--- /dev/null
+From 93403388b99a479ac59190a35638097014d29ab8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Sep 2022 09:02:16 +0200
+Subject: ALSA: hda/hdmi: Fix the converter reuse for the silent stream
+
+From: Jaroslav Kysela <perex@perex.cz>
+
+[ Upstream commit 5f80d6bd2b01de4cafac3302f58456bf860322fc ]
+
+When the user space pcm stream uses the silent stream converter,
+it is no longer allocated for the silent stream. Clear the appropriate
+flag in the hdmi_pcm_open() function. The silent stream setup may
+be applied in hdmi_pcm_close() (and the error path - open fcn) again.
+
+If the flag is not cleared, the reuse conditions for the silent
+stream converter in hdmi_choose_cvt() may improperly share
+this converter.
+
+Cc: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20220913070216.3233974-1-perex@perex.cz
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index c9d9aa6351ec..c239d9dbbaef 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1278,6 +1278,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ set_bit(pcm_idx, &spec->pcm_in_use);
+ per_pin = get_pin(spec, pin_idx);
+ per_pin->cvt_nid = per_cvt->cvt_nid;
++ per_pin->silent_stream = false;
+ hinfo->nid = per_cvt->cvt_nid;
+
+ /* flip stripe flag for the assigned stream if supported */
+--
+2.35.1
+
--- /dev/null
+From 4011884d5b8e28132b58293ae950dd42b2169aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 14:48:55 +0800
+Subject: arch: um: Mark the stack non-executable to fix a binutils warning
+
+From: David Gow <davidgow@google.com>
+
+[ Upstream commit bd71558d585ac61cfd799db7f25e78dca404dd7a ]
+
+Since binutils 2.39, ld will print a warning if any stack section is
+executable, which is the default for stack sections on files without a
+.note.GNU-stack section.
+
+This was fixed for x86 in commit ffcf9c5700e4 ("x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments"),
+but remained broken for UML, resulting in several warnings:
+
+/usr/bin/ld: warning: arch/x86/um/vdso/vdso.o: missing .note.GNU-stack section implies executable stack
+/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms1.o: missing .note.GNU-stack section implies executable stack
+/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2 has a LOAD segment with RWX permissions
+/usr/bin/ld: warning: .tmp_vmlinux.kallsyms2.o: missing .note.GNU-stack section implies executable stack
+/usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
+/usr/bin/ld: warning: vmlinux has a LOAD segment with RWX permissions
+
+Link both the VDSO and vmlinux with -z noexecstack, fixing the warnings
+about .note.GNU-stack sections. In addition, pass --no-warn-rwx-segments
+to dodge the remaining warnings about LOAD segments with RWX permissions
+in the kallsyms objects. (Note that this flag is apparently not
+available on lld, so hide it behind a test for BFD, which is what the
+x86 patch does.)
+
+Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ffcf9c5700e49c0aee42dcba9a12ba21338e8136
+Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
+Signed-off-by: David Gow <davidgow@google.com>
+Reviewed-by: Lukas Straub <lukasstraub2@web.de>
+Tested-by: Lukas Straub <lukasstraub2@web.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/Makefile | 8 ++++++++
+ arch/x86/um/vdso/Makefile | 2 +-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/Makefile b/arch/um/Makefile
+index f2fe63bfd819..f1d4d67157be 100644
+--- a/arch/um/Makefile
++++ b/arch/um/Makefile
+@@ -132,10 +132,18 @@ export LDS_ELF_FORMAT := $(ELF_FORMAT)
+ # The wrappers will select whether using "malloc" or the kernel allocator.
+ LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc
+
++# Avoid binutils 2.39+ warnings by marking the stack non-executable and
++# ignorning warnings for the kallsyms sections.
++LDFLAGS_EXECSTACK = -z noexecstack
++ifeq ($(CONFIG_LD_IS_BFD),y)
++LDFLAGS_EXECSTACK += $(call ld-option,--no-warn-rwx-segments)
++endif
++
+ LD_FLAGS_CMDLINE = $(foreach opt,$(KBUILD_LDFLAGS),-Wl,$(opt))
+
+ # Used by link-vmlinux.sh which has special support for um link
+ export CFLAGS_vmlinux := $(LINK-y) $(LINK_WRAPS) $(LD_FLAGS_CMDLINE)
++export LDFLAGS_vmlinux := $(LDFLAGS_EXECSTACK)
+
+ # When cleaning we don't include .config, so we don't include
+ # TT or skas makefiles and don't clean skas_ptregs.h.
+diff --git a/arch/x86/um/vdso/Makefile b/arch/x86/um/vdso/Makefile
+index 5943387e3f35..5ca366e15c76 100644
+--- a/arch/x86/um/vdso/Makefile
++++ b/arch/x86/um/vdso/Makefile
+@@ -62,7 +62,7 @@ quiet_cmd_vdso = VDSO $@
+ -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
+ sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
+
+-VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv
++VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv -z noexecstack
+ GCOV_PROFILE := n
+
+ #
+--
+2.35.1
+
--- /dev/null
+From 365dd33fc4231f2d0316643022df457686f3fc77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Sep 2022 20:53:41 +0300
+Subject: ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
+
+From: Sergei Antonov <saproj@gmail.com>
+
+[ Upstream commit 02181e68275d28cab3c3f755852770367f1bc229 ]
+
+Driver moxart-mmc.c has .compatible = "moxa,moxart-mmc".
+
+But moxart .dts/.dtsi and the documentation file moxa,moxart-dma.txt
+contain compatible = "moxa,moxart-sdhci".
+
+Change moxart .dts/.dtsi files and moxa,moxart-dma.txt to match the driver.
+
+Replace 'sdhci' with 'mmc' in names too, since SDHCI is a different
+controller from FTSDC010.
+
+Suggested-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sergei Antonov <saproj@gmail.com>
+Cc: Jonas Jensen <jonas.jensen@gmail.com>
+Link: https://lore.kernel.org/r/20220907175341.1477383-1-saproj@gmail.com'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt | 4 ++--
+ arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +-
+ arch/arm/boot/dts/moxart.dtsi | 4 ++--
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
+index 8a9f3559335b..7e14e26676ec 100644
+--- a/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
++++ b/Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt
+@@ -34,8 +34,8 @@ Example:
+ Use specific request line passing from dma
+ For example, MMC request line is 5
+
+- sdhci: sdhci@98e00000 {
+- compatible = "moxa,moxart-sdhci";
++ mmc: mmc@98e00000 {
++ compatible = "moxa,moxart-mmc";
+ reg = <0x98e00000 0x5C>;
+ interrupts = <5 0>;
+ clocks = <&clk_apb>;
+diff --git a/arch/arm/boot/dts/moxart-uc7112lx.dts b/arch/arm/boot/dts/moxart-uc7112lx.dts
+index eb5291b0ee3a..e07b807b4cec 100644
+--- a/arch/arm/boot/dts/moxart-uc7112lx.dts
++++ b/arch/arm/boot/dts/moxart-uc7112lx.dts
+@@ -79,7 +79,7 @@ &clk_pll {
+ clocks = <&ref12>;
+ };
+
+-&sdhci {
++&mmc {
+ status = "okay";
+ };
+
+diff --git a/arch/arm/boot/dts/moxart.dtsi b/arch/arm/boot/dts/moxart.dtsi
+index f5f070a87482..764832ddfa78 100644
+--- a/arch/arm/boot/dts/moxart.dtsi
++++ b/arch/arm/boot/dts/moxart.dtsi
+@@ -93,8 +93,8 @@ watchdog: watchdog@98500000 {
+ clock-names = "PCLK";
+ };
+
+- sdhci: sdhci@98e00000 {
+- compatible = "moxa,moxart-sdhci";
++ mmc: mmc@98e00000 {
++ compatible = "moxa,moxart-mmc";
+ reg = <0x98e00000 0x5C>;
+ interrupts = <5 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk_apb>;
+--
+2.35.1
+
--- /dev/null
+From 0efef8d2fc246f598fe38b8240d87c3d913bf05d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Aug 2022 14:19:29 +0200
+Subject: arm64: dts: rockchip: fix upper usb port on BPI-R2-Pro
+
+From: Frank Wunderlich <frank-w@public-files.de>
+
+[ Upstream commit 388f9f0a7ff84b7890a24499a3a1fea0cad21373 ]
+
+- extcon is no more needed in 5.19 - so drop it
+ commit 51a9b2c03dd3 ("phy: rockchip-inno-usb2: Handle ID IRQ")
+- dr_mode was changed from host to otg in rk356x.dtsi
+ commit bc405bb3eeee ("arm64: dts: rockchip: enable otg/drd
+ operation of usb_host0_xhci in rk356x")
+ change it back on board level as id-pin on r2pro is not connected
+
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Link: https://lore.kernel.org/r/20220821121929.244112-1-linux@fw-web.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts
+index 40cf2236c0b6..ca48d9a54939 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3568-bpi-r2-pro.dts
+@@ -558,7 +558,7 @@ &usb_host0_ohci {
+ };
+
+ &usb_host0_xhci {
+- extcon = <&usb2phy0>;
++ dr_mode = "host";
+ status = "okay";
+ };
+
+--
+2.35.1
+
--- /dev/null
+From d22c9cd39b144348d351ddf7bac3803a1c45d24c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Sep 2022 11:59:14 -0400
+Subject: [coredump] don't use __kernel_write() on kmap_local_page()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 06bbaa6dc53cb72040db952053432541acb9adc7 ]
+
+passing kmap_local_page() result to __kernel_write() is unsafe -
+random ->write_iter() might (and 9p one does) get unhappy when
+passed ITER_KVEC with pointer that came from kmap_local_page().
+
+Fix by providing a variant of __kernel_write() that takes an iov_iter
+from caller (__kernel_write() becomes a trivial wrapper) and adding
+dump_emit_page() that parallels dump_emit(), except that instead of
+__kernel_write() it uses __kernel_write_iter() with ITER_BVEC source.
