02:01 +0200
+Subject: staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
+
+From: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+
+[ Upstream commit 3fac2397f562eb669ddc2f45867a253f3fc26184 ]
+
+When loading the driver for rtl8192e, the W_DISABLE# switch is working as
+intended. But when the WLAN is turned off in software and then turned on
+again the W_DISABLE# does not work anymore. Reason for this is that in
+the function _rtl92e_dm_check_rf_ctrl_gpio() the bfirst_after_down is
+checked and returned when true. bfirst_after_down is set true when
+switching the WLAN off in software. But it is not set to false again
+when WLAN is turned on again.
+
+Add bfirst_after_down = false in _rtl92e_sta_up to reset bit and fix
+above described bug.
+
+Fixes: 94a799425eee ("From: wlanfae <wlanfae@realtek.com> [PATCH 1/8] rtl8192e: Import new version of driver from realtek")
+Signed-off-by: Philipp Hortmann <philipp.g.hortmann@gmail.com>
+Link: https://lore.kernel.org/r/20230418200201.GA17398@matrix-ESPRIMO-P710
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+index bcbf0c8cd4209..be377e75703bf 100644
+--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+@@ -767,6 +767,7 @@ static int _rtl92e_sta_up(struct net_device *dev, bool is_silent_reset)
+ else
+ netif_wake_queue(dev);
+
++ priv->bfirst_after_down = false;
+ return 0;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 4ba883895e8f0973abf0a904d0eedfc2adbafb95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 13:19:02 -0700
+Subject: SUNRPC: remove the maximum number of retries in call_bind_status
+
+From: Dai Ngo <dai.ngo@oracle.com>
+
+[ Upstream commit 691d0b782066a6eeeecbfceb7910a8f6184e6105 ]
+
+Currently call_bind_status places a hard limit of 3 to the number of
+retries on EACCES error. This limit was done to prevent NLM unlock
+requests from being hang forever when the server keeps returning garbage.
+However this change causes problem for cases when NLM service takes
+longer than 9 seconds to register with the port mapper after a restart.
+
+This patch removes this hard coded limit and let the RPC handles
+the retry based on the standard hard/soft task semantics.
+
+Fixes: 0b760113a3a1 ("NLM: Don't hang forever on NLM unlock requests")
+Reported-by: Helen Chao <helen.chao@oracle.com>
+Tested-by: Helen Chao <helen.chao@oracle.com>
+Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sunrpc/sched.h | 3 +--
+ net/sunrpc/clnt.c | 3 ---
+ net/sunrpc/sched.c | 1 -
+ 3 files changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
+index a6ef35184ef13..5c37fabdec103 100644
+--- a/include/linux/sunrpc/sched.h
++++ b/include/linux/sunrpc/sched.h
+@@ -90,8 +90,7 @@ struct rpc_task {
+ #endif
+ unsigned char tk_priority : 2,/* Task priority */
+ tk_garb_retry : 2,
+- tk_cred_retry : 2,
+- tk_rebind_retry : 2;
++ tk_cred_retry : 2;
+ };
+
+ typedef void (*rpc_action)(struct rpc_task *);
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index 012b0504264de..629c05ff1f3e6 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -2003,9 +2003,6 @@ call_bind_status(struct rpc_task *task)
+ status = -EOPNOTSUPP;
+ break;
+ }
+- if (task->tk_rebind_retry == 0)
+- break;
+- task->tk_rebind_retry--;
+ rpc_delay(task, 3*HZ);
+ goto retry_timeout;
+ case -ENOBUFS:
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index 32ffa801a5b97..a5c6a3d05741a 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -827,7 +827,6 @@ rpc_init_task_statistics(struct rpc_task *task)
+ /* Initialize retry counters */
+ task->tk_garb_retry = 2;
+ task->tk_cred_retry = 2;
+- task->tk_rebind_retry = 2;
+
+ /* starting timestamp */
+ task->tk_start = ktime_get();
+--
+2.39.2
+
--- /dev/null
+From db3bee3028c8375de8ac39715ba0b37a01c3e09e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 15:20:22 -0700
+Subject: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
+
+From: Kuniyuki Iwashima <kuniyu@amazon.com>
+
+[ Upstream commit 50749f2dd6854a41830996ad302aef2ffaf011d8 ]
+
+syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY
+skbs. We can reproduce the problem with these sequences:
+
+ sk = socket(AF_INET, SOCK_DGRAM, 0)
+ sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE)
+ sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1)
+ sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53))
+ sk.close()
+
+sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets
+skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct
+ubuf_info_msgzc indirectly holds a refcnt of the socket. When the
+skb is sent, __skb_tstamp_tx() clones it and puts the clone into
+the socket's error queue with the TX timestamp.
+
+When the original skb is received locally, skb_copy_ubufs() calls
+skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt.
+This additional count is decremented while freeing the skb, but struct
+ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is
+not called.
+
+The last refcnt is not released unless we retrieve the TX timestamped
+skb by recvmsg(). Since we clear the error queue in inet_sock_destruct()
+after the socket's refcnt reaches 0, there is a circular dependency.
+If we close() the socket holding such skbs, we never call sock_put()
+and leak the count, sk, and skb.
+
+TCP has the same problem, and commit e0c8bccd40fc ("net: stream:
+purge sk_error_queue in sk_stream_kill_queues()") tried to fix it
+by calling skb_queue_purge() during close(). However, there is a
+small chance that skb queued in a qdisc or device could be put
+into the error queue after the skb_queue_purge() call.
+
+In __skb_tstamp_tx(), the cloned skb should not have a reference
+to the ubuf to remove the circular dependency, but skb_clone() does
+not call skb_copy_ubufs() for zerocopy skb. So, we need to call
+skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs().
+
+[0]:
+BUG: memory leak
+unreferenced object 0xffff88800c6d2d00 (size 1152):
+ comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................
+ 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
+ backtrace:
+ [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024
+ [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083
+ [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline]
+ [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245
+ [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515
+ [<00000000b9b11231>] sock_create net/socket.c:1566 [inline]
+ [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline]
+ [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline]
+ [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636
+ [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline]
+ [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline]
+ [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647
+ [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+ [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+BUG: memory leak
+unreferenced object 0xffff888017633a00 (size 240):
+ comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m.....
+ backtrace:
+ [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497
+ [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline]
+ [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596
+ [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline]
+ [<00000000be626478>] msg_zerocopy_realloc+0x1ce/0x7f0 net/core/skbuff.c:1370
+ [<00000000cbfc9870>] __ip_append_data+0x2adf/0x3b30 net/ipv4/ip_output.c:1037
+ [<0000000089869146>] ip_make_skb+0x26c/0x2e0 net/ipv4/ip_output.c:1652
+ [<00000000098015c2>] udp_sendmsg+0x1bac/0x2390 net/ipv4/udp.c:1253
+ [<0000000045e0e95e>] inet_sendmsg+0x10a/0x150 net/ipv4/af_inet.c:819
+ [<000000008d31bfde>] sock_sendmsg_nosec net/socket.c:714 [inline]
+ [<000000008d31bfde>] sock_sendmsg+0x141/0x190 net/socket.c:734
+ [<0000000021e21aa4>] __sys_sendto+0x243/0x360 net/socket.c:2117
+ [<00000000ac0af00c>] __do_sys_sendto net/socket.c:2129 [inline]
+ [<00000000ac0af00c>] __se_sys_sendto net/socket.c:2125 [inline]
+ [<00000000ac0af00c>] __x64_sys_sendto+0xe1/0x1c0 net/socket.c:2125
+ [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
+ [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+Fixes: f214f915e7db ("tcp: enable MSG_ZEROCOPY")
+Fixes: b5947e5d1e71 ("udp: msg_zerocopy")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/skbuff.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 0547aa2c8b131..291d7a9e04839 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4632,6 +4632,9 @@ void __skb_tstamp_tx(struct sk_buff *orig_skb,
+ skb = alloc_skb(0, GFP_ATOMIC);
+ } else {
+ skb = skb_clone(orig_skb, GFP_ATOMIC);
++
++ if (skb_orphan_frags_rx(skb, GFP_ATOMIC))
++ return;
+ }
+ if (!skb)
+ return;
+--
+2.39.2
+
--- /dev/null
+From 073de093cb136b303b3fb6309bdd4d4f5a2eea8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Apr 2023 14:26:39 +0200
+Subject: tick/common: Align tick period with the HZ tick.
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit e9523a0d81899361214d118ad60ef76f0e92f71d ]
+
+With HIGHRES enabled tick_sched_timer() is programmed every jiffy to
+expire the timer_list timers. This timer is programmed accurate in
+respect to CLOCK_MONOTONIC so that 0 seconds and nanoseconds is the
+first tick and the next one is 1000/CONFIG_HZ ms later. For HZ=250 it is
+every 4 ms and so based on the current time the next tick can be
+computed.
+
+This accuracy broke since the commit mentioned below because the jiffy
+based clocksource is initialized with higher accuracy in
+read_persistent_wall_and_boot_offset(). This higher accuracy is
+inherited during the setup in tick_setup_device(). The timer still fires
+every 4ms with HZ=250 but timer is no longer aligned with
+CLOCK_MONOTONIC with 0 as it origin but has an offset in the us/ns part
+of the timestamp. The offset differs with every boot and makes it
+impossible for user land to align with the tick.
+
+Align the tick period with CLOCK_MONOTONIC ensuring that it is always a
+multiple of 1000/CONFIG_HZ ms.
+
+Fixes: 857baa87b6422 ("sched/clock: Enable sched clock early")
+Reported-by: Gusenleitner Klaus <gus@keba.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/20230406095735.0_14edn3@linutronix.de
+Link: https://lore.kernel.org/r/20230418122639.ikgfvu3f@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-common.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 92bf99d558b48..2b7448ae5b478 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -216,9 +216,19 @@ static void tick_setup_device(struct tick_device *td,
+ * this cpu:
+ */
+ if (tick_do_timer_cpu == TICK_DO_TIMER_BOOT) {
++ ktime_t next_p;
++ u32 rem;
++
+ tick_do_timer_cpu = cpu;
+
+- tick_next_period = ktime_get();
++ next_p = ktime_get();
++ div_u64_rem(next_p, TICK_NSEC, &rem);
++ if (rem) {
++ next_p -= rem;
++ next_p += TICK_NSEC;
++ }
++
++ tick_next_period = next_p;
+ #ifdef CONFIG_NO_HZ_FULL
+ /*
+ * The boot CPU may be nohz_full, in which case set
+--
+2.39.2
+
--- /dev/null
+From f786046c8d8283c1e30b7d3b775822010000fa10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:49 +0100
+Subject: tick: Get rid of tick_period
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit b996544916429946bf4934c1c01a306d1690972c ]
+
+The variable tick_period is initialized to NSEC_PER_TICK / HZ during boot
+and never updated again.
+
+If NSEC_PER_TICK is not an integer multiple of HZ this computation is less
+accurate than TICK_NSEC which has proper rounding in place.
