--- /dev/null
+From ee4b1d5dc30f85c5aad0d30cadc62156bdacfbfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 08:05:10 +0100
+Subject: ARM: dts: exynos: Add GPU thermal zone cooling maps for Odroid
+ XU3/XU4/HC1
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 1c651356f482ff08f6acef197a362f2e71d55a98 ]
+
+Add trip points and cooling maps for GPU thermal zone for Odroid
+XU3/XU4/HC1 boards. Trip points are based on the CPU thermal zone for the
+those boards.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Stable-dep-of: 2e3d0e20d845 ("ARM: dts: exynos: correct TMU phandle in Odroid HC1")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroidhc1.dts | 30 ++++++++++
+ .../boot/dts/exynos5422-odroidxu3-common.dtsi | 59 +++++++++++++++++++
+ 2 files changed, 89 insertions(+)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+index fce5a4579693e..3235d7a27e042 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts
++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+@@ -215,6 +215,36 @@
+ };
+ };
+ };
++ gpu_thermal: gpu-thermal {
++ thermal-sensors = <&tmu_gpu 0>;
++ trips {
++ gpu_alert0: gpu-alert-0 {
++ temperature = <70000>;
++ hysteresis = <10000>;
++ type = "active";
++ };
++ gpu_alert1: gpu-alert-1 {
++ temperature = <85000>;
++ hysteresis = <10000>;
++ type = "active";
++ };
++ gpu_crit0: gpu-crit-0 {
++ temperature = <120000>;
++ hysteresis = <0>;
++ type = "critical";
++ };
++ };
++ cooling-maps {
++ map0 {
++ trip = <&gpu_alert0>;
++ cooling-device = <&gpu 0 2>;
++ };
++ map1 {
++ trip = <&gpu_alert1>;
++ cooling-device = <&gpu 3 6>;
++ };
++ };
++ };
+ };
+
+ };
+diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+index 8388720374932..5cf48af9884c9 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+@@ -357,6 +357,65 @@
+ };
+ };
+ };
++ gpu_thermal: gpu-thermal {
++ thermal-sensors = <&tmu_gpu 0>;
++ polling-delay-passive = <250>;
++ polling-delay = <0>;
++ trips {
++ gpu_alert0: gpu-alert-0 {
++ temperature = <50000>;
++ hysteresis = <5000>;
++ type = "active";
++ };
++ gpu_alert1: gpu-alert-1 {
++ temperature = <60000>;
++ hysteresis = <5000>;
++ type = "active";
++ };
++ gpu_alert2: gpu-alert-2 {
++ temperature = <70000>;
++ hysteresis = <5000>;
++ type = "active";
++ };
++ gpu_crit0: gpu-crit-0 {
++ temperature = <120000>;
++ hysteresis = <0>;
++ type = "critical";
++ };
++ gpu_alert3: gpu-alert-3 {
++ temperature = <70000>;
++ hysteresis = <10000>;
++ type = "passive";
++ };
++ gpu_alert4: gpu-alert-4 {
++ temperature = <85000>;
++ hysteresis = <10000>;
++ type = "passive";
++ };
++ };
++ cooling-maps {
++ map0 {
++ trip = <&gpu_alert0>;
++ cooling-device = <&fan0 0 1>;
++ };
++ map1 {
++ trip = <&gpu_alert1>;
++ cooling-device = <&fan0 1 2>;
++ };
++ map2 {
++ trip = <&gpu_alert2>;
++ cooling-device = <&fan0 2 3>;
++ };
++ map3 {
++ trip = <&gpu_alert3>;
++ cooling-device = <&gpu 0 2>;
++ };
++ map4 {
++ trip = <&gpu_alert4>;
++ cooling-device = <&gpu 3 6>;
++ };
++ };
++ };
+ };
+ };
+
+--
+2.39.2
+
--- /dev/null
+From dda521d9a0e34c1362fc51dca2de53c634d2f9fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 11:58:37 +0100
+Subject: ARM: dts: exynos: correct TMU phandle in Exynos4210
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 408ab6786dbf6dd696488054c9559681112ef994 ]
+
+TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
+it must not have an argument to phandle. Since thermal-sensors property is
+already defined in included exynos4-cpu-thermal.dtsi, drop it from
+exynos4210.dtsi to fix the error and remoev redundancy.
+
+Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230209105841.779596-2-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4210.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi
+index d341dcad8da6d..505b49118d2cf 100644
+--- a/arch/arm/boot/dts/exynos4210.dtsi
++++ b/arch/arm/boot/dts/exynos4210.dtsi
+@@ -389,7 +389,6 @@
+ &cpu_thermal {
+ polling-delay-passive = <0>;
+ polling-delay = <0>;
+- thermal-sensors = <&tmu 0>;
+ };
+
+ &gic {
+--
+2.39.2
+
--- /dev/null
+From 9cc944cbe9d2b6375898acea3f438298ffd47456 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 11:58:38 +0100
+Subject: ARM: dts: exynos: correct TMU phandle in Exynos5250
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 33e2c595e2e4016991ead44933a29d1ef93d5f26 ]
+
+TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
+it must not have an argument to phandle.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 9843a2236003 ("ARM: dts: Provide dt bindings identical for Exynos TMU")
+Link: https://lore.kernel.org/r/20230209105841.779596-3-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
+index 624fa234e7175..d5eccc86f5f78 100644
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -1122,7 +1122,7 @@
+ &cpu_thermal {
+ polling-delay-passive = <0>;
+ polling-delay = <0>;
+- thermal-sensors = <&tmu 0>;
++ thermal-sensors = <&tmu>;
+
+ cooling-maps {
+ map0 {
+--
+2.39.2
+
--- /dev/null
+From 0e21b33a5076396bbb70c3b0c2965d3c17569400 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 11:58:40 +0100
+Subject: ARM: dts: exynos: correct TMU phandle in Odroid HC1
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 2e3d0e20d8456f876607a8af61fdb83dfbf98cb6 ]
+
+TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
+it must not have an argument to phandle. This was not critical before,
+but since rework of thermal Devicetree initialization in the
+commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree
+initialization"), this leads to errors registering thermal zones other
+than first one:
+
+ thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2
+ thermal_sys: Failed to find thermal zone for tmu id=0
+ exynos-tmu 10064000.tmu: Failed to register sensor: -2
+ exynos-tmu: probe of 10064000.tmu failed with error -2
+
+Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230209105841.779596-5-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+index 3235d7a27e042..b423cea4c0e99 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts
++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts
+@@ -29,7 +29,7 @@
+
+ thermal-zones {
+ cpu0_thermal: cpu0-thermal {
+- thermal-sensors = <&tmu_cpu0 0>;
++ thermal-sensors = <&tmu_cpu0>;
+ trips {
+ cpu0_alert0: cpu-alert-0 {
+ temperature = <70000>; /* millicelsius */
+@@ -84,7 +84,7 @@
+ };
+ };
+ cpu1_thermal: cpu1-thermal {
+- thermal-sensors = <&tmu_cpu1 0>;
++ thermal-sensors = <&tmu_cpu1>;
+ trips {
+ cpu1_alert0: cpu-alert-0 {
+ temperature = <70000>;
+@@ -128,7 +128,7 @@
+ };
+ };
+ cpu2_thermal: cpu2-thermal {
+- thermal-sensors = <&tmu_cpu2 0>;
++ thermal-sensors = <&tmu_cpu2>;
+ trips {
+ cpu2_alert0: cpu-alert-0 {
+ temperature = <70000>;
+@@ -172,7 +172,7 @@
+ };
+ };
+ cpu3_thermal: cpu3-thermal {
+- thermal-sensors = <&tmu_cpu3 0>;
++ thermal-sensors = <&tmu_cpu3>;
+ trips {
+ cpu3_alert0: cpu-alert-0 {
+ temperature = <70000>;
+@@ -216,7 +216,7 @@
+ };
+ };
+ gpu_thermal: gpu-thermal {
+- thermal-sensors = <&tmu_gpu 0>;
++ thermal-sensors = <&tmu_gpu>;
+ trips {
+ gpu_alert0: gpu-alert-0 {
+ temperature = <70000>;
+--
+2.39.2
+
--- /dev/null
+From fe2530507d6df156cf4b5ac64c445890ed15d693 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Feb 2023 11:58:41 +0100
+Subject: ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit a3583e92d188ec6c58c7f603ac5e72dd8a11c21a ]
+
+TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing
+it must not have an argument to phandle. This was not critical before,
+but since rework of thermal Devicetree initialization in the
+commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree
+initialization"), this leads to errors registering thermal zones other
+than first one:
+
+ thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2
+ thermal_sys: Failed to find thermal zone for tmu id=0
+ exynos-tmu 10064000.tmu: Failed to register sensor: -2
+ exynos-tmu: probe of 10064000.tmu failed with error -2
+
+Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422")
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+index 5cf48af9884c9..56a0e1eba36fc 100644
+--- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi
+@@ -50,7 +50,7 @@
+
+ thermal-zones {
+ cpu0_thermal: cpu0-thermal {
+- thermal-sensors = <&tmu_cpu0 0>;
++ thermal-sensors = <&tmu_cpu0>;
+ polling-delay-passive = <250>;
+ polling-delay = <0>;
+ trips {
+@@ -139,7 +139,7 @@
+ };
+ };
+ cpu1_thermal: cpu1-thermal {
+- thermal-sensors = <&tmu_cpu1 0>;
++ thermal-sensors = <&tmu_cpu1>;
+ polling-delay-passive = <250>;
+ polling-delay = <0>;
+ trips {
+@@ -212,7 +212,7 @@
+ };
+ };
+ cpu2_thermal: cpu2-thermal {
+- thermal-sensors = <&tmu_cpu2 0>;
++ thermal-sensors = <&tmu_cpu2>;
+ polling-delay-passive = <250>;
+ polling-delay = <0>;
+ trips {
+@@ -285,7 +285,7 @@
+ };
+ };
+ cpu3_thermal: cpu3-thermal {
+- thermal-sensors = <&tmu_cpu3 0>;
++ thermal-sensors = <&tmu_cpu3>;
+ polling-delay-passive = <250>;
+ polling-delay = <0>;
+ trips {
+@@ -358,7 +358,7 @@
+ };
+ };
+ gpu_thermal: gpu-thermal {
+- thermal-sensors = <&tmu_gpu 0>;
++ thermal-sensors = <&tmu_gpu>;
+ polling-delay-passive = <250>;
+ polling-delay = <0>;
+ trips {
+--
+2.39.2
+
--- /dev/null
+From 4572182b40a2be85d99e32e7a5866202912dfd07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Aug 2020 15:51:43 +0200
+Subject: ARM: dts: exynos: Override thermal by label in Exynos4210
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 1708f56081e239a29ed8646aa7fde6853235d93f ]
+
+Using full paths to extend or override a device tree node is error prone
+since if there was a typo error, a new node will be created instead of
+extending the node as it was desired. This will lead to run-time errors
+that could be hard to detect.
+
+A mistyped label on the other hand, will cause a dtc compile error
+(during build time).
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200830135200.24304-16-krzk@kernel.org
+Stable-dep-of: 408ab6786dbf ("ARM: dts: exynos: correct TMU phandle in Exynos4210")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos4210.dtsi | 36 +++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi
+index f220716239dbf..d341dcad8da6d 100644
+--- a/arch/arm/boot/dts/exynos4210.dtsi
++++ b/arch/arm/boot/dts/exynos4210.dtsi
+@@ -372,26 +372,24 @@
+ };
+ };
+ };
++};
+
+- thermal-zones {
+- cpu_thermal: cpu-thermal {
+- polling-delay-passive = <0>;
+- polling-delay = <0>;
+- thermal-sensors = <&tmu 0>;
+-
+- trips {
+- cpu_alert0: cpu-alert-0 {
+- temperature = <85000>; /* millicelsius */
+- };
+- cpu_alert1: cpu-alert-1 {
+- temperature = <100000>; /* millicelsius */
+- };
+- cpu_alert2: cpu-alert-2 {
+- temperature = <110000>; /* millicelsius */
+- };
+- };
+- };
+- };
++&cpu_alert0 {
++ temperature = <85000>; /* millicelsius */
++};
++
++&cpu_alert1 {
++ temperature = <100000>; /* millicelsius */
++};
++
++&cpu_alert2 {
++ temperature = <110000>; /* millicelsius */
++};
++
++&cpu_thermal {
++ polling-delay-passive = <0>;
++ polling-delay = <0>;
++ thermal-sensors = <&tmu 0>;
+ };
+
+ &gic {
+--
+2.39.2
+
--- /dev/null
+From f5f62ff385b0977362ad4ef89affd9a38ed0a7f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Sep 2020 09:54:11 +0200
+Subject: ARM: dts: exynos: Override thermal by label in Exynos5250
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 7e86ef5cc89609cbad8b9dd2f476789c638dbb92 ]
+
+Using full paths to extend or override a device tree node is error prone
+since if there was a typo error, a new node will be created instead of
+extending the node as it was desired. This will lead to run-time errors
+that could be hard to detect.
+
+A mistyped label on the other hand, will cause a dtc compile error
+(during build time).
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Link: https://lore.kernel.org/r/20200901075417.22481-8-krzk@kernel.org
+Stable-dep-of: 33e2c595e2e4 ("ARM: dts: exynos: correct TMU phandle in Exynos5250")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5250.dtsi | 38 +++++++++++++++----------------
+ 1 file changed, 18 insertions(+), 20 deletions(-)
+
+diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
+index fc966c10cf498..624fa234e7175 100644
+--- a/arch/arm/boot/dts/exynos5250.dtsi
++++ b/arch/arm/boot/dts/exynos5250.dtsi
+@@ -1104,26 +1104,6 @@
+ };
+ };
+
+- thermal-zones {
+- cpu_thermal: cpu-thermal {
+- polling-delay-passive = <0>;
+- polling-delay = <0>;
+- thermal-sensors = <&tmu 0>;
+-
+- cooling-maps {
+- map0 {
+- /* Corresponds to 800MHz at freq_table */
+- cooling-device = <&cpu0 9 9>, <&cpu1 9 9>;
+- };
+- map1 {
+- /* Corresponds to 200MHz at freq_table */
+- cooling-device = <&cpu0 15 15>,
+- <&cpu1 15 15>;
+- };
+- };
+- };
+- };
+-
+ timer {
+ compatible = "arm,armv7-timer";
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+@@ -1139,6 +1119,24 @@
+ };
+ };
+
++&cpu_thermal {
++ polling-delay-passive = <0>;
++ polling-delay = <0>;
++ thermal-sensors = <&tmu 0>;
++
++ cooling-maps {
++ map0 {
++ /* Corresponds to 800MHz at freq_table */
++ cooling-device = <&cpu0 9 9>, <&cpu1 9 9>;
++ };
++ map1 {
++ /* Corresponds to 200MHz at freq_table */
++ cooling-device = <&cpu0 15 15>,
++ <&cpu1 15 15>;
++ };
++ };
++};
++
+ &dp {
+ power-domains = <&pd_disp1>;
+ clocks = <&clock CLK_DP>;
+--
+2.39.2
+
--- /dev/null
+From c83e31d83a97f44d1cff57d197d049e0be78df1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 18:43:57 -0800
+Subject: bnxt_en: Avoid order-5 memory allocation for TPA data
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit accd7e23693aaaa9aa0d3e9eca0ae77d1be80ab3 ]
+
+The driver needs to keep track of all the possible concurrent TPA (GRO/LRO)
+completions on the aggregation ring. On P5 chips, the maximum number
+of concurrent TPA is 256 and the amount of memory we allocate is order-5
+on systems using 4K pages. Memory allocation failure has been reported:
+
+NetworkManager: page allocation failure: order:5, mode:0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1
+CPU: 15 PID: 2995 Comm: NetworkManager Kdump: loaded Not tainted 5.10.156 #1
+Hardware name: Dell Inc. PowerEdge R660/0M1CC5, BIOS 0.2.25 08/12/2022
+Call Trace:
+ dump_stack+0x57/0x6e
+ warn_alloc.cold.120+0x7b/0xdd
+ ? _cond_resched+0x15/0x30
+ ? __alloc_pages_direct_compact+0x15f/0x170
+ __alloc_pages_slowpath.constprop.108+0xc58/0xc70
+ __alloc_pages_nodemask+0x2d0/0x300
+ kmalloc_order+0x24/0xe0
+ kmalloc_order_trace+0x19/0x80
+ bnxt_alloc_mem+0x1150/0x15c0 [bnxt_en]
+ ? bnxt_get_func_stat_ctxs+0x13/0x60 [bnxt_en]
+ __bnxt_open_nic+0x12e/0x780 [bnxt_en]
+ bnxt_open+0x10b/0x240 [bnxt_en]
+ __dev_open+0xe9/0x180
+ __dev_change_flags+0x1af/0x220
+ dev_change_flags+0x21/0x60
+ do_setlink+0x35c/0x1100
+
+Instead of allocating this big chunk of memory and dividing it up for the
+concurrent TPA instances, allocate each small chunk separately for each
+TPA instance. This will reduce it to order-0 allocations.
+
+Fixes: 79632e9ba386 ("bnxt_en: Expand bnxt_tpa_info struct to support 57500 chips.")
+Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
+Reviewed-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
+Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index ef8225b7445d3..9fb1da36e9eb8 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -2747,7 +2747,7 @@ static int bnxt_alloc_ring(struct bnxt *bp, struct bnxt_ring_mem_info *rmem)
+
+ static void bnxt_free_tpa_info(struct bnxt *bp)
+ {
+- int i;
++ int i, j;
+
+ for (i = 0; i < bp->rx_nr_rings; i++) {
+ struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];
+@@ -2755,8 +2755,10 @@ static void bnxt_free_tpa_info(struct bnxt *bp)
+ kfree(rxr->rx_tpa_idx_map);
+ rxr->rx_tpa_idx_map = NULL;
+ if (rxr->rx_tpa) {
+- kfree(rxr->rx_tpa[0].agg_arr);
+- rxr->rx_tpa[0].agg_arr = NULL;
++ for (j = 0; j < bp->max_tpa; j++) {
++ kfree(rxr->rx_tpa[j].agg_arr);
++ rxr->rx_tpa[j].agg_arr = NULL;
++ }
+ }
+ kfree(rxr->rx_tpa);
+ rxr->rx_tpa = NULL;
+@@ -2765,14 +2767,13 @@ static void bnxt_free_tpa_info(struct bnxt *bp)
+
+ static int bnxt_alloc_tpa_info(struct bnxt *bp)
+ {
+- int i, j, total_aggs = 0;
++ int i, j;
+
+ bp->max_tpa = MAX_TPA;
+ if (bp->flags & BNXT_FLAG_CHIP_P5) {
+ if (!bp->max_tpa_v2)
+ return 0;
+ bp->max_tpa = max_t(u16, bp->max_tpa_v2, MAX_TPA_P5);
+- total_aggs = bp->max_tpa * MAX_SKB_FRAGS;
+ }
+
+ for (i = 0; i < bp->rx_nr_rings; i++) {
+@@ -2786,12 +2787,12 @@ static int bnxt_alloc_tpa_info(struct bnxt *bp)
+
+ if (!(bp->flags & BNXT_FLAG_CHIP_P5))
+ continue;
+- agg = kcalloc(total_aggs, sizeof(*agg), GFP_KERNEL);
+- rxr->rx_tpa[0].agg_arr = agg;
+- if (!agg)
+- return -ENOMEM;
+- for (j = 1; j < bp->max_tpa; j++)
+- rxr->rx_tpa[j].agg_arr = agg + j * MAX_SKB_FRAGS;
++ for (j = 0; j < bp->max_tpa; j++) {
++ agg = kcalloc(MAX_SKB_FRAGS, sizeof(*agg), GFP_KERNEL);
++ if (!agg)
++ return -ENOMEM;
++ rxr->rx_tpa[j].agg_arr = agg;
++ }
+ rxr->rx_tpa_idx_map = kzalloc(sizeof(*rxr->rx_tpa_idx_map),
+ GFP_KERNEL);
+ if (!rxr->rx_tpa_idx_map)
+--
+2.39.2
+
--- /dev/null
+From 6f2a5556308d2c3241de2fda7133c263435e3f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 11:21:37 +0000
+Subject: btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
+
+From: Lorenz Bauer <lorenz.bauer@isovalent.com>
+
+[ Upstream commit 9b459804ff9973e173fabafba2a1319f771e85fa ]
+
+btf_datasec_resolve contains a bug that causes the following BTF
+to fail loading:
+
+ [1] DATASEC a size=2 vlen=2
+ type_id=4 offset=0 size=1
+ type_id=7 offset=1 size=1
+ [2] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none)
+ [3] PTR (anon) type_id=2
+ [4] VAR a type_id=3 linkage=0
+ [5] INT (anon) size=1 bits_offset=0 nr_bits=8 encoding=(none)
+ [6] TYPEDEF td type_id=5
+ [7] VAR b type_id=6 linkage=0
+
+This error message is printed during btf_check_all_types:
+
+ [1] DATASEC a size=2 vlen=2
+ type_id=7 offset=1 size=1 Invalid type
+
+By tracing btf_*_resolve we can pinpoint the problem:
+
+ btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_TBD) = 0
+ btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_TBD) = 0
+ btf_ptr_resolve(depth: 3, type_id: 3, mode: RESOLVE_PTR) = 0
+ btf_var_resolve(depth: 2, type_id: 4, mode: RESOLVE_PTR) = 0
+ btf_datasec_resolve(depth: 1, type_id: 1, mode: RESOLVE_PTR) = -22
+
+The last invocation of btf_datasec_resolve should invoke btf_var_resolve
+by means of env_stack_push, instead it returns EINVAL. The reason is that
+env_stack_push is never executed for the second VAR.
+
+ if (!env_type_is_resolve_sink(env, var_type) &&
+ !env_type_is_resolved(env, var_type_id)) {
+ env_stack_set_next_member(env, i + 1);
+ return env_stack_push(env, var_type, var_type_id);
+ }
+
+env_type_is_resolve_sink() changes its behaviour based on resolve_mode.
+For RESOLVE_PTR, we can simplify the if condition to the following:
+
+ (btf_type_is_modifier() || btf_type_is_ptr) && !env_type_is_resolved()
+
+Since we're dealing with a VAR the clause evaluates to false. This is
+not sufficient to trigger the bug however. The log output and EINVAL
+are only generated if btf_type_id_size() fails.
+
+ if (!btf_type_id_size(btf, &type_id, &type_size)) {
+ btf_verifier_log_vsi(env, v->t, vsi, "Invalid type");
+ return -EINVAL;
+ }
+
+Most types are sized, so for example a VAR referring to an INT is not a
+problem. The bug is only triggered if a VAR points at a modifier. Since
+we skipped btf_var_resolve that modifier was also never resolved, which
+means that btf_resolved_type_id returns 0 aka VOID for the modifier.
+This in turn causes btf_type_id_size to return NULL, triggering EINVAL.
+
+To summarise, the following conditions are necessary:
+
+- VAR pointing at PTR, STRUCT, UNION or ARRAY
+- Followed by a VAR pointing at TYPEDEF, VOLATILE, CONST, RESTRICT or
+ TYPE_TAG
+
+The fix is to reset resolve_mode to RESOLVE_TBD before attempting to
+resolve a VAR from a DATASEC.
+
+Fixes: 1dc92851849c ("bpf: kernel side support for BTF Var and DataSec")
+Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
+Link: https://lore.kernel.org/r/20230306112138.155352-2-lmb@isovalent.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index 8fd65a0eb7f3e..5189bc5ebd895 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -2719,6 +2719,7 @@ static int btf_datasec_resolve(struct btf_verifier_env *env,
+ struct btf *btf = env->btf;
+ u16 i;
+
++ env->resolve_mode = RESOLVE_TBD;
+ for_each_vsi_from(i, v->next_member, v->t, vsi) {
+ u32 var_type_id = vsi->type, type_id, type_size = 0;
+ const struct btf_type *var_type = btf_type_by_id(env->btf,
+--
+2.39.2
+
--- /dev/null
+From b4b58b11649d72a227b7cf4eb191132028693f52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Jan 2023 12:37:58 +0100
+Subject: cifs: Fix uninitialized memory read in smb3_qfs_tcon()
+
+From: Volker Lendecke <vl@samba.org>
+
+[ Upstream commit d447e794a37288ec7a080aa1b044a8d9deebbab7 ]
+
+oparms was not fully initialized
+
+Signed-off-by: Volker Lendecke <vl@samba.org>
+Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index a3bb2c7468c75..4cb0ebe7330eb 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -823,12 +823,13 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon,
+ struct cifs_fid fid;
+ bool no_cached_open = tcon->nohandlecache;
+
+- oparms.tcon = tcon;
+- oparms.desired_access = FILE_READ_ATTRIBUTES;
+- oparms.disposition = FILE_OPEN;
+- oparms.create_options = cifs_create_options(cifs_sb, 0);
+- oparms.fid = &fid;
+- oparms.reconnect = false;
++ oparms = (struct cifs_open_parms) {
++ .tcon = tcon,
++ .desired_access = FILE_READ_ATTRIBUTES,
++ .disposition = FILE_OPEN,
++ .create_options = cifs_create_options(cifs_sb, 0),
++ .fid = &fid,
++ };
+
+ if (no_cached_open)
+ rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL,
+--
+2.39.2
+
--- /dev/null
+From 66bafaa0a6491d056b102bf4dad574203995755f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 18:18:31 +0800
+Subject: drm/edid: Add aspect ratios to HDMI 4K modes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+[ Upstream commit d2b434730f301a7ad74473eb66422f0008186306 ]
+
+[Why]
+HDMI 2.0 adds aspect ratio attribute to distinguish different
+4k modes. According to Appendix E of HDMI 2.0 spec, source should
+use VSIF to indicate video mode only when the mode is one defined
+in HDMI 1.4b 4K modes. Otherwise, use AVI infoframes to convey VIC.
+
+Current code doesn't take aspect ratio into consideration while
+constructing avi infoframe. Should modify that.
+
+[How]
+Inherit Ville Syrjälä's work
+"drm/edid: Prep for HDMI VIC aspect ratio" at
+https://patchwork.kernel.org/patch/11174639/
+
+Add picture_aspect_ratio attributes to edid_4k_modes[] and
+construct VIC and HDMI_VIC by taking aspect ratio into
+consideration.
+
+v2: Correct missing initializer error at adding aspect ratio of
+SMPTE mode.