+
+Fixes: 3159ed57792b "fs/coredump: use kmap_local_page()"
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/coredump.c | 38 +++++++++++++++++++++++++++++++++-----
+ fs/internal.h | 3 +++
+ fs/read_write.c | 22 ++++++++++++++--------
+ 3 files changed, 50 insertions(+), 13 deletions(-)
+
+diff --git a/fs/coredump.c b/fs/coredump.c
+index ebc43f960b64..f1355e52614a 100644
+--- a/fs/coredump.c
++++ b/fs/coredump.c
+@@ -832,6 +832,38 @@ static int __dump_skip(struct coredump_params *cprm, size_t nr)
+ }
+ }
+
++static int dump_emit_page(struct coredump_params *cprm, struct page *page)
++{
++ struct bio_vec bvec = {
++ .bv_page = page,
++ .bv_offset = 0,
++ .bv_len = PAGE_SIZE,
++ };
++ struct iov_iter iter;
++ struct file *file = cprm->file;
++ loff_t pos = file->f_pos;
++ ssize_t n;
++
++ if (cprm->to_skip) {
++ if (!__dump_skip(cprm, cprm->to_skip))
++ return 0;
++ cprm->to_skip = 0;
++ }
++ if (cprm->written + PAGE_SIZE > cprm->limit)
++ return 0;
++ if (dump_interrupted())
++ return 0;
++ iov_iter_bvec(&iter, WRITE, &bvec, 1, PAGE_SIZE);
++ n = __kernel_write_iter(cprm->file, &iter, &pos);
++ if (n != PAGE_SIZE)
++ return 0;
++ file->f_pos = pos;
++ cprm->written += PAGE_SIZE;
++ cprm->pos += PAGE_SIZE;
++
++ return 1;
++}
++
+ int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
+ {
+ if (cprm->to_skip) {
+@@ -863,7 +895,6 @@ int dump_user_range(struct coredump_params *cprm, unsigned long start,
+
+ for (addr = start; addr < start + len; addr += PAGE_SIZE) {
+ struct page *page;
+- int stop;
+
+ /*
+ * To avoid having to allocate page tables for virtual address
+@@ -874,10 +905,7 @@ int dump_user_range(struct coredump_params *cprm, unsigned long start,
+ */
+ page = get_dump_page(addr);
+ if (page) {
+- void *kaddr = kmap_local_page(page);
+-
+- stop = !dump_emit(cprm, kaddr, PAGE_SIZE);
+- kunmap_local(kaddr);
++ int stop = !dump_emit_page(cprm, page);
+ put_page(page);
+ if (stop)
+ return 0;
+diff --git a/fs/internal.h b/fs/internal.h
+index 87e96b9024ce..3e206d3e317c 100644
+--- a/fs/internal.h
++++ b/fs/internal.h
+@@ -16,6 +16,7 @@ struct shrink_control;
+ struct fs_context;
+ struct user_namespace;
+ struct pipe_inode_info;
++struct iov_iter;
+
+ /*
+ * block/bdev.c
+@@ -221,3 +222,5 @@ ssize_t do_getxattr(struct user_namespace *mnt_userns,
+ int setxattr_copy(const char __user *name, struct xattr_ctx *ctx);
+ int do_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
+ struct xattr_ctx *ctx);
++
++ssize_t __kernel_write_iter(struct file *file, struct iov_iter *from, loff_t *pos);
+diff --git a/fs/read_write.c b/fs/read_write.c
+index 397da0236607..a0a3d35e2c0f 100644
+--- a/fs/read_write.c
++++ b/fs/read_write.c
+@@ -509,14 +509,9 @@ static ssize_t new_sync_write(struct file *filp, const char __user *buf, size_t
+ }
+
+ /* caller is responsible for file_start_write/file_end_write */
+-ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos)
++ssize_t __kernel_write_iter(struct file *file, struct iov_iter *from, loff_t *pos)
+ {
+- struct kvec iov = {
+- .iov_base = (void *)buf,
+- .iov_len = min_t(size_t, count, MAX_RW_COUNT),
+- };
+ struct kiocb kiocb;
+- struct iov_iter iter;
+ ssize_t ret;
+
+ if (WARN_ON_ONCE(!(file->f_mode & FMODE_WRITE)))
+@@ -532,8 +527,7 @@ ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t
+
+ init_sync_kiocb(&kiocb, file);
+ kiocb.ki_pos = pos ? *pos : 0;
+- iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len);
+- ret = file->f_op->write_iter(&kiocb, &iter);
++ ret = file->f_op->write_iter(&kiocb, from);
+ if (ret > 0) {
+ if (pos)
+ *pos = kiocb.ki_pos;
+@@ -543,6 +537,18 @@ ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t
+ inc_syscw(current);
+ return ret;
+ }
++
++/* caller is responsible for file_start_write/file_end_write */
++ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos)
++{
++ struct kvec iov = {
++ .iov_base = (void *)buf,
++ .iov_len = min_t(size_t, count, MAX_RW_COUNT),
++ };
++ struct iov_iter iter;
++ iov_iter_kvec(&iter, WRITE, &iov, 1, iov.iov_len);
++ return __kernel_write_iter(file, &iter, pos);
++}
+ /*
+ * This "EXPORT_SYMBOL_GPL()" is more of a "EXPORT_SYMBOL_DONTUSE()",
+ * but autofs is one of the few internal kernel users that actually
+--
+2.35.1
+
--- /dev/null
+From 2ec3fbd3686c28ee2bb9d6207f03c30459a806e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 11:41:24 +0530
+Subject: dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
+
+From: Swati Agarwal <swati.agarwal@xilinx.com>
+
+[ Upstream commit 462bce790e6a7e68620a4ce260cc38f7ed0255d5 ]
+
+Free the allocated resources for missing xlnx,num-fstores property.
+
+Signed-off-by: Swati Agarwal <swati.agarwal@xilinx.com>
+Link: https://lore.kernel.org/r/20220817061125.4720-3-swati.agarwal@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index ba0dccaa8cf1..f63ec9d862ff 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -3191,7 +3191,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ if (err < 0) {
+ dev_err(xdev->dev,
+ "missing xlnx,num-fstores property\n");
+- return err;
++ goto disable_clks;
+ }
+
+ err = of_property_read_u32(node, "xlnx,flush-fsync",
+--
+2.35.1
+
--- /dev/null
+From fb7dba02c9953b526fb9cad7f7e2b6b337290ac7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 11:41:23 +0530
+Subject: dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error
+ handling
+
+From: Swati Agarwal <swati.agarwal@xilinx.com>
+
+[ Upstream commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d ]
+
+Add missing cleanup in devm_platform_ioremap_resource().
+When probe fails remove dma channel resources and disable clocks in
+accordance with the order of resources allocated .
+
+Signed-off-by: Swati Agarwal <swati.agarwal@xilinx.com>
+Link: https://lore.kernel.org/r/20220817061125.4720-2-swati.agarwal@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index cd62bbb50e8b..ba0dccaa8cf1 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -3160,9 +3160,10 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+
+ /* Request and map I/O memory */
+ xdev->regs = devm_platform_ioremap_resource(pdev, 0);
+- if (IS_ERR(xdev->regs))
+- return PTR_ERR(xdev->regs);
+-
++ if (IS_ERR(xdev->regs)) {
++ err = PTR_ERR(xdev->regs);
++ goto disable_clks;
++ }
+ /* Retrieve the DMA engine properties from the device tree */
+ xdev->max_buffer_len = GENMASK(XILINX_DMA_MAX_TRANS_LEN_MAX - 1, 0);
+ xdev->s2mm_chan_id = xdev->dma_config->max_channels / 2;
+@@ -3259,7 +3260,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ for_each_child_of_node(node, child) {
+ err = xilinx_dma_child_probe(xdev, child);
+ if (err < 0)
+- goto disable_clks;
++ goto error;
+ }
+
+ if (xdev->dma_config->dmatype == XDMA_TYPE_VDMA) {
+@@ -3294,12 +3295,12 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+
+ return 0;
+
+-disable_clks:
+- xdma_disable_allclks(xdev);
+ error:
+ for (i = 0; i < xdev->dma_config->max_channels; i++)
+ if (xdev->chan[i])
+ xilinx_dma_chan_remove(xdev->chan[i]);
++disable_clks:
++ xdma_disable_allclks(xdev);
+
+ return err;
+ }
+--
+2.35.1
+
--- /dev/null
+From dc08246055d9edf68ca583cdb661cbdb6cb1f343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 11:41:25 +0530
+Subject: dmaengine: xilinx_dma: Report error in case of
+ dma_set_mask_and_coherent API failure
+
+From: Swati Agarwal <swati.agarwal@xilinx.com>
+
+[ Upstream commit 8f2b6bc79c32f0fa60df000ae387a790ec80eae9 ]
+
+The driver does not handle the failure case while calling
+dma_set_mask_and_coherent API.
+
+In case of failure, capture the return value of API and then report an
+error.
+
+Addresses-coverity: Unchecked return value (CHECKED_RETURN)
+
+Signed-off-by: Swati Agarwal <swati.agarwal@xilinx.com>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Link: https://lore.kernel.org/r/20220817061125.4720-4-swati.agarwal@xilinx.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index f63ec9d862ff..7ce8bb160a59 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -3211,7 +3211,11 @@ static int xilinx_dma_probe(struct platform_device *pdev)
+ xdev->ext_addr = false;
+
+ /* Set the dma mask bits */
+- dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
++ err = dma_set_mask_and_coherent(xdev->dev, DMA_BIT_MASK(addr_width));
++ if (err < 0) {
++ dev_err(xdev->dev, "DMA mask error %d\n", err);
++ goto disable_clks;
++ }
+
+ /* Initialize the DMA engine */
+ xdev->common.dev = &pdev->dev;
+--
+2.35.1
+
--- /dev/null
+From e99d62f410fd47b5784fed11d531ae157630a5e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Aug 2022 15:10:43 -0400
+Subject: drm/amd/display: Assume an LTTPR is always present on fixed_vs links
+
+From: Michael Strauss <michael.strauss@amd.com>
+
+[ Upstream commit 29956d0fded036a570bd8e7d4ea4b1a1730307d2 ]
+
+[WHY]
+LTTPRs can in very rare instsances fail to increment DPCD LTTPR count.
