--- /dev/null
+From 0154252a3b87f77db1e44516d1ed2e82e2d29c30 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Sun, 4 Dec 2022 09:46:14 +0100
+Subject: ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit 0154252a3b87f77db1e44516d1ed2e82e2d29c30 upstream.
+
+While changing node names of APQ8084 SDHCI, the ones in IFC6540 board
+were not updated leading to disabled and misconfigured SDHCI.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 2477d81901a2 ("ARM: dts: qcom: Fix sdhci node names - use 'mmc@'")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20221204084614.12193-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/qcom-apq8084-ifc6540.dts | 20 ++++++++++----------
+ arch/arm/boot/dts/qcom-apq8084.dtsi | 4 ++--
+ 2 files changed, 12 insertions(+), 12 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-apq8084-ifc6540.dts
++++ b/arch/arm/boot/dts/qcom-apq8084-ifc6540.dts
+@@ -19,16 +19,16 @@
+ serial@f995e000 {
+ status = "okay";
+ };
++ };
++};
+
+- sdhci@f9824900 {
+- bus-width = <8>;
+- non-removable;
+- status = "okay";
+- };
++&sdhc_1 {
++ bus-width = <8>;
++ non-removable;
++ status = "okay";
++};
+
+- sdhci@f98a4900 {
+- cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>;
+- bus-width = <4>;
+- };
+- };
++&sdhc_2 {
++ cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>;
++ bus-width = <4>;
+ };
+--- a/arch/arm/boot/dts/qcom-apq8084.dtsi
++++ b/arch/arm/boot/dts/qcom-apq8084.dtsi
+@@ -419,7 +419,7 @@
+ status = "disabled";
+ };
+
+- mmc@f9824900 {
++ sdhc_1: mmc@f9824900 {
+ compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4";
+ reg = <0xf9824900 0x11c>, <0xf9824000 0x800>;
+ reg-names = "hc", "core";
+@@ -432,7 +432,7 @@
+ status = "disabled";
+ };
+
+- mmc@f98a4900 {
++ sdhc_2: mmc@f98a4900 {
+ compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4";
+ reg = <0xf98a4900 0x11c>, <0xf98a4000 0x800>;
+ reg-names = "hc", "core";
--- /dev/null
+From 980a637d11fe8dfc734f508a422185c2de55e669 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 4 Jan 2023 09:35:09 +0100
+Subject: ARM: omap1: fix !ARCH_OMAP1_ANY link failures
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 980a637d11fe8dfc734f508a422185c2de55e669 upstream.
+
+While compile-testing randconfig builds for the upcoming boardfile
+removal, I noticed that an earlier patch of mine was completely
+broken, and the introduction of CONFIG_ARCH_OMAP1_ANY only replaced
+one set of build failures with another one, now resulting in
+link failures like
+
+ld: drivers/video/fbdev/omap/omapfb_main.o: in function `omapfb_do_probe':
+drivers/video/fbdev/omap/omapfb_main.c:1703: undefined reference to `omap_set_dma_priority'
+ld: drivers/dma/ti/omap-dma.o: in function `omap_dma_free_chan_resources':
+drivers/dma/ti/omap-dma.c:777: undefined reference to `omap_free_dma'
+drivers/dma/ti/omap-dma.c:1685: undefined reference to `omap_get_plat_info'
+ld: drivers/usb/gadget/udc/omap_udc.o: in function `next_in_dma':
+drivers/usb/gadget/udc/omap_udc.c:820: undefined reference to `omap_get_dma_active_status'
+
+I tried reworking it, but the resulting patch ended up much bigger than
+simply avoiding the original problem of unused-function warnings like
+
+arch/arm/mach-omap1/mcbsp.c:76:30: error: unused variable 'omap1_mcbsp_ops' [-Werror,-Wunused-variable]
+
+As a result, revert the previous fix, and rearrange the code that
+produces warnings to hide them. For mcbsp, the #ifdef check can
+simply be removed as the cpu_is_omapxxx() checks already achieve
+the same result, while in the io.c the easiest solution appears to
+be to merge the common map bits into each soc specific portion.
+This gets cleaned in a nicer way after omap7xx support gets dropped,
+as the remaining SoCs all have the exact same I/O map.
+
+Fixes: 615dce5bf736 ("ARM: omap1: fix build with no SoC selected")
+Cc: stable@vger.kernel.org
+Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-omap1/Kconfig | 5 +----
+ arch/arm/mach-omap1/Makefile | 4 ----
+ arch/arm/mach-omap1/io.c | 32 +++++++++++++++-----------------
+ arch/arm/mach-omap1/mcbsp.c | 21 ---------------------
+ arch/arm/mach-omap1/pm.h | 7 -------
+ include/linux/soc/ti/omap1-io.h | 4 ++--
+ 6 files changed, 18 insertions(+), 55 deletions(-)
+
+--- a/arch/arm/mach-omap1/Kconfig
++++ b/arch/arm/mach-omap1/Kconfig
+@@ -4,6 +4,7 @@ menuconfig ARCH_OMAP1
+ depends on ARCH_MULTI_V4T || ARCH_MULTI_V5
+ depends on CPU_LITTLE_ENDIAN
+ depends on ATAGS
++ select ARCH_OMAP
+ select ARCH_HAS_HOLES_MEMORYMODEL
+ select ARCH_OMAP
+ select CLKSRC_MMIO
+@@ -45,10 +46,6 @@ config ARCH_OMAP16XX
+ select CPU_ARM926T
+ select OMAP_DM_TIMER
+
+-config ARCH_OMAP1_ANY
+- select ARCH_OMAP
+- def_bool ARCH_OMAP730 || ARCH_OMAP850 || ARCH_OMAP15XX || ARCH_OMAP16XX
+-
+ config ARCH_OMAP
+ bool
+
+--- a/arch/arm/mach-omap1/Makefile
++++ b/arch/arm/mach-omap1/Makefile
+@@ -3,8 +3,6 @@
+ # Makefile for the linux kernel.
+ #
+
+-ifdef CONFIG_ARCH_OMAP1_ANY
+-
+ # Common support
+ obj-y := io.o id.o sram-init.o sram.o time.o irq.o mux.o flash.o \
+ serial.o devices.o dma.o omap-dma.o fb.o
+@@ -59,5 +57,3 @@ obj-$(CONFIG_ARCH_OMAP730) += gpio7xx.o
+ obj-$(CONFIG_ARCH_OMAP850) += gpio7xx.o
+ obj-$(CONFIG_ARCH_OMAP15XX) += gpio15xx.o
+ obj-$(CONFIG_ARCH_OMAP16XX) += gpio16xx.o
+-
+-endif
+--- a/arch/arm/mach-omap1/io.c
++++ b/arch/arm/mach-omap1/io.c
+@@ -22,17 +22,14 @@
+ * The machine specific code may provide the extra mapping besides the
+ * default mapping provided here.
+ */
+-static struct map_desc omap_io_desc[] __initdata = {
++#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850)
++static struct map_desc omap7xx_io_desc[] __initdata = {
+ {
+ .virtual = OMAP1_IO_VIRT,
+ .pfn = __phys_to_pfn(OMAP1_IO_PHYS),
+ .length = OMAP1_IO_SIZE,
+ .type = MT_DEVICE
+- }
+-};
+-
+-#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850)
+-static struct map_desc omap7xx_io_desc[] __initdata = {
++ },
+ {
+ .virtual = OMAP7XX_DSP_BASE,
+ .pfn = __phys_to_pfn(OMAP7XX_DSP_START),
+@@ -50,6 +47,12 @@ static struct map_desc omap7xx_io_desc[]
+ #ifdef CONFIG_ARCH_OMAP15XX
+ static struct map_desc omap1510_io_desc[] __initdata = {
+ {
++ .virtual = OMAP1_IO_VIRT,
++ .pfn = __phys_to_pfn(OMAP1_IO_PHYS),
++ .length = OMAP1_IO_SIZE,
++ .type = MT_DEVICE
++ },
++ {
+ .virtual = OMAP1510_DSP_BASE,
+ .pfn = __phys_to_pfn(OMAP1510_DSP_START),
+ .length = OMAP1510_DSP_SIZE,
+@@ -66,6 +69,12 @@ static struct map_desc omap1510_io_desc[
+ #if defined(CONFIG_ARCH_OMAP16XX)
+ static struct map_desc omap16xx_io_desc[] __initdata = {
+ {
++ .virtual = OMAP1_IO_VIRT,
++ .pfn = __phys_to_pfn(OMAP1_IO_PHYS),
++ .length = OMAP1_IO_SIZE,
++ .type = MT_DEVICE
++ },
++ {
+ .virtual = OMAP16XX_DSP_BASE,
+ .pfn = __phys_to_pfn(OMAP16XX_DSP_START),
+ .length = OMAP16XX_DSP_SIZE,
+@@ -79,18 +88,9 @@ static struct map_desc omap16xx_io_desc[
+ };
+ #endif
+
+-/*
+- * Maps common IO regions for omap1
+- */
+-static void __init omap1_map_common_io(void)
+-{
+- iotable_init(omap_io_desc, ARRAY_SIZE(omap_io_desc));
+-}
+-
+ #if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850)
+ void __init omap7xx_map_io(void)
+ {
+- omap1_map_common_io();
+ iotable_init(omap7xx_io_desc, ARRAY_SIZE(omap7xx_io_desc));
+ }
+ #endif
+@@ -98,7 +98,6 @@ void __init omap7xx_map_io(void)
+ #ifdef CONFIG_ARCH_OMAP15XX
+ void __init omap15xx_map_io(void)
+ {
+- omap1_map_common_io();
+ iotable_init(omap1510_io_desc, ARRAY_SIZE(omap1510_io_desc));
+ }
+ #endif
+@@ -106,7 +105,6 @@ void __init omap15xx_map_io(void)
+ #if defined(CONFIG_ARCH_OMAP16XX)
+ void __init omap16xx_map_io(void)
+ {
+- omap1_map_common_io();
+ iotable_init(omap16xx_io_desc, ARRAY_SIZE(omap16xx_io_desc));
+ }
+ #endif
+--- a/arch/arm/mach-omap1/mcbsp.c
++++ b/arch/arm/mach-omap1/mcbsp.c
+@@ -89,7 +89,6 @@ static struct omap_mcbsp_ops omap1_mcbsp
+ #define OMAP1610_MCBSP2_BASE 0xfffb1000
+ #define OMAP1610_MCBSP3_BASE 0xe1017000
+
+-#if defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP850)
+ struct resource omap7xx_mcbsp_res[][6] = {
+ {
+ {
+@@ -159,14 +158,7 @@ static struct omap_mcbsp_platform_data o
+ };
+ #define OMAP7XX_MCBSP_RES_SZ ARRAY_SIZE(omap7xx_mcbsp_res[1])
+ #define OMAP7XX_MCBSP_COUNT ARRAY_SIZE(omap7xx_mcbsp_res)
+-#else
+-#define omap7xx_mcbsp_res_0 NULL
+-#define omap7xx_mcbsp_pdata NULL
+-#define OMAP7XX_MCBSP_RES_SZ 0
+-#define OMAP7XX_MCBSP_COUNT 0
+-#endif
+
+-#ifdef CONFIG_ARCH_OMAP15XX
+ struct resource omap15xx_mcbsp_res[][6] = {
+ {
+ {
+@@ -266,14 +258,7 @@ static struct omap_mcbsp_platform_data o
+ };
+ #define OMAP15XX_MCBSP_RES_SZ ARRAY_SIZE(omap15xx_mcbsp_res[1])
+ #define OMAP15XX_MCBSP_COUNT ARRAY_SIZE(omap15xx_mcbsp_res)
+-#else
+-#define omap15xx_mcbsp_res_0 NULL
+-#define omap15xx_mcbsp_pdata NULL
+-#define OMAP15XX_MCBSP_RES_SZ 0
+-#define OMAP15XX_MCBSP_COUNT 0
+-#endif
+
+-#ifdef CONFIG_ARCH_OMAP16XX
+ struct resource omap16xx_mcbsp_res[][6] = {
+ {
+ {
+@@ -373,12 +358,6 @@ static struct omap_mcbsp_platform_data o
+ };
+ #define OMAP16XX_MCBSP_RES_SZ ARRAY_SIZE(omap16xx_mcbsp_res[1])
+ #define OMAP16XX_MCBSP_COUNT ARRAY_SIZE(omap16xx_mcbsp_res)
+-#else
+-#define omap16xx_mcbsp_res_0 NULL
+-#define omap16xx_mcbsp_pdata NULL
+-#define OMAP16XX_MCBSP_RES_SZ 0
+-#define OMAP16XX_MCBSP_COUNT 0
+-#endif
+
+ static void omap_mcbsp_register_board_cfg(struct resource *res, int res_count,
+ struct omap_mcbsp_platform_data *config, int size)
+--- a/arch/arm/mach-omap1/pm.h
++++ b/arch/arm/mach-omap1/pm.h
+@@ -106,13 +106,6 @@
+ #define OMAP7XX_IDLECT3 0xfffece24
+ #define OMAP7XX_IDLE_LOOP_REQUEST 0x0C00
+
+-#if !defined(CONFIG_ARCH_OMAP730) && \
+- !defined(CONFIG_ARCH_OMAP850) && \
+- !defined(CONFIG_ARCH_OMAP15XX) && \
+- !defined(CONFIG_ARCH_OMAP16XX)
+-#warning "Power management for this processor not implemented yet"
+-#endif
+-
+ #ifndef __ASSEMBLER__
+
+ #include <linux/clk.h>
+--- a/include/linux/soc/ti/omap1-io.h
++++ b/include/linux/soc/ti/omap1-io.h
+@@ -5,7 +5,7 @@
+ #ifndef __ASSEMBLER__
+ #include <linux/types.h>
+
+-#ifdef CONFIG_ARCH_OMAP1_ANY
++#ifdef CONFIG_ARCH_OMAP1
+ /*
+ * NOTE: Please use ioremap + __raw_read/write where possible instead of these
+ */
+@@ -15,7 +15,7 @@ extern u32 omap_readl(u32 pa);
+ extern void omap_writeb(u8 v, u32 pa);
+ extern void omap_writew(u16 v, u32 pa);
+ extern void omap_writel(u32 v, u32 pa);
+-#else
++#elif defined(CONFIG_COMPILE_TEST)
+ static inline u8 omap_readb(u32 pa) { return 0; }
+ static inline u16 omap_readw(u32 pa) { return 0; }
+ static inline u32 omap_readl(u32 pa) { return 0; }
--- /dev/null
+From 8a1ed98fe0f2e7669f0409de0f46f317b275f8be Mon Sep 17 00:00:00 2001
+From: Li Jun <jun.li@nxp.com>
+Date: Fri, 30 Sep 2022 22:54:23 +0800
+Subject: arm64: dts: imx8mp: correct usb clocks
+
+From: Li Jun <jun.li@nxp.com>
+
+commit 8a1ed98fe0f2e7669f0409de0f46f317b275f8be upstream.
+
+After commit cf7f3f4fa9e5 ("clk: imx8mp: fix usb_root_clk parent"),
+usb_root_clk is no longer for suspend clock so update dts accordingly
+to use right bus clock and suspend clock.