+
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191118101832.15487-1-Wayne.Lin@amd.com
+Stable-dep-of: 1cbc1f0d324b ("drm/edid: fix AVI infoframe aspect ratio handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 45 +++++++++++++++++++++++++++++---------
+ 1 file changed, 35 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 245e495f57c93..f9735861741c1 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -1292,25 +1292,25 @@ static const struct drm_display_mode edid_4k_modes[] = {
+ 3840, 4016, 4104, 4400, 0,
+ 2160, 2168, 2178, 2250, 0,
+ DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC),
+- .vrefresh = 30, },
++ .vrefresh = 30, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, },
+ /* 2 - 3840x2160@25Hz */
+ { DRM_MODE("3840x2160", DRM_MODE_TYPE_DRIVER, 297000,
+ 3840, 4896, 4984, 5280, 0,
+ 2160, 2168, 2178, 2250, 0,
+ DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC),
+- .vrefresh = 25, },
++ .vrefresh = 25, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, },
+ /* 3 - 3840x2160@24Hz */
+ { DRM_MODE("3840x2160", DRM_MODE_TYPE_DRIVER, 297000,
+ 3840, 5116, 5204, 5500, 0,
+ 2160, 2168, 2178, 2250, 0,
+ DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC),
+- .vrefresh = 24, },
++ .vrefresh = 24, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_16_9, },
+ /* 4 - 4096x2160@24Hz (SMPTE) */
+ { DRM_MODE("4096x2160", DRM_MODE_TYPE_DRIVER, 297000,
+ 4096, 5116, 5204, 5500, 0,
+ 2160, 2168, 2178, 2250, 0,
+ DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC),
+- .vrefresh = 24, },
++ .vrefresh = 24, .picture_aspect_ratio = HDMI_PICTURE_ASPECT_256_135, },
+ };
+
+ /*** DDC fetch and block validation ***/
+@@ -3122,6 +3122,11 @@ enum hdmi_picture_aspect drm_get_cea_aspect_ratio(const u8 video_code)
+ }
+ EXPORT_SYMBOL(drm_get_cea_aspect_ratio);
+
++static enum hdmi_picture_aspect drm_get_hdmi_aspect_ratio(const u8 video_code)
++{
++ return edid_4k_modes[video_code].picture_aspect_ratio;
++}
++
+ /*
+ * Calculate the alternate clock for HDMI modes (those from the HDMI vendor
+ * specific block).
+@@ -3148,6 +3153,9 @@ static u8 drm_match_hdmi_mode_clock_tolerance(const struct drm_display_mode *to_
+ if (!to_match->clock)
+ return 0;
+
++ if (to_match->picture_aspect_ratio)
++ match_flags |= DRM_MODE_MATCH_ASPECT_RATIO;
++
+ for (vic = 1; vic < ARRAY_SIZE(edid_4k_modes); vic++) {
+ const struct drm_display_mode *hdmi_mode = &edid_4k_modes[vic];
+ unsigned int clock1, clock2;
+@@ -3183,6 +3191,9 @@ static u8 drm_match_hdmi_mode(const struct drm_display_mode *to_match)
+ if (!to_match->clock)
+ return 0;
+
++ if (to_match->picture_aspect_ratio)
++ match_flags |= DRM_MODE_MATCH_ASPECT_RATIO;
++
+ for (vic = 1; vic < ARRAY_SIZE(edid_4k_modes); vic++) {
+ const struct drm_display_mode *hdmi_mode = &edid_4k_modes[vic];
+ unsigned int clock1, clock2;
+@@ -5123,6 +5134,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame,
+ const struct drm_display_mode *mode)
+ {
+ enum hdmi_picture_aspect picture_aspect;
++ u8 vic, hdmi_vic;
+ int err;
+
+ if (!frame || !mode)
+@@ -5135,7 +5147,8 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame,
+ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ frame->pixel_repeat = 1;
+
+- frame->video_code = drm_mode_cea_vic(connector, mode);
++ vic = drm_mode_cea_vic(connector, mode);
++ hdmi_vic = drm_mode_hdmi_vic(connector, mode);
+
+ frame->picture_aspect = HDMI_PICTURE_ASPECT_NONE;
+
+@@ -5149,11 +5162,15 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame,
+
+ /*
+ * Populate picture aspect ratio from either
+- * user input (if specified) or from the CEA mode list.
++ * user input (if specified) or from the CEA/HDMI mode lists.
+ */
+ picture_aspect = mode->picture_aspect_ratio;
+- if (picture_aspect == HDMI_PICTURE_ASPECT_NONE)
+- picture_aspect = drm_get_cea_aspect_ratio(frame->video_code);
++ if (picture_aspect == HDMI_PICTURE_ASPECT_NONE) {
++ if (vic)
++ picture_aspect = drm_get_cea_aspect_ratio(vic);
++ else if (hdmi_vic)
++ picture_aspect = drm_get_hdmi_aspect_ratio(hdmi_vic);
++ }
+
+ /*
+ * The infoframe can't convey anything but none, 4:3
+@@ -5161,12 +5178,20 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame,
+ * we can only satisfy it by specifying the right VIC.
+ */
+ if (picture_aspect > HDMI_PICTURE_ASPECT_16_9) {
+- if (picture_aspect !=
+- drm_get_cea_aspect_ratio(frame->video_code))
++ if (vic) {
++ if (picture_aspect != drm_get_cea_aspect_ratio(vic))
++ return -EINVAL;
++ } else if (hdmi_vic) {
++ if (picture_aspect != drm_get_hdmi_aspect_ratio(hdmi_vic))
++ return -EINVAL;
++ } else {
+ return -EINVAL;
++ }
++
+ picture_aspect = HDMI_PICTURE_ASPECT_NONE;
+ }
+
++ frame->video_code = vic;
+ frame->picture_aspect = picture_aspect;
+ frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE;
+ frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN;
+--
+2.39.2
+
--- /dev/null
+From ee13bd559ce240afa08ec469a70dd0587cc39f1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 17:19:12 +0300
+Subject: drm/edid: Extract drm_mode_cea_vic()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit cfd6f8c3a94a96c003a8929b66d6d54181b9420d ]
+
+Extract the logic to compute the final CEA VIC to a small helper.
+We'll reorder it a bit to make future modifications more
+straightforward. No function changes.
+
+Cc: Wayne Lin <waynelin@amd.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191004141914.20600-2-ville.syrjala@linux.intel.com
+Reviewed-by: Uma Shankar <uma.shankar@intel.com>
+Stable-dep-of: 1cbc1f0d324b ("drm/edid: fix AVI infoframe aspect ratio handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 53 +++++++++++++++++++++-----------------
+ 1 file changed, 30 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 2dc6dd6230d76..10eb78b9347e1 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -5065,6 +5065,35 @@ drm_hdmi_infoframe_set_hdr_metadata(struct hdmi_drm_infoframe *frame,
+ }
+ EXPORT_SYMBOL(drm_hdmi_infoframe_set_hdr_metadata);
+
++static u8 drm_mode_cea_vic(struct drm_connector *connector,
++ const struct drm_display_mode *mode)
++{
++ u8 vendor_if_vic = drm_match_hdmi_mode(mode);
++ bool is_s3d = mode->flags & DRM_MODE_FLAG_3D_MASK;
++ u8 vic;
++
++ /*
++ * HDMI spec says if a mode is found in HDMI 1.4b 4K modes
++ * we should send its VIC in vendor infoframes, else send the
++ * VIC in AVI infoframes. Lets check if this mode is present in
++ * HDMI 1.4b 4K modes
++ */
++ if (drm_valid_hdmi_vic(vendor_if_vic) && !is_s3d)
++ return 0;
++
++ vic = drm_match_cea_mode(mode);
++
++ /*
++ * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but
++ * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we
++ * have to make sure we dont break HDMI 1.4 sinks.
++ */
++ if (!is_hdmi2_sink(connector) && vic > 64)
++ return 0;
++
++ return vic;
++}
++
+ /**
+ * drm_hdmi_avi_infoframe_from_display_mode() - fill an HDMI AVI infoframe with
+ * data from a DRM display mode
+@@ -5092,29 +5121,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame,
+ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ frame->pixel_repeat = 1;
+
+- frame->video_code = drm_match_cea_mode(mode);
+-
+- /*
+- * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but
+- * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we
+- * have to make sure we dont break HDMI 1.4 sinks.
+- */
+- if (!is_hdmi2_sink(connector) && frame->video_code > 64)
+- frame->video_code = 0;
+-
+- /*
+- * HDMI spec says if a mode is found in HDMI 1.4b 4K modes
+- * we should send its VIC in vendor infoframes, else send the
+- * VIC in AVI infoframes. Lets check if this mode is present in
+- * HDMI 1.4b 4K modes
+- */
+- if (frame->video_code) {
+- u8 vendor_if_vic = drm_match_hdmi_mode(mode);
+- bool is_s3d = mode->flags & DRM_MODE_FLAG_3D_MASK;
+-
+- if (drm_valid_hdmi_vic(vendor_if_vic) && !is_s3d)
+- frame->video_code = 0;
+- }
++ frame->video_code = drm_mode_cea_vic(connector, mode);
+
+ frame->picture_aspect = HDMI_PICTURE_ASPECT_NONE;
+
+--
+2.39.2
+
--- /dev/null
+From 0b862dc6ccc7dfe316c77eea18fad34f9ddda600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jan 2023 12:05:16 +0200
+Subject: drm/edid: fix AVI infoframe aspect ratio handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit 1cbc1f0d324ba6c4d1b10ac6362b5e0b029f63d5 ]
+
+We try to avoid sending VICs defined in the later specs in AVI
+infoframes to sinks that conform to the earlier specs, to not upset
+them, and use 0 for the VIC instead. However, we do this detection and
+conversion to 0 too early, as we'll need the actual VIC to figure out
+the aspect ratio.
+
+In particular, for a mode with 64:27 aspect ratio, 0 for VIC fails the
+AVI infoframe generation altogether with -EINVAL.
+
+Separate the VIC lookup from the "filtering", and postpone the
+filtering, to use the proper VIC for aspect ratio handling, and the 0
+VIC for the infoframe video code as needed.
+
+Reported-by: William Tseng <william.tseng@intel.com>
+Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6153
+References: https://lore.kernel.org/r/20220920062316.43162-1-william.tseng@intel.com
+Cc: <stable@vger.kernel.org>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/c3e78cc6d01ed237f71ad0038826b08d83d75eef.1672826282.git.jani.nikula@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 21 ++++++++++++---------
+ 1 file changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index f9735861741c1..2e73042e5d070 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -5095,8 +5095,6 @@ static u8 drm_mode_hdmi_vic(struct drm_connector *connector,
+ static u8 drm_mode_cea_vic(struct drm_connector *connector,
+ const struct drm_display_mode *mode)
+ {
+- u8 vic;
+-
+ /*
+ * HDMI spec says if a mode is found in HDMI 1.4b 4K modes
+ * we should send its VIC in vendor infoframes, else send the
+@@ -5106,13 +5104,18 @@ static u8 drm_mode_cea_vic(struct drm_connector *connector,
+ if (drm_mode_hdmi_vic(connector, mode))
+ return 0;
+
+- vic = drm_match_cea_mode(mode);
++ return drm_match_cea_mode(mode);
++}
+
+- /*
+- * HDMI 1.4 VIC range: 1 <= VIC <= 64 (CEA-861-D) but
+- * HDMI 2.0 VIC range: 1 <= VIC <= 107 (CEA-861-F). So we
+- * have to make sure we dont break HDMI 1.4 sinks.
+- */
++/*
++ * Avoid sending VICs defined in HDMI 2.0 in AVI infoframes to sinks that
++ * conform to HDMI 1.4.
++ *
++ * HDMI 1.4 (CTA-861-D) VIC range: [1..64]
++ * HDMI 2.0 (CTA-861-F) VIC range: [1..107]
++ */
++static u8 vic_for_avi_infoframe(const struct drm_connector *connector, u8 vic)
++{
+ if (!is_hdmi2_sink(connector) && vic > 64)
+ return 0;
+
+@@ -5191,7 +5194,7 @@ drm_hdmi_avi_infoframe_from_display_mode(struct hdmi_avi_infoframe *frame,
+ picture_aspect = HDMI_PICTURE_ASPECT_NONE;
+ }
+
+- frame->video_code = vic;
++ frame->video_code = vic_for_avi_infoframe(connector, vic);
+ frame->picture_aspect = picture_aspect;
+ frame->active_aspect = HDMI_ACTIVE_ASPECT_PICTURE;
+ frame->scan_mode = HDMI_SCAN_MODE_UNDERSCAN;
+--
+2.39.2
+
--- /dev/null
+From 099c0f75cc95cf4026dfa0b9087c949040171324 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 17:19:13 +0300
+Subject: drm/edid: Fix HDMI VIC handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 949561eb85bcee10248e7da51d44a0325d5e0d1b ]
+
+Extract drm_mode_hdmi_vic() to correctly calculate the final HDMI
+VIC for us. Currently this is being done a bit differently between
+the AVI and HDMI infoframes. Let's get both to agree on this.
+
+We need to allow the case where a mode is both 3D and has a HDMI
+VIC. Currently we'll just refuse to generate the HDMI infoframe when
+we really should be setting HDMI VIC to 0 and instead enabling 3D
+stereo signalling.
+
+If the sink doesn't even support the HDMI infoframe we should
+not be picking the HDMI VIC in favor of the CEA VIC, because then
+we'll end up not sending either VIC in the end.
+
+Cc: Wayne Lin <waynelin@amd.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191004141914.20600-3-ville.syrjala@linux.intel.com
+Reviewed-by: Uma Shankar <uma.shankar@intel.com>
+Stable-dep-of: 1cbc1f0d324b ("drm/edid: fix AVI infoframe aspect ratio handling")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_edid.c | 37 +++++++++++++++++++++----------------
+ 1 file changed, 21 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
+index 10eb78b9347e1..245e495f57c93 100644
+--- a/drivers/gpu/drm/drm_edid.c
++++ b/drivers/gpu/drm/drm_edid.c
+@@ -5065,11 +5065,25 @@ drm_hdmi_infoframe_set_hdr_metadata(struct hdmi_drm_infoframe *frame,
+ }
+ EXPORT_SYMBOL(drm_hdmi_infoframe_set_hdr_metadata);
+
++static u8 drm_mode_hdmi_vic(struct drm_connector *connector,
++ const struct drm_display_mode *mode)
++{
++ bool has_hdmi_infoframe = connector ?
++ connector->display_info.has_hdmi_infoframe : false;
++
++ if (!has_hdmi_infoframe)
++ return 0;
++
++ /* No HDMI VIC when signalling 3D video format */
++ if (mode->flags & DRM_MODE_FLAG_3D_MASK)
++ return 0;
++
++ return drm_match_hdmi_mode(mode);
++}
++
+ static u8 drm_mode_cea_vic(struct drm_connector *connector,
+ const struct drm_display_mode *mode)
+ {
+- u8 vendor_if_vic = drm_match_hdmi_mode(mode);
+- bool is_s3d = mode->flags & DRM_MODE_FLAG_3D_MASK;
+ u8 vic;
+
+ /*
+@@ -5078,7 +5092,7 @@ static u8 drm_mode_cea_vic(struct drm_connector *connector,
+ * VIC in AVI infoframes. Lets check if this mode is present in
+ * HDMI 1.4b 4K modes
+ */
+- if (drm_valid_hdmi_vic(vendor_if_vic) && !is_s3d)
++ if (drm_mode_hdmi_vic(connector, mode))
+ return 0;
+
+ vic = drm_match_cea_mode(mode);
+@@ -5338,8 +5352,6 @@ drm_hdmi_vendor_infoframe_from_display_mode(struct hdmi_vendor_infoframe *frame,
+ bool has_hdmi_infoframe = connector ?
+ connector->display_info.has_hdmi_infoframe : false;
+ int err;
+- u32 s3d_flags;
+- u8 vic;
+
+ if (!frame || !mode)
+ return -EINVAL;
+@@ -5347,8 +5359,9 @@ drm_hdmi_vendor_infoframe_from_display_mode(struct hdmi_vendor_infoframe *frame,
+ if (!has_hdmi_infoframe)
+ return -EINVAL;
+
+- vic = drm_match_hdmi_mode(mode);
+- s3d_flags = mode->flags & DRM_MODE_FLAG_3D_MASK;
++ err = hdmi_vendor_infoframe_init(frame);
++ if (err < 0)
++ return err;
+
+ /*
+ * Even if it's not absolutely necessary to send the infoframe
+@@ -5359,15 +5372,7 @@ drm_hdmi_vendor_infoframe_from_display_mode(struct hdmi_vendor_infoframe *frame,
+ * mode if the source simply stops sending the infoframe when
+ * it wants to switch from 3D to 2D.
+ */
+-
+- if (vic && s3d_flags)
+- return -EINVAL;
+-
+- err = hdmi_vendor_infoframe_init(frame);
+- if (err < 0)
+- return err;
+-
+- frame->vic = vic;
++ frame->vic = drm_mode_hdmi_vic(connector, mode);
+ frame->s3d_struct = s3d_structure_from_display_mode(mode);
+
+ return 0;
+--
+2.39.2
+
--- /dev/null
+From febc42d9e37a3232c01520d0f1acbd422f5f0538 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Feb 2023 05:09:53 +0300
+Subject: drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+[ Upstream commit a7a4c19c36de1e4b99b06e4060ccc8ab837725bc ]
+
+Rather than writing CP_PREEMPT_ENABLE_GLOBAL twice, follow the vendor
+kernel and set CP_PREEMPT_ENABLE_LOCAL register instead. a5xx_submit()
+will override it during submission, but let's get the sequence correct.
+
+Fixes: b1fc2839d2f9 ("drm/msm: Implement preemption for A5XX targets")
+Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Patchwork: https://patchwork.freedesktop.org/patch/522638/
+Link: https://lore.kernel.org/r/20230214020956.164473-2-dmitry.baryshkov@linaro.org
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index e3579e5ffa146..593b8d83179c9 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -135,8 +135,8 @@ static void a5xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit,
+ OUT_RING(ring, 1);
+
+ /* Enable local preemption for finegrain preemption */
+- OUT_PKT7(ring, CP_PREEMPT_ENABLE_GLOBAL, 1);
+- OUT_RING(ring, 0x02);
++ OUT_PKT7(ring, CP_PREEMPT_ENABLE_LOCAL, 1);
++ OUT_RING(ring, 0x1);
+
+ /* Allow CP_CONTEXT_SWITCH_YIELD packets in the IB2 */
+ OUT_PKT7(ring, CP_YIELD_ENABLE, 1);
+--
+2.39.2
+
--- /dev/null
+From a3153ce3caa13735cf8d91037fd2cd07217acf1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Jan 2023 12:22:21 +0100
+Subject: ext4: Fix possible corruption when moving a directory
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 0813299c586b175d7edb25f56412c54b812d0379 ]
+
+When we are renaming a directory to a different directory, we need to
+update '..' entry in the moved directory. However nothing prevents moved
+directory from being modified and even converted from the inline format
+to the normal format. When such race happens the rename code gets
+confused and we crash. Fix the problem by locking the moved directory.
+
+CC: stable@vger.kernel.org
+Fixes: 32f7f22c0b52 ("ext4: let ext4_rename handle inline dir")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20230126112221.11866-1-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/namei.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 30c37ef8b8af3..f9d11f59df7d2 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3855,9 +3855,16 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (new.dir != old.dir && EXT4_DIR_LINK_MAX(new.dir))
+ goto end_rename;
+ }
++ /*
++ * We need to protect against old.inode directory getting
++ * converted from inline directory format into a normal one.
++ */
++ inode_lock_nested(old.inode, I_MUTEX_NONDIR2);
+ retval = ext4_rename_dir_prepare(handle, &old);
+- if (retval)
++ if (retval) {
++ inode_unlock(old.inode);
+ goto end_rename;
++ }
+ }
+ /*
+ * If we're renaming a file within an inline_data dir and adding or
+@@ -3953,6 +3960,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ } else {
+ ext4_journal_stop(handle);
+ }
++ if (old.dir_bh)
++ inode_unlock(old.inode);
+ release_bh:
+ brelse(old.dir_bh);
+ brelse(old.bh);
+--
+2.39.2
+
--- /dev/null
+From e34797c19ab53c6bc0bbe9fcd6165266a00915e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 15:30:24 +0000
+Subject: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 693aa2c0d9b6d5b1f2745d31b6e70d09dbbaf06e ]
+
+ila_xlat_nl_cmd_get_mapping() generates an empty skb,
+triggerring a recent sanity check [1].
+
+Instead, return an error code, so that user space
+can get it.
+
+[1]
+skb_assert_len
+WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 skb_assert_len include/linux/skbuff.h:2527 [inline]
+WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
+Modules linked in:
+CPU: 0 PID: 5923 Comm: syz-executor269 Not tainted 6.2.0-syzkaller-18300-g2ebd1fbb946d #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
+pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : skb_assert_len include/linux/skbuff.h:2527 [inline]
+pc : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
+lr : skb_assert_len include/linux/skbuff.h:2527 [inline]
+lr : __dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
+sp : ffff80001e0d6c40
+x29: ffff80001e0d6e60 x28: dfff800000000000 x27: ffff0000c86328c0
+x26: dfff800000000000 x25: ffff0000c8632990 x24: ffff0000c8632a00
+x23: 0000000000000000 x22: 1fffe000190c6542 x21: ffff0000c8632a10
+x20: ffff0000c8632a00 x19: ffff80001856e000 x18: ffff80001e0d5fc0
+x17: 0000000000000000 x16: ffff80001235d16c x15: 0000000000000000
+x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
+x11: ff80800008353a30 x10: 0000000000000000 x9 : 21567eaf25bfb600
+x8 : 21567eaf25bfb600 x7 : 0000000000000001 x6 : 0000000000000001
+x5 : ffff80001e0d6558 x4 : ffff800015c74760 x3 : ffff800008596744
+x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000000e
+Call trace:
+skb_assert_len include/linux/skbuff.h:2527 [inline]
+__dev_queue_xmit+0x1bc0/0x3488 net/core/dev.c:4156
+dev_queue_xmit include/linux/netdevice.h:3033 [inline]
+__netlink_deliver_tap_skb net/netlink/af_netlink.c:307 [inline]
+__netlink_deliver_tap+0x45c/0x6f8 net/netlink/af_netlink.c:325
+netlink_deliver_tap+0xf4/0x174 net/netlink/af_netlink.c:338
+__netlink_sendskb net/netlink/af_netlink.c:1283 [inline]
+netlink_sendskb+0x6c/0x154 net/netlink/af_netlink.c:1292
+netlink_unicast+0x334/0x8d4 net/netlink/af_netlink.c:1380
+nlmsg_unicast include/net/netlink.h:1099 [inline]
+genlmsg_unicast include/net/genetlink.h:433 [inline]
+genlmsg_reply include/net/genetlink.h:443 [inline]
+ila_xlat_nl_cmd_get_mapping+0x620/0x7d0 net/ipv6/ila/ila_xlat.c:493
+genl_family_rcv_msg_doit net/netlink/genetlink.c:968 [inline]
+genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
+genl_rcv_msg+0x938/0xc1c net/netlink/genetlink.c:1065
+netlink_rcv_skb+0x214/0x3c4 net/netlink/af_netlink.c:2574
+genl_rcv+0x38/0x50 net/netlink/genetlink.c:1076
+netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
+netlink_unicast+0x660/0x8d4 net/netlink/af_netlink.c:1365
+netlink_sendmsg+0x800/0xae0 net/netlink/af_netlink.c:1942
+sock_sendmsg_nosec net/socket.c:714 [inline]
+sock_sendmsg net/socket.c:734 [inline]
+____sys_sendmsg+0x558/0x844 net/socket.c:2479
+___sys_sendmsg net/socket.c:2533 [inline]
+__sys_sendmsg+0x26c/0x33c net/socket.c:2562
+__do_sys_sendmsg net/socket.c:2571 [inline]
+__se_sys_sendmsg net/socket.c:2569 [inline]
+__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2569
+__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
+invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
+el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
+do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
+el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
+el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
+el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
+irq event stamp: 136484
+hardirqs last enabled at (136483): [<ffff800008350244>] __up_console_sem+0x60/0xb4 kernel/printk/printk.c:345
+hardirqs last disabled at (136484): [<ffff800012358d60>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
+softirqs last enabled at (136418): [<ffff800008020ea8>] softirq_handle_end kernel/softirq.c:414 [inline]
+softirqs last enabled at (136418): [<ffff800008020ea8>] __do_softirq+0xd4c/0xfa4 kernel/softirq.c:600
+softirqs last disabled at (136371): [<ffff80000802b4a4>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
+---[ end trace 0000000000000000 ]---
+skb len=0 headroom=0 headlen=0 tailroom=192
+mac=(0,0) net=(0,-1) trans=-1
+shinfo(txflags=0 nr_frags=0 gso(size=0 type=0 segs=0))
+csum(0x0 ip_summed=0 complete_sw=0 valid=0 level=0)
+hash(0x0 sw=0 l4=0) proto=0x0010 pkttype=6 iif=0
+dev name=nlmon0 feat=0x0000000000005861
+
+Fixes: 7f00feaf1076 ("ila: Add generic ILA translation facility")
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ila/ila_xlat.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
+index 5fc1f4e0c0cf0..10f1367eb4ca0 100644
+--- a/net/ipv6/ila/ila_xlat.c
++++ b/net/ipv6/ila/ila_xlat.c
+@@ -477,6 +477,7 @@ int ila_xlat_nl_cmd_get_mapping(struct sk_buff *skb, struct genl_info *info)
+
+ rcu_read_lock();
+
++ ret = -ESRCH;
+ ila = ila_lookup_by_params(&xp, ilan);
+ if (ila) {
+ ret = ila_dump_info(ila,
+--
+2.39.2
+
--- /dev/null
+From ffaa53b7a5b909ec94b14cde82335e8a57a26383 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Feb 2023 08:26:56 +0000
+Subject: iommu/amd: Add a length limitation for the ivrs_acpihid command-line
+ parameter
+
+From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
+
+[ Upstream commit b6b26d86c61c441144c72f842f7469bb686e1211 ]
+
+The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow,
+because the string specifier in the format string sscanf()
+has no width limitation.
+
+Found by InfoTeCS on behalf of Linux Verification Center
+(linuxtesting.org) with SVACE.
+
+Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
+Reviewed-by: Kim Phillips <kim.phillips@amd.com>
+Link: https://lore.kernel.org/r/20230202082719.1513849-1-Ilia.Gavrilov@infotecs.ru
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 71e4a8eac3c92..4a9feff340da7 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -3049,15 +3049,26 @@ static int __init parse_ivrs_hpet(char *str)
+ return 1;
+ }
+
++#define ACPIID_LEN (ACPIHID_UID_LEN + ACPIHID_HID_LEN)
++
+ static int __init parse_ivrs_acpihid(char *str)
+ {
+ u32 seg = 0, bus, dev, fn;
+ char *hid, *uid, *p, *addr;
+- char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0};
++ char acpiid[ACPIID_LEN] = {0};
+ int i;
+
+ addr = strchr(str, '@');
+ if (!addr) {
++ addr = strchr(str, '=');
++ if (!addr)
++ goto not_found;
++
++ ++addr;
++
++ if (strlen(addr) > ACPIID_LEN)
++ goto not_found;
++
+ if (sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid) == 4 ||
+ sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid) == 5) {
+ pr_warn("ivrs_acpihid%s option format deprecated; use ivrs_acpihid=%s@%04x:%02x:%02x.%d instead\n",
+@@ -3070,6 +3081,9 @@ static int __init parse_ivrs_acpihid(char *str)
+ /* We have the '@', make it the terminator to get just the acpiid */
+ *addr++ = 0;
+
++ if (strlen(str) > ACPIID_LEN + 1)
++ goto not_found;
++
+ if (sscanf(str, "=%s", acpiid) != 1)
+ goto not_found;
+
+--
+2.39.2
+
--- /dev/null
+From 5465580ed1c93c2087ba13d8524f98176c57adfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jul 2022 17:08:22 +0530
+Subject: iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid]
+ commands
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit bbe3a106580c21bc883fb0c9fa3da01534392fe8 ]
+
+By default, PCI segment is zero and can be omitted. To support system
+with non-zero PCI segment ID, modify the parsing functions to allow
+PCI segment ID.