+This results in aux-i LTTPR requests to be sent to the wrong DPCD
+address, which causes link training failure.
+
+[HOW]
+Override internal repeater count if fixed_vs flag is set for a given link
+
+Reviewed-by: George Shen <George.Shen@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Michael Strauss <michael.strauss@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index a4fc9a6c850e..0c52506b367d 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -5211,6 +5211,14 @@ bool dp_retrieve_lttpr_cap(struct dc_link *link)
+ lttpr_dpcd_data[DP_PHY_REPEATER_128B132B_RATES -
+ DP_LT_TUNABLE_PHY_REPEATER_FIELD_DATA_STRUCTURE_REV];
+
++ /* If this chip cap is set, at least one retimer must exist in the chain
++ * Override count to 1 if we receive a known bad count (0 or an invalid value) */
++ if (link->chip_caps & EXT_DISPLAY_PATH_CAPS__DP_FIXED_VS_EN &&
++ (dp_convert_to_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt) == 0)) {
++ ASSERT(0);
++ link->dpcd_caps.lttpr_caps.phy_repeater_cnt = 0x80;
++ }
++
+ /* Attempt to train in LTTPR transparent mode if repeater count exceeds 8. */
+ is_lttpr_present = (link->dpcd_caps.lttpr_caps.max_lane_count > 0 &&
+ link->dpcd_caps.lttpr_caps.max_lane_count <= 4 &&
+--
+2.35.1
+
--- /dev/null
+From d442b4a525cf89de1364c0befb6989ad90b7e73f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 16:38:16 -0400
+Subject: drm/amd/display: Fix double cursor on non-video RGB MPO
+
+From: Leo Li <sunpeng.li@amd.com>
+
+[ Upstream commit b261509952bc19d1012cf732f853659be6ebc61e ]
+
+[Why]
+
+DC makes use of layer_index (zpos) when picking the HW plane to enable
+HW cursor on. However, some compositors will not attach zpos information
+to each DRM plane. Consequently, in amdgpu, we default layer_index to 0
+and do not update it.
+
+This causes said DC logic to enable HW cursor on all planes of the same
+layer_index, which manifests as a double cursor issue if one of the
+planes is scaled (and hence scaling the cursor as well).
+
+[How]
+
+Use DRM core helpers to calculate a normalized_zpos value for each
+drm_plane_state under each crtc, within the atomic state.
+
+This helper will first consider existing zpos values, and if
+identical/unset, fallback to plane ID ordering.
+
+The normalized_zpos is then passed to dc_plane_info during atomic check
+for later use by the cursor logic.
+
+Reviewed-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Leo Li <sunpeng.li@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 0424570c736f..c781f92db959 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5629,7 +5629,7 @@ fill_dc_plane_info_and_addr(struct amdgpu_device *adev,
+ plane_info->visible = true;
+ plane_info->stereo_format = PLANE_STEREO_FORMAT_NONE;
+
+- plane_info->layer_index = 0;
++ plane_info->layer_index = plane_state->normalized_zpos;
+
+ ret = fill_plane_color_attributes(plane_state, plane_info->format,
+ &plane_info->color_space);
+@@ -5697,7 +5697,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev,
+ dc_plane_state->global_alpha = plane_info.global_alpha;
+ dc_plane_state->global_alpha_value = plane_info.global_alpha_value;
+ dc_plane_state->dcc = plane_info.dcc;
+- dc_plane_state->layer_index = plane_info.layer_index; // Always returns 0
++ dc_plane_state->layer_index = plane_info.layer_index;
+ dc_plane_state->flip_int_enabled = true;
+
+ /*
+@@ -11147,6 +11147,14 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
+ }
+ }
+
++ /*
++ * DC consults the zpos (layer_index in DC terminology) to determine the
++ * hw plane on which to enable the hw cursor (see
++ * `dcn10_can_pipe_disable_cursor`). By now, all modified planes are in
++ * atomic state, so call drm helper to normalize zpos.
++ */
++ drm_atomic_normalize_zpos(dev, state);
++
+ /* Remove exiting planes if they are modified */
+ for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) {
+ ret = dm_update_plane_state(dc, state, plane,
+--
+2.35.1
+
--- /dev/null
+From 426328c1ce000b762bb03b5e2b6ded75c6e67f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Sep 2022 22:04:09 +0800
+Subject: drm/amd/display: Fix DP MST timeslot issue when fallback happened
+
+From: Cruise Hung <Cruise.Hung@amd.com>
+
+[ Upstream commit 20c6168b3c8aadef7d2853c925d99eb546bd5e1c ]
+
+[Why]
+When USB4 DP link training failed and fell back to lower link rate,
+the time slot calculation uses the verified_link_cap.
+And the verified_link_cap was not updated to the new one.
+It caused the wrong VC payload time-slot was allocated.
+
+[How]
+Updated verified_link_cap with the new one from cur_link_settings
+after the LT completes successfully.
+
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Cruise Hung <Cruise.Hung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+index 0c52506b367d..b4203a812c4b 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c
+@@ -2857,8 +2857,14 @@ bool perform_link_training_with_retries(
+ skip_video_pattern);
+
+ /* Transmit idle pattern once training successful. */
+- if (status == LINK_TRAINING_SUCCESS && !is_link_bw_low)
++ if (status == LINK_TRAINING_SUCCESS && !is_link_bw_low) {
+ dp_set_hw_test_pattern(link, &pipe_ctx->link_res, DP_TEST_PATTERN_VIDEO_MODE, NULL, 0);
++ /* Update verified link settings to current one
++ * Because DPIA LT might fallback to lower link setting.
++ */
++ link->verified_link_cap.link_rate = link->cur_link_settings.link_rate;
++ link->verified_link_cap.lane_count = link->cur_link_settings.lane_count;
++ }
+ } else {
+ status = dc_link_dp_perform_link_training(link,
+ &pipe_ctx->link_res,
+--
+2.35.1
+
--- /dev/null
+From 92acdee9d4b7df1a2ed2c0476b2263fa9cd9ae45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jul 2022 13:02:44 -0400
+Subject: drm/amd/display: increase dcn315 pstate change latency
+
+From: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+
+[ Upstream commit dcc2527df918edfe297c5074ccc1f05eae361ca6 ]
+
+[Why & How]
+Update after new measurment came in
+
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 22 ++++++++++++-------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+index f4381725b210..c3d7712e9fd0 100644
+--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+@@ -46,6 +46,9 @@
+ #define TO_CLK_MGR_DCN315(clk_mgr)\
+ container_of(clk_mgr, struct clk_mgr_dcn315, base)
+
++#define UNSUPPORTED_DCFCLK 10000000
++#define MIN_DPP_DISP_CLK 100000
++
+ static int dcn315_get_active_display_cnt_wa(
+ struct dc *dc,
+ struct dc_state *context)
+@@ -146,6 +149,9 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
+ }
+ }
+
++ /* Lock pstate by requesting unsupported dcfclk if change is unsupported */
++ if (!new_clocks->p_state_change_support)
++ new_clocks->dcfclk_khz = UNSUPPORTED_DCFCLK;
+ if (should_set_clock(safe_to_lower, new_clocks->dcfclk_khz, clk_mgr_base->clks.dcfclk_khz)) {
+ clk_mgr_base->clks.dcfclk_khz = new_clocks->dcfclk_khz;
+ dcn315_smu_set_hard_min_dcfclk(clk_mgr, clk_mgr_base->clks.dcfclk_khz);
+@@ -159,10 +165,10 @@ static void dcn315_update_clocks(struct clk_mgr *clk_mgr_base,
+
+ // workaround: Limit dppclk to 100Mhz to avoid lower eDP panel switch to plus 4K monitor underflow.
+ if (!IS_DIAG_DC(dc->ctx->dce_environment)) {
+- if (new_clocks->dppclk_khz < 100000)
+- new_clocks->dppclk_khz = 100000;
+- if (new_clocks->dispclk_khz < 100000)
+- new_clocks->dispclk_khz = 100000;
++ if (new_clocks->dppclk_khz < MIN_DPP_DISP_CLK)
++ new_clocks->dppclk_khz = MIN_DPP_DISP_CLK;
++ if (new_clocks->dispclk_khz < MIN_DPP_DISP_CLK)
++ new_clocks->dispclk_khz = MIN_DPP_DISP_CLK;
+ }
+
+ if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr->base.clks.dppclk_khz)) {
+@@ -272,7 +278,7 @@ static struct wm_table ddr5_wm_table = {
+ {
+ .wm_inst = WM_A,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+- .pstate_latency_us = 64.0,
++ .pstate_latency_us = 129.0,
+ .sr_exit_time_us = 11.5,
+ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+@@ -280,7 +286,7 @@ static struct wm_table ddr5_wm_table = {
+ {
+ .wm_inst = WM_B,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+- .pstate_latency_us = 64.0,
++ .pstate_latency_us = 129.0,
+ .sr_exit_time_us = 11.5,
+ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+@@ -288,7 +294,7 @@ static struct wm_table ddr5_wm_table = {
+ {
+ .wm_inst = WM_C,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+- .pstate_latency_us = 64.0,
++ .pstate_latency_us = 129.0,
+ .sr_exit_time_us = 11.5,
+ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+@@ -296,7 +302,7 @@ static struct wm_table ddr5_wm_table = {
+ {
+ .wm_inst = WM_D,
+ .wm_type = WM_TYPE_PSTATE_CHG,
+- .pstate_latency_us = 64.0,
++ .pstate_latency_us = 129.0,
+ .sr_exit_time_us = 11.5,
+ .sr_enter_plus_exit_time_us = 14.5,
+ .valid = true,
+--
+2.35.1
+
--- /dev/null
+From cd533c7a802ce684e4e2dd4177fc5771ac999bf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 19:44:50 +0800
+Subject: drm/amd/display: skip audio setup when audio stream is enabled
+
+From: zhikzhai <zhikai.zhai@amd.com>
+
+[ Upstream commit 65fbfb02c2734cacffec5e3f492e1b4f1dabcf98 ]
+
+[why]
+We have minimal pipe split transition method to avoid pipe
+allocation outage.However, this method will invoke audio setup
+which cause audio output stuck once pipe reallocate.