+
+Aside of the inaccuracy there is no reason for having this variable at
+all. It's just a pointless indirection and all usage sites can just use the
+TICK_NSEC constant.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.766643526@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-broadcast.c | 2 +-
+ kernel/time/tick-common.c | 8 +++-----
+ kernel/time/tick-internal.h | 1 -
+ kernel/time/tick-sched.c | 22 +++++++++++-----------
+ 4 files changed, 15 insertions(+), 18 deletions(-)
+
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index e51778c312f1c..ce7339ff10d22 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -331,7 +331,7 @@ static void tick_handle_periodic_broadcast(struct clock_event_device *dev)
+ bc_local = tick_do_periodic_broadcast();
+
+ if (clockevent_state_oneshot(dev)) {
+- ktime_t next = ktime_add(dev->next_event, tick_period);
++ ktime_t next = ktime_add_ns(dev->next_event, TICK_NSEC);
+
+ clockevents_program_event(dev, next, true);
+ }
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 6c9c342dd0e53..92bf99d558b48 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -30,7 +30,6 @@ DEFINE_PER_CPU(struct tick_device, tick_cpu_device);
+ * Tick next event: keeps track of the tick time
+ */
+ ktime_t tick_next_period;
+-ktime_t tick_period;
+
+ /*
+ * tick_do_timer_cpu is a timer core internal variable which holds the CPU NR
+@@ -88,7 +87,7 @@ static void tick_periodic(int cpu)
+ write_seqcount_begin(&jiffies_seq);
+
+ /* Keep track of the next tick event */
+- tick_next_period = ktime_add(tick_next_period, tick_period);
++ tick_next_period = ktime_add_ns(tick_next_period, TICK_NSEC);
+
+ do_timer(1);
+ write_seqcount_end(&jiffies_seq);
+@@ -127,7 +126,7 @@ void tick_handle_periodic(struct clock_event_device *dev)
+ * Setup the next period for devices, which do not have
+ * periodic mode:
+ */
+- next = ktime_add(next, tick_period);
++ next = ktime_add_ns(next, TICK_NSEC);
+
+ if (!clockevents_program_event(dev, next, false))
+ return;
+@@ -173,7 +172,7 @@ void tick_setup_periodic(struct clock_event_device *dev, int broadcast)
+ for (;;) {
+ if (!clockevents_program_event(dev, next, false))
+ return;
+- next = ktime_add(next, tick_period);
++ next = ktime_add_ns(next, TICK_NSEC);
+ }
+ }
+ }
+@@ -220,7 +219,6 @@ static void tick_setup_device(struct tick_device *td,
+ tick_do_timer_cpu = cpu;
+
+ tick_next_period = ktime_get();
+- tick_period = NSEC_PER_SEC / HZ;
+ #ifdef CONFIG_NO_HZ_FULL
+ /*
+ * The boot CPU may be nohz_full, in which case set
+diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
+index 5294f5b1f9550..e61c1244e7d46 100644
+--- a/kernel/time/tick-internal.h
++++ b/kernel/time/tick-internal.h
+@@ -15,7 +15,6 @@
+
+ DECLARE_PER_CPU(struct tick_device, tick_cpu_device);
+ extern ktime_t tick_next_period;
+-extern ktime_t tick_period;
+ extern int tick_do_timer_cpu __read_mostly;
+
+ extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast);
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 3b00167656d78..1b5037ba4ec40 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -92,17 +92,17 @@ static void tick_do_update_jiffies64(ktime_t now)
+ write_seqcount_begin(&jiffies_seq);
+
+ delta = ktime_sub(now, tick_next_period);
+- if (unlikely(delta >= tick_period)) {
++ if (unlikely(delta >= TICK_NSEC)) {
+ /* Slow path for long idle sleep times */
+- s64 incr = ktime_to_ns(tick_period);
++ s64 incr = TICK_NSEC;
+
+ ticks += ktime_divns(delta, incr);
+
+ last_jiffies_update = ktime_add_ns(last_jiffies_update,
+ incr * ticks);
+ } else {
+- last_jiffies_update = ktime_add(last_jiffies_update,
+- tick_period);
++ last_jiffies_update = ktime_add_ns(last_jiffies_update,
++ TICK_NSEC);
+ }
+
+ do_timer(ticks);
+@@ -112,7 +112,7 @@ static void tick_do_update_jiffies64(ktime_t now)
+ * pairs with the READ_ONCE() in the lockless quick check above.
+ */
+ WRITE_ONCE(tick_next_period,
+- ktime_add(last_jiffies_update, tick_period));
++ ktime_add_ns(last_jiffies_update, TICK_NSEC));
+
+ write_seqcount_end(&jiffies_seq);
+ raw_spin_unlock(&jiffies_lock);
+@@ -659,7 +659,7 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now)
+ hrtimer_set_expires(&ts->sched_timer, ts->last_tick);
+
+ /* Forward the time to expire in the future */
+- hrtimer_forward(&ts->sched_timer, now, tick_period);
++ hrtimer_forward(&ts->sched_timer, now, TICK_NSEC);
+
+ if (ts->nohz_mode == NOHZ_MODE_HIGHRES) {
+ hrtimer_start_expires(&ts->sched_timer,
+@@ -1221,7 +1221,7 @@ static void tick_nohz_handler(struct clock_event_device *dev)
+ if (unlikely(ts->tick_stopped))
+ return;
+
+- hrtimer_forward(&ts->sched_timer, now, tick_period);
++ hrtimer_forward(&ts->sched_timer, now, TICK_NSEC);
+ tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+ }
+
+@@ -1258,7 +1258,7 @@ static void tick_nohz_switch_to_nohz(void)
+ next = tick_init_jiffy_update();
+
+ hrtimer_set_expires(&ts->sched_timer, next);
+- hrtimer_forward_now(&ts->sched_timer, tick_period);
++ hrtimer_forward_now(&ts->sched_timer, TICK_NSEC);
+ tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1);
+ tick_nohz_activate(ts, NOHZ_MODE_LOWRES);
+ }
+@@ -1324,7 +1324,7 @@ static enum hrtimer_restart tick_sched_timer(struct hrtimer *timer)
+ if (unlikely(ts->tick_stopped))
+ return HRTIMER_NORESTART;
+
+- hrtimer_forward(timer, now, tick_period);
++ hrtimer_forward(timer, now, TICK_NSEC);
+
+ return HRTIMER_RESTART;
+ }
+@@ -1358,13 +1358,13 @@ void tick_setup_sched_timer(void)
+
+ /* Offset the tick to avert jiffies_lock contention. */
+ if (sched_skew_tick) {
+- u64 offset = ktime_to_ns(tick_period) >> 1;
++ u64 offset = TICK_NSEC >> 1;
+ do_div(offset, num_possible_cpus());
+ offset *= smp_processor_id();
+ hrtimer_add_expires_ns(&ts->sched_timer, offset);
+ }
+
+- hrtimer_forward(&ts->sched_timer, now, tick_period);
++ hrtimer_forward(&ts->sched_timer, now, TICK_NSEC);
+ hrtimer_start_expires(&ts->sched_timer, HRTIMER_MODE_ABS_PINNED_HARD);
+ tick_nohz_activate(ts, NOHZ_MODE_HIGHRES);
+ }
+--
+2.39.2
+
--- /dev/null
+From 0259d65a05de18da3dc82eab1030aab889f12714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:47 +0100
+Subject: tick/sched: Optimize tick_do_update_jiffies64() further
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 7a35bf2a6a871cd0252cd371d741e7d070b53af9 ]
+
+Now that it's clear that there is always one tick to account, simplify the
+calculations some more.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.565663056@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-sched.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index eaeeb4bb1f8ab..3b00167656d78 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -53,7 +53,7 @@ static ktime_t last_jiffies_update;
+ */
+ static void tick_do_update_jiffies64(ktime_t now)
+ {
+- unsigned long ticks = 0;
++ unsigned long ticks = 1;
+ ktime_t delta;
+
+ /*
+@@ -91,20 +91,21 @@ static void tick_do_update_jiffies64(ktime_t now)
+
+ write_seqcount_begin(&jiffies_seq);
+
+- last_jiffies_update = ktime_add(last_jiffies_update, tick_period);
+-
+ delta = ktime_sub(now, tick_next_period);
+ if (unlikely(delta >= tick_period)) {
+ /* Slow path for long idle sleep times */
+ s64 incr = ktime_to_ns(tick_period);
+
+- ticks = ktime_divns(delta, incr);
++ ticks += ktime_divns(delta, incr);
+
+ last_jiffies_update = ktime_add_ns(last_jiffies_update,
+ incr * ticks);
++ } else {
++ last_jiffies_update = ktime_add(last_jiffies_update,
++ tick_period);
+ }
+
+- do_timer(++ticks);
++ do_timer(ticks);
+
+ /*
+ * Keep the tick_next_period variable up to date. WRITE_ONCE()
+--
+2.39.2
+
--- /dev/null
+From 6b3839e771988366f333ad251c4c4474deae7a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:46 +0100
+Subject: tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit 94ad2e3cedb82af034f6d97c58022f162b669f9b ]
+
+If jiffies are up to date already (caller lost the race against another
+CPU) there is no point to change the sequence count. Doing that just forces
+other CPUs into the seqcount retry loop in tick_nohz_next_event() for
+nothing.
+
+Just bail out early.
+
+[ tglx: Rewrote most of it ]
+
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.462195901@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-sched.c | 47 +++++++++++++++++++---------------------
+ 1 file changed, 22 insertions(+), 25 deletions(-)
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 1dfa53494164a..eaeeb4bb1f8ab 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -84,38 +84,35 @@ static void tick_do_update_jiffies64(ktime_t now)
+
+ /* Reevaluate with jiffies_lock held */
+ raw_spin_lock(&jiffies_lock);
++ if (ktime_before(now, tick_next_period)) {
++ raw_spin_unlock(&jiffies_lock);
++ return;
++ }
++
+ write_seqcount_begin(&jiffies_seq);
+
+- delta = ktime_sub(now, last_jiffies_update);
+- if (delta >= tick_period) {
++ last_jiffies_update = ktime_add(last_jiffies_update, tick_period);
+
+- delta = ktime_sub(delta, tick_period);
+- last_jiffies_update = ktime_add(last_jiffies_update,
+- tick_period);
++ delta = ktime_sub(now, tick_next_period);
++ if (unlikely(delta >= tick_period)) {
++ /* Slow path for long idle sleep times */
++ s64 incr = ktime_to_ns(tick_period);
+
+- /* Slow path for long timeouts */
+- if (unlikely(delta >= tick_period)) {
+- s64 incr = ktime_to_ns(tick_period);
++ ticks = ktime_divns(delta, incr);
+
+- ticks = ktime_divns(delta, incr);
++ last_jiffies_update = ktime_add_ns(last_jiffies_update,
++ incr * ticks);
++ }
+
+- last_jiffies_update = ktime_add_ns(last_jiffies_update,
+- incr * ticks);
+- }
+- do_timer(++ticks);
++ do_timer(++ticks);
++
++ /*
++ * Keep the tick_next_period variable up to date. WRITE_ONCE()
++ * pairs with the READ_ONCE() in the lockless quick check above.
++ */
++ WRITE_ONCE(tick_next_period,
++ ktime_add(last_jiffies_update, tick_period));
+
+- /*
+- * Keep the tick_next_period variable up to date.
+- * WRITE_ONCE() pairs with the READ_ONCE() in the lockless
+- * quick check above.
+- */
+- WRITE_ONCE(tick_next_period,
+- ktime_add(last_jiffies_update, tick_period));
+- } else {
+- write_seqcount_end(&jiffies_seq);
+- raw_spin_unlock(&jiffies_lock);
+- return;
+- }
+ write_seqcount_end(&jiffies_seq);
+ raw_spin_unlock(&jiffies_lock);
+ update_wall_time();
+--
+2.39.2
+
--- /dev/null
+From 2d3926c506fee9e8c9708a6f6d0c073b181d8168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Nov 2020 14:19:45 +0100
+Subject: tick/sched: Use tick_next_period for lockless quick check
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 372acbbaa80940189593f9d69c7c069955f24f7a ]
+
+No point in doing calculations.
+
+ tick_next_period = last_jiffies_update + tick_period
+
+Just check whether now is before tick_next_period to figure out whether
+jiffies need an update.
+
+Add a comment why the intentional data race in the quick check is safe or
+not so safe in a 32bit corner case and why we don't worry about it.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20201117132006.337366695@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/tick-sched.c | 46 ++++++++++++++++++++++++++++------------
+ 1 file changed, 33 insertions(+), 13 deletions(-)
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 88a508cc89255..1dfa53494164a 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -57,11 +57,29 @@ static void tick_do_update_jiffies64(ktime_t now)
+ ktime_t delta;
+
+ /*
+- * Do a quick check without holding jiffies_lock:
+- * The READ_ONCE() pairs with two updates done later in this function.