+
+Co-developed-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Link: https://lore.kernel.org/r/20220706113825.25582-33-vasant.hegde@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: b6b26d86c61c ("iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../admin-guide/kernel-parameters.txt | 34 ++++++++++----
+ drivers/iommu/amd_iommu_init.c | 44 ++++++++++++-------
+ 2 files changed, 52 insertions(+), 26 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 8f71a17ad5442..9164263839216 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1944,23 +1944,39 @@
+
+ ivrs_ioapic [HW,X86_64]
+ Provide an override to the IOAPIC-ID<->DEVICE-ID
+- mapping provided in the IVRS ACPI table. For
+- example, to map IOAPIC-ID decimal 10 to
+- PCI device 00:14.0 write the parameter as:
++ mapping provided in the IVRS ACPI table.
++ By default, PCI segment is 0, and can be omitted.
++ For example:
++ * To map IOAPIC-ID decimal 10 to PCI device 00:14.0
++ write the parameter as:
+ ivrs_ioapic[10]=00:14.0
++ * To map IOAPIC-ID decimal 10 to PCI segment 0x1 and
++ PCI device 00:14.0 write the parameter as:
++ ivrs_ioapic[10]=0001:00:14.0
+
+ ivrs_hpet [HW,X86_64]
+ Provide an override to the HPET-ID<->DEVICE-ID
+- mapping provided in the IVRS ACPI table. For
+- example, to map HPET-ID decimal 0 to
+- PCI device 00:14.0 write the parameter as:
++ mapping provided in the IVRS ACPI table.
++ By default, PCI segment is 0, and can be omitted.
++ For example:
++ * To map HPET-ID decimal 0 to PCI device 00:14.0
++ write the parameter as:
+ ivrs_hpet[0]=00:14.0
++ * To map HPET-ID decimal 10 to PCI segment 0x1 and
++ PCI device 00:14.0 write the parameter as:
++ ivrs_ioapic[10]=0001:00:14.0
+
+ ivrs_acpihid [HW,X86_64]
+ Provide an override to the ACPI-HID:UID<->DEVICE-ID
+- mapping provided in the IVRS ACPI table. For
+- example, to map UART-HID:UID AMD0020:0 to
+- PCI device 00:14.5 write the parameter as:
++ mapping provided in the IVRS ACPI table.
++
++ For example, to map UART-HID:UID AMD0020:0 to
++ PCI segment 0x1 and PCI device ID 00:14.5,
++ write the parameter as:
++ ivrs_acpihid[0001:00:14.5]=AMD0020:0
++
++ By default, PCI segment is 0, and can be omitted.
++ For example, PCI device 00:14.5 write the parameter as:
+ ivrs_acpihid[00:14.5]=AMD0020:0
+
+ js= [HW,JOY] Analog joystick
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 533b920ed7df2..f4e6173e749a4 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -84,6 +84,10 @@
+ #define ACPI_DEVFLAG_ATSDIS 0x10000000
+
+ #define LOOP_TIMEOUT 2000000
++
++#define IVRS_GET_SBDF_ID(seg, bus, dev, fd) (((seg & 0xffff) << 16) | ((bus & 0xff) << 8) \
++ | ((dev & 0x1f) << 3) | (fn & 0x7))
++
+ /*
+ * ACPI table definitions
+ *
+@@ -2971,15 +2975,17 @@ static int __init parse_amd_iommu_options(char *str)
+
+ static int __init parse_ivrs_ioapic(char *str)
+ {
+- unsigned int bus, dev, fn;
++ u32 seg = 0, bus, dev, fn;
+ int ret, id, i;
+- u16 devid;
++ u32 devid;
+
+ ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn);
+-
+ if (ret != 4) {
+- pr_err("Invalid command line: ivrs_ioapic%s\n", str);
+- return 1;
++ ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn);
++ if (ret != 5) {
++ pr_err("Invalid command line: ivrs_ioapic%s\n", str);
++ return 1;
++ }
+ }
+
+ if (early_ioapic_map_size == EARLY_MAP_SIZE) {
+@@ -2988,7 +2994,7 @@ static int __init parse_ivrs_ioapic(char *str)
+ return 1;
+ }
+
+- devid = ((bus & 0xff) << 8) | ((dev & 0x1f) << 3) | (fn & 0x7);
++ devid = IVRS_GET_SBDF_ID(seg, bus, dev, fn);
+
+ cmdline_maps = true;
+ i = early_ioapic_map_size++;
+@@ -3001,15 +3007,17 @@ static int __init parse_ivrs_ioapic(char *str)
+
+ static int __init parse_ivrs_hpet(char *str)
+ {
+- unsigned int bus, dev, fn;
++ u32 seg = 0, bus, dev, fn;
+ int ret, id, i;
+- u16 devid;
++ u32 devid;
+
+ ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn);
+-
+ if (ret != 4) {
+- pr_err("Invalid command line: ivrs_hpet%s\n", str);
+- return 1;
++ ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn);
++ if (ret != 5) {
++ pr_err("Invalid command line: ivrs_hpet%s\n", str);
++ return 1;
++ }
+ }
+
+ if (early_hpet_map_size == EARLY_MAP_SIZE) {
+@@ -3018,7 +3026,7 @@ static int __init parse_ivrs_hpet(char *str)
+ return 1;
+ }
+
+- devid = ((bus & 0xff) << 8) | ((dev & 0x1f) << 3) | (fn & 0x7);
++ devid = IVRS_GET_SBDF_ID(seg, bus, dev, fn);
+
+ cmdline_maps = true;
+ i = early_hpet_map_size++;
+@@ -3031,15 +3039,18 @@ static int __init parse_ivrs_hpet(char *str)
+
+ static int __init parse_ivrs_acpihid(char *str)
+ {
+- u32 bus, dev, fn;
++ u32 seg = 0, bus, dev, fn;
+ char *hid, *uid, *p;
+ char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0};
+ int ret, i;
+
+ ret = sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid);
+ if (ret != 4) {
+- pr_err("Invalid command line: ivrs_acpihid(%s)\n", str);
+- return 1;
++ ret = sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid);
++ if (ret != 5) {
++ pr_err("Invalid command line: ivrs_acpihid(%s)\n", str);
++ return 1;
++ }
+ }
+
+ p = acpiid;
+@@ -3061,8 +3072,7 @@ static int __init parse_ivrs_acpihid(char *str)
+ i = early_acpihid_map_size++;
+ memcpy(early_acpihid_map[i].hid, hid, strlen(hid));
+ memcpy(early_acpihid_map[i].uid, uid, strlen(uid));
+- early_acpihid_map[i].devid =
+- ((bus & 0xff) << 8) | ((dev & 0x1f) << 3) | (fn & 0x7);
++ early_acpihid_map[i].devid = IVRS_GET_SBDF_ID(seg, bus, dev, fn);
+ early_acpihid_map[i].cmd_line = true;
+
+ return 1;
+--
+2.39.2
+
--- /dev/null
+From 550753a8f23ab4dc9ffa1576c1294e1458fa4a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Sep 2022 10:56:38 -0500
+Subject: iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid
+ options
+
+From: Kim Phillips <kim.phillips@amd.com>
+
+[ Upstream commit 1198d2316dc4265a97d0e8445a22c7a6d17580a4 ]
+
+Currently, these options cause the following libkmod error:
+
+libkmod: ERROR ../libkmod/libkmod-config.c:489 kcmdline_parse_result: \
+ Ignoring bad option on kernel command line while parsing module \
+ name: 'ivrs_xxxx[XX:XX'
+
+Fix by introducing a new parameter format for these options and
+throw a warning for the deprecated format.
+
+Users are still allowed to omit the PCI Segment if zero.
+
+Adding a Link: to the reason why we're modding the syntax parsing
+in the driver and not in libkmod.
+
+Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-modules/20200310082308.14318-2-lucas.demarchi@intel.com/
+Reported-by: Kim Phillips <kim.phillips@amd.com>
+Co-developed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Kim Phillips <kim.phillips@amd.com>
+Link: https://lore.kernel.org/r/20220919155638.391481-2-kim.phillips@amd.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Stable-dep-of: b6b26d86c61c ("iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../admin-guide/kernel-parameters.txt | 27 +++++--
+ drivers/iommu/amd_iommu_init.c | 79 +++++++++++++------
+ 2 files changed, 76 insertions(+), 30 deletions(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 9164263839216..5e5704faae24a 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -1946,7 +1946,13 @@
+ Provide an override to the IOAPIC-ID<->DEVICE-ID
+ mapping provided in the IVRS ACPI table.
+ By default, PCI segment is 0, and can be omitted.
+- For example:
++
++ For example, to map IOAPIC-ID decimal 10 to
++ PCI segment 0x1 and PCI device 00:14.0,
++ write the parameter as:
++ ivrs_ioapic=10@0001:00:14.0
++
++ Deprecated formats:
+ * To map IOAPIC-ID decimal 10 to PCI device 00:14.0
+ write the parameter as:
+ ivrs_ioapic[10]=00:14.0
+@@ -1958,7 +1964,13 @@
+ Provide an override to the HPET-ID<->DEVICE-ID
+ mapping provided in the IVRS ACPI table.
+ By default, PCI segment is 0, and can be omitted.
+- For example:
++
++ For example, to map HPET-ID decimal 10 to
++ PCI segment 0x1 and PCI device 00:14.0,
++ write the parameter as:
++ ivrs_hpet=10@0001:00:14.0
++
++ Deprecated formats:
+ * To map HPET-ID decimal 0 to PCI device 00:14.0
+ write the parameter as:
+ ivrs_hpet[0]=00:14.0
+@@ -1969,15 +1981,20 @@
+ ivrs_acpihid [HW,X86_64]
+ Provide an override to the ACPI-HID:UID<->DEVICE-ID
+ mapping provided in the IVRS ACPI table.
++ By default, PCI segment is 0, and can be omitted.
+
+ For example, to map UART-HID:UID AMD0020:0 to
+ PCI segment 0x1 and PCI device ID 00:14.5,
+ write the parameter as:
+- ivrs_acpihid[0001:00:14.5]=AMD0020:0
++ ivrs_acpihid=AMD0020:0@0001:00:14.5
+
+- By default, PCI segment is 0, and can be omitted.
+- For example, PCI device 00:14.5 write the parameter as:
++ Deprecated formats:
++ * To map UART-HID:UID AMD0020:0 to PCI segment is 0,
++ PCI device ID 00:14.5, write the parameter as:
+ ivrs_acpihid[00:14.5]=AMD0020:0
++ * To map UART-HID:UID AMD0020:0 to PCI segment 0x1 and
++ PCI device ID 00:14.5, write the parameter as:
++ ivrs_acpihid[0001:00:14.5]=AMD0020:0
+
+ js= [HW,JOY] Analog joystick
+ See Documentation/input/joydev/joystick.rst.
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index f4e6173e749a4..71e4a8eac3c92 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -2976,18 +2976,24 @@ static int __init parse_amd_iommu_options(char *str)
+ static int __init parse_ivrs_ioapic(char *str)
+ {
+ u32 seg = 0, bus, dev, fn;
+- int ret, id, i;
++ int id, i;
+ u32 devid;
+
+- ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn);
+- if (ret != 4) {
+- ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn);
+- if (ret != 5) {
+- pr_err("Invalid command line: ivrs_ioapic%s\n", str);
+- return 1;
+- }
++ if (sscanf(str, "=%d@%x:%x.%x", &id, &bus, &dev, &fn) == 4 ||
++ sscanf(str, "=%d@%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5)
++ goto found;
++
++ if (sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn) == 4 ||
++ sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5) {
++ pr_warn("ivrs_ioapic%s option format deprecated; use ivrs_ioapic=%d@%04x:%02x:%02x.%d instead\n",
++ str, id, seg, bus, dev, fn);
++ goto found;
+ }
+
++ pr_err("Invalid command line: ivrs_ioapic%s\n", str);
++ return 1;
++
++found:
+ if (early_ioapic_map_size == EARLY_MAP_SIZE) {
+ pr_err("Early IOAPIC map overflow - ignoring ivrs_ioapic%s\n",
+ str);
+@@ -3008,18 +3014,24 @@ static int __init parse_ivrs_ioapic(char *str)
+ static int __init parse_ivrs_hpet(char *str)
+ {
+ u32 seg = 0, bus, dev, fn;
+- int ret, id, i;
++ int id, i;
+ u32 devid;
+
+- ret = sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn);
+- if (ret != 4) {
+- ret = sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn);
+- if (ret != 5) {
+- pr_err("Invalid command line: ivrs_hpet%s\n", str);
+- return 1;
+- }
++ if (sscanf(str, "=%d@%x:%x.%x", &id, &bus, &dev, &fn) == 4 ||
++ sscanf(str, "=%d@%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5)
++ goto found;
++
++ if (sscanf(str, "[%d]=%x:%x.%x", &id, &bus, &dev, &fn) == 4 ||
++ sscanf(str, "[%d]=%x:%x:%x.%x", &id, &seg, &bus, &dev, &fn) == 5) {
++ pr_warn("ivrs_hpet%s option format deprecated; use ivrs_hpet=%d@%04x:%02x:%02x.%d instead\n",
++ str, id, seg, bus, dev, fn);
++ goto found;
+ }
+
++ pr_err("Invalid command line: ivrs_hpet%s\n", str);
++ return 1;
++
++found:
+ if (early_hpet_map_size == EARLY_MAP_SIZE) {
+ pr_err("Early HPET map overflow - ignoring ivrs_hpet%s\n",
+ str);
+@@ -3040,19 +3052,36 @@ static int __init parse_ivrs_hpet(char *str)
+ static int __init parse_ivrs_acpihid(char *str)
+ {
+ u32 seg = 0, bus, dev, fn;
+- char *hid, *uid, *p;
++ char *hid, *uid, *p, *addr;
+ char acpiid[ACPIHID_UID_LEN + ACPIHID_HID_LEN] = {0};
+- int ret, i;
+-
+- ret = sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid);
+- if (ret != 4) {
+- ret = sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid);
+- if (ret != 5) {
+- pr_err("Invalid command line: ivrs_acpihid(%s)\n", str);
+- return 1;
++ int i;
++
++ addr = strchr(str, '@');
++ if (!addr) {
++ if (sscanf(str, "[%x:%x.%x]=%s", &bus, &dev, &fn, acpiid) == 4 ||
++ sscanf(str, "[%x:%x:%x.%x]=%s", &seg, &bus, &dev, &fn, acpiid) == 5) {
++ pr_warn("ivrs_acpihid%s option format deprecated; use ivrs_acpihid=%s@%04x:%02x:%02x.%d instead\n",
++ str, acpiid, seg, bus, dev, fn);
++ goto found;
+ }
++ goto not_found;
+ }
+
++ /* We have the '@', make it the terminator to get just the acpiid */
++ *addr++ = 0;
++
++ if (sscanf(str, "=%s", acpiid) != 1)
++ goto not_found;
++
++ if (sscanf(addr, "%x:%x.%x", &bus, &dev, &fn) == 3 ||
++ sscanf(addr, "%x:%x:%x.%x", &seg, &bus, &dev, &fn) == 4)
++ goto found;
++
++not_found:
++ pr_err("Invalid command line: ivrs_acpihid%s\n", str);
++ return 1;
++
++found:
+ p = acpiid;
+ hid = strsep(&p, ":");
+ uid = p;
+--
+2.39.2
+
--- /dev/null
+From 599d2b068fe90620f816cc0148ee88d52e29ff16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Feb 2023 21:08:15 +0800
+Subject: iommu/vt-d: Fix PASID directory pointer coherency
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 194b3348bdbb7db65375c72f3f774aee4cc6614e ]
+
+On platforms that do not support IOMMU Extended capability bit 0
+Page-walk Coherency, CPU caches are not snooped when IOMMU is accessing
+any translation structures. IOMMU access goes only directly to
+memory. Intel IOMMU code was missing a flush for the PASID table
+directory that resulted in the unrecoverable fault as shown below.
+
+This patch adds clflush calls whenever allocating and updating
+a PASID table directory to ensure cache coherency.
+
+On the reverse direction, there's no need to clflush the PASID directory
+pointer when we deactivate a context entry in that IOMMU hardware will
+not see the old PASID directory pointer after we clear the context entry.
+PASID directory entries are also never freed once allocated.
+
+ DMAR: DRHD: handling fault status reg 3
+ DMAR: [DMA Read NO_PASID] Request device [00:0d.2] fault addr 0x1026a4000
+ [fault reason 0x51] SM: Present bit in Directory Entry is clear
+ DMAR: Dump dmar1 table entries for IOVA 0x1026a4000
+ DMAR: scalable mode root entry: hi 0x0000000102448001, low 0x0000000101b3e001
+ DMAR: context entry: hi 0x0000000000000000, low 0x0000000101b4d401
+ DMAR: pasid dir entry: 0x0000000101b4e001
+ DMAR: pasid table entry[0]: 0x0000000000000109
+ DMAR: pasid table entry[1]: 0x0000000000000001
+ DMAR: pasid table entry[2]: 0x0000000000000000
+ DMAR: pasid table entry[3]: 0x0000000000000000
+ DMAR: pasid table entry[4]: 0x0000000000000000
+ DMAR: pasid table entry[5]: 0x0000000000000000
+ DMAR: pasid table entry[6]: 0x0000000000000000
+ DMAR: pasid table entry[7]: 0x0000000000000000
+ DMAR: PTE not present at level 4
+
+Cc: <stable@vger.kernel.org>
+Fixes: 0bbeb01a4faf ("iommu/vt-d: Manage scalalble mode PASID tables")
+Reviewed-by: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Sukumar Ghorai <sukumar.ghorai@intel.com>
+Signed-off-by: Ashok Raj <ashok.raj@intel.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Link: https://lore.kernel.org/r/20230209212843.1788125-1-jacob.jun.pan@linux.intel.com
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-pasid.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c
+index e7cb0b8a73327..58f060006ba31 100644
+--- a/drivers/iommu/intel-pasid.c
++++ b/drivers/iommu/intel-pasid.c
+@@ -166,6 +166,9 @@ int intel_pasid_alloc_table(struct device *dev)
+ attach_out:
+ device_attach_pasid_table(info, pasid_table);
+
++ if (!ecap_coherent(info->iommu->ecap))
++ clflush_cache_range(pasid_table->table, size);
++
+ return 0;
+ }
+
+@@ -250,6 +253,10 @@ struct pasid_entry *intel_pasid_get_entry(struct device *dev, int pasid)
+
+ WRITE_ONCE(dir[dir_index].val,
+ (u64)virt_to_phys(entries) | PASID_PTE_PRESENT);
++ if (!ecap_coherent(info->iommu->ecap)) {
++ clflush_cache_range(entries, VTD_PAGE_SIZE);
++ clflush_cache_range(&dir[dir_index].val, sizeof(*dir));
++ }
+ }
+ spin_unlock(&pasid_lock);
+
+--
+2.39.2
+
--- /dev/null
+From 2550ab266e28222fc0c651888be20f19d3b56ebf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 10:34:47 -0600
+Subject: ipmi:ssif: Add a timer between request retries
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit 00bb7e763ec9f384cb382455cb6ba5588b5375cf ]
+
+The IPMI spec has a time (T6) specified between request retries. Add
+the handling for that.
+
+Reported by: Tony Camuso <tcamuso@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 34 +++++++++++++++++++++++++++-------
+ 1 file changed, 27 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 02ca0d9a0d8cb..d5f068a10a5a0 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -79,7 +79,8 @@
+ /*
+ * Timer values
+ */
+-#define SSIF_MSG_USEC 60000 /* 60ms between message tries. */
++#define SSIF_MSG_USEC 60000 /* 60ms between message tries (T3). */
++#define SSIF_REQ_RETRY_USEC 60000 /* 60ms between send retries (T6). */
+ #define SSIF_MSG_PART_USEC 5000 /* 5ms for a message part */
+
+ /* How many times to we retry sending/receiving the message. */
+@@ -87,7 +88,9 @@
+ #define SSIF_RECV_RETRIES 250
+
+ #define SSIF_MSG_MSEC (SSIF_MSG_USEC / 1000)
++#define SSIF_REQ_RETRY_MSEC (SSIF_REQ_RETRY_USEC / 1000)
+ #define SSIF_MSG_JIFFIES ((SSIF_MSG_USEC * 1000) / TICK_NSEC)
++#define SSIF_REQ_RETRY_JIFFIES ((SSIF_REQ_RETRY_USEC * 1000) / TICK_NSEC)
+ #define SSIF_MSG_PART_JIFFIES ((SSIF_MSG_PART_USEC * 1000) / TICK_NSEC)
+
+ /*
+@@ -236,6 +239,9 @@ struct ssif_info {
+ bool got_alert;
+ bool waiting_alert;
+
++ /* Used to inform the timeout that it should do a resend. */
++ bool do_resend;
++
+ /*
+ * If set to true, this will request events the next time the
+ * state machine is idle.
+@@ -536,22 +542,28 @@ static void start_get(struct ssif_info *ssif_info)
+ ssif_info->recv, I2C_SMBUS_BLOCK_DATA);
+ }
+
++static void start_resend(struct ssif_info *ssif_info);
++
+ static void retry_timeout(struct timer_list *t)
+ {
+ struct ssif_info *ssif_info = from_timer(ssif_info, t, retry_timer);
+ unsigned long oflags, *flags;
+- bool waiting;
++ bool waiting, resend;
+
+ if (ssif_info->stopping)
+ return;
+
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
++ resend = ssif_info->do_resend;
++ ssif_info->do_resend = false;
+ waiting = ssif_info->waiting_alert;
+ ssif_info->waiting_alert = false;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+
+ if (waiting)
+ start_get(ssif_info);
++ if (resend)
++ start_resend(ssif_info);
+ }
+
+ static void watch_timeout(struct timer_list *t)
+@@ -600,8 +612,6 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type,
+ start_get(ssif_info);
+ }
+
+-static void start_resend(struct ssif_info *ssif_info);
+-
+ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ unsigned char *data, unsigned int len)
+ {
+@@ -906,7 +916,13 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ if (result < 0) {
+ ssif_info->retries_left--;
+ if (ssif_info->retries_left > 0) {
+- start_resend(ssif_info);
++ /*
++ * Wait the retry timeout time per the spec,
++ * then redo the send.
++ */
++ ssif_info->do_resend = true;
++ mod_timer(&ssif_info->retry_timer,
++ jiffies + SSIF_REQ_RETRY_JIFFIES);
+ return;
+ }
+
+@@ -1318,8 +1334,10 @@ static int do_cmd(struct i2c_client *client, int len, unsigned char *msg,
+ ret = i2c_smbus_write_block_data(client, SSIF_IPMI_REQUEST, len, msg);
+ if (ret) {
+ retry_cnt--;
+- if (retry_cnt > 0)
++ if (retry_cnt > 0) {
++ msleep(SSIF_REQ_RETRY_MSEC);
+ goto retry1;
++ }
+ return -ENODEV;
+ }
+
+@@ -1459,8 +1477,10 @@ static int start_multipart_test(struct i2c_client *client,
+ 32, msg);
+ if (ret) {
+ retry_cnt--;
+- if (retry_cnt > 0)
++ if (retry_cnt > 0) {
++ msleep(SSIF_REQ_RETRY_MSEC);
+ goto retry_write;
++ }
+ dev_err(&client->dev, "Could not write multi-part start, though the BMC said it could handle it. Just limit sends to one part.\n");
+ return ret;
+ }
+--
+2.39.2
+
--- /dev/null
+From 0f5062c13ad9df5d62066017015185f66d5fa611 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Nov 2022 15:03:11 -0500
+Subject: ipmi:ssif: Increase the message retry time
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit 39721d62bbc16ebc9bb2bdc2c163658f33da3b0b ]
+
+The spec states that the minimum message retry time is 60ms, but it was
+set to 20ms. Correct it.
+
+Reported by: Tony Camuso <tcamuso@redhat.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Stable-dep-of: 00bb7e763ec9 ("ipmi:ssif: Add a timer between request retries")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 9f1fb8a30a823..02ca0d9a0d8cb 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -79,7 +79,7 @@
+ /*
+ * Timer values
+ */
+-#define SSIF_MSG_USEC 20000 /* 20ms between message tries. */
++#define SSIF_MSG_USEC 60000 /* 60ms between message tries. */
+ #define SSIF_MSG_PART_USEC 5000 /* 5ms for a message part */
+
+ /* How many times to we retry sending/receiving the message. */
+--
+2.39.2
+
--- /dev/null
+From 1468c1898370ccd7811acfdef46fdedb8ce30e90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Mar 2021 22:05:15 +0800
+Subject: ipmi:ssif: make ssif_i2c_send() void
+
+From: Liguang Zhang <zhangliguang@linux.alibaba.com>
+
+[ Upstream commit dcd10526ac5a0d6cc94ce60b9acfca458163277b ]
+
+This function actually needs no return value. So remove the unneeded
+check and make it void.