+
+[how]
+skip audio setup for pipelines which audio stream has been enabled
+
+Reviewed-by: Charlene Liu <Charlene.Liu@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: zhikzhai <zhikai.zhai@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+index aee31c785aa9..4f0ea50eaa83 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+@@ -2165,7 +2165,8 @@ static void dce110_setup_audio_dto(
+ continue;
+ if (pipe_ctx->stream->signal != SIGNAL_TYPE_HDMI_TYPE_A)
+ continue;
+- if (pipe_ctx->stream_res.audio != NULL) {
++ if (pipe_ctx->stream_res.audio != NULL &&
++ pipe_ctx->stream_res.audio->enabled == false) {
+ struct audio_output audio_output;
+
+ build_audio_output(context, pipe_ctx, &audio_output);
+@@ -2207,7 +2208,8 @@ static void dce110_setup_audio_dto(
+ if (!dc_is_dp_signal(pipe_ctx->stream->signal))
+ continue;
+
+- if (pipe_ctx->stream_res.audio != NULL) {
++ if (pipe_ctx->stream_res.audio != NULL &&
++ pipe_ctx->stream_res.audio->enabled == false) {
+ struct audio_output audio_output;
+
+ build_audio_output(context, pipe_ctx, &audio_output);
+--
+2.35.1
+
--- /dev/null
+From c7f7d63718fdfd7b8480c62df80ffa802ded4501 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Sep 2022 10:08:35 +0800
+Subject: drm/amd/display: update gamut remap if plane has changed
+
+From: Hugo Hu <hugo.hu@amd.com>
+
+[ Upstream commit 52bb21499cf54fa65b56d97cd0d68579c90207dd ]
+
+[Why]
+The desktop plane and full-screen game plane may have different
+gamut remap coefficients, if switching between desktop and
+full-screen game without updating the gamut remap will cause
+incorrect color.
+
+[How]
+Update gamut remap if planes change.
+
+Reviewed-by: Dmytro Laktyushkin <Dmytro.Laktyushkin@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Hugo Hu <hugo.hu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+index ec6aa8d8b251..213a02a769d4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c
+@@ -1520,6 +1520,7 @@ static void dcn20_update_dchubp_dpp(
+ /* Any updates are handled in dc interface, just need
+ * to apply existing for plane enable / opp change */
+ if (pipe_ctx->update_flags.bits.enable || pipe_ctx->update_flags.bits.opp_changed
++ || pipe_ctx->update_flags.bits.plane_changed
+ || pipe_ctx->stream->update_flags.bits.gamut_remap
+ || pipe_ctx->stream->update_flags.bits.out_csc) {
+ /* dpp/cm gamut remap*/
+--
+2.35.1
+
--- /dev/null
+From c28ddcd3c77181f56e9dc62b2a8aa5df344fd7b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 23:18:47 +0800
+Subject: drm/amdgpu/mes: zero the sdma_hqd_mask of 2nd SDMA engine for SDMA
+ 6.0.1
+
+From: Yifan Zhang <yifan1.zhang@amd.com>
+
+[ Upstream commit 0af4ed0c329ebb4cef95fda4fcdbfcdea0255442 ]
+
+there is only one SDMA engine in SDMA 6.0.1, the sdma_hqd_mask has to be
+zeroed for the 2nd engine, otherwise MES scheduler will consider 2nd
+engine exists and map/unmap SDMA queues to the non-existent engine.
+
+Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
+Reviewed-by: Tim Huang <Tim.Huang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
+index 69a70a0aaed9..6ab062c63da1 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c
+@@ -169,6 +169,9 @@ int amdgpu_mes_init(struct amdgpu_device *adev)
+ for (i = 0; i < AMDGPU_MES_MAX_SDMA_PIPES; i++) {
+ if (adev->ip_versions[SDMA0_HWIP][0] < IP_VERSION(6, 0, 0))
+ adev->mes.sdma_hqd_mask[i] = i ? 0 : 0x3fc;
++ /* zero sdma_hqd_mask for non-existent engine */
++ else if (adev->sdma.num_instances == 1)
++ adev->mes.sdma_hqd_mask[i] = i ? 0 : 0xfc;
+ else
+ adev->mes.sdma_hqd_mask[i] = 0xfc;
+ }
+--
+2.35.1
+
--- /dev/null
+From 8ab3cf6befa3d9dc00c3344d54948e3cbfa1f75c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 18:27:31 +0100
+Subject: firmware: arm_scmi: Add SCMI PM driver remove routine
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit dea796fcab0a219830831c070b8dc367d7e0f708 ]
+
+Currently, when removing the SCMI PM driver not all the resources
+registered with genpd subsystem are properly de-registered.
+
+As a side effect of this after a driver unload/load cycle you get a
+splat with a few warnings like this:
+
+ | debugfs: Directory 'BIG_CPU0' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'BIG_CPU1' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU0' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU1' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU2' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_CPU3' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'BIG_SSTOP' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'LITTLE_SSTOP' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'DBGSYS' with parent 'pm_genpd' already present!
+ | debugfs: Directory 'GPUTOP' with parent 'pm_genpd' already present!
+
+Add a proper scmi_pm_domain_remove callback to the driver in order to
+take care of all the needed cleanups not handled by devres framework.
+
+Link: https://lore.kernel.org/r/20220817172731.1185305-7-cristian.marussi@arm.com
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+index d5dee625de78..0e05a79de82d 100644
+--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
++++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
+@@ -112,9 +112,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev)
+ scmi_pd_data->domains = domains;
+ scmi_pd_data->num_domains = num_domains;
+
++ dev_set_drvdata(dev, scmi_pd_data);
++
+ return of_genpd_add_provider_onecell(np, scmi_pd_data);
+ }
+
++static void scmi_pm_domain_remove(struct scmi_device *sdev)
++{
++ int i;
++ struct genpd_onecell_data *scmi_pd_data;
++ struct device *dev = &sdev->dev;
++ struct device_node *np = dev->of_node;
++
++ of_genpd_del_provider(np);
++
++ scmi_pd_data = dev_get_drvdata(dev);
++ for (i = 0; i < scmi_pd_data->num_domains; i++) {
++ if (!scmi_pd_data->domains[i])
++ continue;
++ pm_genpd_remove(scmi_pd_data->domains[i]);
++ }
++}
++
+ static const struct scmi_device_id scmi_id_table[] = {
+ { SCMI_PROTOCOL_POWER, "genpd" },
+ { },
+@@ -124,6 +143,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table);
+ static struct scmi_driver scmi_power_domain_driver = {
+ .name = "scmi-power-domain",
+ .probe = scmi_pm_domain_probe,
++ .remove = scmi_pm_domain_remove,
+ .id_table = scmi_id_table,
+ };
+ module_scmi_driver(scmi_power_domain_driver);
+--
+2.35.1
+
--- /dev/null
+From b2160d4d907eab80df64cb72311a23cf33a16fd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 18:27:28 +0100
+Subject: firmware: arm_scmi: Harden accesses to the sensor domains
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit 76f89c954788763db575fb512a40bd483864f1e9 ]
+
+Accessing sensor domains descriptors by the index upon the SCMI drivers
+requests through the SCMI sensor operations interface can potentially
+lead to out-of-bound violations if the SCMI driver misbehave.
+
+Add an internal consistency check before any such domains descriptors
+accesses.
+
+Link: https://lore.kernel.org/r/20220817172731.1185305-4-cristian.marussi@arm.com
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/sensors.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
+index 7d0c7476d206..0b5853fa9d87 100644
+--- a/drivers/firmware/arm_scmi/sensors.c
++++ b/drivers/firmware/arm_scmi/sensors.c
+@@ -762,6 +762,10 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph,
+ {
+ int ret;
+ struct scmi_xfer *t;
++ struct sensors_info *si = ph->get_priv(ph);
++
++ if (sensor_id >= si->num_sensors)
++ return -EINVAL;
+
+ ret = ph->xops->xfer_get_init(ph, SENSOR_CONFIG_GET,
+ sizeof(__le32), sizeof(__le32), &t);
+@@ -771,7 +775,6 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph,
+ put_unaligned_le32(sensor_id, t->tx.buf);
+ ret = ph->xops->do_xfer(ph, t);
+ if (!ret) {
+- struct sensors_info *si = ph->get_priv(ph);
+ struct scmi_sensor_info *s = si->sensors + sensor_id;
+
+ *sensor_config = get_unaligned_le64(t->rx.buf);
+@@ -788,6 +791,10 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph,
+ int ret;
+ struct scmi_xfer *t;
+ struct scmi_msg_sensor_config_set *msg;
++ struct sensors_info *si = ph->get_priv(ph);
++
++ if (sensor_id >= si->num_sensors)
++ return -EINVAL;
+
+ ret = ph->xops->xfer_get_init(ph, SENSOR_CONFIG_SET,
+ sizeof(*msg), 0, &t);
+@@ -800,7 +807,6 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph,
+
+ ret = ph->xops->do_xfer(ph, t);
+ if (!ret) {
+- struct sensors_info *si = ph->get_priv(ph);
+ struct scmi_sensor_info *s = si->sensors + sensor_id;
+
+ s->sensor_config = sensor_config;
+@@ -831,8 +837,11 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph,
+ int ret;
+ struct scmi_xfer *t;
+ struct scmi_msg_sensor_reading_get *sensor;
++ struct scmi_sensor_info *s;
+ struct sensors_info *si = ph->get_priv(ph);
+- struct scmi_sensor_info *s = si->sensors + sensor_id;
++
++ if (sensor_id >= si->num_sensors)
++ return -EINVAL;
+
+ ret = ph->xops->xfer_get_init(ph, SENSOR_READING_GET,
+ sizeof(*sensor), 0, &t);
+@@ -841,6 +850,7 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph,
+
+ sensor = t->tx.buf;
+ sensor->id = cpu_to_le32(sensor_id);
++ s = si->sensors + sensor_id;
+ if (s->async) {
+ sensor->flags = cpu_to_le32(SENSOR_READ_ASYNC);
+ ret = ph->xops->do_xfer_with_response(ph, t);
+@@ -895,9 +905,13 @@ scmi_sensor_reading_get_timestamped(const struct scmi_protocol_handle *ph,
+ int ret;
+ struct scmi_xfer *t;
+ struct scmi_msg_sensor_reading_get *sensor;
++ struct scmi_sensor_info *s;
+ struct sensors_info *si = ph->get_priv(ph);
+- struct scmi_sensor_info *s = si->sensors + sensor_id;
+
++ if (sensor_id >= si->num_sensors)
++ return -EINVAL;
++
++ s = si->sensors + sensor_id;
+ if (!count || !readings ||
+ (!s->num_axis && count > 1) || (s->num_axis && count > s->num_axis))
+ return -EINVAL;
+--
+2.35.1
+
--- /dev/null
+From fbe7de31f8b9171a71a4bf08220acf88684591f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Aug 2022 18:27:27 +0100
+Subject: firmware: arm_scmi: Improve checks in the info_get operations
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit 1ecb7d27b1af6705e9a4e94415b4d8cc8cf2fbfb ]
+
+SCMI protocols abstract and expose a number of protocol specific
+resources like clocks, sensors and so on. Information about such
+specific domain resources are generally exposed via an `info_get`
+protocol operation.