++ * Do a quick check without holding jiffies_lock. The READ_ONCE()
++ * pairs with the update done later in this function.
++ *
++ * This is also an intentional data race which is even safe on
++ * 32bit in theory. If there is a concurrent update then the check
++ * might give a random answer. It does not matter because if it
++ * returns then the concurrent update is already taking care, if it
++ * falls through then it will pointlessly contend on jiffies_lock.
++ *
++ * Though there is one nasty case on 32bit due to store tearing of
++ * the 64bit value. If the first 32bit store makes the quick check
++ * return on all other CPUs and the writing CPU context gets
++ * delayed to complete the second store (scheduled out on virt)
++ * then jiffies can become stale for up to ~2^32 nanoseconds
++ * without noticing. After that point all CPUs will wait for
++ * jiffies lock.
++ *
++ * OTOH, this is not any different than the situation with NOHZ=off
++ * where one CPU is responsible for updating jiffies and
++ * timekeeping. If that CPU goes out for lunch then all other CPUs
++ * will operate on stale jiffies until it decides to come back.
+ */
+- delta = ktime_sub(now, READ_ONCE(last_jiffies_update));
+- if (delta < tick_period)
++ if (ktime_before(now, READ_ONCE(tick_next_period)))
+ return;
+
+ /* Reevaluate with jiffies_lock held */
+@@ -72,9 +90,8 @@ static void tick_do_update_jiffies64(ktime_t now)
+ if (delta >= tick_period) {
+
+ delta = ktime_sub(delta, tick_period);
+- /* Pairs with the lockless read in this function. */
+- WRITE_ONCE(last_jiffies_update,
+- ktime_add(last_jiffies_update, tick_period));
++ last_jiffies_update = ktime_add(last_jiffies_update,
++ tick_period);
+
+ /* Slow path for long timeouts */
+ if (unlikely(delta >= tick_period)) {
+@@ -82,15 +99,18 @@ static void tick_do_update_jiffies64(ktime_t now)
+
+ ticks = ktime_divns(delta, incr);
+
+- /* Pairs with the lockless read in this function. */
+- WRITE_ONCE(last_jiffies_update,
+- ktime_add_ns(last_jiffies_update,
+- incr * ticks));
++ last_jiffies_update = ktime_add_ns(last_jiffies_update,
++ incr * ticks);
+ }
+ do_timer(++ticks);
+
+- /* Keep the tick_next_period variable up to date */
+- tick_next_period = ktime_add(last_jiffies_update, tick_period);
++ /*
++ * Keep the tick_next_period variable up to date.
++ * WRITE_ONCE() pairs with the READ_ONCE() in the lockless
++ * quick check above.
++ */
++ WRITE_ONCE(tick_next_period,
++ ktime_add(last_jiffies_update, tick_period));
+ } else {
+ write_seqcount_end(&jiffies_seq);
+ raw_spin_unlock(&jiffies_lock);
+--
+2.39.2
+
--- /dev/null
+From f239a846198a9ce30df505599ef702ae81d10328 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Mar 2020 12:25:58 +0100
+Subject: timekeeping: Split jiffies seqlock
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit e5d4d1756b07d9490a0269a9e68c1e05ee1feb9b ]
+
+seqlock consists of a sequence counter and a spinlock_t which is used to
+serialize the writers. spinlock_t is substituted by a "sleeping" spinlock
+on PREEMPT_RT enabled kernels which breaks the usage in the timekeeping
+code as the writers are executed in hard interrupt and therefore
+non-preemptible context even on PREEMPT_RT.
+
+The spinlock in seqlock cannot be unconditionally replaced by a
+raw_spinlock_t as many seqlock users have nesting spinlock sections or
+other code which is not suitable to run in truly atomic context on RT.
+
+Instead of providing a raw_seqlock API for a single use case, open code the
+seqlock for the jiffies use case and implement it with a raw_spinlock_t and
+a sequence counter.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20200321113242.120587764@linutronix.de
+Stable-dep-of: e9523a0d8189 ("tick/common: Align tick period with the HZ tick.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/jiffies.c | 7 ++++---
+ kernel/time/tick-common.c | 10 ++++++----
+ kernel/time/tick-sched.c | 19 ++++++++++++-------
+ kernel/time/timekeeping.c | 6 ++++--
+ kernel/time/timekeeping.h | 3 ++-
+ 5 files changed, 28 insertions(+), 17 deletions(-)
+
+diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
+index d23b434c2ca7b..eddcf49704445 100644
+--- a/kernel/time/jiffies.c
++++ b/kernel/time/jiffies.c
+@@ -58,7 +58,8 @@ static struct clocksource clocksource_jiffies = {
+ .max_cycles = 10,
+ };
+
+-__cacheline_aligned_in_smp DEFINE_SEQLOCK(jiffies_lock);
++__cacheline_aligned_in_smp DEFINE_RAW_SPINLOCK(jiffies_lock);
++__cacheline_aligned_in_smp seqcount_t jiffies_seq;
+
+ #if (BITS_PER_LONG < 64)
+ u64 get_jiffies_64(void)
+@@ -67,9 +68,9 @@ u64 get_jiffies_64(void)
+ u64 ret;
+
+ do {
+- seq = read_seqbegin(&jiffies_lock);
++ seq = read_seqcount_begin(&jiffies_seq);
+ ret = jiffies_64;
+- } while (read_seqretry(&jiffies_lock, seq));
++ } while (read_seqcount_retry(&jiffies_seq, seq));
+ return ret;
+ }
+ EXPORT_SYMBOL(get_jiffies_64);
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 7e5d3524e924d..6c9c342dd0e53 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -84,13 +84,15 @@ int tick_is_oneshot_available(void)
+ static void tick_periodic(int cpu)
+ {
+ if (tick_do_timer_cpu == cpu) {
+- write_seqlock(&jiffies_lock);
++ raw_spin_lock(&jiffies_lock);
++ write_seqcount_begin(&jiffies_seq);
+
+ /* Keep track of the next tick event */
+ tick_next_period = ktime_add(tick_next_period, tick_period);
+
+ do_timer(1);
+- write_sequnlock(&jiffies_lock);
++ write_seqcount_end(&jiffies_seq);
++ raw_spin_unlock(&jiffies_lock);
+ update_wall_time();
+ }
+
+@@ -162,9 +164,9 @@ void tick_setup_periodic(struct clock_event_device *dev, int broadcast)
+ ktime_t next;
+
+ do {
+- seq = read_seqbegin(&jiffies_lock);
++ seq = read_seqcount_begin(&jiffies_seq);
+ next = tick_next_period;
+- } while (read_seqretry(&jiffies_lock, seq));
++ } while (read_seqcount_retry(&jiffies_seq, seq));
+
+ clockevents_switch_state(dev, CLOCK_EVT_STATE_ONESHOT);
+
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 5eb04bb598026..88a508cc89255 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -65,7 +65,8 @@ static void tick_do_update_jiffies64(ktime_t now)
+ return;
+
+ /* Reevaluate with jiffies_lock held */
+- write_seqlock(&jiffies_lock);
++ raw_spin_lock(&jiffies_lock);
++ write_seqcount_begin(&jiffies_seq);
+
+ delta = ktime_sub(now, last_jiffies_update);
+ if (delta >= tick_period) {
+@@ -91,10 +92,12 @@ static void tick_do_update_jiffies64(ktime_t now)
+ /* Keep the tick_next_period variable up to date */
+ tick_next_period = ktime_add(last_jiffies_update, tick_period);
+ } else {
+- write_sequnlock(&jiffies_lock);
++ write_seqcount_end(&jiffies_seq);
++ raw_spin_unlock(&jiffies_lock);
+ return;
+ }
+- write_sequnlock(&jiffies_lock);
++ write_seqcount_end(&jiffies_seq);
++ raw_spin_unlock(&jiffies_lock);
+ update_wall_time();
+ }
+
+@@ -105,12 +108,14 @@ static ktime_t tick_init_jiffy_update(void)
+ {
+ ktime_t period;
+
+- write_seqlock(&jiffies_lock);
++ raw_spin_lock(&jiffies_lock);
++ write_seqcount_begin(&jiffies_seq);
+ /* Did we start the jiffies update yet ? */
+ if (last_jiffies_update == 0)
+ last_jiffies_update = tick_next_period;
+ period = last_jiffies_update;
+- write_sequnlock(&jiffies_lock);
++ write_seqcount_end(&jiffies_seq);
++ raw_spin_unlock(&jiffies_lock);
+ return period;
+ }
+
+@@ -665,10 +670,10 @@ static ktime_t tick_nohz_next_event(struct tick_sched *ts, int cpu)
+
+ /* Read jiffies and the time when jiffies were updated last */
+ do {
+- seq = read_seqbegin(&jiffies_lock);
++ seq = read_seqcount_begin(&jiffies_seq);
+ basemono = last_jiffies_update;
+ basejiff = jiffies;
+- } while (read_seqretry(&jiffies_lock, seq));
++ } while (read_seqcount_retry(&jiffies_seq, seq));
+ ts->last_jiffies = basejiff;
+ ts->timer_expires_base = basemono;
+
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 2bc278dd98546..105dd0b663291 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -2415,8 +2415,10 @@ EXPORT_SYMBOL(hardpps);
+ */
+ void xtime_update(unsigned long ticks)
+ {
+- write_seqlock(&jiffies_lock);
++ raw_spin_lock(&jiffies_lock);
++ write_seqcount_begin(&jiffies_seq);
+ do_timer(ticks);
+- write_sequnlock(&jiffies_lock);
++ write_seqcount_end(&jiffies_seq);
++ raw_spin_unlock(&jiffies_lock);
+ update_wall_time();
+ }
+diff --git a/kernel/time/timekeeping.h b/kernel/time/timekeeping.h
+index 141ab3ab0354f..099737f6f10c7 100644
+--- a/kernel/time/timekeeping.h
++++ b/kernel/time/timekeeping.h
+@@ -25,7 +25,8 @@ static inline void sched_clock_resume(void) { }
+ extern void do_timer(unsigned long ticks);
+ extern void update_wall_time(void);
+
+-extern seqlock_t jiffies_lock;
++extern raw_spinlock_t jiffies_lock;
++extern seqcount_t jiffies_seq;
+
+ #define CS_NAME_LEN 32
+
+--
+2.39.2
+
--- /dev/null
+From f1f36e031cc2f3836546097ba33b427ea1b68595 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 16:08:54 +0100
+Subject: tools: bpftool: Remove invalid \' json escape
+
+From: Luis Gerhorst <gerhorst@cs.fau.de>
+
+[ Upstream commit c679bbd611c08b0559ffae079330bc4e5574696a ]
+
+RFC8259 ("The JavaScript Object Notation (JSON) Data Interchange
+Format") only specifies \", \\, \/, \b, \f, \n, \r, and \r as valid
+two-character escape sequences. This does not include \', which is not
+required in JSON because it exclusively uses double quotes as string
+separators.
+
+Solidus (/) may be escaped, but does not have to. Only reverse
+solidus (\), double quotes ("), and the control characters have to be
+escaped. Therefore, with this fix, bpftool correctly supports all valid
+two-character escape sequences (but still does not support characters
+that require multi-character escape sequences).
+
+Witout this fix, attempting to load a JSON file generated by bpftool
+using Python 3.10.6's default json.load() may fail with the error
+"Invalid \escape" if the file contains the invalid escaped single
+quote (\').