+
+Fixes: fb8587a2c165 ("arm64: dtsi: imx8mp: add usb nodes")
+Cc: stable@vger.kernel.org # ed1f4ccfe947: clk: imx: imx8mp: add shared clk gate for usb suspend clk
+Cc: stable@vger.kernel.org # v5.19+
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Tested-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Li Jun <jun.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+@@ -1279,7 +1279,7 @@
+ reg = <0x32f10100 0x8>,
+ <0x381f0000 0x20>;
+ clocks = <&clk IMX8MP_CLK_HSIO_ROOT>,
+- <&clk IMX8MP_CLK_USB_ROOT>;
++ <&clk IMX8MP_CLK_USB_SUSP>;
+ clock-names = "hsio", "suspend";
+ interrupts = <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>;
+ power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>;
+@@ -1292,9 +1292,9 @@
+ usb_dwc3_0: usb@38100000 {
+ compatible = "snps,dwc3";
+ reg = <0x38100000 0x10000>;
+- clocks = <&clk IMX8MP_CLK_HSIO_AXI>,
++ clocks = <&clk IMX8MP_CLK_USB_ROOT>,
+ <&clk IMX8MP_CLK_USB_CORE_REF>,
+- <&clk IMX8MP_CLK_USB_ROOT>;
++ <&clk IMX8MP_CLK_USB_SUSP>;
+ clock-names = "bus_early", "ref", "suspend";
+ interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&usb3_phy0>, <&usb3_phy0>;
+@@ -1321,7 +1321,7 @@
+ reg = <0x32f10108 0x8>,
+ <0x382f0000 0x20>;
+ clocks = <&clk IMX8MP_CLK_HSIO_ROOT>,
+- <&clk IMX8MP_CLK_USB_ROOT>;
++ <&clk IMX8MP_CLK_USB_SUSP>;
+ clock-names = "hsio", "suspend";
+ interrupts = <GIC_SPI 149 IRQ_TYPE_LEVEL_HIGH>;
+ power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>;
+@@ -1334,9 +1334,9 @@
+ usb_dwc3_1: usb@38200000 {
+ compatible = "snps,dwc3";
+ reg = <0x38200000 0x10000>;
+- clocks = <&clk IMX8MP_CLK_HSIO_AXI>,
++ clocks = <&clk IMX8MP_CLK_USB_ROOT>,
+ <&clk IMX8MP_CLK_USB_CORE_REF>,
+- <&clk IMX8MP_CLK_USB_ROOT>;
++ <&clk IMX8MP_CLK_USB_SUSP>;
+ clock-names = "bus_early", "ref", "suspend";
+ interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&usb3_phy1>, <&usb3_phy1>;
--- /dev/null
+From 6744a030d81e456883bfbb627ac1f30465c1a989 Mon Sep 17 00:00:00 2001
+From: Reinette Chatre <reinette.chatre@intel.com>
+Date: Wed, 7 Dec 2022 14:52:22 -0800
+Subject: dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+commit 6744a030d81e456883bfbb627ac1f30465c1a989 upstream.
+
+On driver unload any pending descriptors are flushed and pending
+DMA descriptors are explicitly completed:
+idxd_dmaengine_drv_remove() ->
+ drv_disable_wq() ->
+ idxd_wq_free_irq() ->
+ idxd_flush_pending_descs() ->
+ idxd_dma_complete_txd()
+
+With this done during driver unload any remaining descriptor is
+likely stuck and can be dropped. Even so, the descriptor may still
+have a callback set that could no longer be accessible. An
+example of such a problem is when the dmatest fails and the dmatest
+module is unloaded. The failure of dmatest leaves descriptors with
+dma_async_tx_descriptor::callback pointing to code that no longer
+exist. This causes a page fault as below at the time the IDXD driver
+is unloaded when it attempts to run the callback:
+ BUG: unable to handle page fault for address: ffffffffc0665190
+ #PF: supervisor instruction fetch in kernel mode
+ #PF: error_code(0x0010) - not-present page
+
+Fix this by clearing the callback pointers on the transmit
+descriptors only when workqueue is disabled.
+
+Fixes: 403a2e236538 ("dmaengine: idxd: change MSIX allocation based on per wq activation")
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/37d06b772aa7f8863ca50f90930ea2fd80b38fc3.1670452419.git.reinette.chatre@intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/device.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -1173,8 +1173,19 @@ static void idxd_flush_pending_descs(str
+ spin_unlock(&ie->list_lock);
+
+ list_for_each_entry_safe(desc, itr, &flist, list) {
++ struct dma_async_tx_descriptor *tx;
++
+ list_del(&desc->list);
+ ctype = desc->completion->status ? IDXD_COMPLETE_NORMAL : IDXD_COMPLETE_ABORT;
++ /*
++ * wq is being disabled. Any remaining descriptors are
++ * likely to be stuck and can be dropped. callback could
++ * point to code that is no longer accessible, for example
++ * if dmatest module has been unloaded.
++ */
++ tx = &desc->txd;
++ tx->callback = NULL;
++ tx->callback_result = NULL;
+ idxd_dma_complete_txd(desc, ctype, true);
+ }
+ }
--- /dev/null
+From b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f Mon Sep 17 00:00:00 2001
+From: Reinette Chatre <reinette.chatre@intel.com>
+Date: Wed, 7 Dec 2022 14:52:20 -0800
+Subject: dmaengine: idxd: Let probe fail when workqueue cannot be enabled
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+commit b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f upstream.
+
+The workqueue is enabled when the appropriate driver is loaded and
+disabled when the driver is removed. When the driver is removed it
+assumes that the workqueue was enabled successfully and proceeds to
+free allocations made during workqueue enabling.
+
+Failure during workqueue enabling does not prevent the driver from
+being loaded. This is because the error path within drv_enable_wq()
+returns success unless a second failure is encountered
+during the error path. By returning success it is possible to load
+the driver even if the workqueue cannot be enabled and
+allocations that do not exist are attempted to be freed during
+driver remove.
+
+Some examples of problematic flows:
+(a)
+
+ idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
+ In above flow, if idxd_wq_request_irq() fails then
+ idxd_wq_unmap_portal() is called on error exit path, but
+ drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The
+ driver is thus loaded successfully.
+
+ idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal()
+ Above flow on driver unload triggers the WARN in devm_iounmap() because
+ the device resource has already been removed during error path of
+ drv_enable_wq().
+
+(b)
+
+ idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
+ In above flow, if idxd_wq_request_irq() fails then
+ idxd_wq_init_percpu_ref() is never called to initialize the percpu
+ counter, yet the driver loads successfully because drv_enable_wq()
+ returns 0.
+
+ idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill():
+ Above flow on driver unload triggers a BUG when attempting to drop the
+ initial ref of the uninitialized percpu ref:
+ BUG: kernel NULL pointer dereference, address: 0000000000000010
+
+Fix the drv_enable_wq() error path by returning the original error that
+indicates failure of workqueue enabling. This ensures that the probe
+fails when an error is encountered and the driver remove paths are only
+attempted when the workqueue was enabled successfully.
+
+Fixes: 1f2bb40337f0 ("dmaengine: idxd: move wq_enable() to device.c")
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/e8d8116e5efa0fd14fadc5adae6ffd319f0e5ff1.1670452419.git.reinette.chatre@intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/device.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -1391,8 +1391,7 @@ err_res_alloc:
+ err_irq:
+ idxd_wq_unmap_portal(wq);
+ err_map_portal:
+- rc = idxd_wq_disable(wq, false);
+- if (rc < 0)
++ if (idxd_wq_disable(wq, false))
+ dev_dbg(dev, "wq %s disable failed\n", dev_name(wq_confdev(wq)));
+ err:
+ return rc;
--- /dev/null
+From 1beeec45f9ac31eba52478379f70a5fa9c2ad005 Mon Sep 17 00:00:00 2001
+From: Reinette Chatre <reinette.chatre@intel.com>
+Date: Wed, 7 Dec 2022 14:52:21 -0800
+Subject: dmaengine: idxd: Prevent use after free on completion memory
+
+From: Reinette Chatre <reinette.chatre@intel.com>
+
+commit 1beeec45f9ac31eba52478379f70a5fa9c2ad005 upstream.
+
+On driver unload any pending descriptors are flushed at the
+time the interrupt is freed:
+idxd_dmaengine_drv_remove() ->
+ drv_disable_wq() ->
+ idxd_wq_free_irq() ->
+ idxd_flush_pending_descs().
+
+If there are any descriptors present that need to be flushed this
+flow triggers a "not present" page fault as below:
+
+ BUG: unable to handle page fault for address: ff391c97c70c9040
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+
+The address that triggers the fault is the address of the
+descriptor that was freed moments earlier via:
+drv_disable_wq()->idxd_wq_free_resources()
+
+Fix the use after free by freeing the descriptors after any possible
+usage. This is done after idxd_wq_reset() to ensure that the memory
+remains accessible during possible completion writes by the device.
+
+Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable operations")
+Suggested-by: Dave Jiang <dave.jiang@intel.com>
+Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/6c4657d9cff0a0a00501a7b928297ac966e9ec9d.1670452419.git.reinette.chatre@intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/idxd/device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/idxd/device.c
++++ b/drivers/dma/idxd/device.c
+@@ -1408,11 +1408,11 @@ void drv_disable_wq(struct idxd_wq *wq)
+ dev_warn(dev, "Clients has claim on wq %d: %d\n",
+ wq->id, idxd_wq_refcount(wq));
+
+- idxd_wq_free_resources(wq);
+ idxd_wq_unmap_portal(wq);
+ idxd_wq_drain(wq);
+ idxd_wq_free_irq(wq);
+ idxd_wq_reset(wq);
++ idxd_wq_free_resources(wq);
+ percpu_ref_exit(&wq->wq_active);
+ wq->type = IDXD_WQT_NONE;
+ wq->client_count = 0;
--- /dev/null
+From 96b3bb18f6cbe259ef4e0bed3135911b7e8d2af5 Mon Sep 17 00:00:00 2001
+From: Peter Harliman Liem <pliem@maxlinear.com>
+Date: Thu, 5 Jan 2023 11:05:51 +0800
+Subject: dmaengine: lgm: Move DT parsing after initialization
+
+From: Peter Harliman Liem <pliem@maxlinear.com>
+
+commit 96b3bb18f6cbe259ef4e0bed3135911b7e8d2af5 upstream.
+
+ldma_cfg_init() will parse DT to retrieve certain configs.
+However, that is called before ldma_dma_init_vXX(), which
+will make some initialization to channel configs. It will
+thus incorrectly overwrite certain configs that are declared
+in DT.
+
+To fix that, we move DT parsing after initialization.
+Function name is renamed to better represent what it does.
+
+Fixes: 32d31c79a1a4 ("dmaengine: Add Intel LGM SoC DMA support.")
+Signed-off-by: Peter Harliman Liem <pliem@maxlinear.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/afef6fc1ed20098b684e0d53737d69faf63c125f.1672887183.git.pliem@maxlinear.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/lgm/lgm-dma.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/dma/lgm/lgm-dma.c
++++ b/drivers/dma/lgm/lgm-dma.c
+@@ -914,7 +914,7 @@ static void ldma_dev_init(struct ldma_de
+ }
+ }
+
+-static int ldma_cfg_init(struct ldma_dev *d)
++static int ldma_parse_dt(struct ldma_dev *d)
+ {
+ struct fwnode_handle *fwnode = dev_fwnode(d->dev);
+ struct ldma_port *p;
+@@ -1661,10 +1661,6 @@ static int intel_ldma_probe(struct platf
+ p->ldev = d;
+ }
+
+- ret = ldma_cfg_init(d);
+- if (ret)
+- return ret;
+-
+ dma_dev->dev = &pdev->dev;
+
+ ch_mask = (unsigned long)d->channels_mask;
+@@ -1675,6 +1671,10 @@ static int intel_ldma_probe(struct platf
+ ldma_dma_init_v3X(j, d);
+ }
+
++ ret = ldma_parse_dt(d);
++ if (ret)
++ return ret;
++
+ dma_dev->device_alloc_chan_resources = ldma_alloc_chan_resources;
+ dma_dev->device_free_chan_resources = ldma_free_chan_resources;
+ dma_dev->device_terminate_all = ldma_terminate_all;
--- /dev/null
+From 9c7e355ccbb33d239360c876dbe49ad5ade65b47 Mon Sep 17 00:00:00 2001
+From: Mohan Kumar <mkumard@nvidia.com>
+Date: Mon, 2 Jan 2023 12:18:44 +0530
+Subject: dmaengine: tegra210-adma: fix global intr clear
+
+From: Mohan Kumar <mkumard@nvidia.com>
+
+commit 9c7e355ccbb33d239360c876dbe49ad5ade65b47 upstream.
+
+The current global interrupt clear programming register offset
+was not correct. Fix the programming with right offset
+
+Fixes: ded1f3db4cd6 ("dmaengine: tegra210-adma: prepare for supporting newer Tegra chips")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
+Link: https://lore.kernel.org/r/20230102064844.31306-1-mkumard@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/tegra210-adma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -221,7 +221,7 @@ static int tegra_adma_init(struct tegra_
+ int ret;
+
+ /* Clear any interrupts */
+- tdma_write(tdma, tdma->cdata->global_int_clear, 0x1);
++ tdma_write(tdma, tdma->cdata->ch_base_offset + tdma->cdata->global_int_clear, 0x1);
+
+ /* Assert soft reset */
+ tdma_write(tdma, ADMA_GLOBAL_SOFT_RESET, 0x1);
--- /dev/null
+From 79601b894849cb6f6d6122e6590f1887ac4a66b3 Mon Sep 17 00:00:00 2001
+From: Joshua Ashton <joshua@froggi.es>
+Date: Tue, 10 Jan 2023 20:12:21 +0000
+Subject: drm/amd/display: Calculate output_color_space after pixel encoding adjustment
+
+From: Joshua Ashton <joshua@froggi.es>
+
+commit 79601b894849cb6f6d6122e6590f1887ac4a66b3 upstream.
+
+Code in get_output_color_space depends on knowing the pixel encoding to
+determine whether to pick between eg. COLOR_SPACE_SRGB or
+COLOR_SPACE_YCBCR709 for transparent RGB -> YCbCr 4:4:4 in the driver.
+
+v2: Fixed patch being accidentally based on a personal feature branch, oops!
+
+Fixes: ea117312ea9f ("drm/amd/display: Reduce HDMI pixel encoding if max clock is exceeded")
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Joshua Ashton <joshua@froggi.es>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -5283,8 +5283,6 @@ static void fill_stream_properties_from_
+
+ timing_out->aspect_ratio = get_aspect_ratio(mode_in);
+
+- stream->output_color_space = get_output_color_space(timing_out);
+-
+ stream->out_transfer_func->type = TF_TYPE_PREDEFINED;
+ stream->out_transfer_func->tf = TRANSFER_FUNCTION_SRGB;
+ if (stream->signal == SIGNAL_TYPE_HDMI_TYPE_A) {
+@@ -5295,6 +5293,8 @@ static void fill_stream_properties_from_
+ adjust_colour_depth_from_display_info(timing_out, info);
+ }
+ }
++
++ stream->output_color_space = get_output_color_space(timing_out);
+ }
+
+ static void fill_audio_info(struct audio_info *audio_info,
--- /dev/null
+From a52287d66dfa1cca32e6273623b63ba39d87f126 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 18 Jan 2023 09:21:22 -0500
+Subject: drm/amd/display: disable S/G display on DCN 3.1.4
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a52287d66dfa1cca32e6273623b63ba39d87f126 upstream.
+
+Causes flickering or white screens in some configurations.
+Disable it for now until we can fix the issue.
+
+Cc: roman.li@amd.com
+Cc: yifan1.zhang@amd.com
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Roman Li <Roman.Li@amd.com>
+Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.1.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1512,7 +1512,6 @@ static int amdgpu_dm_init(struct amdgpu_
+ case IP_VERSION(3, 0, 1):
+ case IP_VERSION(3, 1, 2):
+ case IP_VERSION(3, 1, 3):
+- case IP_VERSION(3, 1, 4):
+ case IP_VERSION(3, 1, 6):
+ init_data.flags.gpu_vm_support = true;
+ break;
--- /dev/null
+From e78cc6a4c7486f50c2786d91dd7d9649a87d1dcb Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Wed, 18 Jan 2023 09:19:21 -0500
+Subject: drm/amd/display: disable S/G display on DCN 3.1.5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e78cc6a4c7486f50c2786d91dd7d9649a87d1dcb upstream.
+
+Causes flickering or white screens in some configurations.
+Disable it for now until we can fix the issue.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2354
+Cc: roman.li@amd.com
+Cc: yifan1.zhang@amd.com
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.1.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -1513,7 +1513,6 @@ static int amdgpu_dm_init(struct amdgpu_
+ case IP_VERSION(3, 1, 2):
+ case IP_VERSION(3, 1, 3):
+ case IP_VERSION(3, 1, 4):
+- case IP_VERSION(3, 1, 5):
+ case IP_VERSION(3, 1, 6):
+ init_data.flags.gpu_vm_support = true;
+ break;
--- /dev/null
+From 973a9c810c785ac270a6d50d8cf862b0c1643a10 Mon Sep 17 00:00:00 2001
+From: Joshua Ashton <joshua@froggi.es>
+Date: Tue, 10 Jan 2023 22:50:42 +0000
+Subject: drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
+
+From: Joshua Ashton <joshua@froggi.es>
+
+commit 973a9c810c785ac270a6d50d8cf862b0c1643a10 upstream.