+
+Improve the sanity check on these operations where needed.
+
+Link: https://lore.kernel.org/r/20220817172731.1185305-3-cristian.marussi@arm.com
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/clock.c | 6 +++++-
+ drivers/firmware/arm_scmi/sensors.c | 3 +++
+ include/linux/scmi_protocol.h | 4 ++--
+ 3 files changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/clock.c
+index 3ed7ae0d6781..96060bf90a24 100644
+--- a/drivers/firmware/arm_scmi/clock.c
++++ b/drivers/firmware/arm_scmi/clock.c
+@@ -450,9 +450,13 @@ static int scmi_clock_count_get(const struct scmi_protocol_handle *ph)
+ static const struct scmi_clock_info *
+ scmi_clock_info_get(const struct scmi_protocol_handle *ph, u32 clk_id)
+ {
++ struct scmi_clock_info *clk;
+ struct clock_info *ci = ph->get_priv(ph);
+- struct scmi_clock_info *clk = ci->clk + clk_id;
+
++ if (clk_id >= ci->num_clocks)
++ return NULL;
++
++ clk = ci->clk + clk_id;
+ if (!clk->name[0])
+ return NULL;
+
+diff --git a/drivers/firmware/arm_scmi/sensors.c b/drivers/firmware/arm_scmi/sensors.c
+index 7288c6117838..7d0c7476d206 100644
+--- a/drivers/firmware/arm_scmi/sensors.c
++++ b/drivers/firmware/arm_scmi/sensors.c
+@@ -948,6 +948,9 @@ scmi_sensor_info_get(const struct scmi_protocol_handle *ph, u32 sensor_id)
+ {
+ struct sensors_info *si = ph->get_priv(ph);
+
++ if (sensor_id >= si->num_sensors)
++ return NULL;
++
+ return si->sensors + sensor_id;
+ }
+
+diff --git a/include/linux/scmi_protocol.h b/include/linux/scmi_protocol.h
+index 704111f63993..6dd50ac82d10 100644
+--- a/include/linux/scmi_protocol.h
++++ b/include/linux/scmi_protocol.h
+@@ -78,7 +78,7 @@ struct scmi_protocol_handle;
+ struct scmi_clk_proto_ops {
+ int (*count_get)(const struct scmi_protocol_handle *ph);
+
+- const struct scmi_clock_info *(*info_get)
++ const struct scmi_clock_info __must_check *(*info_get)
+ (const struct scmi_protocol_handle *ph, u32 clk_id);
+ int (*rate_get)(const struct scmi_protocol_handle *ph, u32 clk_id,
+ u64 *rate);
+@@ -460,7 +460,7 @@ enum scmi_sensor_class {
+ */
+ struct scmi_sensor_proto_ops {
+ int (*count_get)(const struct scmi_protocol_handle *ph);
+- const struct scmi_sensor_info *(*info_get)
++ const struct scmi_sensor_info __must_check *(*info_get)
+ (const struct scmi_protocol_handle *ph, u32 sensor_id);
+ int (*trip_point_config)(const struct scmi_protocol_handle *ph,
+ u32 sensor_id, u8 trip_id, u64 trip_value);
+--
+2.35.1
+
--- /dev/null
+From 7f3ba31aa2328d3cba79ff7a4fc1daf6611f9a17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Sep 2022 22:32:54 +0200
+Subject: gpio: ftgpio010: Make irqchip immutable
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit ab637d48363d7b8ee67ae089808a8bc6051d53c4 ]
+
+This turns the FTGPIO010 irqchip immutable.
+
+Tested on the D-Link DIR-685.
+
+Cc: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-ftgpio010.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpio/gpio-ftgpio010.c b/drivers/gpio/gpio-ftgpio010.c
+index f422c3e129a0..f77a965f5780 100644
+--- a/drivers/gpio/gpio-ftgpio010.c
++++ b/drivers/gpio/gpio-ftgpio010.c
+@@ -41,14 +41,12 @@
+ * struct ftgpio_gpio - Gemini GPIO state container
+ * @dev: containing device for this instance
+ * @gc: gpiochip for this instance
+- * @irq: irqchip for this instance
+ * @base: remapped I/O-memory base
+ * @clk: silicon clock
+ */
+ struct ftgpio_gpio {
+ struct device *dev;
+ struct gpio_chip gc;
+- struct irq_chip irq;
+ void __iomem *base;
+ struct clk *clk;
+ };
+@@ -70,6 +68,7 @@ static void ftgpio_gpio_mask_irq(struct irq_data *d)
+ val = readl(g->base + GPIO_INT_EN);
+ val &= ~BIT(irqd_to_hwirq(d));
+ writel(val, g->base + GPIO_INT_EN);
++ gpiochip_disable_irq(gc, irqd_to_hwirq(d));
+ }
+
+ static void ftgpio_gpio_unmask_irq(struct irq_data *d)
+@@ -78,6 +77,7 @@ static void ftgpio_gpio_unmask_irq(struct irq_data *d)
+ struct ftgpio_gpio *g = gpiochip_get_data(gc);
+ u32 val;
+
++ gpiochip_enable_irq(gc, irqd_to_hwirq(d));
+ val = readl(g->base + GPIO_INT_EN);
+ val |= BIT(irqd_to_hwirq(d));
+ writel(val, g->base + GPIO_INT_EN);
+@@ -221,6 +221,16 @@ static int ftgpio_gpio_set_config(struct gpio_chip *gc, unsigned int offset,
+ return 0;
+ }
+
++static const struct irq_chip ftgpio_irq_chip = {
++ .name = "FTGPIO010",
++ .irq_ack = ftgpio_gpio_ack_irq,
++ .irq_mask = ftgpio_gpio_mask_irq,
++ .irq_unmask = ftgpio_gpio_unmask_irq,
++ .irq_set_type = ftgpio_gpio_set_irq_type,
++ .flags = IRQCHIP_IMMUTABLE,
++ GPIOCHIP_IRQ_RESOURCE_HELPERS,
++};
++
+ static int ftgpio_gpio_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -277,14 +287,8 @@ static int ftgpio_gpio_probe(struct platform_device *pdev)
+ if (!IS_ERR(g->clk))
+ g->gc.set_config = ftgpio_gpio_set_config;
+
+- g->irq.name = "FTGPIO010";
+- g->irq.irq_ack = ftgpio_gpio_ack_irq;
+- g->irq.irq_mask = ftgpio_gpio_mask_irq;
+- g->irq.irq_unmask = ftgpio_gpio_unmask_irq;
+- g->irq.irq_set_type = ftgpio_gpio_set_irq_type;
+-
+ girq = &g->gc.irq;
+- girq->chip = &g->irq;
++ gpio_irq_chip_set_chip(girq, &ftgpio_irq_chip);
+ girq->parent_handler = ftgpio_gpio_irq_handler;
+ girq->num_parents = 1;
+ girq->parents = devm_kcalloc(dev, 1, sizeof(*girq->parents),
+--
+2.35.1
+
--- /dev/null
+From 2b6b591d997c9bacaf3067e6e681f5768e13b994 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Sep 2022 22:30:38 +0800
+Subject: i2c: davinci: fix PM disable depth imbalance in davinci_i2c_probe
+
+From: Zhang Qilong <zhangqilong3@huawei.com>
+
+[ Upstream commit e2062df704dea47efe16edcaa2316d7b5ecca64f ]
+
+The pm_runtime_enable will increase power disable depth. Thus a
+pairing decrement is needed on the error handling path to keep
+it balanced according to context.
+
+Fixes: 17f88151ff190 ("i2c: davinci: Add PM Runtime Support")
+Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
+Reviewed-by: Bartosz Golaszewski <brgl@bgdev.pl>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-davinci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
+index 9e09db31a937..5343c82c8594 100644
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -823,7 +823,7 @@ static int davinci_i2c_probe(struct platform_device *pdev)
+ r = pm_runtime_resume_and_get(dev->dev);
+ if (r < 0) {
+ dev_err(dev->dev, "failed to runtime_get device: %d\n", r);
+- return r;
++ goto err_pm;
+ }
+
+ i2c_davinci_init(dev);
+@@ -882,6 +882,7 @@ static int davinci_i2c_probe(struct platform_device *pdev)
+ err_unuse_clocks:
+ pm_runtime_dont_use_autosuspend(dev->dev);
+ pm_runtime_put_sync(dev->dev);
++err_pm:
+ pm_runtime_disable(dev->dev);
+
+ return r;
+--
+2.35.1
+
--- /dev/null
+From 679ad9207c7273d495d653f7ccf2b0f3e7c71fbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Aug 2022 21:25:40 +0200
+Subject: KVM: s390: Pass initialized arg even if unused
+
+From: Janis Schoetterl-Glausch <scgl@linux.ibm.com>
+
+[ Upstream commit b3cefd6bf16e7234ffbd4209f6083060f4e35f59 ]
+
+This silences smatch warnings reported by kbuild bot:
+arch/s390/kvm/gaccess.c:859 guest_range_to_gpas() error: uninitialized symbol 'prot'.