+
+Fixes: b66e907cfee2 ("tools: bpftool: copy JSON writer from iproute2 repository")
+Signed-off-by: Luis Gerhorst <gerhorst@cs.fau.de>
+Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
+Reviewed-by: Quentin Monnet <quentin@isovalent.com>
+Link: https://lore.kernel.org/bpf/20230227150853.16863-1-gerhorst@cs.fau.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/json_writer.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c
+index 86501cd3c763e..f2be9ef2c2d50 100644
+--- a/tools/bpf/bpftool/json_writer.c
++++ b/tools/bpf/bpftool/json_writer.c
+@@ -80,9 +80,6 @@ static void jsonw_puts(json_writer_t *self, const char *str)
+ case '"':
+ fputs("\\\"", self->out);
+ break;
+- case '\'':
+- fputs("\\\'", self->out);
+- break;
+ default:
+ putc(*str, self->out);
+ }
+--
+2.39.2
+
--- /dev/null
+From 1381f6f0b2bf47f70af0f37a00a5da51747faa4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Nov 2022 14:55:28 +0100
+Subject: tpm, tpm_tis: Do not skip reset of original interrupt vector
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+[ Upstream commit ed9be0e6c892a783800d77a41ca4c7255c6af8c5 ]
+
+If in tpm_tis_probe_irq_single() an error occurs after the original
+interrupt vector has been read, restore the interrupts before the error is
+returned.
+
+Since the caller does not check the error value, return -1 in any case that
+the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function
+tpm_tis_gen_interrupt() is not longer used, make it a void function.
+
+Fixes: 1107d065fdf1 ("tpm_tis: Introduce intermediate layer for TPM access")
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
+Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/tpm/tpm_tis_core.c | 29 +++++++++++------------------
+ 1 file changed, 11 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index 70f7859942287..cb0660304e480 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -613,7 +613,7 @@ static irqreturn_t tis_int_handler(int dummy, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
+-static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
++static void tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ {
+ const char *desc = "attempting to generate an interrupt";
+ u32 cap2;
+@@ -622,7 +622,7 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
+
+ ret = request_locality(chip, 0);
+ if (ret < 0)
+- return ret;
++ return;
+
+ if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ ret = tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
+@@ -630,8 +630,6 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
+ ret = tpm1_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc, 0);
+
+ release_locality(chip, 0);
+-
+- return ret;
+ }
+
+ /* Register the IRQ and issue a command that will cause an interrupt. If an
+@@ -661,42 +659,37 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
+
+ rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), irq);
+ if (rc < 0)
+- return rc;
++ goto restore_irqs;
+
+ rc = tpm_tis_read32(priv, TPM_INT_STATUS(priv->locality), &int_status);
+ if (rc < 0)
+- return rc;
++ goto restore_irqs;
+
+ /* Clear all existing */
+ rc = tpm_tis_write32(priv, TPM_INT_STATUS(priv->locality), int_status);
+ if (rc < 0)
+- return rc;
+-
++ goto restore_irqs;
+ /* Turn on */
+ rc = tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality),
+ intmask | TPM_GLOBAL_INT_ENABLE);
+ if (rc < 0)
+- return rc;
++ goto restore_irqs;
+
+ priv->irq_tested = false;
+
+ /* Generate an interrupt by having the core call through to
+ * tpm_tis_send
+ */
+- rc = tpm_tis_gen_interrupt(chip);
+- if (rc < 0)
+- return rc;
++ tpm_tis_gen_interrupt(chip);
+
++restore_irqs:
+ /* tpm_tis_send will either confirm the interrupt is working or it
+ * will call disable_irq which undoes all of the above.
+ */
+ if (!(chip->flags & TPM_CHIP_FLAG_IRQ)) {
+- rc = tpm_tis_write8(priv, original_int_vec,
+- TPM_INT_VECTOR(priv->locality));
+- if (rc < 0)
+- return rc;
+-
+- return 1;
++ tpm_tis_write8(priv, original_int_vec,
++ TPM_INT_VECTOR(priv->locality));
++ return -1;
+ }
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From ad5bc285754907f70d1dd8145caded48cc66441c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 17:37:45 -0800
+Subject: treewide: remove redundant IS_ERR() before error code check
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 45586c7078d42b932c5399953d21746800083691 ]
+
+'PTR_ERR(p) == -E*' is a stronger condition than IS_ERR(p).
+Hence, IS_ERR(p) is unneeded.
+
+The semantic patch that generates this commit is as follows:
+
+// <smpl>
+@@
+expression ptr;
+constant error_code;
+@@
+-IS_ERR(ptr) && (PTR_ERR(ptr) == - error_code)
++PTR_ERR(ptr) == - error_code
+// </smpl>
+
+Link: http://lkml.kernel.org/r/20200106045833.1725-1-masahiroy@kernel.org
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Julia Lawall <julia.lawall@lip6.fr>
+Acked-by: Stephen Boyd <sboyd@kernel.org> [drivers/clk/clk.c]
+Acked-by: Bartosz Golaszewski <bgolaszewski@baylibre.com> [GPIO]
+Acked-by: Wolfram Sang <wsa@the-dreams.de> [drivers/i2c]
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> [acpi/scan.c]
+Acked-by: Rob Herring <robh@kernel.org>
+Cc: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Stable-dep-of: 827026ae2e56 ("dmaengine: mv_xor_v2: Fix an error code.")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/af_alg.c | 2 +-
+ drivers/acpi/scan.c | 2 +-
+ drivers/char/hw_random/bcm2835-rng.c | 2 +-
+ drivers/char/hw_random/omap-rng.c | 4 ++--
+ drivers/clk/clk.c | 2 +-
+ drivers/dma/mv_xor_v2.c | 2 +-
+ drivers/gpio/gpiolib-devres.c | 2 +-
+ drivers/gpio/gpiolib-of.c | 8 ++++----
+ drivers/gpio/gpiolib.c | 2 +-
+ drivers/i2c/busses/i2c-mv64xxx.c | 5 ++---
+ drivers/i2c/busses/i2c-synquacer.c | 2 +-
+ drivers/mtd/ubi/build.c | 2 +-
+ drivers/of/device.c | 2 +-
+ drivers/pci/controller/pci-tegra.c | 2 +-
+ drivers/phy/phy-core.c | 4 ++--
+ drivers/spi/spi-orion.c | 3 +--
+ drivers/video/fbdev/imxfb.c | 2 +-
+ fs/ext4/super.c | 2 +-
+ fs/f2fs/node.c | 2 +-
+ fs/ocfs2/suballoc.c | 2 +-
+ fs/sysfs/group.c | 2 +-
+ net/core/dev.c | 2 +-
+ net/core/filter.c | 2 +-
+ net/xfrm/xfrm_policy.c | 2 +-
+ sound/soc/codecs/ak4104.c | 3 +--
+ sound/soc/codecs/cs4270.c | 3 +--
+ sound/soc/codecs/tlv320aic32x4.c | 6 ++----
+ sound/soc/sunxi/sun4i-spdif.c | 2 +-
+ 28 files changed, 35 insertions(+), 41 deletions(-)
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index 4a2e91baabdef..bb13acef2cb95 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -170,7 +170,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ sa->salg_name[addr_len - sizeof(*sa) - 1] = 0;
+
+ type = alg_get_type(sa->salg_type);
+- if (IS_ERR(type) && PTR_ERR(type) == -ENOENT) {
++ if (PTR_ERR(type) == -ENOENT) {
+ request_module("algif-%s", sa->salg_type);
+ type = alg_get_type(sa->salg_type);
+ }
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index 5d4be80ee6cb4..0c40e1098064a 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -1506,7 +1506,7 @@ int acpi_dma_configure(struct device *dev, enum dev_dma_attr attr)
+ iort_dma_setup(dev, &dma_addr, &size);
+
+ iommu = iort_iommu_configure(dev);
+- if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
++ if (PTR_ERR(iommu) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+
+ arch_setup_dma_ops(dev, dma_addr, size,
+diff --git a/drivers/char/hw_random/bcm2835-rng.c b/drivers/char/hw_random/bcm2835-rng.c
+index f759790c3cdb6..b40601b3127e3 100644
+--- a/drivers/char/hw_random/bcm2835-rng.c
++++ b/drivers/char/hw_random/bcm2835-rng.c
+@@ -160,7 +160,7 @@ static int bcm2835_rng_probe(struct platform_device *pdev)
+
+ /* Clock is optional on most platforms */
+ priv->clk = devm_clk_get(dev, NULL);
+- if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER)
++ if (PTR_ERR(priv->clk) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+
+ priv->rng.name = pdev->name;
+diff --git a/drivers/char/hw_random/omap-rng.c b/drivers/char/hw_random/omap-rng.c
+index e329f82c0467f..9ad3e12430c3c 100644
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -478,7 +478,7 @@ static int omap_rng_probe(struct platform_device *pdev)
+ }
+
+ priv->clk = devm_clk_get(&pdev->dev, NULL);
+- if (IS_ERR(priv->clk) && PTR_ERR(priv->clk) == -EPROBE_DEFER)
++ if (PTR_ERR(priv->clk) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+ if (!IS_ERR(priv->clk)) {
+ ret = clk_prepare_enable(priv->clk);
+@@ -490,7 +490,7 @@ static int omap_rng_probe(struct platform_device *pdev)
+ }
+
+ priv->clk_reg = devm_clk_get(&pdev->dev, "reg");
+- if (IS_ERR(priv->clk_reg) && PTR_ERR(priv->clk_reg) == -EPROBE_DEFER)
++ if (PTR_ERR(priv->clk_reg) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+ if (!IS_ERR(priv->clk_reg)) {
+ ret = clk_prepare_enable(priv->clk_reg);
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 1c73668b43755..fb7b49521646a 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -444,7 +444,7 @@ static void clk_core_fill_parent_index(struct clk_core *core, u8 index)
+ parent = ERR_PTR(-EPROBE_DEFER);
+ } else {
+ parent = clk_core_get(core, index);
+- if (IS_ERR(parent) && PTR_ERR(parent) == -ENOENT && entry->name)
++ if (PTR_ERR(parent) == -ENOENT && entry->name)
+ parent = clk_core_lookup(entry->name);
+ }
+
+diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c
+index 3fa884145eb1e..741b7270a9f5f 100644
+--- a/drivers/dma/mv_xor_v2.c
++++ b/drivers/dma/mv_xor_v2.c
+@@ -750,7 +750,7 @@ static int mv_xor_v2_probe(struct platform_device *pdev)
+ }
+
+ xor_dev->clk = devm_clk_get(&pdev->dev, NULL);
+- if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
++ if (PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) {
+ ret = EPROBE_DEFER;
+ goto disable_reg_clk;
+ }
+diff --git a/drivers/gpio/gpiolib-devres.c b/drivers/gpio/gpiolib-devres.c
+index 98e3c20d9730e..3fc5b86e03faa 100644
+--- a/drivers/gpio/gpiolib-devres.c
++++ b/drivers/gpio/gpiolib-devres.c
+@@ -323,7 +323,7 @@ devm_gpiod_get_array_optional(struct device *dev, const char *con_id,
+ struct gpio_descs *descs;
+
+ descs = devm_gpiod_get_array(dev, con_id, flags);
+- if (IS_ERR(descs) && (PTR_ERR(descs) == -ENOENT))
++ if (PTR_ERR(descs) == -ENOENT)
+ return NULL;
+
+ return descs;
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index 73807c897391c..34e0c3f106566 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -498,24 +498,24 @@ struct gpio_desc *of_find_gpio(struct device *dev, const char *con_id,
+ break;
+ }
+
+- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT) {
++ if (PTR_ERR(desc) == -ENOENT) {
+ /* Special handling for SPI GPIOs if used */
+ desc = of_find_spi_gpio(dev, con_id, &of_flags);
+ }
+
+- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT) {
++ if (PTR_ERR(desc) == -ENOENT) {
+ /* This quirk looks up flags and all */
+ desc = of_find_spi_cs_gpio(dev, con_id, idx, flags);
+ if (!IS_ERR(desc))
+ return desc;
+ }
+
+- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT) {
++ if (PTR_ERR(desc) == -ENOENT) {
+ /* Special handling for regulator GPIOs if used */
+ desc = of_find_regulator_gpio(dev, con_id, &of_flags);
+ }
+
+- if (IS_ERR(desc) && PTR_ERR(desc) == -ENOENT)
++ if (PTR_ERR(desc) == -ENOENT)
+ desc = of_find_arizona_gpio(dev, con_id, &of_flags);
+
+ if (IS_ERR(desc))
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index abdf448b11a3d..06aeb75db6c68 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -4894,7 +4894,7 @@ struct gpio_descs *__must_check gpiod_get_array_optional(struct device *dev,
+ struct gpio_descs *descs;
+
+ descs = gpiod_get_array(dev, con_id, flags);
+- if (IS_ERR(descs) && (PTR_ERR(descs) == -ENOENT))
++ if (PTR_ERR(descs) == -ENOENT)
+ return NULL;
+
+ return descs;
+diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
+index a5a95ea5b81a7..febb7c7ea72ba 100644
+--- a/drivers/i2c/busses/i2c-mv64xxx.c
++++ b/drivers/i2c/busses/i2c-mv64xxx.c
+@@ -901,14 +901,13 @@ mv64xxx_i2c_probe(struct platform_device *pd)
+
+ /* Not all platforms have clocks */
+ drv_data->clk = devm_clk_get(&pd->dev, NULL);
+- if (IS_ERR(drv_data->clk) && PTR_ERR(drv_data->clk) == -EPROBE_DEFER)
++ if (PTR_ERR(drv_data->clk) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+ if (!IS_ERR(drv_data->clk))
+ clk_prepare_enable(drv_data->clk);
+
+ drv_data->reg_clk = devm_clk_get(&pd->dev, "reg");
+- if (IS_ERR(drv_data->reg_clk) &&
+- PTR_ERR(drv_data->reg_clk) == -EPROBE_DEFER)
++ if (PTR_ERR(drv_data->reg_clk) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+ if (!IS_ERR(drv_data->reg_clk))
+ clk_prepare_enable(drv_data->reg_clk);
+diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c
+index 39762f0611b18..86026798b4f76 100644
+--- a/drivers/i2c/busses/i2c-synquacer.c
++++ b/drivers/i2c/busses/i2c-synquacer.c
+@@ -553,7 +553,7 @@ static int synquacer_i2c_probe(struct platform_device *pdev)
+ &i2c->pclkrate);
+
+ i2c->pclk = devm_clk_get(&pdev->dev, "pclk");
+- if (IS_ERR(i2c->pclk) && PTR_ERR(i2c->pclk) == -EPROBE_DEFER)
++ if (PTR_ERR(i2c->pclk) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+ if (!IS_ERR_OR_NULL(i2c->pclk)) {
+ dev_dbg(&pdev->dev, "clock source %p\n", i2c->pclk);
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index f29ed9102ce91..1c036356d6d3f 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1168,7 +1168,7 @@ static struct mtd_info * __init open_mtd_device(const char *mtd_dev)
+ * MTD device name.