+
+The YCC conversion matrix for RGB -> COLOR_SPACE_YCBCR2020_TYPE is
+missing the values for the fourth column of the matrix.
+
+The fourth column of the matrix is essentially just a value that is
+added given that the color is 3 components in size.
+These values are needed to bias the chroma from the [-1, 1] -> [0, 1]
+range.
+
+This fixes color being very green when using Gamescope HDR on HDMI
+output which prefers YCC 4:4:4.
+
+Fixes: 40df2f809e8f ("drm/amd/display: color space ycbcr709 support")
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Joshua Ashton <joshua@froggi.es>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c
+@@ -90,8 +90,8 @@ static const struct out_csc_color_matrix
+ { 0xE00, 0xF349, 0xFEB7, 0x1000, 0x6CE, 0x16E3,
+ 0x24F, 0x200, 0xFCCB, 0xF535, 0xE00, 0x1000} },
+ { COLOR_SPACE_YCBCR2020_TYPE,
+- { 0x1000, 0xF149, 0xFEB7, 0x0000, 0x0868, 0x15B2,
+- 0x01E6, 0x0000, 0xFB88, 0xF478, 0x1000, 0x0000} },
++ { 0x1000, 0xF149, 0xFEB7, 0x1004, 0x0868, 0x15B2,
++ 0x01E6, 0x201, 0xFB88, 0xF478, 0x1000, 0x1004} },
+ { COLOR_SPACE_YCBCR709_BLACK_TYPE,
+ { 0x0000, 0x0000, 0x0000, 0x1000, 0x0000, 0x0000,
+ 0x0000, 0x0200, 0x0000, 0x0000, 0x0000, 0x1000} },
--- /dev/null
+From 040625ab82ce6dca7772cb3867fe5c9eb279a344 Mon Sep 17 00:00:00 2001
+From: hongao <hongao@uniontech.com>
+Date: Tue, 22 Nov 2022 19:20:34 +0800
+Subject: drm/amd/display: Fix set scaling doesn's work
+
+From: hongao <hongao@uniontech.com>
+
+commit 040625ab82ce6dca7772cb3867fe5c9eb279a344 upstream.
+
+[Why]
+Setting scaling does not correctly update CRTC state. As a result
+dc stream state's src (composition area) && dest (addressable area)
+was not calculated as expected. This causes set scaling doesn's work.
+
+[How]
+Correctly update CRTC state when setting scaling property.
+
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Tested-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: hongao <hongao@uniontech.com>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -9433,8 +9433,8 @@ static int amdgpu_dm_atomic_check(struct
+ goto fail;
+ }
+
+- if (dm_old_con_state->abm_level !=
+- dm_new_con_state->abm_level)
++ if (dm_old_con_state->abm_level != dm_new_con_state->abm_level ||
++ dm_old_con_state->scaling != dm_new_con_state->scaling)
+ new_crtc_state->connectors_changed = true;
+ }
+
--- /dev/null
+From dc88063b87775971be564d79dc1b05f7b8b5c135 Mon Sep 17 00:00:00 2001
+From: Lang Yu <Lang.Yu@amd.com>
+Date: Wed, 11 Jan 2023 09:32:15 +0800
+Subject: drm/amdgpu: allow multipipe policy on ASICs with one MEC
+
+From: Lang Yu <Lang.Yu@amd.com>
+
+commit dc88063b87775971be564d79dc1b05f7b8b5c135 upstream.
+
+Always enable multipipe policy on ASICs with GC VERSION > 9.0.0
+instead of MEC number > 1.
+
+This will allow multipipe policy on ASICs with one MEC,
+e.g., gfx11 APUs.
+
+Signed-off-by: Lang Yu <Lang.Yu@amd.com>
+Reviewed-by: Aaron Liu <aaron.liu@amd.com>
+Reviewed-by: Yifan Zhang <yifan1.zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.1.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c
+@@ -156,6 +156,9 @@ static bool amdgpu_gfx_is_compute_multip
+ return amdgpu_compute_multipipe == 1;
+ }
+
++ if (adev->ip_versions[GC_HWIP][0] > IP_VERSION(9, 0, 0))
++ return true;
++
+ /* FIXME: spreading the queues across pipes causes perf regressions
+ * on POLARIS11 compute workloads */
+ if (adev->asic_type == CHIP_POLARIS11)
--- /dev/null
+From c7bae4aaa5609c1fa9761c35dbcc5fcc92915222 Mon Sep 17 00:00:00 2001
+From: jie1zhan <jesse.zhang@amd.com>
+Date: Fri, 13 Jan 2023 10:39:13 +0800
+Subject: drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
+
+From: jie1zhan <jesse.zhang@amd.com>
+
+commit c7bae4aaa5609c1fa9761c35dbcc5fcc92915222 upstream.
+
+From smu firmware,the value of power is transferred in units of watts.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2321
+Fixes: 137aac26a2ed ("drm/amdgpu/smu12: fix power reporting on renoir")
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com>
+Reviewed-by: Aaron Liu <aaron.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
+@@ -1171,6 +1171,7 @@ static int renoir_get_smu_metrics_data(s
+ int ret = 0;
+ uint32_t apu_percent = 0;
+ uint32_t dgpu_percent = 0;
++ struct amdgpu_device *adev = smu->adev;
+
+
+ ret = smu_cmn_get_metrics_table(smu,
+@@ -1196,7 +1197,11 @@ static int renoir_get_smu_metrics_data(s
+ *value = metrics->AverageUvdActivity / 100;
+ break;
+ case METRICS_AVERAGE_SOCKETPOWER:
+- *value = (metrics->CurrentSocketPower << 8) / 1000;
++ if (((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(12, 0, 1)) && (adev->pm.fw_version >= 0x40000f)) ||
++ ((adev->ip_versions[MP1_HWIP][0] == IP_VERSION(12, 0, 0)) && (adev->pm.fw_version >= 0x373200)))
++ *value = metrics->CurrentSocketPower << 8;
++ else
++ *value = (metrics->CurrentSocketPower << 8) / 1000;
+ break;
+ case METRICS_TEMPERATURE_EDGE:
+ *value = (metrics->GfxTemperature / 100) *
--- /dev/null
+From 74ea8e78ab349514c9f4df0be1189d91267d750d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Thu, 12 Jan 2023 14:46:00 +0100
+Subject: drm/amdgpu: fix amdgpu_job_free_resources v2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 74ea8e78ab349514c9f4df0be1189d91267d750d upstream.
+
+It can be that neither fence were initialized when we run out of UVD
+streams for example.
+
+v2: fix typo breaking compile
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2324
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org # 6.1.x
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
+@@ -154,8 +154,14 @@ void amdgpu_job_free_resources(struct am
+ struct dma_fence *f;
+ unsigned i;
+
+- /* use sched fence if available */
+- f = job->base.s_fence ? &job->base.s_fence->finished : &job->hw_fence;
++ /* Check if any fences where initialized */
++ if (job->base.s_fence && job->base.s_fence->finished.ops)
++ f = &job->base.s_fence->finished;
++ else if (job->hw_fence.ops)
++ f = &job->hw_fence;
++ else
++ f = NULL;
++
+ for (i = 0; i < job->num_ibs; ++i)
+ amdgpu_ib_free(ring->adev, &job->ibs[i], f);
+ }
--- /dev/null
+From a273e95721e96885971a05f1b34cb6d093904d9d Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Mon, 16 Jan 2023 12:54:23 +0100
+Subject: drm/i915: Allow switching away via vga-switcheroo if uninitialized
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit a273e95721e96885971a05f1b34cb6d093904d9d upstream.
+
+Always allow switching away via vga-switcheroo if the display is
+uninitalized. Instead prevent switching to i915 if the device has
+not been initialized.
+
+This issue was introduced by commit 5df7bd130818 ("drm/i915: skip
+display initialization when there is no display") protected, which
+protects code paths from being executed on uninitialized devices.
+In the case of vga-switcheroo, we want to allow a switch away from
+i915's device. So run vga_switcheroo_process_delayed_switch() and
+test in the switcheroo callbacks if the i915 device is available.
+
+Fixes: 5df7bd130818 ("drm/i915: skip display initialization when there is no display")
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: José Roberto de Souza <jose.souza@intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
+Cc: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
+Cc: Manasi Navare <manasi.d.navare@intel.com>
+Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: "Jouni Högander" <jouni.hogander@intel.com>
+Cc: Uma Shankar <uma.shankar@intel.com>
+Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Cc: Matt Roper <matthew.d.roper@intel.com>
+Cc: Ramalingam C <ramalingam.c@intel.com>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Andi Shyti <andi.shyti@linux.intel.com>
+Cc: Andrzej Hajda <andrzej.hajda@intel.com>
+Cc: "José Roberto de Souza" <jose.souza@intel.com>
+Cc: Julia Lawall <Julia.Lawall@inria.fr>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v5.14+
+Link: https://patchwork.freedesktop.org/patch/msgid/20230116115425.13484-2-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_driver.c | 5 +----
+ drivers/gpu/drm/i915/i915_switcheroo.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/gpu/drm/i915/i915_driver.c
++++ b/drivers/gpu/drm/i915/i915_driver.c
+@@ -1070,12 +1070,9 @@ static int i915_driver_open(struct drm_d
+ */
+ static void i915_driver_lastclose(struct drm_device *dev)
+ {
+- struct drm_i915_private *i915 = to_i915(dev);
+-
+ intel_fbdev_restore_mode(dev);
+
+- if (HAS_DISPLAY(i915))
+- vga_switcheroo_process_delayed_switch();
++ vga_switcheroo_process_delayed_switch();
+ }
+
+ static void i915_driver_postclose(struct drm_device *dev, struct drm_file *file)
+--- a/drivers/gpu/drm/i915/i915_switcheroo.c
++++ b/drivers/gpu/drm/i915/i915_switcheroo.c
+@@ -19,6 +19,10 @@ static void i915_switcheroo_set_state(st
+ dev_err(&pdev->dev, "DRM not initialized, aborting switch.\n");
+ return;
+ }
++ if (!HAS_DISPLAY(i915)) {
++ dev_err(&pdev->dev, "Device state not initialized, aborting switch.\n");
++ return;
++ }
+
+ if (state == VGA_SWITCHEROO_ON) {
+ drm_info(&i915->drm, "switched on\n");
+@@ -44,7 +48,7 @@ static bool i915_switcheroo_can_switch(s
+ * locking inversion with the driver load path. And the access here is
+ * completely racy anyway. So don't bother with locking for now.
+ */
+- return i915 && atomic_read(&i915->drm.open_count) == 0;
++ return i915 && HAS_DISPLAY(i915) && atomic_read(&i915->drm.open_count) == 0;
+ }
+
+ static const struct vga_switcheroo_client_ops i915_switcheroo_ops = {
--- /dev/null
+From 8565c502e7c156d190d8e6d36e443f51b257f165 Mon Sep 17 00:00:00 2001
+From: Drew Davenport <ddavenport@chromium.org>
+Date: Mon, 26 Dec 2022 22:53:24 -0700
+Subject: drm/i915/display: Check source height is > 0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Drew Davenport <ddavenport@chromium.org>
+
+commit 8565c502e7c156d190d8e6d36e443f51b257f165 upstream.
+
+The error message suggests that the height of the src rect must be at
+least 1. Reject source with height of 0.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Drew Davenport <ddavenport@chromium.org>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221226225246.1.I15dff7bb5a0e485c862eae61a69096caf12ef29f@changeid
+(cherry picked from commit 0fe76b198d482b41771a8d17b45fb726d13083cf)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/display/skl_universal_plane.c
++++ b/drivers/gpu/drm/i915/display/skl_universal_plane.c
+@@ -1620,7 +1620,7 @@ static int skl_check_main_surface(struct
+ u32 offset;
+ int ret;
+
+- if (w > max_width || w < min_width || h > max_height) {
++ if (w > max_width || w < min_width || h > max_height || h < 1) {
+ drm_dbg_kms(&dev_priv->drm,
+ "requested Y/RGB source size %dx%d outside limits (min: %dx1 max: %dx%d)\n",
+ w, h, min_width, max_width, max_height);
--- /dev/null
+From 67b0b4ed259e425b7eed09da75b42c80682ca003 Mon Sep 17 00:00:00 2001
+From: Sasa Dragic <sasa.dragic@gmail.com>
+Date: Mon, 19 Dec 2022 18:29:27 +0100
+Subject: drm/i915: re-disable RC6p on Sandy Bridge
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sasa Dragic <sasa.dragic@gmail.com>
+
+commit 67b0b4ed259e425b7eed09da75b42c80682ca003 upstream.
+
+RC6p on Sandy Bridge got re-enabled over time, causing visual glitches
+and GPU hangs.
+
+Disabled originally in commit 1c8ecf80fdee ("drm/i915: do not enable
+RC6p on Sandy Bridge").
+
+Signed-off-by: Sasa Dragic <sasa.dragic@gmail.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20221219172927.9603-2-sasa.dragic@gmail.com
+Fixes: fb6db0f5bf1d ("drm/i915: Remove unsafe i915.enable_rc6")
+Fixes: 13c5a577b342 ("drm/i915/gt: Select the deepest available parking mode for rc6")
+Cc: stable@vger.kernel.org
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+(cherry picked from commit 0c8a6e9ea232c221976a0670256bd861408d9917)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/i915_pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_pci.c
++++ b/drivers/gpu/drm/i915/i915_pci.c
+@@ -423,7 +423,8 @@ static const struct intel_device_info il
+ .has_coherent_ggtt = true, \
+ .has_llc = 1, \
+ .has_rc6 = 1, \
+- .has_rc6p = 1, \
++ /* snb does support rc6p, but enabling it causes various issues */ \
++ .has_rc6p = 0, \
+ .has_rps = true, \
+ .dma_mask_size = 40, \
+ .__runtime.ppgtt_type = INTEL_PPGTT_ALIASING, \
--- /dev/null
+From c63835bf1c750c9b3aec1d5c23d811d6375fc23d Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 16 Jan 2023 21:17:39 +0100
+Subject: dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+commit c63835bf1c750c9b3aec1d5c23d811d6375fc23d upstream.
+
+The compatible strings in the driver don't have the meson prefix.
+Fix this in the documentation and rename the file accordingly.
+
+Fixes: da86d286cce8 ("dt-bindings: phy: meson-g12a-usb2-phy: convert to yaml")
+Cc: stable@vger.kernel.org
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/8d960029-e94d-224b-911f-03e5deb47ebc@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml | 78 ++++++++++
+ Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml | 78 ----------
+ 2 files changed, 78 insertions(+), 78 deletions(-)
+ rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb2-phy.yaml => amlogic,g12a-usb2-phy.yaml} (85%)
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml
+@@ -0,0 +1,78 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++# Copyright 2019 BayLibre, SAS
++%YAML 1.2
++---
++$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb2-phy.yaml#"
++$schema: "http://devicetree.org/meta-schemas/core.yaml#"
++
++title: Amlogic G12A USB2 PHY
++
++maintainers:
++ - Neil Armstrong <neil.armstrong@linaro.org>
++
++properties:
++ compatible:
++ enum:
++ - amlogic,g12a-usb2-phy
++ - amlogic,a1-usb2-phy
++
++ reg:
++ maxItems: 1
++
++ clocks:
++ maxItems: 1
++
++ clock-names:
++ items:
++ - const: xtal
++
++ resets:
++ maxItems: 1
++
++ reset-names:
++ items:
++ - const: phy
++
++ "#phy-cells":
++ const: 0
++
++ phy-supply:
++ description:
++ Phandle to a regulator that provides power to the PHY. This
++ regulator will be managed during the PHY power on/off sequence.