+
+Signed-off-by: Liguang Zhang <zhangliguang@linux.alibaba.com>
+Message-Id: <20210301140515.18951-1-zhangliguang@linux.alibaba.com>
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Stable-dep-of: 95767ed78a18 ("ipmi:ssif: resend_msg() cannot fail")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 81 +++++++++--------------------------
+ 1 file changed, 20 insertions(+), 61 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index d6b69e19f78a7..5ead5e7f0ce16 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -515,7 +515,7 @@ static int ipmi_ssif_thread(void *data)
+ return 0;
+ }
+
+-static int ssif_i2c_send(struct ssif_info *ssif_info,
++static void ssif_i2c_send(struct ssif_info *ssif_info,
+ ssif_i2c_done handler,
+ int read_write, int command,
+ unsigned char *data, unsigned int size)
+@@ -527,7 +527,6 @@ static int ssif_i2c_send(struct ssif_info *ssif_info,
+ ssif_info->i2c_data = data;
+ ssif_info->i2c_size = size;
+ complete(&ssif_info->wake_thread);
+- return 0;
+ }
+
+
+@@ -536,22 +535,12 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+
+ static void start_get(struct ssif_info *ssif_info)
+ {
+- int rv;
+-
+ ssif_info->rtc_us_timer = 0;
+ ssif_info->multi_pos = 0;
+
+- rv = ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ,
+- SSIF_IPMI_RESPONSE,
+- ssif_info->recv, I2C_SMBUS_BLOCK_DATA);
+- if (rv < 0) {
+- /* request failed, just return the error. */
+- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+- dev_dbg(&ssif_info->client->dev,
+- "Error from i2c_non_blocking_op(5)\n");
+-
+- msg_done_handler(ssif_info, -EIO, NULL, 0);
+- }
++ ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ,
++ SSIF_IPMI_RESPONSE,
++ ssif_info->recv, I2C_SMBUS_BLOCK_DATA);
+ }
+
+ static void retry_timeout(struct timer_list *t)
+@@ -625,7 +614,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ {
+ struct ipmi_smi_msg *msg;
+ unsigned long oflags, *flags;
+- int rv;
+
+ /*
+ * We are single-threaded here, so no need for a lock until we
+@@ -671,17 +659,10 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ ssif_info->multi_len = len;
+ ssif_info->multi_pos = 1;
+
+- rv = ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ,
+- SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE,
+- ssif_info->recv, I2C_SMBUS_BLOCK_DATA);
+- if (rv < 0) {
+- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+- dev_dbg(&ssif_info->client->dev,
+- "Error from i2c_non_blocking_op(1)\n");
+-
+- result = -EIO;
+- } else
+- return;
++ ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ,
++ SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE,
++ ssif_info->recv, I2C_SMBUS_BLOCK_DATA);
++ return;
+ } else if (ssif_info->multi_pos) {
+ /* Middle of multi-part read. Start the next transaction. */
+ int i;
+@@ -743,19 +724,12 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+
+ ssif_info->multi_pos++;
+
+- rv = ssif_i2c_send(ssif_info, msg_done_handler,
+- I2C_SMBUS_READ,
+- SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE,
+- ssif_info->recv,
+- I2C_SMBUS_BLOCK_DATA);
+- if (rv < 0) {
+- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+- dev_dbg(&ssif_info->client->dev,
+- "Error from ssif_i2c_send\n");
+-
+- result = -EIO;
+- } else
+- return;
++ ssif_i2c_send(ssif_info, msg_done_handler,
++ I2C_SMBUS_READ,
++ SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE,
++ ssif_info->recv,
++ I2C_SMBUS_BLOCK_DATA);
++ return;
+ }
+ }
+
+@@ -936,8 +910,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ unsigned char *data, unsigned int len)
+ {
+- int rv;
+-
+ /* We are single-threaded here, so no need for a lock. */
+ if (result < 0) {
+ ssif_info->retries_left--;
+@@ -1000,18 +972,9 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ ssif_info->multi_data = NULL;
+ }
+
+- rv = ssif_i2c_send(ssif_info, msg_written_handler,
+- I2C_SMBUS_WRITE, cmd,
+- data_to_send, I2C_SMBUS_BLOCK_DATA);
+- if (rv < 0) {
+- /* request failed, just return the error. */
+- ssif_inc_stat(ssif_info, send_errors);
+-
+- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+- dev_dbg(&ssif_info->client->dev,
+- "Error from i2c_non_blocking_op(3)\n");
+- msg_done_handler(ssif_info, -EIO, NULL, 0);
+- }
++ ssif_i2c_send(ssif_info, msg_written_handler,
++ I2C_SMBUS_WRITE, cmd,
++ data_to_send, I2C_SMBUS_BLOCK_DATA);
+ } else {
+ /* Ready to request the result. */
+ unsigned long oflags, *flags;
+@@ -1040,7 +1003,6 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+
+ static int start_resend(struct ssif_info *ssif_info)
+ {
+- int rv;
+ int command;
+
+ ssif_info->got_alert = false;
+@@ -1062,12 +1024,9 @@ static int start_resend(struct ssif_info *ssif_info)
+ ssif_info->data[0] = ssif_info->data_len;
+ }
+
+- rv = ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE,
+- command, ssif_info->data, I2C_SMBUS_BLOCK_DATA);
+- if (rv && (ssif_info->ssif_debug & SSIF_DEBUG_MSG))
+- dev_dbg(&ssif_info->client->dev,
+- "Error from i2c_non_blocking_op(4)\n");
+- return rv;
++ ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE,
++ command, ssif_info->data, I2C_SMBUS_BLOCK_DATA);
++ return 0;
+ }
+
+ static int start_send(struct ssif_info *ssif_info,
+--
+2.39.2
+
--- /dev/null
+From a16cd86ec926988d1549eff3e15669fcb5a0959f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 10:41:48 -0600
+Subject: ipmi:ssif: Remove rtc_us_timer
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit 9e8b89926fb87e5625bdde6fd5de2c31fb1d83bf ]
+
+It was cruft left over from older handling of run to completion.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index ff93009583ab1..9f1fb8a30a823 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -248,12 +248,6 @@ struct ssif_info {
+ */
+ bool req_flags;
+
+- /*
+- * Used to perform timer operations when run-to-completion
+- * mode is on. This is a countdown timer.
+- */
+- int rtc_us_timer;
+-
+ /* Used for sending/receiving data. +1 for the length. */
+ unsigned char data[IPMI_MAX_MSG_LENGTH + 1];
+ unsigned int data_len;
+@@ -535,7 +529,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+
+ static void start_get(struct ssif_info *ssif_info)
+ {
+- ssif_info->rtc_us_timer = 0;
+ ssif_info->multi_pos = 0;
+
+ ssif_i2c_send(ssif_info, msg_done_handler, I2C_SMBUS_READ,
+@@ -627,7 +620,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+
+ flags = ipmi_ssif_lock_cond(ssif_info, &oflags);
+ ssif_info->waiting_alert = true;
+- ssif_info->rtc_us_timer = SSIF_MSG_USEC;
+ if (!ssif_info->stopping)
+ mod_timer(&ssif_info->retry_timer,
+ jiffies + SSIF_MSG_JIFFIES);
+@@ -978,7 +970,6 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ /* Wait a jiffie then request the next message */
+ ssif_info->waiting_alert = true;
+ ssif_info->retries_left = SSIF_RECV_RETRIES;
+- ssif_info->rtc_us_timer = SSIF_MSG_PART_USEC;
+ if (!ssif_info->stopping)
+ mod_timer(&ssif_info->retry_timer,
+ jiffies + SSIF_MSG_PART_JIFFIES);
+--
+2.39.2
+
--- /dev/null
+From 24909db90a448ff7d0fd69496a7f4db57bab891d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Jan 2023 10:11:06 -0600
+Subject: ipmi:ssif: resend_msg() cannot fail
+
+From: Corey Minyard <cminyard@mvista.com>
+
+[ Upstream commit 95767ed78a181d5404202627499f9cde56053b96 ]
+
+The resend_msg() function cannot fail, but there was error handling
+around using it. Rework the handling of the error, and fix the out of
+retries debug reporting that was wrong around this, too.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Corey Minyard <cminyard@mvista.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 28 +++++++---------------------
+ 1 file changed, 7 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
+index 5ead5e7f0ce16..ff93009583ab1 100644
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -607,7 +607,7 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type,
+ start_get(ssif_info);
+ }
+
+-static int start_resend(struct ssif_info *ssif_info);
++static void start_resend(struct ssif_info *ssif_info);
+
+ static void msg_done_handler(struct ssif_info *ssif_info, int result,
+ unsigned char *data, unsigned int len)
+@@ -914,31 +914,17 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ if (result < 0) {
+ ssif_info->retries_left--;
+ if (ssif_info->retries_left > 0) {
+- if (!start_resend(ssif_info)) {
+- ssif_inc_stat(ssif_info, send_retries);
+- return;
+- }
+- /* request failed, just return the error. */
+- ssif_inc_stat(ssif_info, send_errors);
+-
+- if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+- dev_dbg(&ssif_info->client->dev,
+- "%s: Out of retries\n", __func__);
+- msg_done_handler(ssif_info, -EIO, NULL, 0);
++ start_resend(ssif_info);
+ return;
+ }
+
+ ssif_inc_stat(ssif_info, send_errors);
+
+- /*
+- * Got an error on transmit, let the done routine
+- * handle it.
+- */
+ if (ssif_info->ssif_debug & SSIF_DEBUG_MSG)
+ dev_dbg(&ssif_info->client->dev,
+- "%s: Error %d\n", __func__, result);
++ "%s: Out of retries\n", __func__);
+
+- msg_done_handler(ssif_info, result, NULL, 0);
++ msg_done_handler(ssif_info, -EIO, NULL, 0);
+ return;
+ }
+
+@@ -1001,7 +987,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
+ }
+ }
+
+-static int start_resend(struct ssif_info *ssif_info)
++static void start_resend(struct ssif_info *ssif_info)
+ {
+ int command;
+
+@@ -1026,7 +1012,6 @@ static int start_resend(struct ssif_info *ssif_info)
+
+ ssif_i2c_send(ssif_info, msg_written_handler, I2C_SMBUS_WRITE,
+ command, ssif_info->data, I2C_SMBUS_BLOCK_DATA);
+- return 0;
+ }
+
+ static int start_send(struct ssif_info *ssif_info,
+@@ -1041,7 +1026,8 @@ static int start_send(struct ssif_info *ssif_info,
+ ssif_info->retries_left = SSIF_SEND_RETRIES;
+ memcpy(ssif_info->data + 1, data, len);
+ ssif_info->data_len = len;
+- return start_resend(ssif_info);
++ start_resend(ssif_info);
++ return 0;
+ }
+
+ /* Must be called with the message lock held. */
+--
+2.39.2
+
--- /dev/null
+From 441953ac47b95d7eb4ec77ae95f96b1b175b659f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 10:52:03 +0800
+Subject: irqdomain: Change the type of 'size' in __irq_domain_add() to be
+ consistent
+
+From: Bixuan Cui <cuibixuan@huawei.com>
+
+[ Upstream commit 20c36ce2164f1774b487d443ece99b754bc6ad43 ]
+
+The 'size' is used in struct_size(domain, revmap, size) and its input
+parameter type is 'size_t'(unsigned int).
+Changing the size to 'unsigned int' to make the type consistent.
+
+Signed-off-by: Bixuan Cui <cuibixuan@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20210916025203.44841-1-cuibixuan@huawei.com
+Stable-dep-of: 8932c32c3053 ("irqdomain: Fix domain registration race")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/irqdomain.h | 2 +-
+ kernel/irq/irqdomain.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
+index 824d7a19dd66e..2552f66a7a891 100644
+--- a/include/linux/irqdomain.h
++++ b/include/linux/irqdomain.h
+@@ -254,7 +254,7 @@ static inline struct fwnode_handle *irq_domain_alloc_fwnode(phys_addr_t *pa)
+ }
+
+ void irq_domain_free_fwnode(struct fwnode_handle *fwnode);
+-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
++struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size,
+ irq_hw_number_t hwirq_max, int direct_max,
+ const struct irq_domain_ops *ops,
+ void *host_data);
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index 3d1b570a1dadd..cfb5a96f023f7 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -127,7 +127,7 @@ EXPORT_SYMBOL_GPL(irq_domain_free_fwnode);
+ * Allocates and initializes an irq_domain structure.
+ * Returns pointer to IRQ domain, or NULL on failure.
+ */
+-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
++struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size,
+ irq_hw_number_t hwirq_max, int direct_max,
+ const struct irq_domain_ops *ops,
+ void *host_data)
+--
+2.39.2
+
--- /dev/null
+From f74ad37d428499ea196d0a5d8a58daf8d3384944 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Feb 2023 11:42:49 +0100
+Subject: irqdomain: Fix domain registration race
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 8932c32c3053accd50702b36e944ac2016cd103c ]
+
+Hierarchical domains created using irq_domain_create_hierarchy() are
+currently added to the domain list before having been fully initialised.
+
+This specifically means that a racing allocation request might fail to
+allocate irq data for the inner domains of a hierarchy in case the
+parent domain pointer has not yet been set up.
+
+Note that this is not really any issue for irqchip drivers that are
+registered early (e.g. via IRQCHIP_DECLARE() or IRQCHIP_ACPI_DECLARE())
+but could potentially cause trouble with drivers that are registered
+later (e.g. modular drivers using IRQCHIP_PLATFORM_DRIVER_BEGIN(),
+gpiochip drivers, etc.).
+
+Fixes: afb7da83b9f4 ("irqdomain: Introduce helper function irq_domain_add_hierarchy()")
+Cc: stable@vger.kernel.org # 3.19
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+[ johan: add commit message ]
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20230213104302.17307-8-johan+linaro@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irqdomain.c | 62 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 43 insertions(+), 19 deletions(-)
+
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index cfb5a96f023f7..d40ae18fe6617 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -114,23 +114,12 @@ void irq_domain_free_fwnode(struct fwnode_handle *fwnode)
+ }
+ EXPORT_SYMBOL_GPL(irq_domain_free_fwnode);
+
+-/**
+- * __irq_domain_add() - Allocate a new irq_domain data structure
+- * @fwnode: firmware node for the interrupt controller
+- * @size: Size of linear map; 0 for radix mapping only
+- * @hwirq_max: Maximum number of interrupts supported by controller
+- * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no
+- * direct mapping
+- * @ops: domain callbacks
+- * @host_data: Controller private data pointer
+- *
+- * Allocates and initializes an irq_domain structure.
+- * Returns pointer to IRQ domain, or NULL on failure.
+- */
+-struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size,
+- irq_hw_number_t hwirq_max, int direct_max,
+- const struct irq_domain_ops *ops,
+- void *host_data)
++static struct irq_domain *__irq_domain_create(struct fwnode_handle *fwnode,
++ unsigned int size,
++ irq_hw_number_t hwirq_max,
++ int direct_max,
++ const struct irq_domain_ops *ops,
++ void *host_data)
+ {
+ struct device_node *of_node = to_of_node(fwnode);
+ struct irqchip_fwid *fwid;
+@@ -222,12 +211,44 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int s
+ domain->revmap_direct_max_irq = direct_max;
+ irq_domain_check_hierarchy(domain);
+
++ return domain;
++}
++
++static void __irq_domain_publish(struct irq_domain *domain)
++{
+ mutex_lock(&irq_domain_mutex);
+ debugfs_add_domain_dir(domain);
+ list_add(&domain->link, &irq_domain_list);
+ mutex_unlock(&irq_domain_mutex);
+
+ pr_debug("Added domain %s\n", domain->name);
++}
++
++/**
++ * __irq_domain_add() - Allocate a new irq_domain data structure
++ * @fwnode: firmware node for the interrupt controller
++ * @size: Size of linear map; 0 for radix mapping only
++ * @hwirq_max: Maximum number of interrupts supported by controller
++ * @direct_max: Maximum value of direct maps; Use ~0 for no limit; 0 for no
++ * direct mapping
++ * @ops: domain callbacks
++ * @host_data: Controller private data pointer
++ *
++ * Allocates and initializes an irq_domain structure.
++ * Returns pointer to IRQ domain, or NULL on failure.
++ */
++struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, unsigned int size,
++ irq_hw_number_t hwirq_max, int direct_max,
++ const struct irq_domain_ops *ops,
++ void *host_data)
++{
++ struct irq_domain *domain;
++
++ domain = __irq_domain_create(fwnode, size, hwirq_max, direct_max,
++ ops, host_data);
++ if (domain)
++ __irq_domain_publish(domain);
++
+ return domain;
+ }
+ EXPORT_SYMBOL_GPL(__irq_domain_add);
+@@ -1068,12 +1089,15 @@ struct irq_domain *irq_domain_create_hierarchy(struct irq_domain *parent,
+ struct irq_domain *domain;
+
+ if (size)
+- domain = irq_domain_create_linear(fwnode, size, ops, host_data);
++ domain = __irq_domain_create(fwnode, size, size, 0, ops, host_data);
+ else
+- domain = irq_domain_create_tree(fwnode, ops, host_data);
++ domain = __irq_domain_create(fwnode, 0, ~0, 0, ops, host_data);
++
+ if (domain) {
+ domain->parent = parent;
+ domain->flags |= flags;
++
++ __irq_domain_publish(domain);
+ }
+
+ return domain;
+--
+2.39.2
+
--- /dev/null
+From 99a26fa975ffdce2a07db079f0a7900ba940e232 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 01:39:13 +0900
+Subject: net: caif: Fix use-after-free in cfusbl_device_notify()
+
+From: Shigeru Yoshida <syoshida@redhat.com>
+
+[ Upstream commit 9781e98a97110f5e76999058368b4be76a788484 ]
+
+syzbot reported use-after-free in cfusbl_device_notify() [1]. This
+causes a stack trace like below:
+
+BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138
+Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214
+
+CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Workqueue: netns cleanup_net
+Call Trace:
+ <TASK>
+ __dump_stack lib/dump_stack.c:88 [inline]
+ dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
+ print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
+ print_report mm/kasan/report.c:429 [inline]
+ kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
+ cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138
+ notifier_call_chain+0xb5/0x200 kernel/notifier.c:87
+ call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945
+ call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
+ call_netdevice_notifiers net/core/dev.c:1997 [inline]
+ netdev_wait_allrefs_any net/core/dev.c:10227 [inline]
+ netdev_run_todo+0xbc0/0x10f0 net/core/dev.c:10341
+ default_device_exit_batch+0x44e/0x590 net/core/dev.c:11334
+ ops_exit_list+0x125/0x170 net/core/net_namespace.c:167
+ cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594
+ process_one_work+0x996/0x1610 kernel/workqueue.c:2289
+ worker_thread+0x665/0x1080 kernel/workqueue.c:2436
+ kthread+0x2e9/0x3a0 kernel/kthread.c:376
+ ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
+ </TASK>
+
+When unregistering a net device, unregister_netdevice_many_notify()
+sets the device's reg_state to NETREG_UNREGISTERING, calls notifiers
+with NETDEV_UNREGISTER, and adds the device to the todo list.
+
+Later on, devices in the todo list are processed by netdev_run_todo().
+netdev_run_todo() waits devices' reference count become 1 while
+rebdoadcasting NETDEV_UNREGISTER notification.
+
+When cfusbl_device_notify() is called with NETDEV_UNREGISTER multiple
+times, the parent device might be freed. This could cause UAF.
+Processing NETDEV_UNREGISTER multiple times also causes inbalance of
+reference count for the module.
+
+This patch fixes the issue by accepting only first NETDEV_UNREGISTER
+notification.
+
+Fixes: 7ad65bf68d70 ("caif: Add support for CAIF over CDC NCM USB interface")
+CC: sjur.brandeland@stericsson.com <sjur.brandeland@stericsson.com>
+Reported-by: syzbot+b563d33852b893653a9e@syzkaller.appspotmail.com
+Link: https://syzkaller.appspot.com/bug?id=c3bfd8e2450adab3bffe4d80821fbbced600407f [1]
+Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
+Link: https://lore.kernel.org/r/20230301163913.391304-1-syoshida@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/caif/caif_usb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
+index 46c62dd1479b8..862226be22868 100644
+--- a/net/caif/caif_usb.c
++++ b/net/caif/caif_usb.c
+@@ -134,6 +134,9 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what,
+ struct usb_device *usbdev;
+ int res;
+
++ if (what == NETDEV_UNREGISTER && dev->reg_state >= NETREG_UNREGISTERED)
++ return 0;
++
+ /* Check whether we have a NCM device, and find its VID/PID. */
+ if (!(dev->dev.parent && dev->dev.parent->driver &&
+ strcmp(dev->dev.parent->driver->name, "cdc_ncm") == 0))
+--
+2.39.2
+
--- /dev/null
+From fa9655a5eb449eb369573ec1f90ac53d6f671c1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Mar 2023 08:43:07 -0700
+Subject: net: lan78xx: fix accessing the LAN7800's internal phy specific
+ registers from the MAC driver
+
+From: Yuiko Oshino <yuiko.oshino@microchip.com>
+
+[ Upstream commit e57cf3639c323eeed05d3725fd82f91b349adca8 ]
+
+Move the LAN7800 internal phy (phy ID 0x0007c132) specific register
+accesses to the phy driver (microchip.c).
+
+Fix the error reported by Enguerrand de Ribaucourt in December 2022,
+"Some operations during the cable switch workaround modify the register
+LAN88XX_INT_MASK of the PHY. However, this register is specific to the
+LAN8835 PHY. For instance, if a DP8322I PHY is connected to the LAN7801,
+that register (0x19), corresponds to the LED and MAC address
+configuration, resulting in unapropriate behavior."
+
+I did not test with the DP8322I PHY, but I tested with an EVB-LAN7800
+with the internal PHY.
+
+Fixes: 14437e3fa284 ("lan78xx: workaround of forced 100 Full/Half duplex mode error")
+Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/20230301154307.30438-1-yuiko.oshino@microchip.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/microchip.c | 32 ++++++++++++++++++++++++++++++++
+ drivers/net/usb/lan78xx.c | 27 +--------------------------
+ 2 files changed, 33 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/net/phy/microchip.c b/drivers/net/phy/microchip.c
+index a644e8e5071c3..375bbd60b38af 100644
+--- a/drivers/net/phy/microchip.c
++++ b/drivers/net/phy/microchip.c
+@@ -326,6 +326,37 @@ static int lan88xx_config_aneg(struct phy_device *phydev)
+ return genphy_config_aneg(phydev);
+ }
+
++static void lan88xx_link_change_notify(struct phy_device *phydev)
++{
++ int temp;
++
++ /* At forced 100 F/H mode, chip may fail to set mode correctly
++ * when cable is switched between long(~50+m) and short one.
++ * As workaround, set to 10 before setting to 100
++ * at forced 100 F/H mode.
++ */
++ if (!phydev->autoneg && phydev->speed == 100) {
++ /* disable phy interrupt */
++ temp = phy_read(phydev, LAN88XX_INT_MASK);
++ temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_;
++ phy_write(phydev, LAN88XX_INT_MASK, temp);
++
++ temp = phy_read(phydev, MII_BMCR);
++ temp &= ~(BMCR_SPEED100 | BMCR_SPEED1000);
++ phy_write(phydev, MII_BMCR, temp); /* set to 10 first */
++ temp |= BMCR_SPEED100;
++ phy_write(phydev, MII_BMCR, temp); /* set to 100 later */
++
++ /* clear pending interrupt generated while workaround */
++ temp = phy_read(phydev, LAN88XX_INT_STS);
++
++ /* enable phy interrupt back */
++ temp = phy_read(phydev, LAN88XX_INT_MASK);
++ temp |= LAN88XX_INT_MASK_MDINTPIN_EN_;
++ phy_write(phydev, LAN88XX_INT_MASK, temp);
++ }
++}
++
+ static struct phy_driver microchip_phy_driver[] = {
+ {
+ .phy_id = 0x0007c130,
+@@ -339,6 +370,7 @@ static struct phy_driver microchip_phy_driver[] = {
+
+ .config_init = lan88xx_config_init,
+ .config_aneg = lan88xx_config_aneg,
++ .link_change_notify = lan88xx_link_change_notify,
+
+ .ack_interrupt = lan88xx_phy_ack_interrupt,
+ .config_intr = lan88xx_phy_config_intr,
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index 5454a20384284..b51017966bb37 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -1851,33 +1851,8 @@ static void lan78xx_remove_mdio(struct lan78xx_net *dev)
+ static void lan78xx_link_status_change(struct net_device *net)
+ {
+ struct phy_device *phydev = net->phydev;
+- int temp;
+-
+- /* At forced 100 F/H mode, chip may fail to set mode correctly
+- * when cable is switched between long(~50+m) and short one.
+- * As workaround, set to 10 before setting to 100
+- * at forced 100 F/H mode.
+- */
+- if (!phydev->autoneg && (phydev->speed == 100)) {
+- /* disable phy interrupt */
+- temp = phy_read(phydev, LAN88XX_INT_MASK);
+- temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_;
+- phy_write(phydev, LAN88XX_INT_MASK, temp);
+
+- temp = phy_read(phydev, MII_BMCR);
+- temp &= ~(BMCR_SPEED100 | BMCR_SPEED1000);
+- phy_write(phydev, MII_BMCR, temp); /* set to 10 first */
+- temp |= BMCR_SPEED100;
+- phy_write(phydev, MII_BMCR, temp); /* set to 100 later */
+-
+- /* clear pending interrupt generated while workaround */
+- temp = phy_read(phydev, LAN88XX_INT_STS);
+-
+- /* enable phy interrupt back */
+- temp = phy_read(phydev, LAN88XX_INT_MASK);
+- temp |= LAN88XX_INT_MASK_MDINTPIN_EN_;
+- phy_write(phydev, LAN88XX_INT_MASK, temp);
+- }
++ phy_print_status(phydev);
+ }
+
+ static int irq_map(struct irq_domain *d, unsigned int irq,
+--
+2.39.2
+
--- /dev/null
+From a3f763d342f8bf0cecebf73d7102e86eb4536413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 11:23:46 +0800
+Subject: net/smc: fix fallback failed while sendmsg with fastopen
+
+From: D. Wythe <alibuda@linux.alibaba.com>
+
+[ Upstream commit ce7ca794712f186da99719e8b4e97bd5ddbb04c3 ]
+
+Before determining whether the msg has unsupported options, it has been
+prematurely terminated by the wrong status check.
+
+For the application, the general usages of MSG_FASTOPEN likes
+
+fd = socket(...)
+/* rather than connect */
+sendto(fd, data, len, MSG_FASTOPEN)
+
+Hence, We need to check the flag before state check, because the sock
+state here is always SMC_INIT when applications tries MSG_FASTOPEN.
+Once we found unsupported options, fallback it to TCP.