+ */
+ mtd = get_mtd_device_nm(mtd_dev);
+- if (IS_ERR(mtd) && PTR_ERR(mtd) == -ENODEV)
++ if (PTR_ERR(mtd) == -ENODEV)
+ /* Probably this is an MTD character device node path */
+ mtd = open_mtd_by_chdev(mtd_dev);
+ } else
+diff --git a/drivers/of/device.c b/drivers/of/device.c
+index 7fb870097a849..aba1510f5d039 100644
+--- a/drivers/of/device.c
++++ b/drivers/of/device.c
+@@ -160,7 +160,7 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
+ coherent ? " " : " not ");
+
+ iommu = of_iommu_configure(dev, np);
+- if (IS_ERR(iommu) && PTR_ERR(iommu) == -EPROBE_DEFER)
++ if (PTR_ERR(iommu) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+
+ dev_dbg(dev, "device is%sbehind an iommu\n",
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 99d505a85067b..b051130e45414 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -1381,7 +1381,7 @@ static struct phy *devm_of_phy_optional_get_index(struct device *dev,
+ phy = devm_of_phy_get(dev, np, name);
+ kfree(name);
+
+- if (IS_ERR(phy) && PTR_ERR(phy) == -ENODEV)
++ if (PTR_ERR(phy) == -ENODEV)
+ phy = NULL;
+
+ return phy;
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index b04f4fe85ac2d..48d355cf02105 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -690,7 +690,7 @@ struct phy *phy_optional_get(struct device *dev, const char *string)
+ {
+ struct phy *phy = phy_get(dev, string);
+
+- if (IS_ERR(phy) && (PTR_ERR(phy) == -ENODEV))
++ if (PTR_ERR(phy) == -ENODEV)
+ phy = NULL;
+
+ return phy;
+@@ -744,7 +744,7 @@ struct phy *devm_phy_optional_get(struct device *dev, const char *string)
+ {
+ struct phy *phy = devm_phy_get(dev, string);
+
+- if (IS_ERR(phy) && (PTR_ERR(phy) == -ENODEV))
++ if (PTR_ERR(phy) == -ENODEV)
+ phy = NULL;
+
+ return phy;
+diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
+index 6643ccdc25085..989aa053471d3 100644
+--- a/drivers/spi/spi-orion.c
++++ b/drivers/spi/spi-orion.c
+@@ -648,8 +648,7 @@ static int orion_spi_probe(struct platform_device *pdev)
+
+ /* The following clock is only used by some SoCs */
+ spi->axi_clk = devm_clk_get(&pdev->dev, "axi");
+- if (IS_ERR(spi->axi_clk) &&
+- PTR_ERR(spi->axi_clk) == -EPROBE_DEFER) {
++ if (PTR_ERR(spi->axi_clk) == -EPROBE_DEFER) {
+ status = -EPROBE_DEFER;
+ goto out_rel_clk;
+ }
+diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
+index ffde3107104bc..4de59807e0c88 100644
+--- a/drivers/video/fbdev/imxfb.c
++++ b/drivers/video/fbdev/imxfb.c
+@@ -1017,7 +1017,7 @@ static int imxfb_probe(struct platform_device *pdev)
+ }
+
+ fbi->lcd_pwr = devm_regulator_get(&pdev->dev, "lcd");
+- if (IS_ERR(fbi->lcd_pwr) && (PTR_ERR(fbi->lcd_pwr) == -EPROBE_DEFER)) {
++ if (PTR_ERR(fbi->lcd_pwr) == -EPROBE_DEFER) {
+ ret = -EPROBE_DEFER;
+ goto failed_lcd;
+ }
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 789a9f6a2ec6e..8b564e40f736b 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -6172,7 +6172,7 @@ static ssize_t ext4_quota_write(struct super_block *sb, int type,
+ bh = ext4_bread(handle, inode, blk,
+ EXT4_GET_BLOCKS_CREATE |
+ EXT4_GET_BLOCKS_METADATA_NOFAIL);
+- } while (IS_ERR(bh) && (PTR_ERR(bh) == -ENOSPC) &&
++ } while (PTR_ERR(bh) == -ENOSPC &&
+ ext4_should_retry_alloc(inode->i_sb, &retries));
+ if (IS_ERR(bh))
+ return PTR_ERR(bh);
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index b080d5c58f6cb..dde8a99189899 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -879,7 +879,7 @@ static int truncate_dnode(struct dnode_of_data *dn)
+
+ /* get direct node */
+ page = f2fs_get_node_page(F2FS_I_SB(dn->inode), dn->nid);
+- if (IS_ERR(page) && PTR_ERR(page) == -ENOENT)
++ if (PTR_ERR(page) == -ENOENT)
+ return 1;
+ else if (IS_ERR(page))
+ return PTR_ERR(page);
+diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
+index 5e0eaea474055..9e79fc6308da5 100644
+--- a/fs/ocfs2/suballoc.c
++++ b/fs/ocfs2/suballoc.c
+@@ -696,7 +696,7 @@ static int ocfs2_block_group_alloc(struct ocfs2_super *osb,
+
+ bg_bh = ocfs2_block_group_alloc_contig(osb, handle, alloc_inode,
+ ac, cl);
+- if (IS_ERR(bg_bh) && (PTR_ERR(bg_bh) == -ENOSPC))
++ if (PTR_ERR(bg_bh) == -ENOSPC)
+ bg_bh = ocfs2_block_group_alloc_discontig(handle,
+ alloc_inode,
+ ac, cl);
+diff --git a/fs/sysfs/group.c b/fs/sysfs/group.c
+index d41c21fef1388..c4ab045926b7c 100644
+--- a/fs/sysfs/group.c
++++ b/fs/sysfs/group.c
+@@ -449,7 +449,7 @@ int __compat_only_sysfs_link_entry_to_kobj(struct kobject *kobj,
+ }
+
+ link = kernfs_create_link(kobj->sd, target_name, entry);
+- if (IS_ERR(link) && PTR_ERR(link) == -EEXIST)
++ if (PTR_ERR(link) == -EEXIST)
+ sysfs_warn_dup(kobj->sd, target_name);
+
+ kernfs_put(entry);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 1a4e20c4ba053..ddc6ae844c0a8 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5552,7 +5552,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
+ if (&ptype->list == head)
+ goto normal;
+
+- if (IS_ERR(pp) && PTR_ERR(pp) == -EINPROGRESS) {
++ if (PTR_ERR(pp) == -EINPROGRESS) {
+ ret = GRO_CONSUMED;
+ goto ok;
+ }
+diff --git a/net/core/filter.c b/net/core/filter.c
+index d866e1c5970cc..135e65754d8d8 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -1573,7 +1573,7 @@ int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk)
+ return -EPERM;
+
+ prog = bpf_prog_get_type(ufd, BPF_PROG_TYPE_SOCKET_FILTER);
+- if (IS_ERR(prog) && PTR_ERR(prog) == -EINVAL)
++ if (PTR_ERR(prog) == -EINVAL)
+ prog = bpf_prog_get_type(ufd, BPF_PROG_TYPE_SK_REUSEPORT);
+ if (IS_ERR(prog))
+ return PTR_ERR(prog);
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 6f58be5a17711..5f8f3d880e3d5 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -3191,7 +3191,7 @@ struct dst_entry *xfrm_lookup_route(struct net *net, struct dst_entry *dst_orig,
+ flags | XFRM_LOOKUP_QUEUE |
+ XFRM_LOOKUP_KEEP_DST_REF);
+
+- if (IS_ERR(dst) && PTR_ERR(dst) == -EREMOTE)
++ if (PTR_ERR(dst) == -EREMOTE)
+ return make_blackhole(net, dst_orig->ops->family, dst_orig);
+
+ if (IS_ERR(dst))
+diff --git a/sound/soc/codecs/ak4104.c b/sound/soc/codecs/ak4104.c
+index e8c5fda82e085..979cfb165eed4 100644
+--- a/sound/soc/codecs/ak4104.c
++++ b/sound/soc/codecs/ak4104.c
+@@ -295,8 +295,7 @@ static int ak4104_spi_probe(struct spi_device *spi)
+
+ reset_gpiod = devm_gpiod_get_optional(&spi->dev, "reset",
+ GPIOD_OUT_HIGH);
+- if (IS_ERR(reset_gpiod) &&
+- PTR_ERR(reset_gpiod) == -EPROBE_DEFER)
++ if (PTR_ERR(reset_gpiod) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+
+ /* read the 'reserved' register - according to the datasheet, it
+diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
+index 793a14d586672..5f25b9f872bdf 100644
+--- a/sound/soc/codecs/cs4270.c
++++ b/sound/soc/codecs/cs4270.c
+@@ -681,8 +681,7 @@ static int cs4270_i2c_probe(struct i2c_client *i2c_client,
+
+ reset_gpiod = devm_gpiod_get_optional(&i2c_client->dev, "reset",
+ GPIOD_OUT_HIGH);
+- if (IS_ERR(reset_gpiod) &&
+- PTR_ERR(reset_gpiod) == -EPROBE_DEFER)
++ if (PTR_ERR(reset_gpiod) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+
+ cs4270->regmap = devm_regmap_init_i2c(i2c_client, &cs4270_regmap);
+diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
+index 7a1ffbaf48be5..f2948fe3f590e 100644
+--- a/sound/soc/codecs/tlv320aic32x4.c
++++ b/sound/soc/codecs/tlv320aic32x4.c
+@@ -1098,11 +1098,9 @@ static int aic32x4_setup_regulators(struct device *dev,
+ return PTR_ERR(aic32x4->supply_av);
+ }
+ } else {
+- if (IS_ERR(aic32x4->supply_dv) &&
+- PTR_ERR(aic32x4->supply_dv) == -EPROBE_DEFER)
++ if (PTR_ERR(aic32x4->supply_dv) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+- if (IS_ERR(aic32x4->supply_av) &&
+- PTR_ERR(aic32x4->supply_av) == -EPROBE_DEFER)
++ if (PTR_ERR(aic32x4->supply_av) == -EPROBE_DEFER)
+ return -EPROBE_DEFER;
+ }
+
+diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c
+index cbe598b0fb107..98a9fe6455213 100644
+--- a/sound/soc/sunxi/sun4i-spdif.c
++++ b/sound/soc/sunxi/sun4i-spdif.c
+@@ -555,7 +555,7 @@ static int sun4i_spdif_probe(struct platform_device *pdev)
+ if (quirks->has_reset) {
+ host->rst = devm_reset_control_get_optional_exclusive(&pdev->dev,
+ NULL);
+- if (IS_ERR(host->rst) && PTR_ERR(host->rst) == -EPROBE_DEFER) {
++ if (PTR_ERR(host->rst) == -EPROBE_DEFER) {
+ ret = -EPROBE_DEFER;
+ dev_err(&pdev->dev, "Failed to get reset: %d\n", ret);
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 5a449c441bd9d91fd06b690fe0fa043a56aca85d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Apr 2023 14:55:55 -0500
+Subject: tty: serial: fsl_lpuart: adjust buffer length to the intended size
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit f73fd750552524b06b5d77ebfdd106ccc8fcac61 ]
+
+Based on the fls function definition provided below, we should not
+subtract 1 to obtain the correct buffer length:
+
+fls(0) = 0, fls(1) = 1, fls(0x80000000) = 32.