++
++required:
++ - compatible
++ - reg
++ - clocks
++ - clock-names
++ - resets
++ - reset-names
++ - "#phy-cells"
++
++if:
++ properties:
++ compatible:
++ enum:
++ - amlogic,meson-a1-usb-ctrl
++
++then:
++ properties:
++ power-domains:
++ maxItems: 1
++ required:
++ - power-domains
++
++additionalProperties: false
++
++examples:
++ - |
++ phy@36000 {
++ compatible = "amlogic,g12a-usb2-phy";
++ reg = <0x36000 0x2000>;
++ clocks = <&xtal>;
++ clock-names = "xtal";
++ resets = <&phy_reset>;
++ reset-names = "phy";
++ #phy-cells = <0>;
++ };
+--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml
++++ /dev/null
+@@ -1,78 +0,0 @@
+-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+-# Copyright 2019 BayLibre, SAS
+-%YAML 1.2
+----
+-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb2-phy.yaml#"
+-$schema: "http://devicetree.org/meta-schemas/core.yaml#"
+-
+-title: Amlogic G12A USB2 PHY
+-
+-maintainers:
+- - Neil Armstrong <neil.armstrong@linaro.org>
+-
+-properties:
+- compatible:
+- enum:
+- - amlogic,meson-g12a-usb2-phy
+- - amlogic,meson-a1-usb2-phy
+-
+- reg:
+- maxItems: 1
+-
+- clocks:
+- maxItems: 1
+-
+- clock-names:
+- items:
+- - const: xtal
+-
+- resets:
+- maxItems: 1
+-
+- reset-names:
+- items:
+- - const: phy
+-
+- "#phy-cells":
+- const: 0
+-
+- phy-supply:
+- description:
+- Phandle to a regulator that provides power to the PHY. This
+- regulator will be managed during the PHY power on/off sequence.
+-
+-required:
+- - compatible
+- - reg
+- - clocks
+- - clock-names
+- - resets
+- - reset-names
+- - "#phy-cells"
+-
+-if:
+- properties:
+- compatible:
+- enum:
+- - amlogic,meson-a1-usb-ctrl
+-
+-then:
+- properties:
+- power-domains:
+- maxItems: 1
+- required:
+- - power-domains
+-
+-additionalProperties: false
+-
+-examples:
+- - |
+- phy@36000 {
+- compatible = "amlogic,meson-g12a-usb2-phy";
+- reg = <0x36000 0x2000>;
+- clocks = <&xtal>;
+- clock-names = "xtal";
+- resets = <&phy_reset>;
+- reset-names = "phy";
+- #phy-cells = <0>;
+- };
--- /dev/null
+From e181119046a0ec16126b682163040e8e33f310c1 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 16 Jan 2023 21:19:03 +0100
+Subject: dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+commit e181119046a0ec16126b682163040e8e33f310c1 upstream.
+
+The compatible string in the driver doesn't have the meson prefix.
+Fix this in the documentation and rename the file accordingly.
+
+Fixes: 87a55485f2fc ("dt-bindings: phy: meson-g12a-usb3-pcie-phy: convert to yaml")
+Cc: stable@vger.kernel.org
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/0a82be92-ce85-da34-9d6f-4b33034473e5@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml | 59 ++++++++++
+ Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml | 59 ----------
+ 2 files changed, 59 insertions(+), 59 deletions(-)
+ rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb3-pcie-phy.yaml => amlogic,g12a-usb3-pcie-phy.yaml} (82%)
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml
+@@ -0,0 +1,59 @@
++# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
++# Copyright 2019 BayLibre, SAS
++%YAML 1.2
++---
++$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb3-pcie-phy.yaml#"
++$schema: "http://devicetree.org/meta-schemas/core.yaml#"
++
++title: Amlogic G12A USB3 + PCIE Combo PHY
++
++maintainers:
++ - Neil Armstrong <neil.armstrong@linaro.org>
++
++properties:
++ compatible:
++ enum:
++ - amlogic,g12a-usb3-pcie-phy
++
++ reg:
++ maxItems: 1
++
++ clocks:
++ maxItems: 1
++
++ clock-names:
++ items:
++ - const: ref_clk
++
++ resets:
++ maxItems: 1
++
++ reset-names:
++ items:
++ - const: phy
++
++ "#phy-cells":
++ const: 1
++
++required:
++ - compatible
++ - reg
++ - clocks
++ - clock-names
++ - resets
++ - reset-names
++ - "#phy-cells"
++
++additionalProperties: false
++
++examples:
++ - |
++ phy@46000 {
++ compatible = "amlogic,g12a-usb3-pcie-phy";
++ reg = <0x46000 0x2000>;
++ clocks = <&ref_clk>;
++ clock-names = "ref_clk";
++ resets = <&phy_reset>;
++ reset-names = "phy";
++ #phy-cells = <1>;
++ };
+--- a/Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml
++++ /dev/null
+@@ -1,59 +0,0 @@
+-# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+-# Copyright 2019 BayLibre, SAS
+-%YAML 1.2
+----
+-$id: "http://devicetree.org/schemas/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml#"
+-$schema: "http://devicetree.org/meta-schemas/core.yaml#"
+-
+-title: Amlogic G12A USB3 + PCIE Combo PHY
+-
+-maintainers:
+- - Neil Armstrong <neil.armstrong@linaro.org>
+-
+-properties:
+- compatible:
+- enum:
+- - amlogic,meson-g12a-usb3-pcie-phy
+-
+- reg:
+- maxItems: 1
+-
+- clocks:
+- maxItems: 1
+-
+- clock-names:
+- items:
+- - const: ref_clk
+-
+- resets:
+- maxItems: 1
+-
+- reset-names:
+- items:
+- - const: phy
+-
+- "#phy-cells":
+- const: 1
+-
+-required:
+- - compatible
+- - reg
+- - clocks
+- - clock-names
+- - resets
+- - reset-names
+- - "#phy-cells"
+-
+-additionalProperties: false
+-
+-examples:
+- - |
+- phy@46000 {
+- compatible = "amlogic,meson-g12a-usb3-pcie-phy";
+- reg = <0x46000 0x2000>;
+- clocks = <&ref_clk>;
+- clock-names = "ref_clk";
+- resets = <&phy_reset>;
+- reset-names = "phy";
+- #phy-cells = <1>;
+- };
--- /dev/null
+From a769b05eeed7accc4019a1ed9799dd72067f1ce8 Mon Sep 17 00:00:00 2001
+From: Khazhismel Kumykov <khazhy@chromium.org>
+Date: Tue, 17 Jan 2023 17:02:12 -0800
+Subject: gsmi: fix null-deref in gsmi_get_variable
+
+From: Khazhismel Kumykov <khazhy@chromium.org>
+
+commit a769b05eeed7accc4019a1ed9799dd72067f1ce8 upstream.
+
+We can get EFI variables without fetching the attribute, so we must
+allow for that in gsmi.
+
+commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore
+access layer") added a new get_variable call with attr=NULL, which
+triggers panic in gsmi.
+
+Fixes: 74c5b31c6618 ("driver: Google EFI SMI")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
+Link: https://lore.kernel.org/r/20230118010212.1268474-1-khazhy@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/google/gsmi.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/firmware/google/gsmi.c
++++ b/drivers/firmware/google/gsmi.c
+@@ -361,9 +361,10 @@ static efi_status_t gsmi_get_variable(ef
+ memcpy(data, gsmi_dev.data_buf->start, *data_size);
+
+ /* All variables are have the following attributes */
+- *attr = EFI_VARIABLE_NON_VOLATILE |
+- EFI_VARIABLE_BOOTSERVICE_ACCESS |
+- EFI_VARIABLE_RUNTIME_ACCESS;
++ if (attr)
++ *attr = EFI_VARIABLE_NON_VOLATILE |
++ EFI_VARIABLE_BOOTSERVICE_ACCESS |
++ EFI_VARIABLE_RUNTIME_ACCESS;
+ }
+
+ spin_unlock_irqrestore(&gsmi_dev.lock, flags);
--- /dev/null
+From 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Fri, 20 Jan 2023 15:08:21 -0700
+Subject: io_uring/poll: don't reissue in case of poll race on multishot request
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 upstream.
+
+A previous commit fixed a poll race that can occur, but it's only
+applicable for multishot requests. For a multishot request, we can safely
+ignore a spurious wakeup, as we never leave the waitqueue to begin with.
+
+A blunt reissue of a multishot armed request can cause us to leak a
+buffer, if they are ring provided. While this seems like a bug in itself,
+it's not really defined behavior to reissue a multishot request directly.
+It's less efficient to do so as well, and not required to rearm anything
+like it is for singleshot poll requests.
+
+Cc: stable@vger.kernel.org
+Fixes: 6e5aedb9324a ("io_uring/poll: attempt request issue after racy poll wakeup")
+Reported-and-tested-by: Olivier Langlois <olivier@trillion01.com>
+Link: https://github.com/axboe/liburing/issues/778
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/poll.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/io_uring/poll.c
++++ b/io_uring/poll.c
+@@ -281,8 +281,12 @@ static int io_poll_check_events(struct i
+ * to the waitqueue, so if we get nothing back, we
+ * should be safe and attempt a reissue.
+ */
+- if (unlikely(!req->cqe.res))
++ if (unlikely(!req->cqe.res)) {
++ /* Multishot armed need not reissue */
++ if (!(req->apoll_events & EPOLLONESHOT))
++ continue;
+ return IOU_POLL_REISSUE;
++ }
+ }
+ if (req->apoll_events & EPOLLONESHOT)
+ return IOU_POLL_DONE;
--- /dev/null
+From a43866856125c3c432e2fbb6cc63cee1539ec4a7 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Tue, 13 Dec 2022 00:02:46 +0200
+Subject: mei: bus: fix unlink on bus in error path
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit a43866856125c3c432e2fbb6cc63cee1539ec4a7 upstream.
+
+Unconditional call to mei_cl_unlink in mei_cl_bus_dev_release leads
+to call of the mei_cl_unlink without corresponding mei_cl_link.
+This leads to miscalculation of open_handle_count (decrease without
+increase).
+
+Call unlink in mei_cldev_enable fail path and remove blanket unlink
+from mei_cl_bus_dev_release.
+
+Fixes: 34f1166afd67 ("mei: bus: need to unlink client before freeing")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Reviewed-by: Tomas Winkler <tomas.winkler@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20221212220247.286019-1-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/bus.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/misc/mei/bus.c
++++ b/drivers/misc/mei/bus.c
+@@ -665,13 +665,15 @@ void *mei_cldev_dma_map(struct mei_cl_de
+ if (cl->state == MEI_FILE_UNINITIALIZED) {
+ ret = mei_cl_link(cl);
+ if (ret)
+- goto out;
++ goto notlinked;
+ /* update pointers */
+ cl->cldev = cldev;
+ }
+
+ ret = mei_cl_dma_alloc_and_map(cl, NULL, buffer_id, size);
+-out:
++ if (ret)
++ mei_cl_unlink(cl);
++notlinked:
+ mutex_unlock(&bus->device_lock);
+ if (ret)
+ return ERR_PTR(ret);
+@@ -721,7 +723,7 @@ int mei_cldev_enable(struct mei_cl_devic
+ if (cl->state == MEI_FILE_UNINITIALIZED) {
+ ret = mei_cl_link(cl);
+ if (ret)
+- goto out;
++ goto notlinked;
+ /* update pointers */
+ cl->cldev = cldev;
+ }
+@@ -748,6 +750,9 @@ int mei_cldev_enable(struct mei_cl_devic
+ }
+
+ out:
++ if (ret)
++ mei_cl_unlink(cl);
++notlinked:
+ mutex_unlock(&bus->device_lock);
+
+ return ret;
+@@ -1115,7 +1120,6 @@ static void mei_cl_bus_dev_release(struc
+ mei_cl_flush_queues(cldev->cl, NULL);
+ mei_me_cl_put(cldev->me_cl);
+ mei_dev_bus_put(cldev->bus);
+- mei_cl_unlink(cldev->cl);
+ kfree(cldev->cl);
+ kfree(cldev);
+ }
--- /dev/null
+From 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 Mon Sep 17 00:00:00 2001
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+Date: Tue, 13 Dec 2022 00:02:47 +0200
+Subject: mei: me: add meteor lake point M DID
+
+From: Alexander Usyskin <alexander.usyskin@intel.com>
+
+commit 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 upstream.
+
+Add Meteor Lake Point M device id.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
+Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
+Link: https://lore.kernel.org/r/20221212220247.286019-2-tomas.winkler@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/mei/hw-me-regs.h | 2 ++
+ drivers/misc/mei/pci-me.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -111,6 +111,8 @@
+
+ #define MEI_DEV_ID_RPL_S 0x7A68 /* Raptor Lake Point S */
+
++#define MEI_DEV_ID_MTL_M 0x7E70 /* Meteor Lake Point M */
++
+ /*
+ * MEI HW Section
+ */
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -118,6 +118,8 @@ static const struct pci_device_id mei_me
+
+ {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)},
++
+ /* required last entry */
+ {0, }
+ };
--- /dev/null
+From 6bc1fe7dd748ba5e76e7917d110837cafe7b931c Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Thu, 12 Jan 2023 18:42:51 +0100
+Subject: mptcp: explicitly specify sock family at subflow creation time
+
+From: Paolo Abeni <pabeni@redhat.com>
+
+commit 6bc1fe7dd748ba5e76e7917d110837cafe7b931c upstream.
+
+Let the caller specify the to-be-created subflow family.
+
+For a given MPTCP socket created with the AF_INET6 family, the current
+userspace PM can already ask the kernel to create subflows in v4 and v6.
+If "plain" IPv4 addresses are passed to the kernel, they are
+automatically mapped in v6 addresses "by accident". This can be
+problematic because the userspace will need to pass different addresses,
+now the v4-mapped-v6 addresses to destroy this new subflow.
+
+On the other hand, if the MPTCP socket has been created with the AF_INET
+family, the command to create a subflow in v6 will be accepted but the
+result will not be the one as expected as new subflow will be created in
+IPv4 using part of the v6 addresses passed to the kernel: not creating
+the expected subflow then.
+
+No functional change intended for the in-kernel PM where an explicit
+enforcement is currently in place. This arbitrary enforcement will be
+leveraged by other patches in a future version.
+
+Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment")
+Cc: stable@vger.kernel.org
+Co-developed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/protocol.c | 2 +-
+ net/mptcp/protocol.h | 3 ++-
+ net/mptcp/subflow.c | 9 +++++----
+ 3 files changed, 8 insertions(+), 6 deletions(-)
+
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -107,7 +107,7 @@ static int __mptcp_socket_create(struct
+ struct socket *ssock;
+ int err;
+
+- err = mptcp_subflow_create_socket(sk, &ssock);
++ err = mptcp_subflow_create_socket(sk, sk->sk_family, &ssock);
+ if (err)
+ return err;
+
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -626,7 +626,8 @@ bool mptcp_addresses_equal(const struct
+ /* called with sk socket lock held */
+ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
+ const struct mptcp_addr_info *remote);
+-int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock);
++int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
++ struct socket **new_sock);
+ void mptcp_info2sockaddr(const struct mptcp_addr_info *info,
+ struct sockaddr_storage *addr,
+ unsigned short family);
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -1492,7 +1492,7 @@ int __mptcp_subflow_connect(struct sock
+ if (!mptcp_is_fully_established(sk))
+ goto err_out;
+
+- err = mptcp_subflow_create_socket(sk, &sf);
++ err = mptcp_subflow_create_socket(sk, loc->family, &sf);
+ if (err)
+ goto err_out;
+
+@@ -1604,7 +1604,9 @@ static void mptcp_subflow_ops_undo_overr
+ #endif
+ ssk->sk_prot = &tcp_prot;
+ }
+-int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock)
++
++int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
++ struct socket **new_sock)
+ {
+ struct mptcp_subflow_context *subflow;
+ struct net *net = sock_net(sk);
+@@ -1617,8 +1619,7 @@ int mptcp_subflow_create_socket(struct s
+ if (unlikely(!sk->sk_socket))
+ return -EINVAL;
+
+- err = sock_create_kern(net, sk->sk_family, SOCK_STREAM, IPPROTO_TCP,
+- &sf);
++ err = sock_create_kern(net, family, SOCK_STREAM, IPPROTO_TCP, &sf);
+ if (err)
+ return err;
+
--- /dev/null
+From fb00ee4f3343acb2b9222ca9b73b47dd1e1a8efc Mon Sep 17 00:00:00 2001
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+Date: Thu, 12 Jan 2023 18:42:52 +0100
+Subject: mptcp: netlink: respect v4/v6-only sockets
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+commit fb00ee4f3343acb2b9222ca9b73b47dd1e1a8efc upstream.