+
+Fixes: ee9dfbef02d1 ("net/smc: handle sockopts forcing fallback")
+Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
+Signed-off-by: Simon Horman <simon.horman@corigine.com>
+
+v2 -> v1: Optimize code style
+Reviewed-by: Tony Lu <tonylu@linux.alibaba.com>
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/af_smc.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 5d696b7fb47e1..b398d72a7bc39 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1542,16 +1542,14 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ {
+ struct sock *sk = sock->sk;
+ struct smc_sock *smc;
+- int rc = -EPIPE;
++ int rc;
+
+ smc = smc_sk(sk);
+ lock_sock(sk);
+- if ((sk->sk_state != SMC_ACTIVE) &&
+- (sk->sk_state != SMC_APPCLOSEWAIT1) &&
+- (sk->sk_state != SMC_INIT))
+- goto out;
+
++ /* SMC does not support connect with fastopen */
+ if (msg->msg_flags & MSG_FASTOPEN) {
++ /* not connected yet, fallback */
+ if (sk->sk_state == SMC_INIT && !smc->connect_nonblock) {
+ smc_switch_to_fallback(smc);
+ smc->fallback_rsn = SMC_CLC_DECL_OPTUNSUPP;
+@@ -1559,6 +1557,11 @@ static int smc_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ rc = -EINVAL;
+ goto out;
+ }
++ } else if ((sk->sk_state != SMC_ACTIVE) &&
++ (sk->sk_state != SMC_APPCLOSEWAIT1) &&
++ (sk->sk_state != SMC_INIT)) {
++ rc = -EPIPE;
++ goto out;
+ }
+
+ if (smc->use_fallback)
+--
+2.39.2
+
--- /dev/null
+From 6304ebb3bb776dc69dc82b7978aa4726893d8637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Nov 2020 11:45:06 +0000
+Subject: net: usb: lan78xx: Remove lots of set but unused 'ret' variables
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lee Jones <lee.jones@linaro.org>
+
+[ Upstream commit 06cd7c46b3ab3f2252c61bf85b191236cf0254e1 ]
+
+Fixes the following W=1 kernel build warning(s):
+
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_read_raw_otp’:
+ drivers/net/usb/lan78xx.c:825:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_write_raw_otp’:
+ drivers/net/usb/lan78xx.c:879:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_deferred_multicast_write’:
+ drivers/net/usb/lan78xx.c:1041:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_update_flowcontrol’:
+ drivers/net/usb/lan78xx.c:1127:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_init_mac_address’:
+ drivers/net/usb/lan78xx.c:1666:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_link_status_change’:
+ drivers/net/usb/lan78xx.c:1841:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_irq_bus_sync_unlock’:
+ drivers/net/usb/lan78xx.c:1920:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan8835_fixup’:
+ drivers/net/usb/lan78xx.c:1994:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_rx_max_frame_length’:
+ drivers/net/usb/lan78xx.c:2192:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_change_mtu’:
+ drivers/net/usb/lan78xx.c:2270:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_mac_addr’:
+ drivers/net/usb/lan78xx.c:2299:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_features’:
+ drivers/net/usb/lan78xx.c:2333:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+ drivers/net/usb/lan78xx.c: In function ‘lan78xx_set_suspend’:
+ drivers/net/usb/lan78xx.c:3807:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable]
+
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Link: https://lore.kernel.org/r/20201102114512.1062724-25-lee.jones@linaro.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: e57cf3639c32 ("net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 168 ++++++++++++++++++--------------------
+ 1 file changed, 78 insertions(+), 90 deletions(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index ce3c8f476d75c..5454a20384284 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -824,20 +824,19 @@ static int lan78xx_read_raw_otp(struct lan78xx_net *dev, u32 offset,
+ u32 length, u8 *data)
+ {
+ int i;
+- int ret;
+ u32 buf;
+ unsigned long timeout;
+
+- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
+
+ if (buf & OTP_PWR_DN_PWRDN_N_) {
+ /* clear it and wait to be cleared */
+- ret = lan78xx_write_reg(dev, OTP_PWR_DN, 0);
++ lan78xx_write_reg(dev, OTP_PWR_DN, 0);
+
+ timeout = jiffies + HZ;
+ do {
+ usleep_range(1, 10);
+- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
+ if (time_after(jiffies, timeout)) {
+ netdev_warn(dev->net,
+ "timeout on OTP_PWR_DN");
+@@ -847,18 +846,18 @@ static int lan78xx_read_raw_otp(struct lan78xx_net *dev, u32 offset,
+ }
+
+ for (i = 0; i < length; i++) {
+- ret = lan78xx_write_reg(dev, OTP_ADDR1,
++ lan78xx_write_reg(dev, OTP_ADDR1,
+ ((offset + i) >> 8) & OTP_ADDR1_15_11);
+- ret = lan78xx_write_reg(dev, OTP_ADDR2,
++ lan78xx_write_reg(dev, OTP_ADDR2,
+ ((offset + i) & OTP_ADDR2_10_3));
+
+- ret = lan78xx_write_reg(dev, OTP_FUNC_CMD, OTP_FUNC_CMD_READ_);
+- ret = lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_);
++ lan78xx_write_reg(dev, OTP_FUNC_CMD, OTP_FUNC_CMD_READ_);
++ lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_);
+
+ timeout = jiffies + HZ;
+ do {
+ udelay(1);
+- ret = lan78xx_read_reg(dev, OTP_STATUS, &buf);
++ lan78xx_read_reg(dev, OTP_STATUS, &buf);
+ if (time_after(jiffies, timeout)) {
+ netdev_warn(dev->net,
+ "timeout on OTP_STATUS");
+@@ -866,7 +865,7 @@ static int lan78xx_read_raw_otp(struct lan78xx_net *dev, u32 offset,
+ }
+ } while (buf & OTP_STATUS_BUSY_);
+
+- ret = lan78xx_read_reg(dev, OTP_RD_DATA, &buf);
++ lan78xx_read_reg(dev, OTP_RD_DATA, &buf);
+
+ data[i] = (u8)(buf & 0xFF);
+ }
+@@ -878,20 +877,19 @@ static int lan78xx_write_raw_otp(struct lan78xx_net *dev, u32 offset,
+ u32 length, u8 *data)
+ {
+ int i;
+- int ret;
+ u32 buf;
+ unsigned long timeout;
+
+- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
+
+ if (buf & OTP_PWR_DN_PWRDN_N_) {
+ /* clear it and wait to be cleared */
+- ret = lan78xx_write_reg(dev, OTP_PWR_DN, 0);
++ lan78xx_write_reg(dev, OTP_PWR_DN, 0);
+
+ timeout = jiffies + HZ;
+ do {
+ udelay(1);
+- ret = lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
++ lan78xx_read_reg(dev, OTP_PWR_DN, &buf);
+ if (time_after(jiffies, timeout)) {
+ netdev_warn(dev->net,
+ "timeout on OTP_PWR_DN completion");
+@@ -901,21 +899,21 @@ static int lan78xx_write_raw_otp(struct lan78xx_net *dev, u32 offset,
+ }
+
+ /* set to BYTE program mode */
+- ret = lan78xx_write_reg(dev, OTP_PRGM_MODE, OTP_PRGM_MODE_BYTE_);
++ lan78xx_write_reg(dev, OTP_PRGM_MODE, OTP_PRGM_MODE_BYTE_);
+
+ for (i = 0; i < length; i++) {
+- ret = lan78xx_write_reg(dev, OTP_ADDR1,
++ lan78xx_write_reg(dev, OTP_ADDR1,
+ ((offset + i) >> 8) & OTP_ADDR1_15_11);
+- ret = lan78xx_write_reg(dev, OTP_ADDR2,
++ lan78xx_write_reg(dev, OTP_ADDR2,
+ ((offset + i) & OTP_ADDR2_10_3));
+- ret = lan78xx_write_reg(dev, OTP_PRGM_DATA, data[i]);
+- ret = lan78xx_write_reg(dev, OTP_TST_CMD, OTP_TST_CMD_PRGVRFY_);
+- ret = lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_);
++ lan78xx_write_reg(dev, OTP_PRGM_DATA, data[i]);
++ lan78xx_write_reg(dev, OTP_TST_CMD, OTP_TST_CMD_PRGVRFY_);
++ lan78xx_write_reg(dev, OTP_CMD_GO, OTP_CMD_GO_GO_);
+
+ timeout = jiffies + HZ;
+ do {
+ udelay(1);
+- ret = lan78xx_read_reg(dev, OTP_STATUS, &buf);
++ lan78xx_read_reg(dev, OTP_STATUS, &buf);
+ if (time_after(jiffies, timeout)) {
+ netdev_warn(dev->net,
+ "Timeout on OTP_STATUS completion");
+@@ -1040,7 +1038,6 @@ static void lan78xx_deferred_multicast_write(struct work_struct *param)
+ container_of(param, struct lan78xx_priv, set_multicast);
+ struct lan78xx_net *dev = pdata->dev;
+ int i;
+- int ret;
+
+ netif_dbg(dev, drv, dev->net, "deferred multicast write 0x%08x\n",
+ pdata->rfe_ctl);
+@@ -1049,14 +1046,14 @@ static void lan78xx_deferred_multicast_write(struct work_struct *param)
+ DP_SEL_VHF_HASH_LEN, pdata->mchash_table);
+
+ for (i = 1; i < NUM_OF_MAF; i++) {
+- ret = lan78xx_write_reg(dev, MAF_HI(i), 0);
+- ret = lan78xx_write_reg(dev, MAF_LO(i),
++ lan78xx_write_reg(dev, MAF_HI(i), 0);
++ lan78xx_write_reg(dev, MAF_LO(i),
+ pdata->pfilter_table[i][1]);
+- ret = lan78xx_write_reg(dev, MAF_HI(i),
++ lan78xx_write_reg(dev, MAF_HI(i),
+ pdata->pfilter_table[i][0]);
+ }
+
+- ret = lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
++ lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
+ }
+
+ static void lan78xx_set_multicast(struct net_device *netdev)
+@@ -1126,7 +1123,6 @@ static int lan78xx_update_flowcontrol(struct lan78xx_net *dev, u8 duplex,
+ u16 lcladv, u16 rmtadv)
+ {
+ u32 flow = 0, fct_flow = 0;
+- int ret;
+ u8 cap;
+
+ if (dev->fc_autoneg)
+@@ -1149,10 +1145,10 @@ static int lan78xx_update_flowcontrol(struct lan78xx_net *dev, u8 duplex,
+ (cap & FLOW_CTRL_RX ? "enabled" : "disabled"),
+ (cap & FLOW_CTRL_TX ? "enabled" : "disabled"));
+
+- ret = lan78xx_write_reg(dev, FCT_FLOW, fct_flow);
++ lan78xx_write_reg(dev, FCT_FLOW, fct_flow);
+
+ /* threshold value should be set before enabling flow */
+- ret = lan78xx_write_reg(dev, FLOW, flow);
++ lan78xx_write_reg(dev, FLOW, flow);
+
+ return 0;
+ }
+@@ -1681,11 +1677,10 @@ static int lan78xx_ioctl(struct net_device *netdev, struct ifreq *rq, int cmd)
+ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ {
+ u32 addr_lo, addr_hi;
+- int ret;
+ u8 addr[6];
+
+- ret = lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
+- ret = lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
++ lan78xx_read_reg(dev, RX_ADDRL, &addr_lo);
++ lan78xx_read_reg(dev, RX_ADDRH, &addr_hi);
+
+ addr[0] = addr_lo & 0xFF;
+ addr[1] = (addr_lo >> 8) & 0xFF;
+@@ -1718,12 +1713,12 @@ static void lan78xx_init_mac_address(struct lan78xx_net *dev)
+ (addr[2] << 16) | (addr[3] << 24);
+ addr_hi = addr[4] | (addr[5] << 8);
+
+- ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+- ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
++ lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
+ }
+
+- ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+- ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
+
+ ether_addr_copy(dev->net->dev_addr, addr);
+ }
+@@ -1856,7 +1851,7 @@ static void lan78xx_remove_mdio(struct lan78xx_net *dev)
+ static void lan78xx_link_status_change(struct net_device *net)
+ {
+ struct phy_device *phydev = net->phydev;
+- int ret, temp;
++ int temp;
+
+ /* At forced 100 F/H mode, chip may fail to set mode correctly
+ * when cable is switched between long(~50+m) and short one.
+@@ -1867,7 +1862,7 @@ static void lan78xx_link_status_change(struct net_device *net)
+ /* disable phy interrupt */
+ temp = phy_read(phydev, LAN88XX_INT_MASK);
+ temp &= ~LAN88XX_INT_MASK_MDINTPIN_EN_;
+- ret = phy_write(phydev, LAN88XX_INT_MASK, temp);
++ phy_write(phydev, LAN88XX_INT_MASK, temp);
+
+ temp = phy_read(phydev, MII_BMCR);
+ temp &= ~(BMCR_SPEED100 | BMCR_SPEED1000);
+@@ -1881,7 +1876,7 @@ static void lan78xx_link_status_change(struct net_device *net)
+ /* enable phy interrupt back */
+ temp = phy_read(phydev, LAN88XX_INT_MASK);
+ temp |= LAN88XX_INT_MASK_MDINTPIN_EN_;
+- ret = phy_write(phydev, LAN88XX_INT_MASK, temp);
++ phy_write(phydev, LAN88XX_INT_MASK, temp);
+ }
+ }
+
+@@ -1935,14 +1930,13 @@ static void lan78xx_irq_bus_sync_unlock(struct irq_data *irqd)
+ struct lan78xx_net *dev =
+ container_of(data, struct lan78xx_net, domain_data);
+ u32 buf;
+- int ret;
+
+ /* call register access here because irq_bus_lock & irq_bus_sync_unlock
+ * are only two callbacks executed in non-atomic contex.
+ */
+- ret = lan78xx_read_reg(dev, INT_EP_CTL, &buf);
++ lan78xx_read_reg(dev, INT_EP_CTL, &buf);
+ if (buf != data->irqenable)
+- ret = lan78xx_write_reg(dev, INT_EP_CTL, data->irqenable);
++ lan78xx_write_reg(dev, INT_EP_CTL, data->irqenable);
+
+ mutex_unlock(&data->irq_lock);
+ }
+@@ -2009,7 +2003,6 @@ static void lan78xx_remove_irq_domain(struct lan78xx_net *dev)
+ static int lan8835_fixup(struct phy_device *phydev)
+ {
+ int buf;
+- int ret;
+ struct lan78xx_net *dev = netdev_priv(phydev->attached_dev);
+
+ /* LED2/PME_N/IRQ_N/RGMII_ID pin to IRQ_N mode */
+@@ -2019,11 +2012,11 @@ static int lan8835_fixup(struct phy_device *phydev)
+ phy_write_mmd(phydev, MDIO_MMD_PCS, 0x8010, buf);
+
+ /* RGMII MAC TXC Delay Enable */
+- ret = lan78xx_write_reg(dev, MAC_RGMII_ID,
++ lan78xx_write_reg(dev, MAC_RGMII_ID,
+ MAC_RGMII_ID_TXC_DELAY_EN_);
+
+ /* RGMII TX DLL Tune Adjust */
+- ret = lan78xx_write_reg(dev, RGMII_TX_BYP_DLL, 0x3D00);
++ lan78xx_write_reg(dev, RGMII_TX_BYP_DLL, 0x3D00);
+
+ dev->interface = PHY_INTERFACE_MODE_RGMII_TXID;
+
+@@ -2207,28 +2200,27 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
+
+ static int lan78xx_set_rx_max_frame_length(struct lan78xx_net *dev, int size)
+ {
+- int ret = 0;
+ u32 buf;
+ bool rxenabled;
+
+- ret = lan78xx_read_reg(dev, MAC_RX, &buf);
++ lan78xx_read_reg(dev, MAC_RX, &buf);
+
+ rxenabled = ((buf & MAC_RX_RXEN_) != 0);
+
+ if (rxenabled) {
+ buf &= ~MAC_RX_RXEN_;
+- ret = lan78xx_write_reg(dev, MAC_RX, buf);
++ lan78xx_write_reg(dev, MAC_RX, buf);
+ }
+
+ /* add 4 to size for FCS */
+ buf &= ~MAC_RX_MAX_SIZE_MASK_;
+ buf |= (((size + 4) << MAC_RX_MAX_SIZE_SHIFT_) & MAC_RX_MAX_SIZE_MASK_);
+
+- ret = lan78xx_write_reg(dev, MAC_RX, buf);
++ lan78xx_write_reg(dev, MAC_RX, buf);
+
+ if (rxenabled) {
+ buf |= MAC_RX_RXEN_;
+- ret = lan78xx_write_reg(dev, MAC_RX, buf);
++ lan78xx_write_reg(dev, MAC_RX, buf);
+ }
+
+ return 0;
+@@ -2285,13 +2277,12 @@ static int lan78xx_change_mtu(struct net_device *netdev, int new_mtu)
+ int ll_mtu = new_mtu + netdev->hard_header_len;
+ int old_hard_mtu = dev->hard_mtu;
+ int old_rx_urb_size = dev->rx_urb_size;
+- int ret;
+
+ /* no second zero-length packet read wanted after mtu-sized packets */
+ if ((ll_mtu % dev->maxpacket) == 0)
+ return -EDOM;
+
+- ret = lan78xx_set_rx_max_frame_length(dev, new_mtu + VLAN_ETH_HLEN);
++ lan78xx_set_rx_max_frame_length(dev, new_mtu + VLAN_ETH_HLEN);
+
+ netdev->mtu = new_mtu;
+
+@@ -2314,7 +2305,6 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)
+ struct lan78xx_net *dev = netdev_priv(netdev);
+ struct sockaddr *addr = p;
+ u32 addr_lo, addr_hi;
+- int ret;
+
+ if (netif_running(netdev))
+ return -EBUSY;
+@@ -2331,12 +2321,12 @@ static int lan78xx_set_mac_addr(struct net_device *netdev, void *p)
+ addr_hi = netdev->dev_addr[4] |
+ netdev->dev_addr[5] << 8;
+
+- ret = lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
+- ret = lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
++ lan78xx_write_reg(dev, RX_ADDRL, addr_lo);
++ lan78xx_write_reg(dev, RX_ADDRH, addr_hi);
+
+ /* Added to support MAC address changes */
+- ret = lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
+- ret = lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
++ lan78xx_write_reg(dev, MAF_LO(0), addr_lo);
++ lan78xx_write_reg(dev, MAF_HI(0), addr_hi | MAF_HI_VALID_);
+
+ return 0;
+ }
+@@ -2348,7 +2338,6 @@ static int lan78xx_set_features(struct net_device *netdev,
+ struct lan78xx_net *dev = netdev_priv(netdev);
+ struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
+ unsigned long flags;
+- int ret;
+
+ spin_lock_irqsave(&pdata->rfe_ctl_lock, flags);
+
+@@ -2372,7 +2361,7 @@ static int lan78xx_set_features(struct net_device *netdev,
+
+ spin_unlock_irqrestore(&pdata->rfe_ctl_lock, flags);
+
+- ret = lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
++ lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
+
+ return 0;
+ }
+@@ -3828,7 +3817,6 @@ static u16 lan78xx_wakeframe_crc16(const u8 *buf, int len)
+ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol)
+ {
+ u32 buf;
+- int ret;
+ int mask_index;
+ u16 crc;
+ u32 temp_wucsr;
+@@ -3837,26 +3825,26 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol)
+ const u8 ipv6_multicast[3] = { 0x33, 0x33 };
+ const u8 arp_type[2] = { 0x08, 0x06 };
+
+- ret = lan78xx_read_reg(dev, MAC_TX, &buf);
++ lan78xx_read_reg(dev, MAC_TX, &buf);
+ buf &= ~MAC_TX_TXEN_;
+- ret = lan78xx_write_reg(dev, MAC_TX, buf);
+- ret = lan78xx_read_reg(dev, MAC_RX, &buf);
++ lan78xx_write_reg(dev, MAC_TX, buf);
++ lan78xx_read_reg(dev, MAC_RX, &buf);
+ buf &= ~MAC_RX_RXEN_;
+- ret = lan78xx_write_reg(dev, MAC_RX, buf);
++ lan78xx_write_reg(dev, MAC_RX, buf);
+
+- ret = lan78xx_write_reg(dev, WUCSR, 0);
+- ret = lan78xx_write_reg(dev, WUCSR2, 0);
+- ret = lan78xx_write_reg(dev, WK_SRC, 0xFFF1FF1FUL);
++ lan78xx_write_reg(dev, WUCSR, 0);
++ lan78xx_write_reg(dev, WUCSR2, 0);
++ lan78xx_write_reg(dev, WK_SRC, 0xFFF1FF1FUL);
+
+ temp_wucsr = 0;
+
+ temp_pmt_ctl = 0;
+- ret = lan78xx_read_reg(dev, PMT_CTL, &temp_pmt_ctl);
++ lan78xx_read_reg(dev, PMT_CTL, &temp_pmt_ctl);
+ temp_pmt_ctl &= ~PMT_CTL_RES_CLR_WKP_EN_;
+ temp_pmt_ctl |= PMT_CTL_RES_CLR_WKP_STS_;
+
+ for (mask_index = 0; mask_index < NUM_OF_WUF_CFG; mask_index++)
+- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_CFG(mask_index), 0);
+
+ mask_index = 0;
+ if (wol & WAKE_PHY) {
+@@ -3885,30 +3873,30 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol)
+
+ /* set WUF_CFG & WUF_MASK for IPv4 Multicast */
+ crc = lan78xx_wakeframe_crc16(ipv4_multicast, 3);
+- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index),
++ lan78xx_write_reg(dev, WUF_CFG(mask_index),
+ WUF_CFGX_EN_ |
+ WUF_CFGX_TYPE_MCAST_ |
+ (0 << WUF_CFGX_OFFSET_SHIFT_) |
+ (crc & WUF_CFGX_CRC16_MASK_));
+
+- ret = lan78xx_write_reg(dev, WUF_MASK0(mask_index), 7);
+- ret = lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0);
+- ret = lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0);
+- ret = lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK0(mask_index), 7);
++ lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0);
+ mask_index++;
+
+ /* for IPv6 Multicast */
+ crc = lan78xx_wakeframe_crc16(ipv6_multicast, 2);
+- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index),
++ lan78xx_write_reg(dev, WUF_CFG(mask_index),
+ WUF_CFGX_EN_ |
+ WUF_CFGX_TYPE_MCAST_ |
+ (0 << WUF_CFGX_OFFSET_SHIFT_) |
+ (crc & WUF_CFGX_CRC16_MASK_));
+
+- ret = lan78xx_write_reg(dev, WUF_MASK0(mask_index), 3);
+- ret = lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0);
+- ret = lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0);
+- ret = lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK0(mask_index), 3);
++ lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0);
+ mask_index++;
+
+ temp_pmt_ctl |= PMT_CTL_WOL_EN_;
+@@ -3929,16 +3917,16 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol)
+ * for packettype (offset 12,13) = ARP (0x0806)
+ */
+ crc = lan78xx_wakeframe_crc16(arp_type, 2);
+- ret = lan78xx_write_reg(dev, WUF_CFG(mask_index),
++ lan78xx_write_reg(dev, WUF_CFG(mask_index),
+ WUF_CFGX_EN_ |
+ WUF_CFGX_TYPE_ALL_ |
+ (0 << WUF_CFGX_OFFSET_SHIFT_) |
+ (crc & WUF_CFGX_CRC16_MASK_));
+
+- ret = lan78xx_write_reg(dev, WUF_MASK0(mask_index), 0x3000);
+- ret = lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0);
+- ret = lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0);
+- ret = lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK0(mask_index), 0x3000);
++ lan78xx_write_reg(dev, WUF_MASK1(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK2(mask_index), 0);
++ lan78xx_write_reg(dev, WUF_MASK3(mask_index), 0);
+ mask_index++;
+
+ temp_pmt_ctl |= PMT_CTL_WOL_EN_;
+@@ -3946,7 +3934,7 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol)
+ temp_pmt_ctl |= PMT_CTL_SUS_MODE_0_;
+ }
+
+- ret = lan78xx_write_reg(dev, WUCSR, temp_wucsr);
++ lan78xx_write_reg(dev, WUCSR, temp_wucsr);
+
+ /* when multiple WOL bits are set */
+ if (hweight_long((unsigned long)wol) > 1) {
+@@ -3954,16 +3942,16 @@ static int lan78xx_set_suspend(struct lan78xx_net *dev, u32 wol)
+ temp_pmt_ctl &= ~PMT_CTL_SUS_MODE_MASK_;
+ temp_pmt_ctl |= PMT_CTL_SUS_MODE_0_;
+ }
+- ret = lan78xx_write_reg(dev, PMT_CTL, temp_pmt_ctl);
++ lan78xx_write_reg(dev, PMT_CTL, temp_pmt_ctl);
+
+ /* clear WUPS */
+- ret = lan78xx_read_reg(dev, PMT_CTL, &buf);
++ lan78xx_read_reg(dev, PMT_CTL, &buf);
+ buf |= PMT_CTL_WUPS_MASK_;
+- ret = lan78xx_write_reg(dev, PMT_CTL, buf);
++ lan78xx_write_reg(dev, PMT_CTL, buf);
+
+- ret = lan78xx_read_reg(dev, MAC_RX, &buf);
++ lan78xx_read_reg(dev, MAC_RX, &buf);
+ buf |= MAC_RX_RXEN_;
+- ret = lan78xx_write_reg(dev, MAC_RX, buf);
++ lan78xx_write_reg(dev, MAC_RX, buf);
+
+ return 0;
+ }
+--
+2.39.2
+
--- /dev/null
+From 6e472a7a1a037504449aff9daf24b7bfbf8630ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Mar 2023 10:58:56 +0100
+Subject: netfilter: tproxy: fix deadlock due to missing BH disable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 4a02426787bf024dafdb79b362285ee325de3f5e ]
+
+The xtables packet traverser performs an unconditional local_bh_disable(),
+but the nf_tables evaluation loop does not.
+
+Functions that are called from either xtables or nftables must assume
+that they can be called in process context.
+
+inet_twsk_deschedule_put() assumes that no softirq interrupt can occur.
+If tproxy is used from nf_tables its possible that we'll deadlock
+trying to aquire a lock already held in process context.
+
+Add a small helper that takes care of this and use it.
+
+Link: https://lore.kernel.org/netfilter-devel/401bd6ed-314a-a196-1cdc-e13c720cc8f2@balasys.hu/
+Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support")
+Reported-and-tested-by: Major Dávid <major.david@balasys.hu>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/netfilter/nf_tproxy.h | 7 +++++++
+ net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +-
+ net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 +-
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/netfilter/nf_tproxy.h b/include/net/netfilter/nf_tproxy.h
+index 82d0e41b76f22..faa108b1ba675 100644
+--- a/include/net/netfilter/nf_tproxy.h
++++ b/include/net/netfilter/nf_tproxy.h
+@@ -17,6 +17,13 @@ static inline bool nf_tproxy_sk_is_transparent(struct sock *sk)
+ return false;
+ }
+
++static inline void nf_tproxy_twsk_deschedule_put(struct inet_timewait_sock *tw)
++{
++ local_bh_disable();
++ inet_twsk_deschedule_put(tw);
++ local_bh_enable();
++}
++
+ /* assign a socket to the skb -- consumes sk */
+ static inline void nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
+ {
+diff --git a/net/ipv4/netfilter/nf_tproxy_ipv4.c b/net/ipv4/netfilter/nf_tproxy_ipv4.c
+index b2bae0b0e42a1..61cb2341f50fe 100644
+--- a/net/ipv4/netfilter/nf_tproxy_ipv4.c
++++ b/net/ipv4/netfilter/nf_tproxy_ipv4.c
+@@ -38,7 +38,7 @@ nf_tproxy_handle_time_wait4(struct net *net, struct sk_buff *skb,
+ hp->source, lport ? lport : hp->dest,
+ skb->dev, NF_TPROXY_LOOKUP_LISTENER);
+ if (sk2) {
+- inet_twsk_deschedule_put(inet_twsk(sk));
++ nf_tproxy_twsk_deschedule_put(inet_twsk(sk));
+ sk = sk2;
+ }
+ }
+diff --git a/net/ipv6/netfilter/nf_tproxy_ipv6.c b/net/ipv6/netfilter/nf_tproxy_ipv6.c
+index 34d51cd426b0c..00761924f2766 100644
+--- a/net/ipv6/netfilter/nf_tproxy_ipv6.c
++++ b/net/ipv6/netfilter/nf_tproxy_ipv6.c
+@@ -63,7 +63,7 @@ nf_tproxy_handle_time_wait6(struct sk_buff *skb, int tproto, int thoff,
+ lport ? lport : hp->dest,
+ skb->dev, NF_TPROXY_LOOKUP_LISTENER);
+ if (sk2) {
+- inet_twsk_deschedule_put(inet_twsk(sk));
++ nf_tproxy_twsk_deschedule_put(inet_twsk(sk));
+ sk = sk2;
+ }
+ }
+--
+2.39.2
+
--- /dev/null
+From f906d734248db2a2f88807176f746a433e8cdda8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 17:30:37 +0800
+Subject: nfc: fdp: add null check of devm_kmalloc_array in
+ fdp_nci_i2c_read_device_properties
+
+From: Kang Chen <void0red@gmail.com>
+
+[ Upstream commit 11f180a5d62a51b484e9648f9b310e1bd50b1a57 ]
+
+devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause
+out-of-bounds write in device_property_read_u8_array later.