+
+Fixes: 5887ad43ee02 ("tty: serial: fsl_lpuart: Use cyclic DMA for Rx")
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Link: https://lore.kernel.org/r/20230410195555.1003900-1-shenwei.wang@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index b722ab9415285..0b57973e7c658 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -1172,7 +1172,7 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
+ * 10ms at any baud rate.
+ */
+ sport->rx_dma_rng_buf_len = (DMA_RX_TIMEOUT * baud / bits / 1000) * 2;
+- sport->rx_dma_rng_buf_len = (1 << (fls(sport->rx_dma_rng_buf_len) - 1));
++ sport->rx_dma_rng_buf_len = (1 << fls(sport->rx_dma_rng_buf_len));
+ if (sport->rx_dma_rng_buf_len < 16)
+ sport->rx_dma_rng_buf_len = 16;
+
+--
+2.39.2
+
--- /dev/null
+From 44801935777b01e7401dbeb537a00bd893a026f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Apr 2023 10:27:47 +0100
+Subject: uapi/linux/const.h: prefer ISO-friendly __typeof__
+
+From: Kevin Brodsky <kevin.brodsky@arm.com>
+
+[ Upstream commit 31088f6f7906253ef4577f6a9b84e2d42447dba0 ]
+
+typeof is (still) a GNU extension, which means that it cannot be used when
+building ISO C (e.g. -std=c99). It should therefore be avoided in uapi
+headers in favour of the ISO-friendly __typeof__.
+
+Unfortunately this issue could not be detected by
+CONFIG_UAPI_HEADER_TEST=y as the __ALIGN_KERNEL() macro is not expanded in
+any uapi header.
+
+This matters from a userspace perspective, not a kernel one. uapi
+headers and their contents are expected to be usable in a variety of
+situations, and in particular when building ISO C applications (with
+-std=c99 or similar).
+
+This particular problem can be reproduced by trying to use the
+__ALIGN_KERNEL macro directly in application code, say:
+
+#include <linux/const.h>
+
+int align(int x, int a)
+{
+ return __KERNEL_ALIGN(x, a);
+}
+
+and trying to build that with -std=c99.
+
+Link: https://lkml.kernel.org/r/20230411092747.3759032-1-kevin.brodsky@arm.com
+Fixes: a79ff731a1b2 ("netfilter: xtables: make XT_ALIGN() usable in exported headers by exporting __ALIGN_KERNEL()")
+Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
+Reported-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Tested-by: Ruben Ayrapetyan <ruben.ayrapetyan@arm.com>
+Reviewed-by: Petr Vorel <pvorel@suse.cz>
+Tested-by: Petr Vorel <pvorel@suse.cz>
+Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/const.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/linux/const.h b/include/uapi/linux/const.h
+index af2a44c08683d..a429381e7ca50 100644
+--- a/include/uapi/linux/const.h
++++ b/include/uapi/linux/const.h
+@@ -28,7 +28,7 @@
+ #define _BITUL(x) (_UL(1) << (x))
+ #define _BITULL(x) (_ULL(1) << (x))
+
+-#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1)
++#define __ALIGN_KERNEL(x, a) __ALIGN_KERNEL_MASK(x, (__typeof__(x))(a) - 1)
+ #define __ALIGN_KERNEL_MASK(x, mask) (((x) + (mask)) & ~(mask))
+
+ #define __KERNEL_DIV_ROUND_UP(n, d) (((n) + (d) - 1) / (d))
+--
+2.39.2
+
--- /dev/null
+From 391ecfe8888765a14160035bd3cbce39a0050a2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Apr 2023 13:58:52 +0800
+Subject: usb: chipidea: fix missing goto in `ci_hdrc_probe`
+
+From: Yinhao Hu <dddddd@hust.edu.cn>
+
+[ Upstream commit d6f712f53b79f5017cdcefafb7a5aea9ec52da5d ]
+
+From the comment of ci_usb_phy_init, it returns an error code if
+usb_phy_init has failed, and it should do some clean up, not just
+return directly.
+
+Fix this by goto the error handling.
+
+Fixes: 74475ede784d ("usb: chipidea: move PHY operation to core")
+Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Signed-off-by: Yinhao Hu <dddddd@hust.edu.cn>
+Link: https://lore.kernel.org/r/20230412055852.971991-1-dddddd@hust.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/chipidea/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
+index 7a86979cf1406..27298ca083d14 100644
+--- a/drivers/usb/chipidea/core.c
++++ b/drivers/usb/chipidea/core.c
+@@ -1084,7 +1084,7 @@ static int ci_hdrc_probe(struct platform_device *pdev)
+ ret = ci_usb_phy_init(ci);
+ if (ret) {
+ dev_err(dev, "unable to init phy: %d\n", ret);
+- return ret;
++ goto ulpi_exit;
+ }
+
+ ci->hw_bank.phys = res->start;
+--
+2.39.2
+
--- /dev/null
+From 915aaded6a2c190a0f54342d967b5d472052f66f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Mar 2023 14:29:31 +0800
+Subject: usb: gadget: udc: renesas_usb3: Fix use after free bug in
+ renesas_usb3_remove due to race condition
+
+From: Zheng Wang <zyytlz.wz@163.com>
+
+[ Upstream commit 2b947f8769be8b8181dc795fd292d3e7120f5204 ]
+
+In renesas_usb3_probe, role_work is bound with renesas_usb3_role_work.
+renesas_usb3_start will be called to start the work.
+
+If we remove the driver which will call usbhs_remove, there may be
+an unfinished work. The possible sequence is as follows:
+
+CPU0 CPU1
+
+ renesas_usb3_role_work
+renesas_usb3_remove
+usb_role_switch_unregister
+device_unregister
+kfree(sw)
+//free usb3->role_sw
+ usb_role_switch_set_role
+ //use usb3->role_sw
+
+The usb3->role_sw could be freed under such circumstance and then
+used in usb_role_switch_set_role.
+
+This bug was found by static analysis. And note that removing a
+driver is a root-only operation, and should never happen in normal
+case. But the root user may directly remove the device which
+will also trigger the remove function.
+
+Fix it by canceling the work before cleanup in the renesas_usb3_remove.
+
+Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch")
+Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20230320062931.505170-1-zyytlz.wz@163.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/renesas_usb3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
+index 0bbd180022aa7..e04acf2dfa65d 100644
+--- a/drivers/usb/gadget/udc/renesas_usb3.c
++++ b/drivers/usb/gadget/udc/renesas_usb3.c
+@@ -2553,6 +2553,7 @@ static int renesas_usb3_remove(struct platform_device *pdev)
+ debugfs_remove_recursive(usb3->dentry);
+ device_remove_file(&pdev->dev, &dev_attr_role);
+
++ cancel_work_sync(&usb3->role_work);
+ usb_role_switch_unregister(usb3->role_sw);
+
+ usb_del_gadget_udc(&usb3->gadget);
+--
+2.39.2
+
--- /dev/null
+From 84096d47a446a55f766db3fc8016ad1fb52d8714 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 17:30:37 +0100
+Subject: usb: host: xhci-rcar: remove leftover quirk handling
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 5d67f4861884762ebc2bddb5d667444e45f25782 ]
+
+Loading V3 firmware does not need a quirk anymore, remove the leftover
+code.
+
+Fixes: ed8603e11124 ("usb: host: xhci-rcar: Simplify getting the firmware name for R-Car Gen3")
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Link: https://lore.kernel.org/r/20230307163041.3815-10-wsa+renesas@sang-engineering.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-rcar.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c
+index 3da75b367f952..5d78352992454 100644
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -74,7 +74,6 @@ MODULE_FIRMWARE(XHCI_RCAR_FIRMWARE_NAME_V3);
+
+ /* For soc_device_attribute */
+ #define RCAR_XHCI_FIRMWARE_V2 BIT(0) /* FIRMWARE V2 */
+-#define RCAR_XHCI_FIRMWARE_V3 BIT(1) /* FIRMWARE V3 */
+
+ static const struct soc_device_attribute rcar_quirks_match[] = {
+ {
+@@ -147,8 +146,6 @@ static int xhci_rcar_download_firmware(struct usb_hcd *hcd)
+
+ if (quirks & RCAR_XHCI_FIRMWARE_V2)
+ firmware_name = XHCI_RCAR_FIRMWARE_NAME_V2;
+- else if (quirks & RCAR_XHCI_FIRMWARE_V3)
+- firmware_name = XHCI_RCAR_FIRMWARE_NAME_V3;
+ else
+ firmware_name = priv->firmware_name;
+
+--
+2.39.2
+
--- /dev/null
+From 9b7e624218a15e74909022746045bd0c54936294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 10:51:59 +0800
+Subject: usb: mtu3: fix kernel panic at qmu transfer done irq handler
+
+From: Chunfeng Yun <chunfeng.yun@mediatek.com>
+
+[ Upstream commit d28f4091ea7ec3510fd6a3c6d433234e7a2bef14 ]
+
+When handle qmu transfer irq, it will unlock @mtu->lock before give back
+request, if another thread handle disconnect event at the same time, and
+try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu
+irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before
+handling it.
+
+e.g.