+
+If an MPTCP socket has been created with AF_INET6 and the IPV6_V6ONLY
+option has been set, the userspace PM would allow creating subflows
+using IPv4 addresses, e.g. mapped in v6.
+
+The kernel side of userspace PM will also accept creating subflows with
+local and remote addresses having different families. Depending on the
+subflow socket's family, different behaviours are expected:
+ - If AF_INET is forced with a v6 address, the kernel will take the last
+ byte of the IP and try to connect to that: a new subflow is created
+ but to a non expected address.
+ - If AF_INET6 is forced with a v4 address, the kernel will try to
+ connect to a v4 address (v4-mapped-v6). A -EBADF error from the
+ connect() part is then expected.
+
+It is then required to check the given families can be accepted. This is
+done by using a new helper for addresses family matching, taking care of
+IPv4 vs IPv4-mapped-IPv6 addresses. This helper will be re-used later by
+the in-kernel path-manager to use mixed IPv4 and IPv6 addresses.
+
+While at it, a clear error message is now reported if there are some
+conflicts with the families that have been passed by the userspace.
+
+Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment")
+Cc: stable@vger.kernel.org
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mptcp/pm.c | 25 +++++++++++++++++++++++++
+ net/mptcp/pm_userspace.c | 7 +++++++
+ net/mptcp/protocol.h | 3 +++
+ 3 files changed, 35 insertions(+)
+
+--- a/net/mptcp/pm.c
++++ b/net/mptcp/pm.c
+@@ -420,6 +420,31 @@ void mptcp_pm_subflow_chk_stale(const st
+ }
+ }
+
++/* if sk is ipv4 or ipv6_only allows only same-family local and remote addresses,
++ * otherwise allow any matching local/remote pair
++ */
++bool mptcp_pm_addr_families_match(const struct sock *sk,
++ const struct mptcp_addr_info *loc,
++ const struct mptcp_addr_info *rem)
++{
++ bool mptcp_is_v4 = sk->sk_family == AF_INET;
++
++#if IS_ENABLED(CONFIG_MPTCP_IPV6)
++ bool loc_is_v4 = loc->family == AF_INET || ipv6_addr_v4mapped(&loc->addr6);
++ bool rem_is_v4 = rem->family == AF_INET || ipv6_addr_v4mapped(&rem->addr6);
++
++ if (mptcp_is_v4)
++ return loc_is_v4 && rem_is_v4;
++
++ if (ipv6_only_sock(sk))
++ return !loc_is_v4 && !rem_is_v4;
++
++ return loc_is_v4 == rem_is_v4;
++#else
++ return mptcp_is_v4 && loc->family == AF_INET && rem->family == AF_INET;
++#endif
++}
++
+ void mptcp_pm_data_reset(struct mptcp_sock *msk)
+ {
+ u8 pm_type = mptcp_get_pm_type(sock_net((struct sock *)msk));
+--- a/net/mptcp/pm_userspace.c
++++ b/net/mptcp/pm_userspace.c
+@@ -294,6 +294,13 @@ int mptcp_nl_cmd_sf_create(struct sk_buf
+ }
+
+ sk = &msk->sk.icsk_inet.sk;
++
++ if (!mptcp_pm_addr_families_match(sk, &addr_l, &addr_r)) {
++ GENL_SET_ERR_MSG(info, "families mismatch");
++ err = -EINVAL;
++ goto create_err;
++ }
++
+ lock_sock(sk);
+
+ err = __mptcp_subflow_connect(sk, &addr_l, &addr_r);
+--- a/net/mptcp/protocol.h
++++ b/net/mptcp/protocol.h
+@@ -762,6 +762,9 @@ int mptcp_pm_parse_addr(struct nlattr *a
+ int mptcp_pm_parse_entry(struct nlattr *attr, struct genl_info *info,
+ bool require_family,
+ struct mptcp_pm_addr_entry *entry);
++bool mptcp_pm_addr_families_match(const struct sock *sk,
++ const struct mptcp_addr_info *loc,
++ const struct mptcp_addr_info *rem);
+ void mptcp_pm_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk);
+ void mptcp_pm_nl_subflow_chk_stale(const struct mptcp_sock *msk, struct sock *ssk);
+ void mptcp_pm_new_connection(struct mptcp_sock *msk, const struct sock *ssk, int server_side);
--- /dev/null
+From 3e9900f3bd7ba30d60f82b162b70a1dffe4e8e24 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Mon, 16 Jan 2023 08:51:05 -0700
+Subject: pktcdvd: check for NULL returna fter calling bio_split_to_limits()
+
+From: Jens Axboe <axboe@kernel.dk>
+
+commit 3e9900f3bd7ba30d60f82b162b70a1dffe4e8e24 upstream.
+
+The revert of the removal of this driver happened after we fixed up
+the split limits for NOWAIT issue, hence it got missed. Ensure that
+we check for a NULL bio after splitting, in case it should be retried.
+
+Marking this as fixing both commits, so that stable backport will do
+this correctly.
+
+Cc: stable@vger.kernel.org
+Fixes: 9cea62b2cbab ("block: don't allow splitting of a REQ_NOWAIT bio")
+Fixes: 4b83e99ee709 ("Revert "pktcdvd: remove driver."")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/block/pktcdvd.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/block/pktcdvd.c
++++ b/drivers/block/pktcdvd.c
+@@ -2400,6 +2400,8 @@ static void pkt_submit_bio(struct bio *b
+ struct bio *split;
+
+ bio = bio_split_to_limits(bio);
++ if (!bio)
++ return;
+
+ pkt_dbg(2, pd, "start = %6llx stop = %6llx\n",
+ (unsigned long long)bio->bi_iter.bi_sector,
--- /dev/null
+From 4656d72c1efa495a58ad6d8b073a60907073e4e6 Mon Sep 17 00:00:00 2001
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+Date: Thu, 12 Jan 2023 18:42:53 +0100
+Subject: selftests: mptcp: userspace: validate v4-v6 subflows mix
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+commit 4656d72c1efa495a58ad6d8b073a60907073e4e6 upstream.
+
+MPTCP protocol supports having subflows in both IPv4 and IPv6. In Linux,
+it is possible to have that if the MPTCP socket has been created with
+AF_INET6 family without the IPV6_V6ONLY option.
+
+Here, a new IPv4 subflow is being added to the initial IPv6 connection,
+then being removed using Netlink commands.
+
+Cc: stable@vger.kernel.org # v5.19+
+Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/net/mptcp/userspace_pm.sh | 47 ++++++++++++++++++++++
+ 1 file changed, 47 insertions(+)
+
+--- a/tools/testing/selftests/net/mptcp/userspace_pm.sh
++++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh
+@@ -776,6 +776,52 @@ test_subflows()
+ rm -f "$evts"
+ }
+
++test_subflows_v4_v6_mix()
++{
++ # Attempt to add a listener at 10.0.2.1:<subflow-port>
++ ip netns exec "$ns1" ./pm_nl_ctl listen 10.0.2.1\
++ $app6_port > /dev/null 2>&1 &
++ local listener_pid=$!
++
++ # ADD_ADDR4 from server to client machine reusing the subflow port on
++ # the established v6 connection
++ :>"$client_evts"
++ ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\
++ $server_addr_id dev ns1eth2 > /dev/null 2>&1
++ stdbuf -o0 -e0 printf "ADD_ADDR4 id:%d 10.0.2.1 (ns1) => ns2, reuse port\t\t" $server_addr_id
++ sleep 0.5
++ verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\
++ "$server_addr_id" "$app6_port"
++
++ # CREATE_SUBFLOW from client to server machine
++ :>"$client_evts"
++ ip netns exec "$ns2" ./pm_nl_ctl csf lip 10.0.2.2 lid 23 rip 10.0.2.1 rport\
++ $app6_port token "$client6_token" > /dev/null 2>&1
++ sleep 0.5
++ verify_subflow_events "$client_evts" "$SUB_ESTABLISHED" "$client6_token"\
++ "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\
++ "$server_addr_id" "ns2" "ns1"
++
++ # Delete the listener from the server ns, if one was created
++ kill_wait $listener_pid
++
++ sport=$(sed --unbuffered -n 's/.*\(sport:\)\([[:digit:]]*\).*$/\2/p;q' "$client_evts")
++
++ # DESTROY_SUBFLOW from client to server machine
++ :>"$client_evts"
++ ip netns exec "$ns2" ./pm_nl_ctl dsf lip 10.0.2.2 lport "$sport" rip 10.0.2.1 rport\
++ $app6_port token "$client6_token" > /dev/null 2>&1
++ sleep 0.5
++ verify_subflow_events "$client_evts" "$SUB_CLOSED" "$client6_token" \
++ "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\
++ "$server_addr_id" "ns2" "ns1"
++
++ # RM_ADDR from server to client machine
++ ip netns exec "$ns1" ./pm_nl_ctl rem id $server_addr_id token\
++ "$server6_token" > /dev/null 2>&1
++ sleep 0.5
++}
++
+ test_prio()
+ {
+ local count
+@@ -812,6 +858,7 @@ make_connection "v6"
+ test_announce
+ test_remove
+ test_subflows
++test_subflows_v4_v6_mix
+ test_prio
+
+ exit 0
--- /dev/null
+From 4f39aca2360c82dccd2f5179d77e94aab665bea6 Mon Sep 17 00:00:00 2001
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Date: Sun, 8 Jan 2023 19:17:35 +0100
+Subject: serial: amba-pl011: fix high priority character transmission in rs486 mode
+
+From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+
+commit 4f39aca2360c82dccd2f5179d77e94aab665bea6 upstream.
+
+In RS485 mode the transmission of a high priority character fails since it
+is written to the data register before the transmitter is enabled. Fix this
+in pl011_tx_chars() by enabling RS485 transmission before writing the
+character.
+
+Fixes: 8d479237727c ("serial: amba-pl011: add RS485 support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
+Link: https://lore.kernel.org/r/20230108181735.10937-1-LinoSanfilippo@gmx.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/amba-pl011.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -1467,6 +1467,10 @@ static bool pl011_tx_chars(struct uart_a
+ struct circ_buf *xmit = &uap->port.state->xmit;
+ int count = uap->fifosize >> 1;
+
++ if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
++ !uap->rs485_tx_started)
++ pl011_rs485_tx_start(uap);
++
+ if (uap->port.x_char) {
+ if (!pl011_tx_char(uap, uap->port.x_char, from_irq))
+ return true;
+@@ -1478,10 +1482,6 @@ static bool pl011_tx_chars(struct uart_a
+ return false;
+ }
+
+- if ((uap->port.rs485.flags & SER_RS485_ENABLED) &&
+- !uap->rs485_tx_started)
+- pl011_rs485_tx_start(uap);
+-
+ /* If we are using DMA mode, try to send some characters. */
+ if (pl011_dma_tx_irq(uap))
+ return true;
--- /dev/null
+From 5bfdd3c654bd879bff50c2e85e42f85ae698b42f Mon Sep 17 00:00:00 2001
+From: Tobias Schramm <t.schramm@manjaro.org>
+Date: Mon, 9 Jan 2023 08:29:40 +0100
+Subject: serial: atmel: fix incorrect baudrate setup
+
+From: Tobias Schramm <t.schramm@manjaro.org>
+
+commit 5bfdd3c654bd879bff50c2e85e42f85ae698b42f upstream.
+
+Commit ba47f97a18f2 ("serial: core: remove baud_rates when serial console
+setup") changed uart_set_options to select the correct baudrate
+configuration based on the absolute error between requested baudrate and
+available standard baudrate settings.
+Prior to that commit the baudrate was selected based on which predefined
+standard baudrate did not exceed the requested baudrate.
+This change of selection logic was never reflected in the atmel serial
+driver. Thus the comment left in the atmel serial driver is no longer
+accurate.
+Additionally the manual rounding up described in that comment and applied
+via (quot - 1) requests an incorrect baudrate. Since uart_set_options uses
+tty_termios_encode_baud_rate to determine the appropriate baudrate flags
+this can cause baudrate selection to fail entirely because
+tty_termios_encode_baud_rate will only select a baudrate if relative error
+between requested and selected baudrate does not exceed +/-2%.
+Fix that by requesting actual, exact baudrate used by the serial.
+
+Fixes: ba47f97a18f2 ("serial: core: remove baud_rates when serial console setup")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Tobias Schramm <t.schramm@manjaro.org>
+Acked-by: Richard Genoud <richard.genoud@gmail.com>
+Link: https://lore.kernel.org/r/20230109072940.202936-1-t.schramm@manjaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/atmel_serial.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -2673,13 +2673,7 @@ static void __init atmel_console_get_opt
+ else if (mr == ATMEL_US_PAR_ODD)
+ *parity = 'o';
+
+- /*
+- * The serial core only rounds down when matching this to a
+- * supported baud rate. Make sure we don't end up slightly
+- * lower than one of those, as it would make us fall through
+- * to a much lower baud rate than we really want.
+- */
+- *baud = port->uartclk / (16 * (quot - 1));
++ *baud = port->uartclk / (16 * quot);
+ }
+
+ static int __init atmel_console_setup(struct console *co, char *options)
--- /dev/null
+From 14ee78d5932afeb710c8305196a676a715bfdea8 Mon Sep 17 00:00:00 2001
+From: Matthew Howell <matthew.howell@sealevel.com>
+Date: Thu, 19 Jan 2023 14:40:29 -0500
+Subject: serial: exar: Add support for Sealevel 7xxxC serial cards
+
+From: Matthew Howell <matthew.howell@sealevel.com>
+
+commit 14ee78d5932afeb710c8305196a676a715bfdea8 upstream.
+
+Add support for Sealevel 7xxxC serial cards.
+
+This patch:
+* Adds IDs to recognize 7xxxC cards from Sealevel Systems.
+* Updates exar_pci_probe() to set nr_ports to last two bytes of primary
+ dev ID for these cards.
+
+Signed-off-by: Matthew Howell <matthew.howell@sealevel.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2301191440010.22558@tstest-VirtualBox
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_exar.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -43,6 +43,12 @@
+ #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358
+ #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358
+
++#define PCI_DEVICE_ID_SEALEVEL_710xC 0x1001
++#define PCI_DEVICE_ID_SEALEVEL_720xC 0x1002
++#define PCI_DEVICE_ID_SEALEVEL_740xC 0x1004
++#define PCI_DEVICE_ID_SEALEVEL_780xC 0x1008
++#define PCI_DEVICE_ID_SEALEVEL_716xC 0x1010
++
+ #define UART_EXAR_INT0 0x80
+ #define UART_EXAR_8XMODE 0x88 /* 8X sampling rate select */
+ #define UART_EXAR_SLEEP 0x8b /* Sleep mode */
+@@ -638,6 +644,8 @@ exar_pci_probe(struct pci_dev *pcidev, c
+ nr_ports = BIT(((pcidev->device & 0x38) >> 3) - 1);
+ else if (board->num_ports)
+ nr_ports = board->num_ports;
++ else if (pcidev->vendor == PCI_VENDOR_ID_SEALEVEL)
++ nr_ports = pcidev->device & 0xff;
+ else
+ nr_ports = pcidev->device & 0x0f;
+
+@@ -864,6 +872,12 @@ static const struct pci_device_id exar_p
+ EXAR_DEVICE(COMMTECH, 4224PCI335, pbn_fastcom335_4),
+ EXAR_DEVICE(COMMTECH, 2324PCI335, pbn_fastcom335_4),
+ EXAR_DEVICE(COMMTECH, 2328PCI335, pbn_fastcom335_8),
++
++ EXAR_DEVICE(SEALEVEL, 710xC, pbn_exar_XR17V35x),
++ EXAR_DEVICE(SEALEVEL, 720xC, pbn_exar_XR17V35x),
++ EXAR_DEVICE(SEALEVEL, 740xC, pbn_exar_XR17V35x),
++ EXAR_DEVICE(SEALEVEL, 780xC, pbn_exar_XR17V35x),
++ EXAR_DEVICE(SEALEVEL, 716xC, pbn_exar_XR17V35x),
+ { 0, }
+ };
+ MODULE_DEVICE_TABLE(pci, exar_pci_tbl);
--- /dev/null
+From e8914b52e5b024e4af3d810a935fe0805eee8a36 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Tue, 3 Jan 2023 11:34:35 +0200
+Subject: serial: pch_uart: Pass correct sg to dma_unmap_sg()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit e8914b52e5b024e4af3d810a935fe0805eee8a36 upstream.