+arch/s390/kvm/gaccess.c:1064 access_guest_with_key() error: uninitialized symbol 'prot'.
+
+This is because it cannot tell that the value is not used in this case.
+The trans_exc* only examine prot if code is PGM_PROTECTION.
+Pass a dummy value for other codes.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Janis Schoetterl-Glausch <scgl@linux.ibm.com>
+Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
+Link: https://lore.kernel.org/r/20220825192540.1560559-1-scgl@linux.ibm.com
+Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/gaccess.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c
+index 227ed0009354..0e82bf85e59b 100644
+--- a/arch/s390/kvm/gaccess.c
++++ b/arch/s390/kvm/gaccess.c
+@@ -489,6 +489,8 @@ enum prot_type {
+ PROT_TYPE_ALC = 2,
+ PROT_TYPE_DAT = 3,
+ PROT_TYPE_IEP = 4,
++ /* Dummy value for passing an initialized value when code != PGM_PROTECTION */
++ PROT_NONE,
+ };
+
+ static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva, u8 ar,
+@@ -504,6 +506,10 @@ static int trans_exc_ending(struct kvm_vcpu *vcpu, int code, unsigned long gva,
+ switch (code) {
+ case PGM_PROTECTION:
+ switch (prot) {
++ case PROT_NONE:
++ /* We should never get here, acts like termination */
++ WARN_ON_ONCE(1);
++ break;
+ case PROT_TYPE_IEP:
+ tec->b61 = 1;
+ fallthrough;
+@@ -968,8 +974,10 @@ static int guest_range_to_gpas(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
+ return rc;
+ } else {
+ gpa = kvm_s390_real_to_abs(vcpu, ga);
+- if (kvm_is_error_gpa(vcpu->kvm, gpa))
++ if (kvm_is_error_gpa(vcpu->kvm, gpa)) {
+ rc = PGM_ADDRESSING;
++ prot = PROT_NONE;
++ }
+ }
+ if (rc)
+ return trans_exc(vcpu, rc, ga, ar, mode, prot);
+@@ -1112,8 +1120,6 @@ int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
+ if (rc == PGM_PROTECTION && try_storage_prot_override)
+ rc = access_guest_page_with_key(vcpu->kvm, mode, gpas[idx],
+ data, fragment_len, PAGE_SPO_ACC);
+- if (rc == PGM_PROTECTION)
+- prot = PROT_TYPE_KEYC;
+ if (rc)
+ break;
+ len -= fragment_len;
+@@ -1123,6 +1129,10 @@ int access_guest_with_key(struct kvm_vcpu *vcpu, unsigned long ga, u8 ar,
+ if (rc > 0) {
+ bool terminate = (mode == GACC_STORE) && (idx > 0);
+
++ if (rc == PGM_PROTECTION)
++ prot = PROT_TYPE_KEYC;
++ else
++ prot = PROT_NONE;
+ rc = trans_exc_ending(vcpu, rc, ga, ar, mode, prot, terminate);
+ }
+ out_unlock:
+--
+2.35.1
+
--- /dev/null
+From f80bf7c854e6d01a4b715727b31b2e96aff566bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Sep 2022 09:42:38 +0800
+Subject: net: atlantic: fix potential memory leak in aq_ndev_close()
+
+From: Jianglei Nie <niejianglei2021@163.com>
+
+[ Upstream commit 65e5d27df61283e5390f04b09dc79cd832f95607 ]
+
+If aq_nic_stop() fails, aq_ndev_close() returns err without calling
+aq_nic_deinit() to release the relevant memory and resource, which
+will lead to a memory leak.
+
+We can fix it by deleting the if condition judgment and goto statement to
+call aq_nic_deinit() directly after aq_nic_stop() to fix the memory leak.
+
+Signed-off-by: Jianglei Nie <niejianglei2021@163.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_main.c b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+index 88595863d8bc..8a0af371e7dc 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_main.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_main.c
+@@ -94,11 +94,8 @@ static int aq_ndev_close(struct net_device *ndev)
+ int err = 0;
+
+ err = aq_nic_stop(aq_nic);
+- if (err < 0)
+- goto err_exit;
+ aq_nic_deinit(aq_nic, true);
+
+-err_exit:
+ return err;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 12e87c3d736d88d53a10ee678451ab1796b1e964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Sep 2022 20:19:27 +0800
+Subject: net/ieee802154: fix uninit value bug in dgram_sendmsg
+
+From: Haimin Zhang <tcs.kernel@gmail.com>
+
+[ Upstream commit 94160108a70c8af17fa1484a37e05181c0e094af ]
+
+There is uninit value bug in dgram_sendmsg function in
+net/ieee802154/socket.c when the length of valid data pointed by the
+msg->msg_name isn't verified.
+
+We introducing a helper function ieee802154_sockaddr_check_size to
+check namelen. First we check there is addr_type in ieee802154_addr_sa.
+Then, we check namelen according to addr_type.
+
+Also fixed in raw_bind, dgram_bind, dgram_connect.
+
+Signed-off-by: Haimin Zhang <tcs_kernel@tencent.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/ieee802154_netdev.h | 37 +++++++++++++++++++++++++++++
+ net/ieee802154/socket.c | 42 ++++++++++++++++++---------------
+ 2 files changed, 60 insertions(+), 19 deletions(-)
+
+diff --git a/include/net/ieee802154_netdev.h b/include/net/ieee802154_netdev.h
+index d0d188c3294b..a8994f307fc3 100644
+--- a/include/net/ieee802154_netdev.h
++++ b/include/net/ieee802154_netdev.h
+@@ -15,6 +15,22 @@
+ #ifndef IEEE802154_NETDEVICE_H
+ #define IEEE802154_NETDEVICE_H
+
++#define IEEE802154_REQUIRED_SIZE(struct_type, member) \
++ (offsetof(typeof(struct_type), member) + \
++ sizeof(((typeof(struct_type) *)(NULL))->member))
++
++#define IEEE802154_ADDR_OFFSET \
++ offsetof(typeof(struct sockaddr_ieee802154), addr)
++
++#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \
++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type))
++
++#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \
++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr))
++
++#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \
++ IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr))
++
+ #include <net/af_ieee802154.h>
+ #include <linux/netdevice.h>
+ #include <linux/skbuff.h>
+@@ -165,6 +181,27 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)
+ memcpy(raw, &temp, IEEE802154_ADDR_LEN);
+ }
+
++static inline int
++ieee802154_sockaddr_check_size(struct sockaddr_ieee802154 *daddr, int len)
++{
++ struct ieee802154_addr_sa *sa;
++
++ sa = &daddr->addr;
++ if (len < IEEE802154_MIN_NAMELEN)
++ return -EINVAL;
++ switch (sa->addr_type) {
++ case IEEE802154_ADDR_SHORT:
++ if (len < IEEE802154_NAMELEN_SHORT)
++ return -EINVAL;
++ break;
++ case IEEE802154_ADDR_LONG:
++ if (len < IEEE802154_NAMELEN_LONG)
++ return -EINVAL;
++ break;
++ }
++ return 0;
++}
++
+ static inline void ieee802154_addr_from_sa(struct ieee802154_addr *a,
+ const struct ieee802154_addr_sa *sa)
+ {
+diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
+index 718fb77bb372..7889e1ef7fad 100644
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -200,8 +200,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *_uaddr, int len)
+ int err = 0;
+ struct net_device *dev = NULL;
+
+- if (len < sizeof(*uaddr))
+- return -EINVAL;
++ err = ieee802154_sockaddr_check_size(uaddr, len);
++ if (err < 0)
++ return err;
+
+ uaddr = (struct sockaddr_ieee802154 *)_uaddr;
+ if (uaddr->family != AF_IEEE802154)
+@@ -493,7 +494,8 @@ static int dgram_bind(struct sock *sk, struct sockaddr *uaddr, int len)
+
+ ro->bound = 0;
+
+- if (len < sizeof(*addr))
++ err = ieee802154_sockaddr_check_size(addr, len);
++ if (err < 0)
+ goto out;
+
+ if (addr->family != AF_IEEE802154)
+@@ -564,8 +566,9 @@ static int dgram_connect(struct sock *sk, struct sockaddr *uaddr,
+ struct dgram_sock *ro = dgram_sk(sk);
+ int err = 0;
+
+- if (len < sizeof(*addr))
+- return -EINVAL;
++ err = ieee802154_sockaddr_check_size(addr, len);
++ if (err < 0)
++ return err;
+
+ if (addr->family != AF_IEEE802154)
+ return -EINVAL;
+@@ -604,6 +607,7 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ struct ieee802154_mac_cb *cb;
+ struct dgram_sock *ro = dgram_sk(sk);
+ struct ieee802154_addr dst_addr;
++ DECLARE_SOCKADDR(struct sockaddr_ieee802154*, daddr, msg->msg_name);
+ int hlen, tlen;
+ int err;
+
+@@ -612,10 +616,20 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ return -EOPNOTSUPP;
+ }
+
+- if (!ro->connected && !msg->msg_name)
+- return -EDESTADDRREQ;
+- else if (ro->connected && msg->msg_name)
+- return -EISCONN;
++ if (msg->msg_name) {
++ if (ro->connected)
++ return -EISCONN;
++ if (msg->msg_namelen < IEEE802154_MIN_NAMELEN)
++ return -EINVAL;
++ err = ieee802154_sockaddr_check_size(daddr, msg->msg_namelen);
++ if (err < 0)
++ return err;
++ ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
++ } else {
++ if (!ro->connected)
++ return -EDESTADDRREQ;
++ dst_addr = ro->dst_addr;
++ }
+
+ if (!ro->bound)
+ dev = dev_getfirstbyhwtype(sock_net(sk), ARPHRD_IEEE802154);
+@@ -651,16 +665,6 @@ static int dgram_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
+ cb = mac_cb_init(skb);
+ cb->type = IEEE802154_FC_TYPE_DATA;
+ cb->ackreq = ro->want_ack;
+-
+- if (msg->msg_name) {
+- DECLARE_SOCKADDR(struct sockaddr_ieee802154*,
+- daddr, msg->msg_name);
+-
+- ieee802154_addr_from_sa(&dst_addr, &daddr->addr);
+- } else {
+- dst_addr = ro->dst_addr;
+- }
+-
+ cb->secen = ro->secen;
+ cb->secen_override = ro->secen_override;
+ cb->seclevel = ro->seclevel;
+--
+2.35.1
+
--- /dev/null
+From df75a9f131a105def7adae40545a9459b4368c29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Sep 2022 16:14:46 +0300
+Subject: net: marvell: prestera: add support for for Aldrin2
+
+From: Oleksandr Mazur <oleksandr.mazur@plvision.eu>
+
+[ Upstream commit 9124dbcc2dd6c51e81f97f63f7807118c4eb140a ]
+
+Aldrin2 (98DX8525) is a Marvell Prestera PP, with 100G support.