+
+Fixes: a06347c04c13 ("NFC: Add Intel Fields Peak NFC solution driver")
+Signed-off-by: Kang Chen <void0red@gmail.com>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Simon Horman <simon.horman@corigine.com>
+Link: https://lore.kernel.org/r/20230227093037.907654-1-void0red@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/fdp/i2c.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
+index ad0abb1f0bae9..7305f1a06e97c 100644
+--- a/drivers/nfc/fdp/i2c.c
++++ b/drivers/nfc/fdp/i2c.c
+@@ -255,6 +255,9 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
+ len, sizeof(**fw_vsc_cfg),
+ GFP_KERNEL);
+
++ if (!*fw_vsc_cfg)
++ goto alloc_err;
++
+ r = device_property_read_u8_array(dev, FDP_DP_FW_VSC_CFG_NAME,
+ *fw_vsc_cfg, len);
+
+@@ -268,6 +271,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
+ *fw_vsc_cfg = NULL;
+ }
+
++alloc_err:
+ dev_dbg(dev, "Clock type: %d, clock frequency: %d, VSC: %s",
+ *clock_type, *clock_freq, *fw_vsc_cfg != NULL ? "yes" : "no");
+ }
+--
+2.39.2
+
--- /dev/null
+From bf37e6388dc21d42ea1cdca38b9ac990b4042fed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Sep 2022 13:00:37 -0700
+Subject: RISC-V: Avoid dereferening NULL regs in die()
+
+From: Palmer Dabbelt <palmer@rivosinc.com>
+
+[ Upstream commit f2913d006fcdb61719635e093d1b5dd0dafecac7 ]
+
+I don't think we can actually die() without a regs pointer, but the
+compiler was warning about a NULL check after a dereference. It seems
+prudent to just avoid the possibly-NULL dereference, given that when
+die()ing the system is already toast so who knows how we got there.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20220920200037.6727-1-palmer@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Stable-dep-of: 130aee3fd998 ("riscv: Avoid enabling interrupts in die()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/traps.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index 030094ac71902..5ca5a04258d0d 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -31,6 +31,7 @@ void die(struct pt_regs *regs, const char *str)
+ {
+ static int die_counter;
+ int ret;
++ long cause;
+
+ oops_enter();
+
+@@ -40,11 +41,13 @@ void die(struct pt_regs *regs, const char *str)
+
+ pr_emerg("%s [#%d]\n", str, ++die_counter);
+ print_modules();
+- show_regs(regs);
++ if (regs)
++ show_regs(regs);
+
+- ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV);
++ cause = regs ? regs->cause : -1;
++ ret = notify_die(DIE_OOPS, str, regs, 0, cause, SIGSEGV);
+
+- if (regs && kexec_should_crash(current))
++ if (kexec_should_crash(current))
+ crash_kexec(regs);
+
+ bust_spinlocks(0);
+--
+2.39.2
+
--- /dev/null
+From 3ef295cec87891ddcce650d9aea368d2179be8c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 13:10:32 +0100
+Subject: riscv: abstract out CSR names for supervisor vs machine mode
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit a4c3733d32a72f11dee86d0731d7565aa6ebe22d ]
+
+Many of the privileged CSRs exist in a supervisor and machine version
+that are used very similarly. Provide versions of the CSR names and
+fields that map to either the S-mode or M-mode variant depending on
+a new CONFIG_RISCV_M_MODE kconfig symbol.
+
+Contains contributions from Damien Le Moal <Damien.LeMoal@wdc.com>
+and Paul Walmsley <paul.walmsley@sifive.com>.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Thomas Gleixner <tglx@linutronix.de> # for drivers/clocksource, drivers/irqchip
+[paul.walmsley@sifive.com: updated to apply]
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Stable-dep-of: 130aee3fd998 ("riscv: Avoid enabling interrupts in die()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Kconfig | 4 ++
+ arch/riscv/include/asm/csr.h | 72 +++++++++++++++++++++++++----
+ arch/riscv/include/asm/irqflags.h | 12 ++---
+ arch/riscv/include/asm/processor.h | 2 +-
+ arch/riscv/include/asm/ptrace.h | 16 +++----
+ arch/riscv/include/asm/switch_to.h | 10 ++--
+ arch/riscv/kernel/asm-offsets.c | 8 ++--
+ arch/riscv/kernel/entry.S | 74 +++++++++++++++++-------------
+ arch/riscv/kernel/fpu.S | 8 ++--
+ arch/riscv/kernel/head.S | 12 ++---
+ arch/riscv/kernel/irq.c | 17 ++-----
+ arch/riscv/kernel/perf_callchain.c | 2 +-
+ arch/riscv/kernel/process.c | 17 +++----
+ arch/riscv/kernel/signal.c | 21 ++++-----
+ arch/riscv/kernel/smp.c | 2 +-
+ arch/riscv/kernel/traps.c | 16 +++----
+ arch/riscv/lib/uaccess.S | 12 ++---
+ arch/riscv/mm/extable.c | 4 +-
+ arch/riscv/mm/fault.c | 6 +--
+ drivers/clocksource/timer-riscv.c | 8 ++--
+ drivers/irqchip/irq-sifive-plic.c | 11 +++--
+ 21 files changed, 199 insertions(+), 135 deletions(-)
+
+diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
+index e0a77af5c130c..c21ebdb969570 100644
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -72,6 +72,10 @@ config ARCH_MMAP_RND_BITS_MAX
+ default 24 if 64BIT # SV39 based
+ default 17
+
++# set if we run in machine mode, cleared if we run in supervisor mode
++config RISCV_M_MODE
++ bool
++
+ config MMU
+ def_bool y
+
+diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h
+index a18923fa23c80..0ab6428110280 100644
+--- a/arch/riscv/include/asm/csr.h
++++ b/arch/riscv/include/asm/csr.h
+@@ -11,8 +11,11 @@
+
+ /* Status register flags */
+ #define SR_SIE _AC(0x00000002, UL) /* Supervisor Interrupt Enable */
++#define SR_MIE _AC(0x00000008, UL) /* Machine Interrupt Enable */
+ #define SR_SPIE _AC(0x00000020, UL) /* Previous Supervisor IE */
++#define SR_MPIE _AC(0x00000080, UL) /* Previous Machine IE */
+ #define SR_SPP _AC(0x00000100, UL) /* Previously Supervisor */
++#define SR_MPP _AC(0x00001800, UL) /* Previously Machine */
+ #define SR_SUM _AC(0x00040000, UL) /* Supervisor User Memory Access */
+
+ #define SR_FS _AC(0x00006000, UL) /* Floating-point Status */
+@@ -44,9 +47,10 @@
+ #define SATP_MODE SATP_MODE_39
+ #endif
+
+-/* SCAUSE */
+-#define SCAUSE_IRQ_FLAG (_AC(1, UL) << (__riscv_xlen - 1))
++/* Exception cause high bit - is an interrupt if set */
++#define CAUSE_IRQ_FLAG (_AC(1, UL) << (__riscv_xlen - 1))
+
++/* Interrupt causes (minus the high bit) */
+ #define IRQ_U_SOFT 0
+ #define IRQ_S_SOFT 1
+ #define IRQ_M_SOFT 3
+@@ -57,6 +61,7 @@
+ #define IRQ_S_EXT 9
+ #define IRQ_M_EXT 11
+
++/* Exception causes */
+ #define EXC_INST_MISALIGNED 0
+ #define EXC_INST_ACCESS 1
+ #define EXC_BREAKPOINT 3
+@@ -67,14 +72,14 @@
+ #define EXC_LOAD_PAGE_FAULT 13
+ #define EXC_STORE_PAGE_FAULT 15
+
+-/* SIE (Interrupt Enable) and SIP (Interrupt Pending) flags */
+-#define SIE_SSIE (_AC(0x1, UL) << IRQ_S_SOFT)
+-#define SIE_STIE (_AC(0x1, UL) << IRQ_S_TIMER)
+-#define SIE_SEIE (_AC(0x1, UL) << IRQ_S_EXT)
+-
++/* symbolic CSR names: */
+ #define CSR_CYCLE 0xc00
+ #define CSR_TIME 0xc01
+ #define CSR_INSTRET 0xc02
++#define CSR_CYCLEH 0xc80
++#define CSR_TIMEH 0xc81
++#define CSR_INSTRETH 0xc82
++
+ #define CSR_SSTATUS 0x100
+ #define CSR_SIE 0x104
+ #define CSR_STVEC 0x105
+@@ -85,9 +90,56 @@
+ #define CSR_STVAL 0x143
+ #define CSR_SIP 0x144
+ #define CSR_SATP 0x180
+-#define CSR_CYCLEH 0xc80
+-#define CSR_TIMEH 0xc81
+-#define CSR_INSTRETH 0xc82
++
++#define CSR_MSTATUS 0x300
++#define CSR_MIE 0x304
++#define CSR_MTVEC 0x305
++#define CSR_MSCRATCH 0x340
++#define CSR_MEPC 0x341
++#define CSR_MCAUSE 0x342
++#define CSR_MTVAL 0x343
++#define CSR_MIP 0x344
++
++#ifdef CONFIG_RISCV_M_MODE
++# define CSR_STATUS CSR_MSTATUS
++# define CSR_IE CSR_MIE
++# define CSR_TVEC CSR_MTVEC
++# define CSR_SCRATCH CSR_MSCRATCH
++# define CSR_EPC CSR_MEPC
++# define CSR_CAUSE CSR_MCAUSE
++# define CSR_TVAL CSR_MTVAL
++# define CSR_IP CSR_MIP
++
++# define SR_IE SR_MIE
++# define SR_PIE SR_MPIE
++# define SR_PP SR_MPP
++
++# define IRQ_SOFT IRQ_M_SOFT
++# define IRQ_TIMER IRQ_M_TIMER
++# define IRQ_EXT IRQ_M_EXT
++#else /* CONFIG_RISCV_M_MODE */
++# define CSR_STATUS CSR_SSTATUS
++# define CSR_IE CSR_SIE
++# define CSR_TVEC CSR_STVEC
++# define CSR_SCRATCH CSR_SSCRATCH
++# define CSR_EPC CSR_SEPC
++# define CSR_CAUSE CSR_SCAUSE
++# define CSR_TVAL CSR_STVAL
++# define CSR_IP CSR_SIP
++
++# define SR_IE SR_SIE
++# define SR_PIE SR_SPIE
++# define SR_PP SR_SPP
++
++# define IRQ_SOFT IRQ_S_SOFT
++# define IRQ_TIMER IRQ_S_TIMER
++# define IRQ_EXT IRQ_S_EXT
++#endif /* CONFIG_RISCV_M_MODE */
++
++/* IE/IP (Supervisor/Machine Interrupt Enable/Pending) flags */
++#define IE_SIE (_AC(0x1, UL) << IRQ_SOFT)
++#define IE_TIE (_AC(0x1, UL) << IRQ_TIMER)
++#define IE_EIE (_AC(0x1, UL) << IRQ_EXT)
+
+ #ifndef __ASSEMBLY__
+
+diff --git a/arch/riscv/include/asm/irqflags.h b/arch/riscv/include/asm/irqflags.h
+index e70f647ce3b76..08d4d6a5b7e95 100644
+--- a/arch/riscv/include/asm/irqflags.h
++++ b/arch/riscv/include/asm/irqflags.h
+@@ -13,31 +13,31 @@
+ /* read interrupt enabled status */
+ static inline unsigned long arch_local_save_flags(void)
+ {
+- return csr_read(CSR_SSTATUS);
++ return csr_read(CSR_STATUS);
+ }
+
+ /* unconditionally enable interrupts */
+ static inline void arch_local_irq_enable(void)
+ {
+- csr_set(CSR_SSTATUS, SR_SIE);
++ csr_set(CSR_STATUS, SR_IE);
+ }
+
+ /* unconditionally disable interrupts */
+ static inline void arch_local_irq_disable(void)
+ {
+- csr_clear(CSR_SSTATUS, SR_SIE);
++ csr_clear(CSR_STATUS, SR_IE);
+ }
+
+ /* get status and disable interrupts */
+ static inline unsigned long arch_local_irq_save(void)
+ {
+- return csr_read_clear(CSR_SSTATUS, SR_SIE);
++ return csr_read_clear(CSR_STATUS, SR_IE);
+ }
+
+ /* test flags */
+ static inline int arch_irqs_disabled_flags(unsigned long flags)
+ {
+- return !(flags & SR_SIE);
++ return !(flags & SR_IE);
+ }
+
+ /* test hardware interrupt enable bit */
+@@ -49,7 +49,7 @@ static inline int arch_irqs_disabled(void)
+ /* set interrupt enabled status */
+ static inline void arch_local_irq_restore(unsigned long flags)
+ {
+- csr_set(CSR_SSTATUS, flags & SR_SIE);
++ csr_set(CSR_STATUS, flags & SR_IE);
+ }
+
+ #endif /* _ASM_RISCV_IRQFLAGS_H */
+diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
+index 8c5b11a640dd3..60fd02698b770 100644
+--- a/arch/riscv/include/asm/processor.h
++++ b/arch/riscv/include/asm/processor.h
+@@ -44,7 +44,7 @@ struct thread_struct {
+ ((struct pt_regs *)(task_stack_page(tsk) + THREAD_SIZE \
+ - ALIGN(sizeof(struct pt_regs), STACK_ALIGN)))
+
+-#define KSTK_EIP(tsk) (task_pt_regs(tsk)->sepc)
++#define KSTK_EIP(tsk) (task_pt_regs(tsk)->epc)
+ #define KSTK_ESP(tsk) (task_pt_regs(tsk)->sp)
+
+
+diff --git a/arch/riscv/include/asm/ptrace.h b/arch/riscv/include/asm/ptrace.h
+index d48d1e13973ce..ee49f80c95337 100644
+--- a/arch/riscv/include/asm/ptrace.h
++++ b/arch/riscv/include/asm/ptrace.h
+@@ -12,7 +12,7 @@
+ #ifndef __ASSEMBLY__
+
+ struct pt_regs {
+- unsigned long sepc;
++ unsigned long epc;
+ unsigned long ra;
+ unsigned long sp;
+ unsigned long gp;
+@@ -44,10 +44,10 @@ struct pt_regs {
+ unsigned long t4;
+ unsigned long t5;
+ unsigned long t6;
+- /* Supervisor CSRs */
+- unsigned long sstatus;
+- unsigned long sbadaddr;
+- unsigned long scause;
++ /* Supervisor/Machine CSRs */
++ unsigned long status;
++ unsigned long badaddr;
++ unsigned long cause;
+ /* a0 value before the syscall */
+ unsigned long orig_a0;
+ };
+@@ -58,18 +58,18 @@ struct pt_regs {
+ #define REG_FMT "%08lx"
+ #endif
+
+-#define user_mode(regs) (((regs)->sstatus & SR_SPP) == 0)
++#define user_mode(regs) (((regs)->status & SR_PP) == 0)
+
+
+ /* Helpers for working with the instruction pointer */
+ static inline unsigned long instruction_pointer(struct pt_regs *regs)
+ {
+- return regs->sepc;
++ return regs->epc;
+ }
+ static inline void instruction_pointer_set(struct pt_regs *regs,
+ unsigned long val)
+ {
+- regs->sepc = val;
++ regs->epc = val;
+ }
+
+ #define profile_pc(regs) instruction_pointer(regs)
+diff --git a/arch/riscv/include/asm/switch_to.h b/arch/riscv/include/asm/switch_to.h
+index ee4f0ac62c9d7..407bcc96a7109 100644
+--- a/arch/riscv/include/asm/switch_to.h
++++ b/arch/riscv/include/asm/switch_to.h
+@@ -17,19 +17,19 @@ extern void __fstate_restore(struct task_struct *restore_from);
+
+ static inline void __fstate_clean(struct pt_regs *regs)
+ {
+- regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_CLEAN;
++ regs->status = (regs->status & ~SR_FS) | SR_FS_CLEAN;
+ }
+
+ static inline void fstate_off(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+- regs->sstatus = (regs->sstatus & ~SR_FS) | SR_FS_OFF;
++ regs->status = (regs->status & ~SR_FS) | SR_FS_OFF;
+ }
+
+ static inline void fstate_save(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+- if ((regs->sstatus & SR_FS) == SR_FS_DIRTY) {
++ if ((regs->status & SR_FS) == SR_FS_DIRTY) {
+ __fstate_save(task);
+ __fstate_clean(regs);
+ }
+@@ -38,7 +38,7 @@ static inline void fstate_save(struct task_struct *task,
+ static inline void fstate_restore(struct task_struct *task,
+ struct pt_regs *regs)
+ {
+- if ((regs->sstatus & SR_FS) != SR_FS_OFF) {
++ if ((regs->status & SR_FS) != SR_FS_OFF) {
+ __fstate_restore(task);
+ __fstate_clean(regs);
+ }
+@@ -50,7 +50,7 @@ static inline void __switch_to_aux(struct task_struct *prev,
+ struct pt_regs *regs;
+
+ regs = task_pt_regs(prev);
+- if (unlikely(regs->sstatus & SR_SD))
++ if (unlikely(regs->status & SR_SD))
+ fstate_save(prev, regs);
+ fstate_restore(next, task_pt_regs(next));
+ }
+diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c
+index 9f5628c38ac9f..07cb9c10de4ec 100644
+--- a/arch/riscv/kernel/asm-offsets.c
++++ b/arch/riscv/kernel/asm-offsets.c
+@@ -71,7 +71,7 @@ void asm_offsets(void)
+ OFFSET(TASK_THREAD_FCSR, task_struct, thread.fstate.fcsr);
+
+ DEFINE(PT_SIZE, sizeof(struct pt_regs));
+- OFFSET(PT_SEPC, pt_regs, sepc);
++ OFFSET(PT_EPC, pt_regs, epc);
+ OFFSET(PT_RA, pt_regs, ra);
+ OFFSET(PT_FP, pt_regs, s0);
+ OFFSET(PT_S0, pt_regs, s0);
+@@ -105,9 +105,9 @@ void asm_offsets(void)
+ OFFSET(PT_T6, pt_regs, t6);
+ OFFSET(PT_GP, pt_regs, gp);
+ OFFSET(PT_ORIG_A0, pt_regs, orig_a0);
+- OFFSET(PT_SSTATUS, pt_regs, sstatus);
+- OFFSET(PT_SBADADDR, pt_regs, sbadaddr);
+- OFFSET(PT_SCAUSE, pt_regs, scause);
++ OFFSET(PT_STATUS, pt_regs, status);
++ OFFSET(PT_BADADDR, pt_regs, badaddr);
++ OFFSET(PT_CAUSE, pt_regs, cause);
+
+ /*
+ * THREAD_{F,X}* might be larger than a S-type offset can handle, but
+diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
+index 9c87ae77ad5d3..57b27b8278b1e 100644
+--- a/arch/riscv/kernel/entry.S
++++ b/arch/riscv/kernel/entry.S
+@@ -26,14 +26,14 @@
+
+ /*
+ * If coming from userspace, preserve the user thread pointer and load
+- * the kernel thread pointer. If we came from the kernel, sscratch
+- * will contain 0, and we should continue on the current TP.
++ * the kernel thread pointer. If we came from the kernel, the scratch
++ * register will contain 0, and we should continue on the current TP.
+ */
+- csrrw tp, CSR_SSCRATCH, tp
++ csrrw tp, CSR_SCRATCH, tp
+ bnez tp, _save_context
+
+ _restore_kernel_tpsp:
+- csrr tp, CSR_SSCRATCH
++ csrr tp, CSR_SCRATCH
+ REG_S sp, TASK_TI_KERNEL_SP(tp)
+ _save_context:
+ REG_S sp, TASK_TI_USER_SP(tp)
+@@ -79,16 +79,16 @@ _save_context:
+ li t0, SR_SUM | SR_FS
+
+ REG_L s0, TASK_TI_USER_SP(tp)
+- csrrc s1, CSR_SSTATUS, t0
+- csrr s2, CSR_SEPC
+- csrr s3, CSR_STVAL
+- csrr s4, CSR_SCAUSE
+- csrr s5, CSR_SSCRATCH
++ csrrc s1, CSR_STATUS, t0
++ csrr s2, CSR_EPC
++ csrr s3, CSR_TVAL
++ csrr s4, CSR_CAUSE
++ csrr s5, CSR_SCRATCH
+ REG_S s0, PT_SP(sp)
+- REG_S s1, PT_SSTATUS(sp)
+- REG_S s2, PT_SEPC(sp)
+- REG_S s3, PT_SBADADDR(sp)
+- REG_S s4, PT_SCAUSE(sp)
++ REG_S s1, PT_STATUS(sp)
++ REG_S s2, PT_EPC(sp)
++ REG_S s3, PT_BADADDR(sp)
++ REG_S s4, PT_CAUSE(sp)
+ REG_S s5, PT_TP(sp)
+ .endm
+
+@@ -97,7 +97,7 @@ _save_context:
+ * registers from the stack.
+ */
+ .macro RESTORE_ALL
+- REG_L a0, PT_SSTATUS(sp)
++ REG_L a0, PT_STATUS(sp)
+ /*
+ * The current load reservation is effectively part of the processor's
+ * state, in the sense that load reservations cannot be shared between
+@@ -115,11 +115,11 @@ _save_context:
+ * completes, implementations are allowed to expand reservations to be
+ * arbitrarily large.
+ */
+- REG_L a2, PT_SEPC(sp)
+- REG_SC x0, a2, PT_SEPC(sp)
++ REG_L a2, PT_EPC(sp)
++ REG_SC x0, a2, PT_EPC(sp)
+
+- csrw CSR_SSTATUS, a0
+- csrw CSR_SEPC, a2
++ csrw CSR_STATUS, a0
++ csrw CSR_EPC, a2
+
+ REG_L x1, PT_RA(sp)
+ REG_L x3, PT_GP(sp)
+@@ -163,10 +163,10 @@ ENTRY(handle_exception)
+ SAVE_ALL
+
+ /*
+- * Set sscratch register to 0, so that if a recursive exception
++ * Set the scratch register to 0, so that if a recursive exception
+ * occurs, the exception vector knows it came from the kernel
+ */
+- csrw CSR_SSCRATCH, x0
++ csrw CSR_SCRATCH, x0
+
+ /* Load the global pointer */
+ .option push
+@@ -185,11 +185,13 @@ ENTRY(handle_exception)
+ move a0, sp /* pt_regs */
+ tail do_IRQ
+ 1:
+- /* Exceptions run with interrupts enabled or disabled
+- depending on the state of sstatus.SR_SPIE */
+- andi t0, s1, SR_SPIE
++ /*
++ * Exceptions run with interrupts enabled or disabled depending on the
++ * state of SR_PIE in m/sstatus.
++ */
++ andi t0, s1, SR_PIE
+ beqz t0, 1f
+- csrs CSR_SSTATUS, SR_SIE
++ csrs CSR_STATUS, SR_IE
+
+ 1:
+ /* Handle syscalls */
+@@ -217,7 +219,7 @@ handle_syscall:
+ * scall instruction on sret
+ */
+ addi s2, s2, 0x4
+- REG_S s2, PT_SEPC(sp)
++ REG_S s2, PT_EPC(sp)
+ /* Trace syscalls, but only if requested by the user. */
+ REG_L t0, TASK_TI_FLAGS(tp)
+ andi t0, t0, _TIF_SYSCALL_WORK
+@@ -244,9 +246,15 @@ ret_from_syscall:
+ bnez t0, handle_syscall_trace_exit
+
+ ret_from_exception:
+- REG_L s0, PT_SSTATUS(sp)
+- csrc CSR_SSTATUS, SR_SIE
++ REG_L s0, PT_STATUS(sp)
++ csrc CSR_STATUS, SR_IE
++#ifdef CONFIG_RISCV_M_MODE
++ /* the MPP value is too large to be used as an immediate arg for addi */
++ li t0, SR_MPP
++ and s0, s0, t0
++#else
+ andi s0, s0, SR_SPP
++#endif
+ bnez s0, resume_kernel
+
+ resume_userspace:
+@@ -260,14 +268,18 @@ resume_userspace:
+ REG_S s0, TASK_TI_KERNEL_SP(tp)
+
+ /*
+- * Save TP into sscratch, so we can find the kernel data structures
+- * again.
++ * Save TP into the scratch register , so we can find the kernel data
++ * structures again.