+
+A local variable sg is used to store scatterlist pointer in
+pch_dma_tx_complete(). The for loop doing Tx byte accounting before
+dma_unmap_sg() alters sg in its increment statement. Therefore, the
+pointer passed into dma_unmap_sg() won't match to the one given to
+dma_map_sg().
+
+To fix the problem, use priv->sg_tx_p directly in dma_unmap_sg()
+instead of the local variable.
+
+Fixes: da3564ee027e ("pch_uart: add multi-scatter processing")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20230103093435.4396-1-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/pch_uart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -752,7 +752,7 @@ static void pch_dma_tx_complete(void *ar
+ }
+ xmit->tail &= UART_XMIT_SIZE - 1;
+ async_tx_ack(priv->desc_tx);
+- dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE);
++ dma_unmap_sg(port->dev, priv->sg_tx_p, priv->orig_nent, DMA_TO_DEVICE);
+ priv->tx_dma_use = 0;
+ priv->nent = 0;
+ priv->orig_nent = 0;
thunderbolt-do-not-call-pm-runtime-functions-in-tb_retimer_scan.patch
riscv-dts-sifive-fu740-fix-size-of-pcie-32bit-memory.patch
bpf-restore-the-ebpf-program-id-for-bpf_audit_unload-and-perf_bpf_event_prog_unload.patch
+tty-serial-qcom-geni-serial-fix-slab-out-of-bounds-on-rx-fifo-buffer.patch
+tty-fix-possible-null-ptr-defer-in-spk_ttyio_release.patch
+pktcdvd-check-for-null-returna-fter-calling-bio_split_to_limits.patch
+io_uring-poll-don-t-reissue-in-case-of-poll-race-on-multishot-request.patch
+mptcp-explicitly-specify-sock-family-at-subflow-creation-time.patch
+mptcp-netlink-respect-v4-v6-only-sockets.patch
+selftests-mptcp-userspace-validate-v4-v6-subflows-mix.patch
+usb-gadgetfs-fix-race-between-mounting-and-unmounting.patch
+usb-serial-cp210x-add-scalance-lpe-9000-device-id.patch
+usb-cdns3-remove-fetched-trb-from-cache-before-dequeuing.patch
+usb-host-ehci-fsl-fix-module-alias.patch
+usb-musb-fix-error-return-code-in-omap2430_probe.patch
+usb-typec-tcpm-fix-altmode-re-registration-causes-sysfs-create-fail.patch
+usb-typec-altmodes-displayport-add-pin-assignment-helper.patch
+usb-typec-altmodes-displayport-fix-pin-assignment-calculation.patch
+usb-gadget-g_webcam-send-color-matching-descriptor-per-frame.patch
+usb-gadget-add-id-numbers-to-configfs-gadget-driver-names.patch
+usb-gadget-f_ncm-fix-potential-null-ptr-deref-in-ncm_bitrate.patch
+usb-storage-apply-ignore_uas-only-for-hiksemi-md202-on-rtl9210.patch
+arm64-dts-imx8mp-correct-usb-clocks.patch
+dt-bindings-phy-g12a-usb2-phy-fix-compatible-string-documentation.patch
+dt-bindings-phy-g12a-usb3-pcie-phy-fix-compatible-string-documentation.patch
+serial-pch_uart-pass-correct-sg-to-dma_unmap_sg.patch
+dmaengine-lgm-move-dt-parsing-after-initialization.patch
+dmaengine-tegra210-adma-fix-global-intr-clear.patch
+dmaengine-idxd-let-probe-fail-when-workqueue-cannot-be-enabled.patch
+dmaengine-idxd-prevent-use-after-free-on-completion-memory.patch
+dmaengine-idxd-do-not-call-dmx-tx-callbacks-during-workqueue-disable.patch
+serial-amba-pl011-fix-high-priority-character-transmission-in-rs486-mode.patch
+serial-atmel-fix-incorrect-baudrate-setup.patch
+serial-exar-add-support-for-sealevel-7xxxc-serial-cards.patch
+gsmi-fix-null-deref-in-gsmi_get_variable.patch
+mei-bus-fix-unlink-on-bus-in-error-path.patch
+mei-me-add-meteor-lake-point-m-did.patch
+vmci-use-threaded-irqs-instead-of-tasklets.patch
+arm-dts-qcom-apq8084-ifc6540-fix-overriding-sdhci.patch
+arm-omap1-fix-arch_omap1_any-link-failures.patch
+drm-amdgpu-fix-amdgpu_job_free_resources-v2.patch
+drm-amdgpu-allow-multipipe-policy-on-asics-with-one-mec.patch
+drm-amdgpu-correct-the-power-calcultion-for-renior-cezanne.patch
+drm-i915-re-disable-rc6p-on-sandy-bridge.patch
+drm-i915-display-check-source-height-is-0.patch
+drm-i915-allow-switching-away-via-vga-switcheroo-if-uninitialized.patch
+drm-amd-display-fix-set-scaling-doesn-s-work.patch
+drm-amd-display-calculate-output_color_space-after-pixel-encoding-adjustment.patch
+drm-amd-display-fix-color_space_ycbcr2020_type-matrix.patch
+drm-amd-display-disable-s-g-display-on-dcn-3.1.5.patch
+drm-amd-display-disable-s-g-display-on-dcn-3.1.4.patch
--- /dev/null
+From 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 Mon Sep 17 00:00:00 2001
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+Date: Fri, 2 Dec 2022 14:06:33 +0800
+Subject: tty: fix possible null-ptr-defer in spk_ttyio_release
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+commit 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 upstream.
+
+Run the following tests on the qemu platform:
+
+syzkaller:~# modprobe speakup_audptr
+ input: Speakup as /devices/virtual/input/input4
+ initialized device: /dev/synth, node (MAJOR 10, MINOR 125)
+ speakup 3.1.6: initialized
+ synth name on entry is: (null)
+ synth probe
+
+spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned
+failed (errno -16), then remove the module, we will get a null-ptr-defer
+problem, as follow:
+
+syzkaller:~# modprobe -r speakup_audptr
+ releasing synth audptr
+ BUG: kernel NULL pointer dereference, address: 0000000000000080
+ #PF: supervisor write access in kernel mode
+ #PF: error_code(0x0002) - not-present page
+ PGD 0 P4D 0
+ Oops: 0002 [#1] PREEMPT SMP PTI
+ CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1
+ RIP: 0010:mutex_lock+0x14/0x30
+ Call Trace:
+ <TASK>
+ spk_ttyio_release+0x19/0x70 [speakup]
+ synth_release.part.6+0xac/0xc0 [speakup]
+ synth_remove+0x56/0x60 [speakup]
+ __x64_sys_delete_module+0x156/0x250
+ ? fpregs_assert_state_consistent+0x1d/0x50
+ do_syscall_64+0x37/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+ </TASK>
+ Modules linked in: speakup_audptr(-) speakup
+ Dumping ftrace buffer:
+
+in_synth->dev was not initialized during modprobe, so we add check
+for in_synth->dev to fix this bug.
+
+Fixes: 4f2a81f3a882 ("speakup: Reference synth from tty and tty from synth")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Link: https://lore.kernel.org/r/20221202060633.217364-1-cuigaosheng1@huawei.com
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/accessibility/speakup/spk_ttyio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/accessibility/speakup/spk_ttyio.c
++++ b/drivers/accessibility/speakup/spk_ttyio.c
+@@ -354,6 +354,9 @@ void spk_ttyio_release(struct spk_synth
+ {
+ struct tty_struct *tty = in_synth->dev;
+
++ if (tty == NULL)
++ return;
++
+ tty_lock(tty);
+
+ if (tty->ops->close)
--- /dev/null
+From b8caf69a6946e18ffebad49847e258f5b6d52ac2 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Wed, 21 Dec 2022 17:40:22 +0100
+Subject: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit b8caf69a6946e18ffebad49847e258f5b6d52ac2 upstream.
+
+Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on
+default RX FIFO depth, e.g. 16. Later during serial startup the
+qcom_geni_serial_port_setup() updates the RX FIFO depth
+(port->rx_fifo_depth) to match real device capabilities, e.g. to 32.
+
+The RX UART handle code will read "port->rx_fifo_depth" number of words
+into "port->rx_fifo" buffer, thus exceeding the bounds. This can be
+observed in certain configurations with Qualcomm Bluetooth HCI UART
+device and KASAN:
+
+ Bluetooth: hci0: QCA Product ID :0x00000010
+ Bluetooth: hci0: QCA SOC Version :0x400a0200
+ Bluetooth: hci0: QCA ROM Version :0x00000200
+ Bluetooth: hci0: QCA Patch Version:0x00000d2b
+ Bluetooth: hci0: QCA controller version 0x02000200
+ Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv
+ bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2
+ Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)
+ Bluetooth: hci0: QCA Failed to download patch (-2)
+ ==================================================================
+ BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c
+ Write of size 4 at addr ffff279347d578c0 by task swapper/0/0
+
+ CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26
+ Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
+ Call trace:
+ dump_backtrace.part.0+0xe0/0xf0
+ show_stack+0x18/0x40
+ dump_stack_lvl+0x8c/0xb8
+ print_report+0x188/0x488
+ kasan_report+0xb4/0x100
+ __asan_store4+0x80/0xa4
+ handle_rx_uart+0xa8/0x18c
+ qcom_geni_serial_handle_rx+0x84/0x9c
+ qcom_geni_serial_isr+0x24c/0x760
+ __handle_irq_event_percpu+0x108/0x500
+ handle_irq_event+0x6c/0x110
+ handle_fasteoi_irq+0x138/0x2cc
+ generic_handle_domain_irq+0x48/0x64
+
+If the RX FIFO depth changes after probe, be sure to resize the buffer.
+
+Fixes: f9d690b6ece7 ("tty: serial: qcom_geni_serial: Allocate port->rx_fifo buffer in probe")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
+Link: https://lore.kernel.org/r/20221221164022.1087814-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -864,9 +864,10 @@ out_unlock:
+ return IRQ_HANDLED;
+ }
+
+-static void get_tx_fifo_size(struct qcom_geni_serial_port *port)
++static int setup_fifos(struct qcom_geni_serial_port *port)
+ {
+ struct uart_port *uport;
++ u32 old_rx_fifo_depth = port->rx_fifo_depth;
+
+ uport = &port->uport;
+ port->tx_fifo_depth = geni_se_get_tx_fifo_depth(&port->se);
+@@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom
+ port->rx_fifo_depth = geni_se_get_rx_fifo_depth(&port->se);
+ uport->fifosize =
+ (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE;
++
++ if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) {
++ port->rx_fifo = devm_krealloc(uport->dev, port->rx_fifo,
++ port->rx_fifo_depth * sizeof(u32),
++ GFP_KERNEL);
++ if (!port->rx_fifo)
++ return -ENOMEM;
++ }
++
++ return 0;
+ }
+
+
+@@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(s
+ u32 rxstale = DEFAULT_BITS_PER_CHAR * STALE_TIMEOUT;
+ u32 proto;
+ u32 pin_swap;
++ int ret;
+
+ proto = geni_se_read_proto(&port->se);
+ if (proto != GENI_SE_UART) {
+@@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(s
+
+ qcom_geni_serial_stop_rx(uport);
+
+- get_tx_fifo_size(port);
++ ret = setup_fifos(port);
++ if (ret)
++ return ret;
+
+ writel(rxstale, uport->membase + SE_UART_RX_STALE_CNT);
+
--- /dev/null
+From 1301c7b9f7efad2f11ef924e317c18ebd714fc9a Mon Sep 17 00:00:00 2001
+From: Pawel Laszczak <pawell@cadence.com>
+Date: Tue, 15 Nov 2022 05:00:39 -0500
+Subject: usb: cdns3: remove fetched trb from cache before dequeuing
+
+From: Pawel Laszczak <pawell@cadence.com>
+
+commit 1301c7b9f7efad2f11ef924e317c18ebd714fc9a upstream.
+
+After doorbell DMA fetches the TRB. If during dequeuing request
+driver changes NORMAL TRB to LINK TRB but doesn't delete it from
+controller cache then controller will handle cached TRB and packet
+can be lost.
+
+The example scenario for this issue looks like:
+1. queue request - set doorbell
+2. dequeue request
+3. send OUT data packet from host
+4. Device will accept this packet which is unexpected
+5. queue new request - set doorbell
+6. Device lost the expected packet.
+
+By setting DFLUSH controller clears DRDY bit and stop DMA transfer.
+
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+cc: <stable@vger.kernel.org>
+Signed-off-by: Pawel Laszczak <pawell@cadence.com>
+Acked-by: Peter Chen <peter.chen@kernel.org>
+Link: https://lore.kernel.org/r/20221115100039.441295-1-pawell@cadence.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -2614,6 +2614,7 @@ int cdns3_gadget_ep_dequeue(struct usb_e
+ u8 req_on_hw_ring = 0;
+ unsigned long flags;
+ int ret = 0;
++ int val;
+
+ if (!ep || !request || !ep->desc)
+ return -EINVAL;
+@@ -2649,6 +2650,13 @@ found:
+
+ /* Update ring only if removed request is on pending_req_list list */
+ if (req_on_hw_ring && link_trb) {
++ /* Stop DMA */
++ writel(EP_CMD_DFLUSH, &priv_dev->regs->ep_cmd);
++
++ /* wait for DFLUSH cleared */
++ readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val,
++ !(val & EP_CMD_DFLUSH), 1, 1000);
++
+ link_trb->buffer = cpu_to_le32(TRB_BUFFER(priv_ep->trb_pool_dma +
+ ((priv_req->end_trb + 1) * TRB_SIZE)));
+ link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) |
+@@ -2660,6 +2668,10 @@ found:
+
+ cdns3_gadget_giveback(priv_ep, priv_req, -ECONNRESET);
+
++ req = cdns3_next_request(&priv_ep->pending_req_list);
++ if (req)
++ cdns3_rearm_transfer(priv_ep, 1);
++
+ not_found:
+ spin_unlock_irqrestore(&priv_dev->lock, flags);
+ return ret;
--- /dev/null
+From 7c07553807c5125c89de242d35c10c206fd8e6bb Mon Sep 17 00:00:00 2001
+From: Chanh Nguyen <chanh@os.amperecomputing.com>
+Date: Wed, 11 Jan 2023 13:51:05 +0700
+Subject: USB: gadget: Add ID numbers to configfs-gadget driver names
+
+From: Chanh Nguyen <chanh@os.amperecomputing.com>
+
+commit 7c07553807c5125c89de242d35c10c206fd8e6bb upstream.
+
+It is unable to use configfs to attach more than one gadget. When
+attaching the second gadget, it always fails and the kernel message
+prints out:
+
+Error: Driver 'configfs-gadget' is already registered, aborting...
+UDC core: g1: driver registration failed: -16
+
+This commit fixes the problem by using the gadget name as a suffix
+to each configfs_gadget's driver name, thus making the names
+distinct.
+
+Fixes: fc274c1e9973 ("USB: gadget: Add a new bus for gadgets")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Chanh Nguyen <chanh@os.amperecomputing.com>
+Reviewed-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
+Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Frank Li <frank.li@nxp.com>
+Link: https://lore.kernel.org/r/20230111065105.29205-1-chanh@os.amperecomputing.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/configfs.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/gadget/configfs.c
++++ b/drivers/usb/gadget/configfs.c
+@@ -392,6 +392,7 @@ static void gadget_info_attr_release(str
+ WARN_ON(!list_empty(&gi->string_list));
+ WARN_ON(!list_empty(&gi->available_func));
+ kfree(gi->composite.gadget_driver.function);
++ kfree(gi->composite.gadget_driver.driver.name);
+ kfree(gi);
+ }
+
+@@ -1571,7 +1572,6 @@ static const struct usb_gadget_driver co
+ .max_speed = USB_SPEED_SUPER_PLUS,
+ .driver = {
+ .owner = THIS_MODULE,
+- .name = "configfs-gadget",
+ },
+ .match_existing_only = 1,
+ };
+@@ -1622,13 +1622,21 @@ static struct config_group *gadgets_make
+
+ gi->composite.gadget_driver = configfs_driver_template;
+
++ gi->composite.gadget_driver.driver.name = kasprintf(GFP_KERNEL,
++ "configfs-gadget.%s", name);
++ if (!gi->composite.gadget_driver.driver.name)
++ goto err;
++
+ gi->composite.gadget_driver.function = kstrdup(name, GFP_KERNEL);
+ gi->composite.name = gi->composite.gadget_driver.function;
+
+ if (!gi->composite.gadget_driver.function)
+- goto err;
++ goto out_free_driver_name;
+
+ return &gi->group;
++
++out_free_driver_name:
++ kfree(gi->composite.gadget_driver.driver.name);
+ err:
+ kfree(gi);
+ return ERR_PTR(-ENOMEM);
--- /dev/null
+From c6ec929595c7443250b2a4faea988c62019d5cd2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= <maze@google.com>
+Date: Tue, 17 Jan 2023 05:18:39 -0800
+Subject: usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Żenczykowski <maze@google.com>
+
+commit c6ec929595c7443250b2a4faea988c62019d5cd2 upstream.