+qmu done irq on cpu0 thread running on cpu1
+
+qmu_done_tx()
+ handle gpd [0]
+ mtu3_requ_complete() mtu3_gadget_ep_disable()
+ unlock @mtu->lock
+ give back request lock @mtu->lock
+ mtu3_ep_disable()
+ mtu3_gpd_ring_free()
+ unlock @mtu->lock
+ lock @mtu->lock
+ get next gpd [1]
+
+[1]: goto [0] to handle next gpd, and next gpd may be NULL.
+
+Fixes: 48e0d3735aa5 ("usb: mtu3: supports new QMU format")
+Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Link: https://lore.kernel.org/r/20230417025203.18097-3-chunfeng.yun@mediatek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mtu3/mtu3_qmu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c
+index 2ea3157ddb6e2..e65586147965d 100644
+--- a/drivers/usb/mtu3/mtu3_qmu.c
++++ b/drivers/usb/mtu3/mtu3_qmu.c
+@@ -210,6 +210,7 @@ static struct qmu_gpd *advance_enq_gpd(struct mtu3_gpd_ring *ring)
+ return ring->enqueue;
+ }
+
++/* @dequeue may be NULL if ring is unallocated or freed */
+ static struct qmu_gpd *advance_deq_gpd(struct mtu3_gpd_ring *ring)
+ {
+ if (ring->dequeue < ring->end)
+@@ -484,7 +485,7 @@ static void qmu_done_tx(struct mtu3 *mtu, u8 epnum)
+ dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n",
+ __func__, epnum, gpd, gpd_current, ring->enqueue);
+
+- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) {
++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) {
+
+ mreq = next_request(mep);
+
+@@ -523,7 +524,7 @@ static void qmu_done_rx(struct mtu3 *mtu, u8 epnum)
+ dev_dbg(mtu->dev, "%s EP%d, last=%p, current=%p, enq=%p\n",
+ __func__, epnum, gpd, gpd_current, ring->enqueue);
+
+- while (gpd != gpd_current && !GET_GPD_HWO(gpd)) {
++ while (gpd && gpd != gpd_current && !GET_GPD_HWO(gpd)) {
+
+ mreq = next_request(mep);
+
+--
+2.39.2
+
--- /dev/null
+From 28dcc66d50320b9e40c673fde96e7151b3006b4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 08:33:02 -0700
+Subject: vlan: partially enable SIOCSHWTSTAMP in container
+
+From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+
+[ Upstream commit 731b73dba359e3ff00517c13aa0daa82b34ff466 ]
+
+Setting timestamp filter was explicitly disabled on vlan devices in
+containers because it might affect other processes on the host. But it's
+absolutely legit in case when real device is in the same namespace.
+
+Fixes: 873017af7784 ("vlan: disable SIOCSHWTSTAMP in container")
+Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/8021q/vlan_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 589615ec490bb..b10f31f98cb87 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -366,7 +366,7 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+
+ switch (cmd) {
+ case SIOCSHWTSTAMP:
+- if (!net_eq(dev_net(dev), &init_net))
++ if (!net_eq(dev_net(dev), dev_net(real_dev)))
+ break;
+ /* fall through */
+ case SIOCGMIIPHY:
+--
+2.39.2
+
--- /dev/null
+From b64341b4695eec4227a4d253897023b101251a10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Mar 2023 21:01:53 +0900
+Subject: vmci_host: fix a race condition in vmci_host_poll() causing GPF
+
+From: Dae R. Jeong <threeearcat@gmail.com>
+
+[ Upstream commit ae13381da5ff0e8e084c0323c3cc0a945e43e9c7 ]
+
+During fuzzing, a general protection fault is observed in
+vmci_host_poll().
+
+general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN
+KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
+RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926
+<- omitting registers ->
+Call Trace:
+ <TASK>
+ lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672
+ __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
+ _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162
+ add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22
+ poll_wait include/linux/poll.h:49 [inline]
+ vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174
+ vfs_poll include/linux/poll.h:88 [inline]
+ do_pollfd fs/select.c:873 [inline]
+ do_poll fs/select.c:921 [inline]
+ do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015
+ __do_sys_ppoll fs/select.c:1121 [inline]
+ __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101
+ do_syscall_x64 arch/x86/entry/common.c:51 [inline]
+ do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Example thread interleaving that causes the general protection fault
+is as follows:
+
+CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context)
+----- -----
+// Read uninitialized context
+context = vmci_host_dev->context;
+ // Initialize context
+ vmci_host_dev->context = vmci_ctx_create();
+ vmci_host_dev->ct_type = VMCIOBJ_CONTEXT;
+
+if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
+ // Dereferencing the wrong pointer
+ poll_wait(..., &context->host_context);
+}
+
+In this scenario, vmci_host_poll() reads vmci_host_dev->context first,
+and then reads vmci_host_dev->ct_type to check that
+vmci_host_dev->context is initialized. However, since these two reads
+are not atomically executed, there is a chance of a race condition as
+described above.
+
+To fix this race condition, read vmci_host_dev->context after checking
+the value of vmci_host_dev->ct_type so that vmci_host_poll() always
+reads an initialized context.
+
+Reported-by: Dae R. Jeong <threeearcat@gmail.com>
+Fixes: 8bf503991f87 ("VMCI: host side driver implementation.")
+Signed-off-by: Dae R. Jeong <threeearcat@gmail.com>
+Link: https://lore.kernel.org/r/ZCGFsdBAU4cYww5l@dragonet
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/vmw_vmci/vmci_host.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
+index 833e2bd248a57..8ff8d649d9b3a 100644
+--- a/drivers/misc/vmw_vmci/vmci_host.c
++++ b/drivers/misc/vmw_vmci/vmci_host.c
+@@ -160,10 +160,16 @@ static int vmci_host_close(struct inode *inode, struct file *filp)
+ static __poll_t vmci_host_poll(struct file *filp, poll_table *wait)
+ {
+ struct vmci_host_dev *vmci_host_dev = filp->private_data;
+- struct vmci_ctx *context = vmci_host_dev->context;
++ struct vmci_ctx *context;
+ __poll_t mask = 0;
+
+ if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) {
++ /*
++ * Read context only if ct_type == VMCIOBJ_CONTEXT to make
++ * sure that context is initialized
++ */
++ context = vmci_host_dev->context;
++
+ /* Check for VMCI calls to this VM context. */
+ if (wait)
+ poll_wait(filp, &context->host_context.wait_queue,
+--
+2.39.2
+
--- /dev/null
+From 9c344c3700b5e3ad87e2688a8955faeaae325dd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Feb 2023 16:15:48 +0300
+Subject: wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
+
+From: Dan Carpenter <error27@gmail.com>
+
+[ Upstream commit 4c856ee12df85aabd437c3836ed9f68d94268358 ]
+
+This loop checks that i < max at the start of loop but then it does
+i++ which could put it past the end of the array. It's harmless to
+check again and prevent a potential out of bounds.
+
+Fixes: 1048643ea94d ("ath5k: Clean up eeprom parsing and add missing calibration data")
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/Y+D9hPQrHfWBJhXz@kili
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath5k/eeprom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
+index 01163b3339451..92f5c8e830901 100644
+--- a/drivers/net/wireless/ath/ath5k/eeprom.c
++++ b/drivers/net/wireless/ath/ath5k/eeprom.c
+@@ -529,7 +529,7 @@ ath5k_eeprom_read_freq_list(struct ath5k_hw *ah, int *offset, int max,
+ ee->ee_n_piers[mode]++;
+
+ freq2 = (val >> 8) & 0xff;
+- if (!freq2)
++ if (!freq2 || i >= max)
+ break;
+
+ pc[i++].freq = ath5k_eeprom_bin2freq(ee,
+--
+2.39.2
+
--- /dev/null
+From 80742220caa0458951179f4581e2b68e48737efc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 20:31:37 +0200
+Subject: wifi: ath6kl: minor fix for allocation size
+
+From: Alexey V. Vissarionov <gremlin@altlinux.org>
+
+[ Upstream commit 778f83f889e7fca37780d9640fcbd0229ae38eaa ]
+
+Although the "param" pointer occupies more or equal space compared
+to "*param", the allocation size should use the size of variable
+itself.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver")
+Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230117110414.GC12547@altlinux.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/bmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c
+index bde5a10d470c8..af98e871199d3 100644
+--- a/drivers/net/wireless/ath/ath6kl/bmi.c
++++ b/drivers/net/wireless/ath/ath6kl/bmi.c
+@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param)
+ return -EACCES;
+ }
+
+- size = sizeof(cid) + sizeof(addr) + sizeof(param);
++ size = sizeof(cid) + sizeof(addr) + sizeof(*param);
+ if (size > ar->bmi.max_cmd_size) {
+ WARN_ON(1);
+ return -EINVAL;
+--
+2.39.2
+
--- /dev/null
+From 9ef0d3db6dd8bc4a7e53b8abe73789b9d0a0b997 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Feb 2023 12:28:05 +0200
+Subject: wifi: ath6kl: reduce WARN to dev_dbg() in callback
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 75c4a8154cb6c7239fb55d5550f481f6765fb83c ]
+
+The warn is triggered on a known race condition, documented in the code above
+the test, that is correctly handled. Using WARN() hinders automated testing.
+Reducing severity.
+
+Fixes: de2070fc4aa7 ("ath6kl: Fix kernel panic on continuous driver load/unload")
+Reported-and-tested-by: syzbot+555908813b2ea35dae9a@syzkaller.appspotmail.com
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230126182431.867984-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/htc_pipe.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+index c68848819a52d..9b88d96bfe96c 100644
+--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
++++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+@@ -960,8 +960,8 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
+ * Thus the possibility of ar->htc_target being NULL
+ * via ath6kl_recv_complete -> ath6kl_usb_io_comp_work.
+ */
+- if (WARN_ON_ONCE(!target)) {
+- ath6kl_err("Target not yet initialized\n");
++ if (!target) {
++ ath6kl_dbg(ATH6KL_DBG_HTC, "Target not yet initialized\n");
+ status = -EINVAL;
+ goto free_skb;
+ }
+--
+2.39.2
+
--- /dev/null
+From 101a14d0948336b27c65ee127e4dca50f06b0f1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 22:23:01 +0300
+Subject: wifi: ath9k: hif_usb: fix memory leak of remain_skbs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Fedor Pchelkin <pchelkin@ispras.ru>
+
+[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ]
+
+hif_dev->remain_skb is allocated and used exclusively in
+ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is
+processed and subsequently freed (in error paths) only during the next
+call of ath9k_hif_usb_rx_stream().
+
+So, if the urbs are deallocated between those two calls due to the device
+deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream()
+is not called next time and the allocated remain_skb is leaked. Our local
+Syzkaller instance was able to trigger that.
+
+remain_skb makes sense when receiving two consecutive urbs which are
+logically linked together, i.e. a specific data field from the first skb
+indicates a cached skb to be allocated, memcpy'd with some data and
+subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs
+deallocation supposedly makes that link irrelevant so we need to free the
+cached skb in those cases.
+
+Fix the leak by introducing a function to explicitly free remain_skb (if
+it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL
+when it has not been allocated at all (hif_dev struct is kzalloced) or
+when it has been processed in next call to ath9k_hif_usb_rx_stream().
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
+index e23d58f83dd6f..3aa915d215545 100644
+--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
+@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = {
+ .send = hif_usb_send,
+ };
+
++/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream
++ * in case ath9k_hif_usb_rx_stream wasn't called next time to
++ * process the buffer and subsequently free it.