+ */
+- csrw CSR_SSCRATCH, tp
++ csrw CSR_SCRATCH, tp
+
+ restore_all:
+ RESTORE_ALL
++#ifdef CONFIG_RISCV_M_MODE
++ mret
++#else
+ sret
++#endif
+
+ #if IS_ENABLED(CONFIG_PREEMPT)
+ resume_kernel:
+@@ -287,7 +299,7 @@ work_pending:
+ bnez s1, work_resched
+ work_notifysig:
+ /* Handle pending signals and notify-resume requests */
+- csrs CSR_SSTATUS, SR_SIE /* Enable interrupts for do_notify_resume() */
++ csrs CSR_STATUS, SR_IE /* Enable interrupts for do_notify_resume() */
+ move a0, sp /* pt_regs */
+ move a1, s0 /* current_thread_info->flags */
+ tail do_notify_resume
+diff --git a/arch/riscv/kernel/fpu.S b/arch/riscv/kernel/fpu.S
+index 631d31540660e..dd2205473de78 100644
+--- a/arch/riscv/kernel/fpu.S
++++ b/arch/riscv/kernel/fpu.S
+@@ -23,7 +23,7 @@ ENTRY(__fstate_save)
+ li a2, TASK_THREAD_F0
+ add a0, a0, a2
+ li t1, SR_FS
+- csrs CSR_SSTATUS, t1
++ csrs CSR_STATUS, t1
+ frcsr t0
+ fsd f0, TASK_THREAD_F0_F0(a0)
+ fsd f1, TASK_THREAD_F1_F0(a0)
+@@ -58,7 +58,7 @@ ENTRY(__fstate_save)
+ fsd f30, TASK_THREAD_F30_F0(a0)
+ fsd f31, TASK_THREAD_F31_F0(a0)
+ sw t0, TASK_THREAD_FCSR_F0(a0)
+- csrc CSR_SSTATUS, t1
++ csrc CSR_STATUS, t1
+ ret
+ ENDPROC(__fstate_save)
+
+@@ -67,7 +67,7 @@ ENTRY(__fstate_restore)
+ add a0, a0, a2
+ li t1, SR_FS
+ lw t0, TASK_THREAD_FCSR_F0(a0)
+- csrs CSR_SSTATUS, t1
++ csrs CSR_STATUS, t1
+ fld f0, TASK_THREAD_F0_F0(a0)
+ fld f1, TASK_THREAD_F1_F0(a0)
+ fld f2, TASK_THREAD_F2_F0(a0)
+@@ -101,6 +101,6 @@ ENTRY(__fstate_restore)
+ fld f30, TASK_THREAD_F30_F0(a0)
+ fld f31, TASK_THREAD_F31_F0(a0)
+ fscsr t0
+- csrc CSR_SSTATUS, t1
++ csrc CSR_STATUS, t1
+ ret
+ ENDPROC(__fstate_restore)
+diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
+index 344793159b97d..57817c1987743 100644
+--- a/arch/riscv/kernel/head.S
++++ b/arch/riscv/kernel/head.S
+@@ -52,8 +52,8 @@ ENTRY(_start)
+ .global _start_kernel
+ _start_kernel:
+ /* Mask all interrupts */
+- csrw CSR_SIE, zero
+- csrw CSR_SIP, zero
++ csrw CSR_IE, zero
++ csrw CSR_IP, zero
+
+ /* Load the global pointer */
+ .option push
+@@ -66,7 +66,7 @@ _start_kernel:
+ * floating point in kernel space
+ */
+ li t0, SR_FS
+- csrc CSR_SSTATUS, t0
++ csrc CSR_STATUS, t0
+
+ #ifdef CONFIG_SMP
+ li t0, CONFIG_NR_CPUS
+@@ -121,7 +121,7 @@ relocate:
+ /* Point stvec to virtual address of intruction after satp write */
+ la a2, 1f
+ add a2, a2, a1
+- csrw CSR_STVEC, a2
++ csrw CSR_TVEC, a2
+
+ /* Compute satp for kernel page tables, but don't load it yet */
+ srl a2, a0, PAGE_SHIFT
+@@ -143,7 +143,7 @@ relocate:
+ 1:
+ /* Set trap vector to spin forever to help debug */
+ la a0, .Lsecondary_park
+- csrw CSR_STVEC, a0
++ csrw CSR_TVEC, a0
+
+ /* Reload the global pointer */
+ .option push
+@@ -166,7 +166,7 @@ relocate:
+ #ifdef CONFIG_SMP
+ /* Set trap vector to spin forever to help debug */
+ la a3, .Lsecondary_park
+- csrw CSR_STVEC, a3
++ csrw CSR_TVEC, a3
+
+ slli a3, a0, LGREG
+ la a1, __cpu_up_stack_pointer
+diff --git a/arch/riscv/kernel/irq.c b/arch/riscv/kernel/irq.c
+index fffac6ddb0e00..3f07a91d5afb4 100644
+--- a/arch/riscv/kernel/irq.c
++++ b/arch/riscv/kernel/irq.c
+@@ -11,13 +11,6 @@
+ #include <linux/seq_file.h>
+ #include <asm/smp.h>
+
+-/*
+- * Possible interrupt causes:
+- */
+-#define INTERRUPT_CAUSE_SOFTWARE IRQ_S_SOFT
+-#define INTERRUPT_CAUSE_TIMER IRQ_S_TIMER
+-#define INTERRUPT_CAUSE_EXTERNAL IRQ_S_EXT
+-
+ int arch_show_interrupts(struct seq_file *p, int prec)
+ {
+ show_ipi_stats(p, prec);
+@@ -29,12 +22,12 @@ asmlinkage __visible void __irq_entry do_IRQ(struct pt_regs *regs)
+ struct pt_regs *old_regs = set_irq_regs(regs);
+
+ irq_enter();
+- switch (regs->scause & ~SCAUSE_IRQ_FLAG) {
+- case INTERRUPT_CAUSE_TIMER:
++ switch (regs->cause & ~CAUSE_IRQ_FLAG) {
++ case IRQ_TIMER:
+ riscv_timer_interrupt();
+ break;
+ #ifdef CONFIG_SMP
+- case INTERRUPT_CAUSE_SOFTWARE:
++ case IRQ_SOFT:
+ /*
+ * We only use software interrupts to pass IPIs, so if a non-SMP
+ * system gets one, then we don't know what to do.
+@@ -42,11 +35,11 @@ asmlinkage __visible void __irq_entry do_IRQ(struct pt_regs *regs)
+ riscv_software_interrupt();
+ break;
+ #endif
+- case INTERRUPT_CAUSE_EXTERNAL:
++ case IRQ_EXT:
+ handle_arch_irq(regs);
+ break;
+ default:
+- pr_alert("unexpected interrupt cause 0x%lx", regs->scause);
++ pr_alert("unexpected interrupt cause 0x%lx", regs->cause);
+ BUG();
+ }
+ irq_exit();
+diff --git a/arch/riscv/kernel/perf_callchain.c b/arch/riscv/kernel/perf_callchain.c
+index 1de5991916eb9..20af8ecbb7e41 100644
+--- a/arch/riscv/kernel/perf_callchain.c
++++ b/arch/riscv/kernel/perf_callchain.c
+@@ -68,7 +68,7 @@ void perf_callchain_user(struct perf_callchain_entry_ctx *entry,
+ return;
+
+ fp = regs->s0;
+- perf_callchain_store(entry, regs->sepc);
++ perf_callchain_store(entry, regs->epc);
+
+ fp = user_backtrace(entry, fp, regs->ra);
+ while (fp && !(fp & 0x3) && entry->nr < entry->max_stack)
+diff --git a/arch/riscv/kernel/process.c b/arch/riscv/kernel/process.c
+index 9d4b4098874bb..f17e7f4ad3e7a 100644
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -35,8 +35,8 @@ void show_regs(struct pt_regs *regs)
+ {
+ show_regs_print_info(KERN_DEFAULT);
+
+- pr_cont("sepc: " REG_FMT " ra : " REG_FMT " sp : " REG_FMT "\n",
+- regs->sepc, regs->ra, regs->sp);
++ pr_cont("epc: " REG_FMT " ra : " REG_FMT " sp : " REG_FMT "\n",
++ regs->epc, regs->ra, regs->sp);
+ pr_cont(" gp : " REG_FMT " tp : " REG_FMT " t0 : " REG_FMT "\n",
+ regs->gp, regs->tp, regs->t0);
+ pr_cont(" t1 : " REG_FMT " t2 : " REG_FMT " s0 : " REG_FMT "\n",
+@@ -58,23 +58,23 @@ void show_regs(struct pt_regs *regs)
+ pr_cont(" t5 : " REG_FMT " t6 : " REG_FMT "\n",
+ regs->t5, regs->t6);
+
+- pr_cont("sstatus: " REG_FMT " sbadaddr: " REG_FMT " scause: " REG_FMT "\n",
+- regs->sstatus, regs->sbadaddr, regs->scause);
++ pr_cont("status: " REG_FMT " badaddr: " REG_FMT " cause: " REG_FMT "\n",
++ regs->status, regs->badaddr, regs->cause);
+ }
+
+ void start_thread(struct pt_regs *regs, unsigned long pc,
+ unsigned long sp)
+ {
+- regs->sstatus = SR_SPIE;
++ regs->status = SR_PIE;
+ if (has_fpu) {
+- regs->sstatus |= SR_FS_INITIAL;
++ regs->status |= SR_FS_INITIAL;
+ /*
+ * Restore the initial value to the FP register
+ * before starting the user program.
+ */
+ fstate_restore(current, regs);
+ }
+- regs->sepc = pc;
++ regs->epc = pc;
+ regs->sp = sp;
+ set_fs(USER_DS);
+ }
+@@ -112,7 +112,8 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long usp,
+ const register unsigned long gp __asm__ ("gp");
+ memset(childregs, 0, sizeof(struct pt_regs));
+ childregs->gp = gp;
+- childregs->sstatus = SR_SPP | SR_SPIE; /* Supervisor, irqs on */
++ /* Supervisor/Machine, irqs on: */
++ childregs->status = SR_PP | SR_PIE;
+
+ p->thread.ra = (unsigned long)ret_from_kernel_thread;
+ p->thread.s[0] = usp; /* fn */
+diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c
+index d0f6f212f5dfd..b7f9a5565c4bf 100644
+--- a/arch/riscv/kernel/signal.c
++++ b/arch/riscv/kernel/signal.c
+@@ -124,7 +124,7 @@ SYSCALL_DEFINE0(rt_sigreturn)
+ pr_info_ratelimited(
+ "%s[%d]: bad frame in %s: frame=%p pc=%p sp=%p\n",
+ task->comm, task_pid_nr(task), __func__,
+- frame, (void *)regs->sepc, (void *)regs->sp);
++ frame, (void *)regs->epc, (void *)regs->sp);
+ }
+ force_sig(SIGSEGV);
+ return 0;
+@@ -199,7 +199,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+ * We always pass siginfo and mcontext, regardless of SA_SIGINFO,
+ * since some things rely on this (e.g. glibc's debug/segfault.c).
+ */
+- regs->sepc = (unsigned long)ksig->ka.sa.sa_handler;
++ regs->epc = (unsigned long)ksig->ka.sa.sa_handler;
+ regs->sp = (unsigned long)frame;
+ regs->a0 = ksig->sig; /* a0: signal number */
+ regs->a1 = (unsigned long)(&frame->info); /* a1: siginfo pointer */
+@@ -208,7 +208,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
+ #if DEBUG_SIG
+ pr_info("SIG deliver (%s:%d): sig=%d pc=%p ra=%p sp=%p\n",
+ current->comm, task_pid_nr(current), ksig->sig,
+- (void *)regs->sepc, (void *)regs->ra, frame);
++ (void *)regs->epc, (void *)regs->ra, frame);
+ #endif
+
+ return 0;
+@@ -220,10 +220,9 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
+ int ret;
+
+ /* Are we from a system call? */
+- if (regs->scause == EXC_SYSCALL) {
++ if (regs->cause == EXC_SYSCALL) {
+ /* Avoid additional syscall restarting via ret_from_exception */
+- regs->scause = -1UL;
+-
++ regs->cause = -1UL;
+ /* If so, check system call restarting.. */
+ switch (regs->a0) {
+ case -ERESTART_RESTARTBLOCK:
+@@ -239,7 +238,7 @@ static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
+ /* fallthrough */
+ case -ERESTARTNOINTR:
+ regs->a0 = regs->orig_a0;
+- regs->sepc -= 0x4;
++ regs->epc -= 0x4;
+ break;
+ }
+ }
+@@ -261,9 +260,9 @@ static void do_signal(struct pt_regs *regs)
+ }
+
+ /* Did we come from a system call? */
+- if (regs->scause == EXC_SYSCALL) {
++ if (regs->cause == EXC_SYSCALL) {
+ /* Avoid additional syscall restarting via ret_from_exception */
+- regs->scause = -1UL;
++ regs->cause = -1UL;
+
+ /* Restart the system call - no handlers present */
+ switch (regs->a0) {
+@@ -271,12 +270,12 @@ static void do_signal(struct pt_regs *regs)
+ case -ERESTARTSYS:
+ case -ERESTARTNOINTR:
+ regs->a0 = regs->orig_a0;
+- regs->sepc -= 0x4;
++ regs->epc -= 0x4;
+ break;
+ case -ERESTART_RESTARTBLOCK:
+ regs->a0 = regs->orig_a0;
+ regs->a7 = __NR_restart_syscall;
+- regs->sepc -= 0x4;
++ regs->epc -= 0x4;
+ break;
+ }
+ }
+diff --git a/arch/riscv/kernel/smp.c b/arch/riscv/kernel/smp.c
+index 098c04adbaaf6..d724a7e6f4eb8 100644
+--- a/arch/riscv/kernel/smp.c
++++ b/arch/riscv/kernel/smp.c
+@@ -108,7 +108,7 @@ static void send_ipi_single(int cpu, enum ipi_message_type op)
+
+ static inline void clear_ipi(void)
+ {
+- csr_clear(CSR_SIP, SIE_SSIE);
++ csr_clear(CSR_IP, IE_SIE);
+ }
+
+ void riscv_software_interrupt(void)
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index c28d4debf5926..030094ac71902 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -42,7 +42,7 @@ void die(struct pt_regs *regs, const char *str)
+ print_modules();
+ show_regs(regs);
+
+- ret = notify_die(DIE_OOPS, str, regs, 0, regs->scause, SIGSEGV);
++ ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV);
+
+ if (regs && kexec_should_crash(current))
+ crash_kexec(regs);
+@@ -90,7 +90,7 @@ static void do_trap_error(struct pt_regs *regs, int signo, int code,
+ #define DO_ERROR_INFO(name, signo, code, str) \
+ asmlinkage __visible void name(struct pt_regs *regs) \
+ { \
+- do_trap_error(regs, signo, code, regs->sepc, "Oops - " str); \
++ do_trap_error(regs, signo, code, regs->epc, "Oops - " str); \
+ }
+
+ DO_ERROR_INFO(do_trap_unknown,
+@@ -128,9 +128,9 @@ static inline unsigned long get_break_insn_length(unsigned long pc)
+ asmlinkage __visible void do_trap_break(struct pt_regs *regs)
+ {
+ if (user_mode(regs))
+- force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->sepc);
+- else if (report_bug(regs->sepc, regs) == BUG_TRAP_TYPE_WARN)
+- regs->sepc += get_break_insn_length(regs->sepc);
++ force_sig_fault(SIGTRAP, TRAP_BRKPT, (void __user *)regs->epc);
++ else if (report_bug(regs->epc, regs) == BUG_TRAP_TYPE_WARN)
++ regs->epc += get_break_insn_length(regs->epc);
+ else
+ die(regs, "Kernel BUG");
+ }
+@@ -157,9 +157,9 @@ void __init trap_init(void)
+ * Set sup0 scratch register to 0, indicating to exception vector
+ * that we are presently executing in the kernel
+ */
+- csr_write(CSR_SSCRATCH, 0);
++ csr_write(CSR_SCRATCH, 0);
+ /* Set the exception vector address */
+- csr_write(CSR_STVEC, &handle_exception);
++ csr_write(CSR_TVEC, &handle_exception);
+ /* Enable all interrupts */
+- csr_write(CSR_SIE, -1);
++ csr_write(CSR_IE, -1);
+ }
+diff --git a/arch/riscv/lib/uaccess.S b/arch/riscv/lib/uaccess.S
+index ed2696c0143d5..fecd65657a6fc 100644
+--- a/arch/riscv/lib/uaccess.S
++++ b/arch/riscv/lib/uaccess.S
+@@ -18,7 +18,7 @@ ENTRY(__asm_copy_from_user)
+
+ /* Enable access to user memory */
+ li t6, SR_SUM
+- csrs CSR_SSTATUS, t6
++ csrs CSR_STATUS, t6
+
+ add a3, a1, a2
+ /* Use word-oriented copy only if low-order bits match */
+@@ -47,7 +47,7 @@ ENTRY(__asm_copy_from_user)
+
+ 3:
+ /* Disable access to user memory */
+- csrc CSR_SSTATUS, t6
++ csrc CSR_STATUS, t6
+ li a0, 0
+ ret
+ 4: /* Edge case: unalignment */
+@@ -72,7 +72,7 @@ ENTRY(__clear_user)
+
+ /* Enable access to user memory */
+ li t6, SR_SUM
+- csrs CSR_SSTATUS, t6
++ csrs CSR_STATUS, t6
+
+ add a3, a0, a1
+ addi t0, a0, SZREG-1
+@@ -94,7 +94,7 @@ ENTRY(__clear_user)
+
+ 3:
+ /* Disable access to user memory */
+- csrc CSR_SSTATUS, t6
++ csrc CSR_STATUS, t6
+ li a0, 0
+ ret
+ 4: /* Edge case: unalignment */
+@@ -114,11 +114,11 @@ ENDPROC(__clear_user)
+ /* Fixup code for __copy_user(10) and __clear_user(11) */
+ 10:
+ /* Disable access to user memory */
+- csrs CSR_SSTATUS, t6
++ csrs CSR_STATUS, t6
+ mv a0, a2
+ ret
+ 11:
+- csrs CSR_SSTATUS, t6
++ csrs CSR_STATUS, t6
+ mv a0, a1
+ ret
+ .previous
+diff --git a/arch/riscv/mm/extable.c b/arch/riscv/mm/extable.c
+index 7aed9178d365d..2fc7294221515 100644
+--- a/arch/riscv/mm/extable.c
++++ b/arch/riscv/mm/extable.c
+@@ -15,9 +15,9 @@ int fixup_exception(struct pt_regs *regs)
+ {
+ const struct exception_table_entry *fixup;
+
+- fixup = search_exception_tables(regs->sepc);
++ fixup = search_exception_tables(regs->epc);
+ if (fixup) {
+- regs->sepc = fixup->fixup;
++ regs->epc = fixup->fixup;
+ return 1;
+ }
+ return 0;
+diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c
+index 1cfce62caa119..55ac8b7bb432d 100644
+--- a/arch/riscv/mm/fault.c
++++ b/arch/riscv/mm/fault.c
+@@ -34,8 +34,8 @@ asmlinkage void do_page_fault(struct pt_regs *regs)
+ int code = SEGV_MAPERR;
+ vm_fault_t fault;
+
+- cause = regs->scause;
+- addr = regs->sbadaddr;
++ cause = regs->cause;
++ addr = regs->badaddr;
+
+ tsk = current;
+ mm = tsk->mm;
+@@ -53,7 +53,7 @@ asmlinkage void do_page_fault(struct pt_regs *regs)
+ goto vmalloc_fault;
+
+ /* Enable interrupts if they were enabled in the parent context. */
+- if (likely(regs->sstatus & SR_SPIE))
++ if (likely(regs->status & SR_PIE))
+ local_irq_enable();
+
+ /*
+diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c
+index 4b04ffbe5e7e9..cd83951718494 100644
+--- a/drivers/clocksource/timer-riscv.c
++++ b/drivers/clocksource/timer-riscv.c
+@@ -19,7 +19,7 @@
+ static int riscv_clock_next_event(unsigned long delta,
+ struct clock_event_device *ce)
+ {
+- csr_set(sie, SIE_STIE);
++ csr_set(CSR_IE, IE_TIE);
+ sbi_set_timer(get_cycles64() + delta);
+ return 0;
+ }
+@@ -61,13 +61,13 @@ static int riscv_timer_starting_cpu(unsigned int cpu)
+ ce->cpumask = cpumask_of(cpu);
+ clockevents_config_and_register(ce, riscv_timebase, 100, 0x7fffffff);
+
+- csr_set(sie, SIE_STIE);
++ csr_set(CSR_IE, IE_TIE);
+ return 0;
+ }
+
+ static int riscv_timer_dying_cpu(unsigned int cpu)
+ {
+- csr_clear(sie, SIE_STIE);
++ csr_clear(CSR_IE, IE_TIE);
+ return 0;
+ }
+
+@@ -76,7 +76,7 @@ void riscv_timer_interrupt(void)
+ {
+ struct clock_event_device *evdev = this_cpu_ptr(&riscv_clock_event);
+
+- csr_clear(sie, SIE_STIE);
++ csr_clear(CSR_IE, IE_TIE);
+ evdev->event_handler(evdev);
+ }
+
+diff --git a/drivers/irqchip/irq-sifive-plic.c b/drivers/irqchip/irq-sifive-plic.c
+index 9dad45d928bfe..2dca689a5cbc6 100644
+--- a/drivers/irqchip/irq-sifive-plic.c
++++ b/drivers/irqchip/irq-sifive-plic.c
+@@ -187,7 +187,7 @@ static void plic_handle_irq(struct pt_regs *regs)
+
+ WARN_ON_ONCE(!handler->present);
+
+- csr_clear(sie, SIE_SEIE);
++ csr_clear(CSR_IE, IE_EIE);
+ while ((hwirq = readl(claim))) {
+ int irq = irq_find_mapping(plic_irqdomain, hwirq);
+
+@@ -197,7 +197,7 @@ static void plic_handle_irq(struct pt_regs *regs)
+ else
+ generic_handle_irq(irq);
+ }
+- csr_set(sie, SIE_SEIE);
++ csr_set(CSR_IE, IE_EIE);
+ }
+
+ /*
+@@ -258,8 +258,11 @@ static int __init plic_init(struct device_node *node,
+ continue;
+ }
+
+- /* skip contexts other than supervisor external interrupt */
+- if (parent.args[0] != IRQ_S_EXT)
++ /*
++ * Skip contexts other than external interrupts for our
++ * privilege level.
++ */
++ if (parent.args[0] != IRQ_EXT)
+ continue;
+
+ hartid = plic_find_hart_id(parent.np);
+--
+2.39.2
+
--- /dev/null
+From d52b7f5ca92c5ccfd25076035a3bc1d329e7d83b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 14:48:28 +0000
+Subject: riscv: Avoid enabling interrupts in die()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mattias Nissler <mnissler@rivosinc.com>
+
+[ Upstream commit 130aee3fd9981297ff9354e5d5609cd59aafbbea ]
+
+While working on something else, I noticed that the kernel would start
+accepting interrupts again after crashing in an interrupt handler. Since
+the kernel is already in inconsistent state, enabling interrupts is
+dangerous and opens up risk of kernel state deteriorating further.
+Interrupts do get enabled via what looks like an unintended side effect of
+spin_unlock_irq, so switch to the more cautious
+spin_lock_irqsave/spin_unlock_irqrestore instead.
+
+Fixes: 76d2a0493a17 ("RISC-V: Init and Halt Code")
+Signed-off-by: Mattias Nissler <mnissler@rivosinc.com>
+Reviewed-by: Björn Töpel <bjorn@kernel.org>
+Link: https://lore.kernel.org/r/20230215144828.3370316-1-mnissler@rivosinc.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/traps.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index 5ca5a04258d0d..312da504b0162 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -32,10 +32,11 @@ void die(struct pt_regs *regs, const char *str)
+ static int die_counter;
+ int ret;
+ long cause;
++ unsigned long flags;
+
+ oops_enter();
+
+- spin_lock_irq(&die_lock);
++ spin_lock_irqsave(&die_lock, flags);
+ console_verbose();
+ bust_spinlocks(1);
+
+@@ -52,7 +53,7 @@ void die(struct pt_regs *regs, const char *str)
+
+ bust_spinlocks(0);
+ add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+- spin_unlock_irq(&die_lock);
++ spin_unlock_irqrestore(&die_lock, flags);
+ oops_exit();
+
+ if (in_interrupt())
+--
+2.39.2
+
--- /dev/null
+From 90d2039dfb03cdc912ca5b796940853ee5c978ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Jan 2023 04:05:58 -0500
+Subject: riscv: ftrace: Remove wasted nops for !RISCV_ISA_C
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+[ Upstream commit 409c8fb20c66df7150e592747412438c04aeb11f ]
+
+When CONFIG_RISCV_ISA_C=n, -fpatchable-function-entry=8 would generate
+more nops than we expect. Because it treat nop opcode as 0x00000013
+instead of 0x0001.
+
+Dump of assembler code for function dw_pcie_free_msi:
+ 0xffffffff806fce94 <+0>: sd ra,-8(sp)
+ 0xffffffff806fce98 <+4>: auipc ra,0xff90f
+ 0xffffffff806fce9c <+8>: jalr -684(ra) # 0xffffffff8000bbec
+<ftrace_caller>
+ 0xffffffff806fcea0 <+12>: ld ra,-8(sp)
+ 0xffffffff806fcea4 <+16>: nop /* wasted */
+ 0xffffffff806fcea8 <+20>: nop /* wasted */
+ 0xffffffff806fceac <+24>: nop /* wasted */
+ 0xffffffff806fceb0 <+28>: nop /* wasted */
+ 0xffffffff806fceb4 <+0>: addi sp,sp,-48
+ 0xffffffff806fceb8 <+4>: sd s0,32(sp)
+ 0xffffffff806fcebc <+8>: sd s1,24(sp)
+ 0xffffffff806fcec0 <+12>: sd s2,16(sp)
+ 0xffffffff806fcec4 <+16>: sd s3,8(sp)
+ 0xffffffff806fcec8 <+20>: sd ra,40(sp)
+ 0xffffffff806fcecc <+24>: addi s0,sp,48
+
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Link: https://lore.kernel.org/r/20230112090603.1295340-3-guoren@kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Makefile | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 16dc4a7e9b379..26ffd9e6a2818 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -13,7 +13,11 @@ LDFLAGS_vmlinux :=
+ ifeq ($(CONFIG_DYNAMIC_FTRACE),y)
+ LDFLAGS_vmlinux := --no-relax
+ KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY
++ifeq ($(CONFIG_RISCV_ISA_C),y)
+ CC_FLAGS_FTRACE := -fpatchable-function-entry=8
++else
++ CC_FLAGS_FTRACE := -fpatchable-function-entry=4
++endif
+ endif
+ KBUILD_AFLAGS_MODULE += -fPIC
+ KBUILD_CFLAGS_MODULE += -fPIC
+--
+2.39.2
+
--- /dev/null
+From b7a09cc15da6829a604960438ec9a668b2401c18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Mar 2023 10:16:39 +0100
+Subject: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
+
+From: Alexandre Ghiti <alexghiti@rivosinc.com>
+
+[ Upstream commit 76950340cf03b149412fe0d5f0810e52ac1df8cb ]
+
+When CONFIG_FRAME_POINTER is unset, the stack unwinding function
+walk_stackframe randomly reads the stack and then, when KASAN is enabled,
+it can lead to the following backtrace:
+
+[ 0.000000] ==================================================================
+[ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a
+[ 0.000000] Read of size 8 at addr ffffffff81807c40 by task swapper/0
+[ 0.000000]
+[ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.2.0-12919-g24203e6db61f #43
+[ 0.000000] Hardware name: riscv-virtio,qemu (DT)
+[ 0.000000] Call Trace:
+[ 0.000000] [<ffffffff80007ba8>] walk_stackframe+0x0/0x11a
+[ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a
+[ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
+[ 0.000000] [<ffffffff80c49c80>] dump_stack_lvl+0x22/0x36
+[ 0.000000] [<ffffffff80c3783e>] print_report+0x198/0x4a8
+[ 0.000000] [<ffffffff80099ecc>] init_param_lock+0x26/0x2a
+[ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
+[ 0.000000] [<ffffffff8015f68a>] kasan_report+0x9a/0xc8
+[ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
+[ 0.000000] [<ffffffff80007c4a>] walk_stackframe+0xa2/0x11a
+[ 0.000000] [<ffffffff8006e99c>] desc_make_final+0x80/0x84
+[ 0.000000] [<ffffffff8009a04e>] stack_trace_save+0x88/0xa6
+[ 0.000000] [<ffffffff80099fc2>] filter_irq_stacks+0x72/0x76
+[ 0.000000] [<ffffffff8006b95e>] devkmsg_read+0x32a/0x32e
+[ 0.000000] [<ffffffff8015ec16>] kasan_save_stack+0x28/0x52
+[ 0.000000] [<ffffffff8006e998>] desc_make_final+0x7c/0x84
+[ 0.000000] [<ffffffff8009a04a>] stack_trace_save+0x84/0xa6
+[ 0.000000] [<ffffffff8015ec52>] kasan_set_track+0x12/0x20
+[ 0.000000] [<ffffffff8015f22e>] __kasan_slab_alloc+0x58/0x5e
+[ 0.000000] [<ffffffff8015e7ea>] __kmem_cache_create+0x21e/0x39a
+[ 0.000000] [<ffffffff80e133ac>] create_boot_cache+0x70/0x9c
+[ 0.000000] [<ffffffff80e17ab2>] kmem_cache_init+0x6c/0x11e
+[ 0.000000] [<ffffffff80e00fd6>] mm_init+0xd8/0xfe
+[ 0.000000] [<ffffffff80e011d8>] start_kernel+0x190/0x3ca
+[ 0.000000]
+[ 0.000000] The buggy address belongs to stack of task swapper/0
+[ 0.000000] and is located at offset 0 in frame:
+[ 0.000000] stack_trace_save+0x0/0xa6
+[ 0.000000]
+[ 0.000000] This frame has 1 object:
+[ 0.000000] [32, 56) 'c'
+[ 0.000000]
+[ 0.000000] The buggy address belongs to the physical page:
+[ 0.000000] page:(____ptrval____) refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x81a07
+[ 0.000000] flags: 0x1000(reserved|zone=0)
+[ 0.000000] raw: 0000000000001000 ff600003f1e3d150 ff600003f1e3d150 0000000000000000
+[ 0.000000] raw: 0000000000000000 0000000000000000 00000001ffffffff
+[ 0.000000] page dumped because: kasan: bad access detected
+[ 0.000000]
+[ 0.000000] Memory state around the buggy address:
+[ 0.000000] ffffffff81807b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 0.000000] ffffffff81807b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 0.000000] >ffffffff81807c00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 f3
+[ 0.000000] ^
+[ 0.000000] ffffffff81807c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
+[ 0.000000] ffffffff81807d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 0.000000] ==================================================================
+
+Fix that by using READ_ONCE_NOCHECK when reading the stack in imprecise
+mode.