+
+In Google internal bug 265639009 we've received an (as yet) unreproducible
+crash report from an aarch64 GKI 5.10.149-android13 running device.
+
+AFAICT the source code is at:
+ https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10
+
+The call stack is:
+ ncm_close() -> ncm_notify() -> ncm_do_notify()
+with the crash at:
+ ncm_do_notify+0x98/0x270
+Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)
+
+Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):
+
+ // halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)
+ 0B 0D 00 79 strh w11, [x8, #6]
+
+ // word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)
+ 6C 0A 00 B9 str w12, [x19, #8]
+
+ // x10 (NULL) was read here from offset 0 of valid pointer x9
+ // IMHO we're reading 'cdev->gadget' and getting NULL
+ // gadget is indeed at offset 0 of struct usb_composite_dev
+ 2A 01 40 F9 ldr x10, [x9]
+
+ // loading req->buf pointer, which is at offset 0 of struct usb_request
+ 69 02 40 F9 ldr x9, [x19]
+
+ // x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed
+ 4B 5D 40 B9 ldr w11, [x10, #0x5c]
+
+which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:
+
+ event->wLength = cpu_to_le16(8);
+ req->length = NCM_STATUS_BYTECOUNT;
+
+ /* SPEED_CHANGE data is up/down speeds in bits/sec */
+ data = req->buf + sizeof *event;
+ data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
+
+My analysis of registers and NULL ptr deref crash offset
+ (Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)
+heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing:
+ data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
+which calls:
+ ncm_bitrate(NULL)
+which then calls:
+ gadget_is_superspeed(NULL)
+which reads
+ ((struct usb_gadget *)NULL)->max_speed
+and hits a panic.
+
+AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C.
+(remember there's a GKI KABI reservation of 16 bytes in struct work_struct)
+
+It's not at all clear to me how this is all supposed to work...
+but returning 0 seems much better than panic-ing...
+
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Lorenzo Colitti <lorenzo@google.com>
+Cc: Carlos Llamas <cmllamas@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Maciej Żenczykowski <maze@google.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20230117131839.1138208-1-maze@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/function/f_ncm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -83,7 +83,9 @@ static inline struct f_ncm *func_to_ncm(
+ /* peak (theoretical) bulk transfer rate in bits-per-second */
+ static inline unsigned ncm_bitrate(struct usb_gadget *g)
+ {
+- if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
++ if (!g)
++ return 0;
++ else if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
+ return 4250000000U;
+ else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
+ return 3750000000U;
--- /dev/null
+From e95765e97d9cb93258a4840440d410fa6ff7e819 Mon Sep 17 00:00:00 2001
+From: Daniel Scally <dan.scally@ideasonboard.com>
+Date: Fri, 16 Dec 2022 16:05:28 +0000
+Subject: usb: gadget: g_webcam: Send color matching descriptor per frame
+
+From: Daniel Scally <dan.scally@ideasonboard.com>
+
+commit e95765e97d9cb93258a4840440d410fa6ff7e819 upstream.
+
+Currently the color matching descriptor is only sent across the wire
+a single time, following the descriptors for each format and frame.
+According to the UVC 1.5 Specification 3.9.2.6 ("Color Matching
+Descriptors"):
+
+"Only one instance is allowed for a given format and if present,
+the Color Matching descriptor shall be placed following the Video
+and Still Image Frame descriptors for that format".
+
+Add another reference to the color matching descriptor after the
+yuyv frames so that it's correctly transmitted for that format
+too.
+
+Fixes: a9914127e834 ("USB gadget: Webcam device")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Daniel Scally <dan.scally@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Link: https://lore.kernel.org/r/20221216160528.479094-1-dan.scally@ideasonboard.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/legacy/webcam.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/gadget/legacy/webcam.c
++++ b/drivers/usb/gadget/legacy/webcam.c
+@@ -293,6 +293,7 @@ static const struct uvc_descriptor_heade
+ (const struct uvc_descriptor_header *) &uvc_format_yuv,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
++ (const struct uvc_descriptor_header *) &uvc_color_matching,
+ (const struct uvc_descriptor_header *) &uvc_format_mjpg,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
+@@ -305,6 +306,7 @@ static const struct uvc_descriptor_heade
+ (const struct uvc_descriptor_header *) &uvc_format_yuv,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
++ (const struct uvc_descriptor_header *) &uvc_color_matching,
+ (const struct uvc_descriptor_header *) &uvc_format_mjpg,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
+@@ -317,6 +319,7 @@ static const struct uvc_descriptor_heade
+ (const struct uvc_descriptor_header *) &uvc_format_yuv,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p,
++ (const struct uvc_descriptor_header *) &uvc_color_matching,
+ (const struct uvc_descriptor_header *) &uvc_format_mjpg,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p,
+ (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
--- /dev/null
+From d18dcfe9860e842f394e37ba01ca9440ab2178f4 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Fri, 23 Dec 2022 09:59:09 -0500
+Subject: USB: gadgetfs: Fix race between mounting and unmounting
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 upstream.
+
+The syzbot fuzzer and Gerald Lee have identified a use-after-free bug
+in the gadgetfs driver, involving processes concurrently mounting and
+unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super()
+can race with gadgetfs_kill_sb(), causing the latter to deallocate
+the_device while the former is using it. The output from KASAN says,
+in part:
+
+BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline]
+BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]
+BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline]
+BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline]
+BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline]
+BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]
+BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086
+Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689
+
+CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
+Call Trace:
+ <TASK>
+...
+ atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline]
+ __refcount_sub_and_test include/linux/refcount.h:272 [inline]
+ __refcount_dec_and_test include/linux/refcount.h:315 [inline]
+ refcount_dec_and_test include/linux/refcount.h:333 [inline]
+ put_dev drivers/usb/gadget/legacy/inode.c:159 [inline]
+ gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086
+ deactivate_locked_super+0xa7/0xf0 fs/super.c:332
+ vfs_get_super fs/super.c:1190 [inline]
+ get_tree_single+0xd0/0x160 fs/super.c:1207
+ vfs_get_tree+0x88/0x270 fs/super.c:1531
+ vfs_fsconfig_locked fs/fsopen.c:232 [inline]
+
+The simplest solution is to ensure that gadgetfs_fill_super() and
+gadgetfs_kill_sb() are serialized by making them both acquire a new
+mutex.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-and-tested-by: syzbot+33d7ad66d65044b93f16@syzkaller.appspotmail.com
+Reported-and-tested-by: Gerald Lee <sundaywind2004@gmail.com>
+Link: https://lore.kernel.org/linux-usb/CAO3qeMVzXDP-JU6v1u5Ags6Q-bb35kg3=C6d04DjzA9ffa5x1g@mail.gmail.com/
+Fixes: e5d82a7360d1 ("vfs: Convert gadgetfs to use the new mount API")
+CC: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/Y6XCPXBpn3tmjdCC@rowland.harvard.edu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data
+ */
+
+ static const char *CHIP;
++static DEFINE_MUTEX(sb_mutex); /* Serialize superblock operations */
+
+ /*----------------------------------------------------------------------*/
+
+@@ -2010,13 +2011,20 @@ gadgetfs_fill_super (struct super_block
+ {
+ struct inode *inode;
+ struct dev_data *dev;
++ int rc;
+
+- if (the_device)
+- return -ESRCH;
++ mutex_lock(&sb_mutex);
++
++ if (the_device) {
++ rc = -ESRCH;
++ goto Done;
++ }
+
+ CHIP = usb_get_gadget_udc_name();
+- if (!CHIP)
+- return -ENODEV;
++ if (!CHIP) {
++ rc = -ENODEV;
++ goto Done;
++ }
+
+ /* superblock */
+ sb->s_blocksize = PAGE_SIZE;
+@@ -2053,13 +2061,17 @@ gadgetfs_fill_super (struct super_block
+ * from binding to a controller.
+ */
+ the_device = dev;
+- return 0;
++ rc = 0;
++ goto Done;
+
+-Enomem:
++ Enomem:
+ kfree(CHIP);
+ CHIP = NULL;
++ rc = -ENOMEM;
+
+- return -ENOMEM;
++ Done:
++ mutex_unlock(&sb_mutex);
++ return rc;
+ }
+
+ /* "mount -t gadgetfs path /dev/gadget" ends up here */
+@@ -2081,6 +2093,7 @@ static int gadgetfs_init_fs_context(stru
+ static void
+ gadgetfs_kill_sb (struct super_block *sb)
+ {
++ mutex_lock(&sb_mutex);
+ kill_litter_super (sb);
+ if (the_device) {
+ put_dev (the_device);
+@@ -2088,6 +2101,7 @@ gadgetfs_kill_sb (struct super_block *sb
+ }
+ kfree(CHIP);
+ CHIP = NULL;
++ mutex_unlock(&sb_mutex);
+ }
+
+ /*----------------------------------------------------------------------*/
--- /dev/null
+From 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Fri, 20 Jan 2023 13:27:14 +0100
+Subject: usb: host: ehci-fsl: Fix module alias
+
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+
+commit 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c upstream.
+
+Commit ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent
+driver module") changed DRV_NAME which was used for MODULE_ALIAS as well.
+Starting from this the module alias didn't match the platform device
+name created in fsl-mph-dr-of.c
+Change DRV_NAME to match the driver name for host mode in fsl-mph-dr-of.
+This is needed for module autoloading on ls1021a.
+
+Fixes: ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent driver module")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Link: https://lore.kernel.org/r/20230120122714.3848784-1-alexander.stein@ew.tq-group.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/ehci-fsl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/host/ehci-fsl.c
++++ b/drivers/usb/host/ehci-fsl.c
+@@ -29,7 +29,7 @@
+ #include "ehci-fsl.h"
+
+ #define DRIVER_DESC "Freescale EHCI Host controller driver"
+-#define DRV_NAME "ehci-fsl"
++#define DRV_NAME "fsl-ehci"
+
+ static struct hc_driver __read_mostly fsl_ehci_hc_driver;
+
--- /dev/null
+From bd449ad8cee9d4b523abbdfa73e1a2a08333f331 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 30 Dec 2022 16:17:30 +0800
+Subject: usb: musb: fix error return code in omap2430_probe()
+
+From: Yang Yingliang <yangyingliang@huawei.com>
+
+commit bd449ad8cee9d4b523abbdfa73e1a2a08333f331 upstream.
+
+Before calling platform_get_resource() in omap2430_probe(), the 'ret' is
+re-assgined to 0, it can't return an error code, if platform_get_resource
+fails. Set the error code to -EINVAL to fix this.
+
+Fixes: ffbe2feac59b ("usb: musb: omap2430: Fix probe regression for missing resources")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Link: https://lore.kernel.org/r/20221230081730.1655616-1-yangyingliang@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/omap2430.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index 476f55d1fec3..44a21ec865fb 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -411,8 +411,10 @@ static int omap2430_probe(struct platform_device *pdev)
+ memset(musb_res, 0, sizeof(*musb_res) * ARRAY_SIZE(musb_res));
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- if (!res)
++ if (!res) {
++ ret = -EINVAL;
+ goto err2;
++ }
+
+ musb_res[i].start = res->start;
+ musb_res[i].end = res->end;
+--
+2.39.1
+
--- /dev/null
+From 3f9e76e31704a325170e5aec2243c8d084d74854 Mon Sep 17 00:00:00 2001
+From: Michael Adler <michael.adler@siemens.com>
+Date: Tue, 3 Jan 2023 14:48:50 +0100
+Subject: USB: serial: cp210x: add SCALANCE LPE-9000 device id
+
+From: Michael Adler <michael.adler@siemens.com>
+
+commit 3f9e76e31704a325170e5aec2243c8d084d74854 upstream.
+
+Add the USB serial console device ID for Siemens SCALANCE LPE-9000
+which have a USB port for their serial console.
+
+Signed-off-by: Michael Adler <michael.adler@siemens.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/cp210x.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -60,6 +60,7 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
++ { USB_DEVICE(0x0908, 0x0070) }, /* Siemens SCALANCE LPE-9000 USB Serial Console */
+ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
+ { USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */
+ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
--- /dev/null
+From dbd24ec17b85b45f4e823d1aa5607721920f2b05 Mon Sep 17 00:00:00 2001
+From: Juhyung Park <qkrwngud825@gmail.com>
+Date: Tue, 17 Jan 2023 17:51:54 +0900
+Subject: usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
+
+From: Juhyung Park <qkrwngud825@gmail.com>
+
+commit dbd24ec17b85b45f4e823d1aa5607721920f2b05 upstream.
+
+The commit e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS")
+blacklists UAS for all of RTL9210 enclosures.
+
+The RTL9210 controller was advertised with UAS since its release back in
+2019 and was shipped with a lot of enclosure products with different
+firmware combinations.
+
+Blacklist UAS only for HIKSEMI MD202.
+
+This should hopefully be replaced with more robust method than just
+comparing strings. But with limited information [1] provided thus far
+(dmesg when the device is plugged in, which includes manufacturer and
+product, but no lsusb -v to compare against), this is the best we can do
+for now.
+
+[1] https://lore.kernel.org/all/20230109115550.71688-1-qkrwngud825@gmail.com
+
+Fixes: e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS")
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Hongling Zeng <zenghongling@kylinos.cn>
+Cc: stable@vger.kernel.org
+Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20230117085154.123301-1-qkrwngud825@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/storage/uas-detect.h | 13 +++++++++++++
+ drivers/usb/storage/unusual_uas.h | 7 -------
+ 2 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/usb/storage/uas-detect.h
++++ b/drivers/usb/storage/uas-detect.h
+@@ -116,6 +116,19 @@ static int uas_use_uas_driver(struct usb
+ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2)
+ flags |= US_FL_NO_ATA_1X;
+
++ /*
++ * RTL9210-based enclosure from HIKSEMI, MD202 reportedly have issues
++ * with UAS. This isn't distinguishable with just idVendor and
++ * idProduct, use manufacturer and product too.
++ *
++ * Reported-by: Hongling Zeng <zenghongling@kylinos.cn>
++ */
++ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bda &&
++ le16_to_cpu(udev->descriptor.idProduct) == 0x9210 &&
++ (udev->manufacturer && !strcmp(udev->manufacturer, "HIKSEMI")) &&
++ (udev->product && !strcmp(udev->product, "MD202")))
++ flags |= US_FL_IGNORE_UAS;
++
+ usb_stor_adjust_quirks(udev, &flags);
+
+ if (flags & US_FL_IGNORE_UAS) {
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -83,13 +83,6 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x99
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_LUNS),
+
+-/* Reported-by: Hongling Zeng <zenghongling@kylinos.cn> */
+-UNUSUAL_DEV(0x0bda, 0x9210, 0x0000, 0x9999,
+- "Hiksemi",
+- "External HDD",
+- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+- US_FL_IGNORE_UAS),
+-
+ /* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
+ UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
+ "Initio Corporation",
--- /dev/null
+From 582836e3cfab4faafbdc93bbec96fce036a08ee1 Mon Sep 17 00:00:00 2001
+From: Prashant Malani <pmalani@chromium.org>
+Date: Wed, 11 Jan 2023 02:05:41 +0000
+Subject: usb: typec: altmodes/displayport: Add pin assignment helper
+
+From: Prashant Malani <pmalani@chromium.org>
+
+commit 582836e3cfab4faafbdc93bbec96fce036a08ee1 upstream.