+
+Signed-off-by: Oleksandr Mazur <oleksandr.mazur@plvision.eu>
+
+V2:
+ - retarget to net tree instead of net-next;
+ - fix missed colon in patch subject ('net marvell' vs 'net: mavell');
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/prestera/prestera_pci.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/marvell/prestera/prestera_pci.c b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
+index f538a749ebd4..59470d99f522 100644
+--- a/drivers/net/ethernet/marvell/prestera/prestera_pci.c
++++ b/drivers/net/ethernet/marvell/prestera/prestera_pci.c
+@@ -872,6 +872,7 @@ static void prestera_pci_remove(struct pci_dev *pdev)
+ static const struct pci_device_id prestera_pci_devices[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xC804) },
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xC80C) },
++ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0xCC1E) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(pci, prestera_pci_devices);
+--
+2.35.1
+
--- /dev/null
+From 18f238fa2e428ab127ce1177799e96f9ddcd7930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Aug 2022 07:27:02 -0700
+Subject: perf/x86/intel: Fix unchecked MSR access error for Alder Lake N
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 24919fdea6f8b31d7cdf32ac291bc5dd0b023878 ]
+
+For some Alder Lake N machine, the below unchecked MSR access error may be
+triggered.
+
+[ 0.088017] rcu: Hierarchical SRCU implementation.
+[ 0.088017] unchecked MSR access error: WRMSR to 0x38f (tried to write
+0x0001000f0000003f) at rIP: 0xffffffffb5684de8 (native_write_msr+0x8/0x30)
+[ 0.088017] Call Trace:
+[ 0.088017] <TASK>
+[ 0.088017] __intel_pmu_enable_all.constprop.46+0x4a/0xa0
+
+The Alder Lake N only has e-cores. The X86_FEATURE_HYBRID_CPU flag is
+not set. The perf cannot retrieve the correct CPU type via
+get_this_hybrid_cpu_type(). The model specific get_hybrid_cpu_type() is
+hardcode to p-core. The wrong CPU type is given to the PMU of the
+Alder Lake N.
+
+Since Alder Lake N isn't in fact a hybrid CPU, remove ALDERLAKE_N from
+the rest of {ALDER,RAPTOP}LAKE and create a non-hybrid PMU setup.
+
+The differences between Gracemont and the previous Tremont are,
+- Number of GP counters
+- Load and store latency Events
+- PEBS event_constraints
+- Instruction Latency support
+- Data source encoding
+- Memory access latency encoding
+
+Fixes: c2a960f7c574 ("perf/x86: Add new Alder Lake and Raptor Lake support")
+Reported-by: Jianfeng Gao <jianfeng.gao@intel.com>
+Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20220831142702.153110-1-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/core.c | 40 +++++++++++++++++++++++++++++++++++-
+ arch/x86/events/intel/ds.c | 9 ++++++--
+ arch/x86/events/perf_event.h | 2 ++
+ 3 files changed, 48 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index bd8b98857609..8d6befb24b8e 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -2101,6 +2101,15 @@ static struct extra_reg intel_tnt_extra_regs[] __read_mostly = {
+ EVENT_EXTRA_END
+ };
+
++EVENT_ATTR_STR(mem-loads, mem_ld_grt, "event=0xd0,umask=0x5,ldlat=3");
++EVENT_ATTR_STR(mem-stores, mem_st_grt, "event=0xd0,umask=0x6");
++
++static struct attribute *grt_mem_attrs[] = {
++ EVENT_PTR(mem_ld_grt),
++ EVENT_PTR(mem_st_grt),
++ NULL
++};
++
+ static struct extra_reg intel_grt_extra_regs[] __read_mostly = {
+ /* must define OFFCORE_RSP_X first, see intel_fixup_er() */
+ INTEL_UEVENT_EXTRA_REG(0x01b7, MSR_OFFCORE_RSP_0, 0x3fffffffffull, RSP_0),
+@@ -5874,6 +5883,36 @@ __init int intel_pmu_init(void)
+ name = "Tremont";
+ break;
+
++ case INTEL_FAM6_ALDERLAKE_N:
++ x86_pmu.mid_ack = true;
++ memcpy(hw_cache_event_ids, glp_hw_cache_event_ids,
++ sizeof(hw_cache_event_ids));
++ memcpy(hw_cache_extra_regs, tnt_hw_cache_extra_regs,
++ sizeof(hw_cache_extra_regs));
++ hw_cache_event_ids[C(ITLB)][C(OP_READ)][C(RESULT_ACCESS)] = -1;
++
++ x86_pmu.event_constraints = intel_slm_event_constraints;
++ x86_pmu.pebs_constraints = intel_grt_pebs_event_constraints;
++ x86_pmu.extra_regs = intel_grt_extra_regs;
++
++ x86_pmu.pebs_aliases = NULL;
++ x86_pmu.pebs_prec_dist = true;
++ x86_pmu.pebs_block = true;
++ x86_pmu.lbr_pt_coexist = true;
++ x86_pmu.flags |= PMU_FL_HAS_RSP_1;
++ x86_pmu.flags |= PMU_FL_INSTR_LATENCY;
++
++ intel_pmu_pebs_data_source_grt();
++ x86_pmu.pebs_latency_data = adl_latency_data_small;
++ x86_pmu.get_event_constraints = tnt_get_event_constraints;
++ x86_pmu.limit_period = spr_limit_period;
++ td_attr = tnt_events_attrs;
++ mem_attr = grt_mem_attrs;
++ extra_attr = nhm_format_attr;
++ pr_cont("Gracemont events, ");
++ name = "gracemont";
++ break;
++
+ case INTEL_FAM6_WESTMERE:
+ case INTEL_FAM6_WESTMERE_EP:
+ case INTEL_FAM6_WESTMERE_EX:
+@@ -6216,7 +6255,6 @@ __init int intel_pmu_init(void)
+
+ case INTEL_FAM6_ALDERLAKE:
+ case INTEL_FAM6_ALDERLAKE_L:
+- case INTEL_FAM6_ALDERLAKE_N:
+ case INTEL_FAM6_RAPTORLAKE:
+ case INTEL_FAM6_RAPTORLAKE_P:
+ /*
+diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
+index 9b48d957d2b3..139204aea94e 100644
+--- a/arch/x86/events/intel/ds.c
++++ b/arch/x86/events/intel/ds.c
+@@ -110,13 +110,18 @@ void __init intel_pmu_pebs_data_source_skl(bool pmem)
+ __intel_pmu_pebs_data_source_skl(pmem, pebs_data_source);
+ }
+
+-static void __init intel_pmu_pebs_data_source_grt(u64 *data_source)
++static void __init __intel_pmu_pebs_data_source_grt(u64 *data_source)
+ {
+ data_source[0x05] = OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HIT);
+ data_source[0x06] = OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOP, HITM);
+ data_source[0x08] = OP_LH | P(LVL, L3) | LEVEL(L3) | P(SNOOPX, FWD);
+ }
+
++void __init intel_pmu_pebs_data_source_grt(void)
++{
++ __intel_pmu_pebs_data_source_grt(pebs_data_source);
++}
++
+ void __init intel_pmu_pebs_data_source_adl(void)
+ {
+ u64 *data_source;
+@@ -127,7 +132,7 @@ void __init intel_pmu_pebs_data_source_adl(void)
+
+ data_source = x86_pmu.hybrid_pmu[X86_HYBRID_PMU_ATOM_IDX].pebs_data_source;
+ memcpy(data_source, pebs_data_source, sizeof(pebs_data_source));
+- intel_pmu_pebs_data_source_grt(data_source);
++ __intel_pmu_pebs_data_source_grt(data_source);
+ }
+
+ static u64 precise_store_data(u64 status)
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index 821098aebf78..84f6f947ddef 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -1513,6 +1513,8 @@ void intel_pmu_pebs_data_source_skl(bool pmem);
+
+ void intel_pmu_pebs_data_source_adl(void);
+
++void intel_pmu_pebs_data_source_grt(void);
++
+ int intel_pmu_setup_lbr_filter(struct perf_event *event);
+
+ void intel_pt_interrupt(void);
+--
+2.35.1
+
--- /dev/null
+From 74b80201f18ff3febc8a063a56254df2fcf61f93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Nov 2021 20:06:41 +0800
+Subject: scsi: qedf: Fix a UAF bug in __qedf_probe()
+
+From: Letu Ren <fantasquex@gmail.com>
+
+[ Upstream commit fbfe96869b782364caebae0445763969ddb6ea67 ]
+
+In __qedf_probe(), if qedf->cdev is NULL which means
+qed_ops->common->probe() failed, then the program will goto label err1, and
+scsi_host_put() will free lport->host pointer. Because the memory qedf
+points to is allocated by libfc_host_alloc(), it will be freed by
+scsi_host_put(). However, the if statement below label err0 only checks
+whether qedf is NULL but doesn't check whether the memory has been freed.