++ */
++static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&hif_dev->rx_lock, flags);
++ if (hif_dev->remain_skb) {
++ dev_kfree_skb_any(hif_dev->remain_skb);
++ hif_dev->remain_skb = NULL;
++ hif_dev->rx_remain_len = 0;
++ RX_STAT_INC(hif_dev, skb_dropped);
++ }
++ spin_unlock_irqrestore(&hif_dev->rx_lock, flags);
++}
++
+ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
+ struct sk_buff *skb)
+ {
+@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
+ static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
+ {
+ usb_kill_anchored_urbs(&hif_dev->rx_submitted);
++ ath9k_hif_usb_free_rx_remain_skb(hif_dev);
+ }
+
+ static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)
+--
+2.39.2
+
--- /dev/null
+From 96d8a884fb8087a11901cae97f1c688b3a01cd88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Apr 2023 15:47:38 +0300
+Subject: wifi: iwlwifi: make the loop for card preparation effective
+
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+
+[ Upstream commit 28965ec0b5d9112585f725660e2ff13218505ace ]
+
+Since we didn't reset t to 0, only the first iteration of the loop
+did checked the ready bit several times.
+From the second iteration and on, we just tested the bit once and
+continued to the next iteration.
+
+Reported-and-tested-by: Lorenzo Zolfanelli <lorenzo@zolfa.nl>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216452
+Fixes: 289e5501c314 ("iwlwifi: fix the preparation of the card")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230416154301.615b683ab9c8.Ic52c3229d3345b0064fa34263293db095d88daf8@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 8915030030c4c..3a93a7b8ba0af 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -630,7 +630,6 @@ static int iwl_pcie_set_hw_ready(struct iwl_trans *trans)
+ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ {
+ int ret;
+- int t = 0;
+ int iter;
+
+ IWL_DEBUG_INFO(trans, "iwl_trans_prepare_card_hw enter\n");
+@@ -645,6 +644,8 @@ int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
+ usleep_range(1000, 2000);
+
+ for (iter = 0; iter < 10; iter++) {
++ int t = 0;
++
+ /* If HW is not ready, prepare the conditions to check again */
+ iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG,
+ CSR_HW_IF_CONFIG_REG_PREPARE);
+--
+2.39.2
+
--- /dev/null
+From 7e4ab7682557ad7ed23fe5384773dc628ab3bcdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 11:41:33 +0300
+Subject: wifi: iwlwifi: mvm: check firmware response size
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 13513cec93ac9902d0b896976d8bab3758a9881c ]
+
+Check the firmware response size for responses to the
+memory read/write command in debugfs before using it.
+
+Fixes: 2b55f43f8e47 ("iwlwifi: mvm: Add mem debugfs entry")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+index 524f9dd2323dc..f8785c70842dc 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+@@ -1877,6 +1877,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+@@ -1954,6 +1959,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file,
+ if (ret < 0)
+ return ret;
+
++ if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
++ ret = -EIO;
++ goto out;
++ }
++
+ rsp = (void *)hcmd.resp_pkt->data;
+ if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) {
+ ret = -ENXIO;
+--
+2.39.2
+
--- /dev/null
+From db259efc6ff59623a866e46330b249bd1f2b6253 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:31:38 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_rfreg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 905a9241e4e8c15d2c084fee916280514848fe35 ]
+
+If there is a failure during copy_from_user or user-provided data buffer
+is invalid, rtl_debugfs_set_write_rfreg should return negative error code
+instead of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326053138.91338-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index a7a5d8fa3cc0c..c8db166a7dc80 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -395,8 +395,8 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -406,7 +406,7 @@ static ssize_t rtl_debugfs_set_write_rfreg(struct file *filp,
+ if (num != 4) {
+ rtl_dbg(rtlpriv, COMP_ERR, DBG_DMESG,
+ "Format is <path> <addr> <mask> <data>\n");
+- return count;
++ return -EINVAL;
+ }
+
+ rtl_set_rfreg(hw, path, addr, bitmask, data);
+--
+2.39.2
+
--- /dev/null
+From dffe6e0bb61fd26b38ebc57b6525ad6a259b29ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Mar 2023 05:42:17 +0000
+Subject: wifi: rtlwifi: fix incorrect error codes in
+ rtl_debugfs_set_write_reg()
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 5dbe1f8eb8c5ac69394400a5b86fd81775e96c43 ]
+
+If there is a failure during copy_from_user or user-provided data buffer is
+invalid, rtl_debugfs_set_write_reg should return negative error code instead
+of a positive value count.
+
+Fix this bug by returning correct error code. Moreover, the check of buffer
+against null is removed since it will be handled by copy_from_user.
+
+Fixes: 610247f46feb ("rtlwifi: Improve debugging by using debugfs")
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230326054217.93492-1-harperchen1110@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/debug.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/debug.c b/drivers/net/wireless/realtek/rtlwifi/debug.c
+index c8db166a7dc80..3866ea300a70b 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/debug.c
++++ b/drivers/net/wireless/realtek/rtlwifi/debug.c
+@@ -298,8 +298,8 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+
+ tmp_len = (count > sizeof(tmp) - 1 ? sizeof(tmp) - 1 : count);
+
+- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
+- return count;
++ if (copy_from_user(tmp, buffer, tmp_len))
++ return -EFAULT;
+
+ tmp[tmp_len] = '\0';
+
+@@ -307,7 +307,7 @@ static ssize_t rtl_debugfs_set_write_reg(struct file *filp,
+ num = sscanf(tmp, "%x %x %x", &addr, &val, &len);
+
+ if (num != 3)
+- return count;
++ return -EINVAL;
+
+ switch (len) {
+ case 1:
+--
+2.39.2
+
--- /dev/null
+From 559cb70c91a4ae8bb6ab14de80a092b744961749 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Feb 2023 23:10:04 +0100
+Subject: wifi: rtw88: mac: Return the original error from
+ rtw_mac_power_switch()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 15c8e267dfa62f207ee1db666c822324e3362b84 ]
+
+rtw_mac_power_switch() calls rtw_pwr_seq_parser() which can return
+-EINVAL, -EBUSY or 0. Propagate the original error code instead of
+unconditionally returning -EINVAL in case of an error.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230226221004.138331-3-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
+index 9a50984fa06c9..94e69e97d5f5f 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -224,6 +224,7 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ struct rtw_pwr_seq_cmd **pwr_seq;
+ u8 rpwm;
+ bool cur_pwr;
++ int ret;
+
+ rpwm = rtw_read8(rtwdev, rtwdev->hci.rpwm_addr);
+
+@@ -245,8 +246,9 @@ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ return -EALREADY;
+
+ pwr_seq = pwr_on ? chip->pwr_on_seq : chip->pwr_off_seq;
+- if (rtw_pwr_seq_parser(rtwdev, pwr_seq))
+- return -EINVAL;
++ ret = rtw_pwr_seq_parser(rtwdev, pwr_seq);
++ if (ret)
++ return ret;
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 9e606625b16346c10bc0d7dc89cc9277a32f5f63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Feb 2023 23:10:03 +0100
+Subject: wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit b7ed9fa2cb76ca7a3c3cd4a6d35748fe1fbda9f6 ]
+
+rtw_pwr_seq_parser() calls rtw_sub_pwr_seq_parser() which can either
+return -EBUSY, -EINVAL or 0. Propagate the original error code instead
+of unconditionally returning -EBUSY in case of an error.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20230226221004.138331-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/mac.c b/drivers/net/wireless/realtek/rtw88/mac.c
+index b61b073031e57..9a50984fa06c9 100644
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -210,7 +210,7 @@ static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,
+
+ ret = rtw_sub_pwr_seq_parser(rtwdev, intf_mask, cut_mask, cmd);
+ if (ret)
+- return -EBUSY;
++ return ret;
+
+ idx++;
+ } while (1);
+--
+2.39.2
+
--- /dev/null
+From c5bcbdc18aa3a8cfe5b8b98bdca5eb2744ac43d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 17:09:17 +0100
+Subject: x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
+
+From: Uros Bizjak <ubizjak@gmail.com>
+
+[ Upstream commit f96fb2df3eb31ede1b34b0521560967310267750 ]
+
+The detection of atomic update failure in reserve_eilvt_offset() is
+not correct. The value returned by atomic_cmpxchg() should be compared
+to the old value from the location to be updated.
+
+If these two are the same, then atomic update succeeded and
+"eilvt_offsets[offset]" location is updated to "new" in an atomic way.
+
+Otherwise, the atomic update failed and it should be retried with the
+value from "eilvt_offsets[offset]" - exactly what atomic_try_cmpxchg()
+does in a correct and more optimal way.
+
+Fixes: a68c439b1966c ("apic, x86: Check if EILVT APIC registers are available (AMD only)")
+Signed-off-by: Uros Bizjak <ubizjak@gmail.com>
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Link: https://lore.kernel.org/r/20230227160917.107820-1-ubizjak@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/apic.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index 68c7340325233..a3b7b2fb04cb0 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -410,10 +410,9 @@ static unsigned int reserve_eilvt_offset(int offset, unsigned int new)
+ if (vector && !eilvt_entry_is_changeable(vector, new))
+ /* may not change if vectors are different */
+ return rsvd;
+- rsvd = atomic_cmpxchg(&eilvt_offsets[offset], rsvd, new);
+- } while (rsvd != new);
++ } while (!atomic_try_cmpxchg(&eilvt_offsets[offset], &rsvd, new));
+
+- rsvd &= ~APIC_EILVT_MASKED;
++ rsvd = new & ~APIC_EILVT_MASKED;
+ if (rsvd && rsvd != vector)
+ pr_info("LVT offset %d assigned for vector 0x%02x\n",
+ offset, rsvd);
+--
+2.39.2
+
--- /dev/null
+From 13d6c83d6968b10a40d115aeaac4eee771dfc628 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Mar 2023 00:30:04 -0700
+Subject: x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
+
+From: Saurabh Sengar <ssengar@linux.microsoft.com>
+
+[ Upstream commit 5af507bef93c09a94fb8f058213b489178f4cbe5 ]
+
+arch_dynirq_lower_bound() is invoked by the core interrupt code to
+retrieve the lowest possible Linux interrupt number for dynamically
+allocated interrupts like MSI.
+
+The x86 implementation uses this to exclude the IO/APIC GSI space.
+This works correctly as long as there is an IO/APIC registered, but
+returns 0 if not. This has been observed in VMs where the BIOS does
+not advertise an IO/APIC.
+
+0 is an invalid interrupt number except for the legacy timer interrupt
+on x86. The return value is unchecked in the core code, so it ends up
+to allocate interrupt number 0 which is subsequently considered to be
+invalid by the caller, e.g. the MSI allocation code.
+
+The function has already a check for 0 in the case that an IO/APIC is
+registered, as ioapic_dynirq_base is 0 in case of device tree setups.
+
+Consolidate this and zero check for both ioapic_dynirq_base and gsi_top,
+which is used in the case that no IO/APIC is registered.
+
+Fixes: 3e5bedc2c258 ("x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled machines")
+Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/1679988604-20308-1-git-send-email-ssengar@linux.microsoft.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/apic/io_apic.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
+index 1622cff009c9a..e4d63392c619e 100644
+--- a/arch/x86/kernel/apic/io_apic.c
++++ b/arch/x86/kernel/apic/io_apic.c
+@@ -2455,17 +2455,21 @@ static int io_apic_get_redir_entries(int ioapic)
+
+ unsigned int arch_dynirq_lower_bound(unsigned int from)
+ {
++ unsigned int ret;
++
+ /*
+ * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
+ * gsi_top if ioapic_dynirq_base hasn't been initialized yet.
+ */
+- if (!ioapic_initialized)
+- return gsi_top;
++ ret = ioapic_dynirq_base ? : gsi_top;
++
+ /*
+- * For DT enabled machines ioapic_dynirq_base is irrelevant and not
+- * updated. So simply return @from if ioapic_dynirq_base == 0.
++ * For DT enabled machines ioapic_dynirq_base is irrelevant and
++ * always 0. gsi_top can be 0 if there is no IO/APIC registered.
++ * 0 is an invalid interrupt number for dynamic allocations. Return
++ * @from instead.
+ */
+- return ioapic_dynirq_base ? : from;
++ return ret ? : from;
+ }
+
+ #ifdef CONFIG_X86_32
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