+
+The code to extract a peripheral's currently supported Pin Assignments
+is repeated in a couple of locations. Factor it out into a separate
+function.
+
+This will also make it easier to add fixes (we only need to update 1
+location instead of 2).
+
+Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles")
+Cc: stable@vger.kernel.org
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20230111020546.3384569-1-pmalani@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/altmodes/displayport.c | 22 ++++++++++++++--------
+ 1 file changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -419,6 +419,18 @@ static const char * const pin_assignment
+ [DP_PIN_ASSIGN_F] = "F",
+ };
+
++/*
++ * Helper function to extract a peripheral's currently supported
++ * Pin Assignments from its DisplayPort alternate mode state.
++ */
++static u8 get_current_pin_assignments(struct dp_altmode *dp)
++{
++ if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
++ return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
++ else
++ return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
++}
++
+ static ssize_t
+ pin_assignment_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t size)
+@@ -445,10 +457,7 @@ pin_assignment_store(struct device *dev,
+ goto out_unlock;
+ }
+
+- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
+- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
+- else
+- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
++ assignments = get_current_pin_assignments(dp);
+
+ if (!(DP_CONF_GET_PIN_ASSIGN(conf) & assignments)) {
+ ret = -EINVAL;
+@@ -485,10 +494,7 @@ static ssize_t pin_assignment_show(struc
+
+ cur = get_count_order(DP_CONF_GET_PIN_ASSIGN(dp->data.conf));
+
+- if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
+- assignments = DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
+- else
+- assignments = DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
++ assignments = get_current_pin_assignments(dp);
+
+ for (i = 0; assignments; assignments >>= 1, i++) {
+ if (assignments & 1) {
--- /dev/null
+From 9682b41e52cc9f42f5c33caf410464392adaef04 Mon Sep 17 00:00:00 2001
+From: Prashant Malani <pmalani@chromium.org>
+Date: Wed, 11 Jan 2023 02:05:42 +0000
+Subject: usb: typec: altmodes/displayport: Fix pin assignment calculation
+
+From: Prashant Malani <pmalani@chromium.org>
+
+commit 9682b41e52cc9f42f5c33caf410464392adaef04 upstream.
+
+Commit c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin
+assignment for UFP receptacles") fixed the pin assignment calculation
+to take into account whether the peripheral was a plug or a receptacle.
+
+But the "pin_assignments" sysfs logic was not updated. Address this by
+using the macros introduced in the aforementioned commit in the sysfs
+logic too.
+
+Fixes: c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles")
+Cc: stable@vger.kernel.org
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Reviewed-by: Benson Leung <bleung@chromium.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20230111020546.3384569-2-pmalani@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/altmodes/displayport.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/altmodes/displayport.c
++++ b/drivers/usb/typec/altmodes/displayport.c
+@@ -426,9 +426,9 @@ static const char * const pin_assignment
+ static u8 get_current_pin_assignments(struct dp_altmode *dp)
+ {
+ if (DP_CONF_CURRENTLY(dp->data.conf) == DP_CONF_DFP_D)
+- return DP_CAP_UFP_D_PIN_ASSIGN(dp->alt->vdo);
++ return DP_CAP_PIN_ASSIGN_DFP_D(dp->alt->vdo);
+ else
+- return DP_CAP_DFP_D_PIN_ASSIGN(dp->alt->vdo);
++ return DP_CAP_PIN_ASSIGN_UFP_D(dp->alt->vdo);
+ }
+
+ static ssize_t
--- /dev/null
+From 36f78477ac2c89e9a2eed4a31404a291a3450b5d Mon Sep 17 00:00:00 2001
+From: ChiYuan Huang <cy_huang@richtek.com>
+Date: Mon, 9 Jan 2023 15:19:50 +0800
+Subject: usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
+
+From: ChiYuan Huang <cy_huang@richtek.com>
+
+commit 36f78477ac2c89e9a2eed4a31404a291a3450b5d upstream.
+
+There's the altmode re-registeration issue after data role
+swap (DR_SWAP).
+
+Comparing to USBPD 2.0, in USBPD 3.0, it loose the limit that only DFP
+can initiate the VDM command to get partner identity information.
+
+For a USBPD 3.0 UFP device, it may already get the identity information
+from its port partner before DR_SWAP. If DR_SWAP send or receive at the
+mean time, 'send_discover' flag will be raised again. It causes discover
+identify action restart while entering ready state. And after all
+discover actions are done, the 'tcpm_register_altmodes' will be called.
+If old altmode is not unregistered, this sysfs create fail can be found.
+
+In 'DR_SWAP_CHANGE_DR' state case, only DFP will unregister altmodes.
+For UFP, the original altmodes keep registered.
+
+This patch fix the logic that after DR_SWAP, 'tcpm_unregister_altmodes'
+must be called whatever the current data role is.
+
+Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
+Fixes: ae8a2ca8a221 ("usb: typec: Group all TCPCI/TCPM code together")
+Reported-by: TommyYl Chen <tommyyl.chen@mediatek.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
+Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/1673248790-15794-1-git-send-email-cy_huang@richtek.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -4594,14 +4594,13 @@ static void run_state_machine(struct tcp
+ tcpm_set_state(port, ready_state(port), 0);
+ break;
+ case DR_SWAP_CHANGE_DR:
+- if (port->data_role == TYPEC_HOST) {
+- tcpm_unregister_altmodes(port);
++ tcpm_unregister_altmodes(port);
++ if (port->data_role == TYPEC_HOST)
+ tcpm_set_roles(port, true, port->pwr_role,
+ TYPEC_DEVICE);
+- } else {
++ else
+ tcpm_set_roles(port, true, port->pwr_role,
+ TYPEC_HOST);
+- }
+ tcpm_ams_finish(port);
+ tcpm_set_state(port, ready_state(port), 0);
+ break;
--- /dev/null
+From 3daed6345d5880464f46adab871d208e1baa2f3a Mon Sep 17 00:00:00 2001
+From: Vishnu Dasa <vdasa@vmware.com>
+Date: Tue, 29 Nov 2022 23:05:11 -0800
+Subject: VMCI: Use threaded irqs instead of tasklets
+
+From: Vishnu Dasa <vdasa@vmware.com>
+
+commit 3daed6345d5880464f46adab871d208e1baa2f3a upstream.
+
+The vmci_dispatch_dgs() tasklet function calls vmci_read_data()
+which uses wait_event() resulting in invalid sleep in an atomic
+context (and therefore potentially in a deadlock).
+
+Use threaded irqs to fix this issue and completely remove usage
+of tasklets.
+
+[ 20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145
+[ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd
+[ 20.264645] preempt_count: 101, expected: 0
+[ 20.264646] RCU nest depth: 0, expected: 0
+[ 20.264647] 1 lock held by vmtoolsd/762:
+[ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock]
+[ 20.264658] Preemption disabled at:
+[ 20.264659] [<ffff80000151d7d8>] vmci_send_datagram+0x44/0xa0 [vmw_vmci]
+[ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1
+[ 20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020
+[ 20.264668] Call trace:
+[ 20.264669] dump_backtrace+0xc4/0x130
+[ 20.264672] show_stack+0x24/0x80
+[ 20.264673] dump_stack_lvl+0x88/0xb4
+[ 20.264676] dump_stack+0x18/0x34
+[ 20.264677] __might_resched+0x1a0/0x280
+[ 20.264679] __might_sleep+0x58/0x90
+[ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci]
+[ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci]
+[ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150
+[ 20.264688] tasklet_action+0x40/0x50
+[ 20.264689] __do_softirq+0x23c/0x6b4
+[ 20.264690] __irq_exit_rcu+0x104/0x214
+[ 20.264691] irq_exit_rcu+0x1c/0x50
+[ 20.264693] el1_interrupt+0x38/0x6c
+[ 20.264695] el1h_64_irq_handler+0x18/0x24
+[ 20.264696] el1h_64_irq+0x68/0x6c
+[ 20.264697] preempt_count_sub+0xa4/0xe0
+[ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0
+[ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci]
+[ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci]
+[ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci]
+[ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport]
+[ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport]
+[ 20.264713] vsock_connect+0x278/0x330 [vsock]
+[ 20.264715] __sys_connect_file+0x8c/0xc0
+[ 20.264718] __sys_connect+0x84/0xb4
+[ 20.264720] __arm64_sys_connect+0x2c/0x3c
+[ 20.264721] invoke_syscall+0x78/0x100
+[ 20.264723] el0_svc_common.constprop.0+0x68/0x124
+[ 20.264724] do_el0_svc+0x38/0x4c
+[ 20.264725] el0_svc+0x60/0x180
+[ 20.264726] el0t_64_sync_handler+0x11c/0x150
+[ 20.264728] el0t_64_sync+0x190/0x194
+
+Signed-off-by: Vishnu Dasa <vdasa@vmware.com>
+Suggested-by: Zack Rusin <zackr@vmware.com>
+Reported-by: Nadav Amit <namit@vmware.com>
+Reported-by: Nathan Chancellor <nathan@kernel.org>
+Tested-by: Nathan Chancellor <nathan@kernel.org>
+Fixes: 463713eb6164 ("VMCI: dma dg: add support for DMA datagrams receive")
+Cc: <stable@vger.kernel.org> # v5.18+
+Cc: VMware PV-Drivers Reviewers <pv-drivers@vmware.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Bryan Tan <bryantan@vmware.com>
+Reviewed-by: Bryan Tan <bryantan@vmware.com>
+Reviewed-by: Zack Rusin <zackr@vmware.com>
+Link: https://lore.kernel.org/r/20221130070511.46558-1-vdasa@vmware.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/vmw_vmci/vmci_guest.c | 49 ++++++++++++------------------
+ 1 file changed, 19 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
+index aa7b05de97dd..4f8d962bb5b2 100644
+--- a/drivers/misc/vmw_vmci/vmci_guest.c
++++ b/drivers/misc/vmw_vmci/vmci_guest.c
+@@ -56,8 +56,6 @@ struct vmci_guest_device {
+
+ bool exclusive_vectors;
+
+- struct tasklet_struct datagram_tasklet;
+- struct tasklet_struct bm_tasklet;
+ struct wait_queue_head inout_wq;
+
+ void *data_buffer;
+@@ -304,9 +302,8 @@ static int vmci_check_host_caps(struct pci_dev *pdev)
+ * This function assumes that it has exclusive access to the data
+ * in register(s) for the duration of the call.
+ */
+-static void vmci_dispatch_dgs(unsigned long data)
++static void vmci_dispatch_dgs(struct vmci_guest_device *vmci_dev)
+ {
+- struct vmci_guest_device *vmci_dev = (struct vmci_guest_device *)data;
+ u8 *dg_in_buffer = vmci_dev->data_buffer;
+ struct vmci_datagram *dg;
+ size_t dg_in_buffer_size = VMCI_MAX_DG_SIZE;
+@@ -465,10 +462,8 @@ static void vmci_dispatch_dgs(unsigned long data)
+ * Scans the notification bitmap for raised flags, clears them
+ * and handles the notifications.
+ */
+-static void vmci_process_bitmap(unsigned long data)
++static void vmci_process_bitmap(struct vmci_guest_device *dev)
+ {
+- struct vmci_guest_device *dev = (struct vmci_guest_device *)data;
+-
+ if (!dev->notification_bitmap) {
+ dev_dbg(dev->dev, "No bitmap present in %s\n", __func__);
+ return;
+@@ -486,13 +481,13 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev)
+ struct vmci_guest_device *dev = _dev;
+
+ /*
+- * If we are using MSI-X with exclusive vectors then we simply schedule
+- * the datagram tasklet, since we know the interrupt was meant for us.
++ * If we are using MSI-X with exclusive vectors then we simply call
++ * vmci_dispatch_dgs(), since we know the interrupt was meant for us.
+ * Otherwise we must read the ICR to determine what to do.
+ */
+
+ if (dev->exclusive_vectors) {
+- tasklet_schedule(&dev->datagram_tasklet);
++ vmci_dispatch_dgs(dev);
+ } else {
+ unsigned int icr;
+
+@@ -502,12 +497,12 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev)
+ return IRQ_NONE;
+
+ if (icr & VMCI_ICR_DATAGRAM) {
+- tasklet_schedule(&dev->datagram_tasklet);
++ vmci_dispatch_dgs(dev);
+ icr &= ~VMCI_ICR_DATAGRAM;
+ }
+
+ if (icr & VMCI_ICR_NOTIFICATION) {
+- tasklet_schedule(&dev->bm_tasklet);
++ vmci_process_bitmap(dev);
+ icr &= ~VMCI_ICR_NOTIFICATION;
+ }
+
+@@ -536,7 +531,7 @@ static irqreturn_t vmci_interrupt_bm(int irq, void *_dev)
+ struct vmci_guest_device *dev = _dev;
+
+ /* For MSI-X we can just assume it was meant for us. */
+- tasklet_schedule(&dev->bm_tasklet);
++ vmci_process_bitmap(dev);
+
+ return IRQ_HANDLED;
+ }
+@@ -638,10 +633,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
+ vmci_dev->iobase = iobase;
+ vmci_dev->mmio_base = mmio_base;
+
+- tasklet_init(&vmci_dev->datagram_tasklet,
+- vmci_dispatch_dgs, (unsigned long)vmci_dev);
+- tasklet_init(&vmci_dev->bm_tasklet,
+- vmci_process_bitmap, (unsigned long)vmci_dev);
+ init_waitqueue_head(&vmci_dev->inout_wq);
+
+ if (mmio_base != NULL) {
+@@ -808,8 +799,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
+ * Request IRQ for legacy or MSI interrupts, or for first
+ * MSI-X vector.
+ */
+- error = request_irq(pci_irq_vector(pdev, 0), vmci_interrupt,
+- IRQF_SHARED, KBUILD_MODNAME, vmci_dev);
++ error = request_threaded_irq(pci_irq_vector(pdev, 0), NULL,
++ vmci_interrupt, IRQF_SHARED,
++ KBUILD_MODNAME, vmci_dev);
+ if (error) {
+ dev_err(&pdev->dev, "Irq %u in use: %d\n",
+ pci_irq_vector(pdev, 0), error);
+@@ -823,9 +815,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
+ * between the vectors.
+ */
+ if (vmci_dev->exclusive_vectors) {
+- error = request_irq(pci_irq_vector(pdev, 1),
+- vmci_interrupt_bm, 0, KBUILD_MODNAME,
+- vmci_dev);
++ error = request_threaded_irq(pci_irq_vector(pdev, 1), NULL,
++ vmci_interrupt_bm, 0,
++ KBUILD_MODNAME, vmci_dev);
+ if (error) {
+ dev_err(&pdev->dev,
+ "Failed to allocate irq %u: %d\n",
+@@ -833,9 +825,11 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
+ goto err_free_irq;
+ }
+ if (caps_in_use & VMCI_CAPS_DMA_DATAGRAM) {
+- error = request_irq(pci_irq_vector(pdev, 2),
+- vmci_interrupt_dma_datagram,
+- 0, KBUILD_MODNAME, vmci_dev);
++ error = request_threaded_irq(pci_irq_vector(pdev, 2),
++ NULL,
++ vmci_interrupt_dma_datagram,
++ 0, KBUILD_MODNAME,
++ vmci_dev);
+ if (error) {
+ dev_err(&pdev->dev,
+ "Failed to allocate irq %u: %d\n",
+@@ -871,8 +865,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
+
+ err_free_irq:
+ free_irq(pci_irq_vector(pdev, 0), vmci_dev);
+- tasklet_kill(&vmci_dev->datagram_tasklet);
+- tasklet_kill(&vmci_dev->bm_tasklet);
+
+ err_disable_msi:
+ pci_free_irq_vectors(pdev);
+@@ -943,9 +935,6 @@ static void vmci_guest_remove_device(struct pci_dev *pdev)
+ free_irq(pci_irq_vector(pdev, 0), vmci_dev);
+ pci_free_irq_vectors(pdev);
+
+- tasklet_kill(&vmci_dev->datagram_tasklet);
+- tasklet_kill(&vmci_dev->bm_tasklet);
+-
+ if (vmci_dev->notification_bitmap) {
+ /*
+ * The device reset above cleared the bitmap state of the
+--
+2.39.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