+So a UAF bug can occur.
+
+There are two ways to reach the statements below err0. The first one is
+described as before, "qedf" should be set to NULL. The second one is goto
+"err0" directly. In the latter scenario qedf hasn't been changed and it has
+the initial value NULL. As a result the if statement is not reachable in
+any situation.
+
+The KASAN logs are as follows:
+
+[ 2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0
+[ 2.312969]
+[ 2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
+[ 2.312969] Call Trace:
+[ 2.312969] dump_stack_lvl+0x59/0x7b
+[ 2.312969] print_address_description+0x7c/0x3b0
+[ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0
+[ 2.312969] __kasan_report+0x160/0x1c0
+[ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0
+[ 2.312969] kasan_report+0x4b/0x70
+[ 2.312969] ? kobject_put+0x25d/0x290
+[ 2.312969] kasan_check_range+0x2ca/0x310
+[ 2.312969] __qedf_probe+0x5dcf/0x6bc0
+[ 2.312969] ? selinux_kernfs_init_security+0xdc/0x5f0
+[ 2.312969] ? trace_rpm_return_int_rcuidle+0x18/0x120
+[ 2.312969] ? rpm_resume+0xa5c/0x16e0
+[ 2.312969] ? qedf_get_generic_tlv_data+0x160/0x160
+[ 2.312969] local_pci_probe+0x13c/0x1f0
+[ 2.312969] pci_device_probe+0x37e/0x6c0
+
+Link: https://lore.kernel.org/r/20211112120641.16073-1-fantasquex@gmail.com
+Reported-by: Zheyu Ma <zheyuma97@gmail.com>
+Acked-by: Saurav Kashyap <skashyap@marvell.com>
+Co-developed-by: Wende Tan <twd2.me@gmail.com>
+Signed-off-by: Wende Tan <twd2.me@gmail.com>
+Signed-off-by: Letu Ren <fantasquex@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedf/qedf_main.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
+index 3d6b137314f3..bbc4d5890ae6 100644
+--- a/drivers/scsi/qedf/qedf_main.c
++++ b/drivers/scsi/qedf/qedf_main.c
+@@ -3686,11 +3686,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
+ err1:
+ scsi_host_put(lport->host);
+ err0:
+- if (qedf) {
+- QEDF_INFO(&qedf->dbg_ctx, QEDF_LOG_DISC, "Probe done.\n");
+-
+- clear_bit(QEDF_PROBING, &qedf->flags);
+- }
+ return rc;
+ }
+
+--
+2.35.1
+
xsk-inherit-need_wakeup-flag-for-shared-sockets.patch
wait_on_bit-add-an-acquire-memory-barrier.patch
provide-arch_test_bit_acquire-for-architectures-that-define-test_bit.patch
+firmware-arm_scmi-improve-checks-in-the-info_get-ope.patch
+firmware-arm_scmi-harden-accesses-to-the-sensor-doma.patch
+firmware-arm_scmi-add-scmi-pm-driver-remove-routine.patch
+arm64-dts-rockchip-fix-upper-usb-port-on-bpi-r2-pro.patch
+dmaengine-xilinx_dma-fix-devm_platform_ioremap_resou.patch
+dmaengine-xilinx_dma-cleanup-for-fetching-xlnx-num-f.patch
+dmaengine-xilinx_dma-report-error-in-case-of-dma_set.patch
+wifi-iwlwifi-don-t-spam-logs-with-nss-2-messages.patch
+arm-dts-fix-moxa-sdio-compatible-remove-sdhci-misnom.patch
+drm-amdgpu-mes-zero-the-sdma_hqd_mask-of-2nd-sdma-en.patch
+scsi-qedf-fix-a-uaf-bug-in-__qedf_probe.patch
+net-ieee802154-fix-uninit-value-bug-in-dgram_sendmsg.patch
+net-marvell-prestera-add-support-for-for-aldrin2.patch
+alsa-hda-hdmi-fix-the-converter-reuse-for-the-silent.patch
+um-cleanup-syscall_handler_t-cast-in-syscalls_32.h.patch
+um-cleanup-compiler-warning-in-arch-x86-um-tls_32.c.patch
+gpio-ftgpio010-make-irqchip-immutable.patch
+arch-um-mark-the-stack-non-executable-to-fix-a-binut.patch
+net-atlantic-fix-potential-memory-leak-in-aq_ndev_cl.patch
+kvm-s390-pass-initialized-arg-even-if-unused.patch
+drm-amd-display-fix-double-cursor-on-non-video-rgb-m.patch
+drm-amd-display-assume-an-lttpr-is-always-present-on.patch
+drm-amd-display-update-gamut-remap-if-plane-has-chan.patch
+drm-amd-display-skip-audio-setup-when-audio-stream-i.patch
+drm-amd-display-fix-dp-mst-timeslot-issue-when-fallb.patch
+drm-amd-display-increase-dcn315-pstate-change-latenc.patch
+perf-x86-intel-fix-unchecked-msr-access-error-for-al.patch
+coredump-don-t-use-__kernel_write-on-kmap_local_page.patch
+i2c-davinci-fix-pm-disable-depth-imbalance-in-davinc.patch
--- /dev/null
+From b3aa287a9b066a474f56d45ab0dfe3e3643b8210 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 15:29:31 +0000
+Subject: um: Cleanup compiler warning in arch/x86/um/tls_32.c
+
+From: Lukas Straub <lukasstraub2@web.de>
+
+[ Upstream commit d27fff3499671dc23a08efd01cdb8b3764a391c4 ]
+
+arch.tls_array is statically allocated so checking for NULL doesn't
+make sense. This causes the compiler warning below.
+
+Remove the checks to silence these warnings.
+
+../arch/x86/um/tls_32.c: In function 'get_free_idx':
+../arch/x86/um/tls_32.c:68:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
+ 68 | if (!t->arch.tls_array)
+ | ^
+In file included from ../arch/x86/um/asm/processor.h:10,
+ from ../include/linux/rcupdate.h:30,
+ from ../include/linux/rculist.h:11,
+ from ../include/linux/pid.h:5,
+ from ../include/linux/sched.h:14,
+ from ../arch/x86/um/tls_32.c:7:
+../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
+ 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
+ | ^~~~~~~~~
+../arch/x86/um/tls_32.c: In function 'get_tls_entry':
+../arch/x86/um/tls_32.c:243:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
+ 243 | if (!t->arch.tls_array)
+ | ^
+../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
+ 22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
+ | ^~~~~~~~~
+
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/um/tls_32.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/x86/um/tls_32.c b/arch/x86/um/tls_32.c
+index ac8eee093f9c..66162eafd8e8 100644
+--- a/arch/x86/um/tls_32.c
++++ b/arch/x86/um/tls_32.c
+@@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task)
+ struct thread_struct *t = &task->thread;
+ int idx;
+
+- if (!t->arch.tls_array)
+- return GDT_ENTRY_TLS_MIN;
+-
+ for (idx = 0; idx < GDT_ENTRY_TLS_ENTRIES; idx++)
+ if (!t->arch.tls_array[idx].present)
+ return idx + GDT_ENTRY_TLS_MIN;
+@@ -240,9 +237,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info,
+ {
+ struct thread_struct *t = &task->thread;
+
+- if (!t->arch.tls_array)
+- goto clear;
+-
+ if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
+ return -EINVAL;
+
+--
+2.35.1
+
--- /dev/null
+From de0bd6fe834dcc5975b60d8249d92b8adb0ceea3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Aug 2022 15:29:27 +0000
+Subject: um: Cleanup syscall_handler_t cast in syscalls_32.h
+
+From: Lukas Straub <lukasstraub2@web.de>
+
+[ Upstream commit 61670b4d270c71219def1fbc9441debc2ac2e6e9 ]
+
+Like in f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9
+"um: Cleanup syscall_handler_t definition/cast, fix warning",
+remove the cast to to fix the compiler warning.
+
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/um/shared/sysdep/syscalls_32.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/um/shared/sysdep/syscalls_32.h b/arch/x86/um/shared/sysdep/syscalls_32.h
+index 68fd2cf526fd..f6e9f84397e7 100644
+--- a/arch/x86/um/shared/sysdep/syscalls_32.h
++++ b/arch/x86/um/shared/sysdep/syscalls_32.h
+@@ -6,10 +6,9 @@
+ #include <asm/unistd.h>
+ #include <sysdep/ptrace.h>
+
+-typedef long syscall_handler_t(struct pt_regs);
++typedef long syscall_handler_t(struct syscall_args);
+
+ extern syscall_handler_t *sys_call_table[];
+
+ #define EXECUTE_SYSCALL(syscall, regs) \
+- ((long (*)(struct syscall_args)) \
+- (*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs))
++ ((*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs))
+--
+2.35.1
+
--- /dev/null
+From 6cd40120a0dbbf9a58924536230d00053f92f6db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Sep 2022 19:22:46 +0200
+Subject: wifi: iwlwifi: don't spam logs with NSS>2 messages
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+[ Upstream commit 4d8421f2dd88583cc7a4d6c2a5532c35e816a52a ]
+
+I get a log line like this every 4 seconds when connected to my AP:
+
+[15650.221468] iwlwifi 0000:09:00.0: Got NSS = 4 - trimming to 2
+
+Looking at the code, this seems to be related to a hardware limitation,
+and there's nothing to be done. In an effort to keep my dmesg
+manageable, downgrade this error to "debug" rather than "info".
+
+Cc: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20220905172246.105383-1-Jason@zx2c4.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index c5626ff83805..640e3786c244 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -1833,8 +1833,8 @@ static void iwl_mvm_parse_ppe(struct iwl_mvm *mvm,
+ * If nss < MAX: we can set zeros in other streams
+ */
+ if (nss > MAX_HE_SUPP_NSS) {
+- IWL_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
+- MAX_HE_SUPP_NSS);
++ IWL_DEBUG_INFO(mvm, "Got NSS = %d - trimming to %d\n", nss,
++ MAX_HE_SUPP_NSS);
+ nss = MAX_HE_SUPP_NSS;
+ }
+
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