+
+Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly")
+Reported-by: Chathura Rajapaksha <chathura.abeyrathne.lk@gmail.com>
+Link: https://lore.kernel.org/all/CAD7mqryDQCYyJ1gAmtMm8SASMWAQ4i103ptTb0f6Oda=tPY2=A@mail.gmail.com/
+Suggested-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20230308091639.602024-1-alexghiti@rivosinc.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/stacktrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
+index 19e46f4160cc3..5ba4d23971fdb 100644
+--- a/arch/riscv/kernel/stacktrace.c
++++ b/arch/riscv/kernel/stacktrace.c
+@@ -89,7 +89,7 @@ void notrace walk_stackframe(struct task_struct *task,
+ while (!kstack_end(ksp)) {
+ if (__kernel_text_address(pc) && unlikely(fn(pc, arg)))
+ break;
+- pc = (*ksp++) - 0x4;
++ pc = READ_ONCE_NOCHECK(*ksp++) - 0x4;
+ }
+ }
+
+--
+2.39.2
+
--- /dev/null
+From 90df613c317f4d768516001b773fde681377bc27 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Dec 2020 16:01:41 +0000
+Subject: riscv: Using PATCHABLE_FUNCTION_ENTRY instead of MCOUNT
+
+From: Guo Ren <guoren@linux.alibaba.com>
+
+[ Upstream commit afc76b8b80112189b6f11e67e19cf58301944814 ]
+
+This patch changes the current detour mechanism of dynamic ftrace
+which has been discussed during LPC 2020 RISCV-MC [1].
+
+Before the patch, we used mcount for detour:
+<funca>:
+ addi sp,sp,-16
+ sd ra,8(sp)
+ sd s0,0(sp)
+ addi s0,sp,16
+ mv a5,ra
+ mv a0,a5
+ auipc ra,0x0 -> nop
+ jalr -296(ra) <_mcount@plt> ->nop
+ ...
+
+After the patch, we use nop call site area for detour:
+<funca>:
+ nop -> REG_S ra, -SZREG(sp)
+ nop -> auipc ra, 0x?
+ nop -> jalr ?(ra)
+ nop -> REG_L ra, -SZREG(sp)
+ ...
+
+The mcount mechanism is mixed with gcc function prologue which is
+not very clear. The patchable function entry just put 16 bytes nop
+before the front of the function prologue which could be filled
+with a separated detour mechanism.
+
+[1] https://www.linuxplumbersconf.org/event/7/contributions/807/
+
+Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Stable-dep-of: 409c8fb20c66 ("riscv: ftrace: Remove wasted nops for !RISCV_ISA_C")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Makefile | 2 +
+ arch/riscv/kernel/ftrace.c | 95 ++++-----
+ arch/riscv/kernel/mcount-dyn.S | 342 +++++++++++++++------------------
+ 3 files changed, 204 insertions(+), 235 deletions(-)
+
+diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
+index 1641d82014127..16dc4a7e9b379 100644
+--- a/arch/riscv/Makefile
++++ b/arch/riscv/Makefile
+@@ -12,6 +12,8 @@ OBJCOPYFLAGS := -O binary
+ LDFLAGS_vmlinux :=
+ ifeq ($(CONFIG_DYNAMIC_FTRACE),y)
+ LDFLAGS_vmlinux := --no-relax
++ KBUILD_CPPFLAGS += -DCC_USING_PATCHABLE_FUNCTION_ENTRY
++ CC_FLAGS_FTRACE := -fpatchable-function-entry=8
+ endif
+ KBUILD_AFLAGS_MODULE += -fPIC
+ KBUILD_CFLAGS_MODULE += -fPIC
+diff --git a/arch/riscv/kernel/ftrace.c b/arch/riscv/kernel/ftrace.c
+index 291c579e12457..d42df2d561ddd 100644
+--- a/arch/riscv/kernel/ftrace.c
++++ b/arch/riscv/kernel/ftrace.c
+@@ -63,29 +63,56 @@ static int __ftrace_modify_call(unsigned long hook_pos, unsigned long target,
+ return 0;
+ }
+
++/*
++ * Put 5 instructions with 16 bytes at the front of function within
++ * patchable function entry nops' area.
++ *
++ * 0: REG_S ra, -SZREG(sp)
++ * 1: auipc ra, 0x?
++ * 2: jalr -?(ra)
++ * 3: REG_L ra, -SZREG(sp)
++ *
++ * So the opcodes is:
++ * 0: 0xfe113c23 (sd)/0xfe112e23 (sw)
++ * 1: 0x???????? -> auipc
++ * 2: 0x???????? -> jalr
++ * 3: 0xff813083 (ld)/0xffc12083 (lw)
++ */
++#if __riscv_xlen == 64
++#define INSN0 0xfe113c23
++#define INSN3 0xff813083
++#elif __riscv_xlen == 32
++#define INSN0 0xfe112e23
++#define INSN3 0xffc12083
++#endif
++
++#define FUNC_ENTRY_SIZE 16
++#define FUNC_ENTRY_JMP 4
++
+ int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
+ {
+- int ret = ftrace_check_current_call(rec->ip, NULL);
++ unsigned int call[4] = {INSN0, 0, 0, INSN3};
++ unsigned long target = addr;
++ unsigned long caller = rec->ip + FUNC_ENTRY_JMP;
+
+- if (ret)
+- return ret;
++ call[1] = to_auipc_insn((unsigned int)(target - caller));
++ call[2] = to_jalr_insn((unsigned int)(target - caller));
+
+- return __ftrace_modify_call(rec->ip, addr, true);
++ if (patch_text_nosync((void *)rec->ip, call, FUNC_ENTRY_SIZE))
++ return -EPERM;
++
++ return 0;
+ }
+
+ int ftrace_make_nop(struct module *mod, struct dyn_ftrace *rec,
+ unsigned long addr)
+ {
+- unsigned int call[2];
+- int ret;
++ unsigned int nops[4] = {NOP4, NOP4, NOP4, NOP4};
+
+- make_call(rec->ip, addr, call);
+- ret = ftrace_check_current_call(rec->ip, call);
+-
+- if (ret)
+- return ret;
++ if (patch_text_nosync((void *)rec->ip, nops, FUNC_ENTRY_SIZE))
++ return -EPERM;
+
+- return __ftrace_modify_call(rec->ip, addr, false);
++ return 0;
+ }
+
+
+@@ -130,15 +157,16 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
+ unsigned long addr)
+ {
+ unsigned int call[2];
++ unsigned long caller = rec->ip + FUNC_ENTRY_JMP;
+ int ret;
+
+- make_call(rec->ip, old_addr, call);
+- ret = ftrace_check_current_call(rec->ip, call);
++ make_call(caller, old_addr, call);
++ ret = ftrace_check_current_call(caller, call);
+
+ if (ret)
+ return ret;
+
+- return __ftrace_modify_call(rec->ip, addr, true);
++ return __ftrace_modify_call(caller, addr, true);
+ }
+ #endif
+
+@@ -167,53 +195,30 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr,
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ extern void ftrace_graph_call(void);
++extern void ftrace_graph_regs_call(void);
+ int ftrace_enable_ftrace_graph_caller(void)
+ {
+- unsigned int call[2];
+- static int init_graph = 1;
+ int ret;
+
+- make_call(&ftrace_graph_call, &ftrace_stub, call);
+-
+- /*
+- * When enabling graph tracer for the first time, ftrace_graph_call
+- * should contains a call to ftrace_stub. Once it has been disabled,
+- * the 8-bytes at the position becomes NOPs.
+- */
+- if (init_graph) {
+- ret = ftrace_check_current_call((unsigned long)&ftrace_graph_call,
+- call);
+- init_graph = 0;
+- } else {
+- ret = ftrace_check_current_call((unsigned long)&ftrace_graph_call,
+- NULL);
+- }
+-
++ ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call,
++ (unsigned long)&prepare_ftrace_return, true);
+ if (ret)
+ return ret;
+
+- return __ftrace_modify_call((unsigned long)&ftrace_graph_call,
++ return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call,
+ (unsigned long)&prepare_ftrace_return, true);
+ }
+
+ int ftrace_disable_ftrace_graph_caller(void)
+ {
+- unsigned int call[2];
+ int ret;
+
+- make_call(&ftrace_graph_call, &prepare_ftrace_return, call);
+-
+- /*
+- * This is to make sure that ftrace_enable_ftrace_graph_caller
+- * did the right thing.
+- */
+- ret = ftrace_check_current_call((unsigned long)&ftrace_graph_call,
+- call);
+-
++ ret = __ftrace_modify_call((unsigned long)&ftrace_graph_call,
++ (unsigned long)&prepare_ftrace_return, false);
+ if (ret)
+ return ret;
+
+- return __ftrace_modify_call((unsigned long)&ftrace_graph_call,
++ return __ftrace_modify_call((unsigned long)&ftrace_graph_regs_call,
+ (unsigned long)&prepare_ftrace_return, false);
+ }
+ #endif /* CONFIG_DYNAMIC_FTRACE */
+diff --git a/arch/riscv/kernel/mcount-dyn.S b/arch/riscv/kernel/mcount-dyn.S
+index 35a6ed76cb8b7..d171eca623b6f 100644
+--- a/arch/riscv/kernel/mcount-dyn.S
++++ b/arch/riscv/kernel/mcount-dyn.S
+@@ -13,224 +13,186 @@
+
+ .text
+
+- .macro SAVE_ABI_STATE
+-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- addi sp, sp, -48
+- sd s0, 32(sp)
+- sd ra, 40(sp)
+- addi s0, sp, 48
+- sd t0, 24(sp)
+- sd t1, 16(sp)
+-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
+- sd t2, 8(sp)
+-#endif
+-#else
+- addi sp, sp, -16
+- sd s0, 0(sp)
+- sd ra, 8(sp)
+- addi s0, sp, 16
+-#endif
++#define FENTRY_RA_OFFSET 12
++#define ABI_SIZE_ON_STACK 72
++#define ABI_A0 0
++#define ABI_A1 8
++#define ABI_A2 16
++#define ABI_A3 24
++#define ABI_A4 32
++#define ABI_A5 40
++#define ABI_A6 48
++#define ABI_A7 56
++#define ABI_RA 64
++
++ .macro SAVE_ABI
++ addi sp, sp, -SZREG
++ addi sp, sp, -ABI_SIZE_ON_STACK
++
++ REG_S a0, ABI_A0(sp)
++ REG_S a1, ABI_A1(sp)
++ REG_S a2, ABI_A2(sp)
++ REG_S a3, ABI_A3(sp)
++ REG_S a4, ABI_A4(sp)
++ REG_S a5, ABI_A5(sp)
++ REG_S a6, ABI_A6(sp)
++ REG_S a7, ABI_A7(sp)
++ REG_S ra, ABI_RA(sp)
+ .endm
+
+- .macro RESTORE_ABI_STATE
+-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- ld s0, 32(sp)
+- ld ra, 40(sp)
+- addi sp, sp, 48
+-#else
+- ld ra, 8(sp)
+- ld s0, 0(sp)
+- addi sp, sp, 16
+-#endif
++ .macro RESTORE_ABI
++ REG_L a0, ABI_A0(sp)
++ REG_L a1, ABI_A1(sp)
++ REG_L a2, ABI_A2(sp)
++ REG_L a3, ABI_A3(sp)
++ REG_L a4, ABI_A4(sp)
++ REG_L a5, ABI_A5(sp)
++ REG_L a6, ABI_A6(sp)
++ REG_L a7, ABI_A7(sp)
++ REG_L ra, ABI_RA(sp)
++
++ addi sp, sp, ABI_SIZE_ON_STACK
++ addi sp, sp, SZREG
+ .endm
+
+- .macro RESTORE_GRAPH_ARGS
+- ld a0, 24(sp)
+- ld a1, 16(sp)
+-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
+- ld a2, 8(sp)
+-#endif
++#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
++ .macro SAVE_ALL
++ addi sp, sp, -SZREG
++ addi sp, sp, -PT_SIZE_ON_STACK
++
++ REG_S x1, PT_EPC(sp)
++ addi sp, sp, PT_SIZE_ON_STACK
++ REG_L x1, (sp)
++ addi sp, sp, -PT_SIZE_ON_STACK
++ REG_S x1, PT_RA(sp)
++ REG_L x1, PT_EPC(sp)
++
++ REG_S x2, PT_SP(sp)
++ REG_S x3, PT_GP(sp)
++ REG_S x4, PT_TP(sp)
++ REG_S x5, PT_T0(sp)
++ REG_S x6, PT_T1(sp)
++ REG_S x7, PT_T2(sp)
++ REG_S x8, PT_S0(sp)
++ REG_S x9, PT_S1(sp)
++ REG_S x10, PT_A0(sp)
++ REG_S x11, PT_A1(sp)
++ REG_S x12, PT_A2(sp)
++ REG_S x13, PT_A3(sp)
++ REG_S x14, PT_A4(sp)
++ REG_S x15, PT_A5(sp)
++ REG_S x16, PT_A6(sp)
++ REG_S x17, PT_A7(sp)
++ REG_S x18, PT_S2(sp)
++ REG_S x19, PT_S3(sp)
++ REG_S x20, PT_S4(sp)
++ REG_S x21, PT_S5(sp)
++ REG_S x22, PT_S6(sp)
++ REG_S x23, PT_S7(sp)
++ REG_S x24, PT_S8(sp)
++ REG_S x25, PT_S9(sp)
++ REG_S x26, PT_S10(sp)
++ REG_S x27, PT_S11(sp)
++ REG_S x28, PT_T3(sp)
++ REG_S x29, PT_T4(sp)
++ REG_S x30, PT_T5(sp)
++ REG_S x31, PT_T6(sp)
+ .endm
+
+-ENTRY(ftrace_graph_caller)
+- addi sp, sp, -16
+- sd s0, 0(sp)
+- sd ra, 8(sp)
+- addi s0, sp, 16
+-ftrace_graph_call:
+- .global ftrace_graph_call
+- /*
+- * Calling ftrace_enable/disable_ftrace_graph_caller would overwrite the
+- * call below. Check ftrace_modify_all_code for details.
+- */
+- call ftrace_stub
+- ld ra, 8(sp)
+- ld s0, 0(sp)
+- addi sp, sp, 16
+- ret
+-ENDPROC(ftrace_graph_caller)
++ .macro RESTORE_ALL
++ REG_L x1, PT_RA(sp)
++ addi sp, sp, PT_SIZE_ON_STACK
++ REG_S x1, (sp)
++ addi sp, sp, -PT_SIZE_ON_STACK
++ REG_L x1, PT_EPC(sp)
++ REG_L x2, PT_SP(sp)
++ REG_L x3, PT_GP(sp)
++ REG_L x4, PT_TP(sp)
++ REG_L x5, PT_T0(sp)
++ REG_L x6, PT_T1(sp)
++ REG_L x7, PT_T2(sp)
++ REG_L x8, PT_S0(sp)
++ REG_L x9, PT_S1(sp)
++ REG_L x10, PT_A0(sp)
++ REG_L x11, PT_A1(sp)
++ REG_L x12, PT_A2(sp)
++ REG_L x13, PT_A3(sp)
++ REG_L x14, PT_A4(sp)
++ REG_L x15, PT_A5(sp)
++ REG_L x16, PT_A6(sp)
++ REG_L x17, PT_A7(sp)
++ REG_L x18, PT_S2(sp)
++ REG_L x19, PT_S3(sp)
++ REG_L x20, PT_S4(sp)
++ REG_L x21, PT_S5(sp)
++ REG_L x22, PT_S6(sp)
++ REG_L x23, PT_S7(sp)
++ REG_L x24, PT_S8(sp)
++ REG_L x25, PT_S9(sp)
++ REG_L x26, PT_S10(sp)
++ REG_L x27, PT_S11(sp)
++ REG_L x28, PT_T3(sp)
++ REG_L x29, PT_T4(sp)
++ REG_L x30, PT_T5(sp)
++ REG_L x31, PT_T6(sp)
++
++ addi sp, sp, PT_SIZE_ON_STACK
++ addi sp, sp, SZREG
++ .endm
++#endif /* CONFIG_DYNAMIC_FTRACE_WITH_REGS */
+
+ ENTRY(ftrace_caller)
+- /*
+- * a0: the address in the caller when calling ftrace_caller
+- * a1: the caller's return address
+- * a2: the address of global variable function_trace_op
+- */
+- ld a1, -8(s0)
+- addi a0, ra, -MCOUNT_INSN_SIZE
+- la t5, function_trace_op
+- ld a2, 0(t5)
++ SAVE_ABI
+
+-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- /*
+- * the graph tracer (specifically, prepare_ftrace_return) needs these
+- * arguments but for now the function tracer occupies the regs, so we
+- * save them in temporary regs to recover later.
+- */
+- addi t0, s0, -8
+- mv t1, a0
+-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
+- ld t2, -16(s0)
+-#endif
+-#endif
++ addi a0, ra, -FENTRY_RA_OFFSET
++ la a1, function_trace_op
++ REG_L a2, 0(a1)
++ REG_L a1, ABI_SIZE_ON_STACK(sp)
++ mv a3, sp
+
+- SAVE_ABI_STATE
+ ftrace_call:
+ .global ftrace_call
+- /*
+- * For the dynamic ftrace to work, here we should reserve at least
+- * 8 bytes for a functional auipc-jalr pair. The following call
+- * serves this purpose.
+- *
+- * Calling ftrace_update_ftrace_func would overwrite the nops below.
+- * Check ftrace_modify_all_code for details.
+- */
+ call ftrace_stub
+
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- RESTORE_GRAPH_ARGS
+- call ftrace_graph_caller
++ addi a0, sp, ABI_SIZE_ON_STACK
++ REG_L a1, ABI_RA(sp)
++ addi a1, a1, -FENTRY_RA_OFFSET
++#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
++ mv a2, s0
+ #endif
+-
+- RESTORE_ABI_STATE
++ftrace_graph_call:
++ .global ftrace_graph_call
++ call ftrace_stub
++#endif
++ RESTORE_ABI
+ ret
+ ENDPROC(ftrace_caller)
+
+ #ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
+- .macro SAVE_ALL
+- addi sp, sp, -(PT_SIZE_ON_STACK+16)
+- sd s0, (PT_SIZE_ON_STACK)(sp)
+- sd ra, (PT_SIZE_ON_STACK+8)(sp)
+- addi s0, sp, (PT_SIZE_ON_STACK+16)
+-
+- sd x1, PT_RA(sp)
+- sd x2, PT_SP(sp)
+- sd x3, PT_GP(sp)
+- sd x4, PT_TP(sp)
+- sd x5, PT_T0(sp)
+- sd x6, PT_T1(sp)
+- sd x7, PT_T2(sp)
+- sd x8, PT_S0(sp)
+- sd x9, PT_S1(sp)
+- sd x10, PT_A0(sp)
+- sd x11, PT_A1(sp)
+- sd x12, PT_A2(sp)
+- sd x13, PT_A3(sp)
+- sd x14, PT_A4(sp)
+- sd x15, PT_A5(sp)
+- sd x16, PT_A6(sp)
+- sd x17, PT_A7(sp)
+- sd x18, PT_S2(sp)
+- sd x19, PT_S3(sp)
+- sd x20, PT_S4(sp)
+- sd x21, PT_S5(sp)
+- sd x22, PT_S6(sp)
+- sd x23, PT_S7(sp)
+- sd x24, PT_S8(sp)
+- sd x25, PT_S9(sp)
+- sd x26, PT_S10(sp)
+- sd x27, PT_S11(sp)
+- sd x28, PT_T3(sp)
+- sd x29, PT_T4(sp)
+- sd x30, PT_T5(sp)
+- sd x31, PT_T6(sp)
+- .endm
+-
+- .macro RESTORE_ALL
+- ld x1, PT_RA(sp)
+- ld x2, PT_SP(sp)
+- ld x3, PT_GP(sp)
+- ld x4, PT_TP(sp)
+- ld x5, PT_T0(sp)
+- ld x6, PT_T1(sp)
+- ld x7, PT_T2(sp)
+- ld x8, PT_S0(sp)
+- ld x9, PT_S1(sp)
+- ld x10, PT_A0(sp)
+- ld x11, PT_A1(sp)
+- ld x12, PT_A2(sp)
+- ld x13, PT_A3(sp)
+- ld x14, PT_A4(sp)
+- ld x15, PT_A5(sp)
+- ld x16, PT_A6(sp)
+- ld x17, PT_A7(sp)
+- ld x18, PT_S2(sp)
+- ld x19, PT_S3(sp)
+- ld x20, PT_S4(sp)
+- ld x21, PT_S5(sp)
+- ld x22, PT_S6(sp)
+- ld x23, PT_S7(sp)
+- ld x24, PT_S8(sp)
+- ld x25, PT_S9(sp)
+- ld x26, PT_S10(sp)
+- ld x27, PT_S11(sp)
+- ld x28, PT_T3(sp)
+- ld x29, PT_T4(sp)
+- ld x30, PT_T5(sp)
+- ld x31, PT_T6(sp)
+-
+- ld s0, (PT_SIZE_ON_STACK)(sp)
+- ld ra, (PT_SIZE_ON_STACK+8)(sp)
+- addi sp, sp, (PT_SIZE_ON_STACK+16)
+- .endm
+-
+- .macro RESTORE_GRAPH_REG_ARGS
+- ld a0, PT_T0(sp)
+- ld a1, PT_T1(sp)
+-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
+- ld a2, PT_T2(sp)
+-#endif
+- .endm
+-
+-/*
+- * Most of the contents are the same as ftrace_caller.
+- */
+ ENTRY(ftrace_regs_caller)
+- /*
+- * a3: the address of all registers in the stack
+- */
+- ld a1, -8(s0)
+- addi a0, ra, -MCOUNT_INSN_SIZE
+- la t5, function_trace_op
+- ld a2, 0(t5)
+- addi a3, sp, -(PT_SIZE_ON_STACK+16)
+-
+-#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- addi t0, s0, -8
+- mv t1, a0
+-#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
+- ld t2, -16(s0)
+-#endif
+-#endif
+ SAVE_ALL
+
++ addi a0, ra, -FENTRY_RA_OFFSET
++ la a1, function_trace_op
++ REG_L a2, 0(a1)
++ REG_L a1, PT_SIZE_ON_STACK(sp)
++ mv a3, sp
++
+ ftrace_regs_call:
+ .global ftrace_regs_call
+ call ftrace_stub
+
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+- RESTORE_GRAPH_REG_ARGS
+- call ftrace_graph_caller
++ addi a0, sp, PT_RA
++ REG_L a1, PT_EPC(sp)
++ addi a1, a1, -FENTRY_RA_OFFSET
++#ifdef HAVE_FUNCTION_GRAPH_FP_TEST
++ mv a2, s0
++#endif
++ftrace_graph_regs_call:
++ .global ftrace_graph_regs_call
++ call ftrace_stub
+ #endif
+
+ RESTORE_ALL
+--
+2.39.2
+
--- /dev/null
+From 8c210f7136602b369661a70ca9af3fbabeb81c45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Feb 2023 12:52:00 -0800
+Subject: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit fc663711b94468f4e1427ebe289c9f05669699c9 ]
+
+Remove the /proc/scsi/${proc_name} directory earlier to fix a race
+condition between unloading and reloading kernel modules. This fixes a bug
+introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in
+the SCSI core").
+
+Fix the following kernel warning:
+
+proc_dir_entry 'scsi/scsi_debug' already registered
+WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_register+0x27d/0x2e0
+Call Trace:
+ proc_mkdir+0xb5/0xe0
+ scsi_proc_hostdir_add+0xb5/0x170
+ scsi_host_alloc+0x683/0x6c0
+ sdebug_driver_probe+0x6b/0x2d0 [scsi_debug]
+ really_probe+0x159/0x540
+ __driver_probe_device+0xdc/0x230
+ driver_probe_device+0x4f/0x120
+ __device_attach_driver+0xef/0x180
+ bus_for_each_drv+0xe5/0x130
+ __device_attach+0x127/0x290
+ device_initial_probe+0x17/0x20
+ bus_probe_device+0x110/0x130
+ device_add+0x673/0xc80
+ device_register+0x1e/0x30
+ sdebug_add_host_helper+0x1a7/0x3b0 [scsi_debug]
+ scsi_debug_init+0x64f/0x1000 [scsi_debug]
+ do_one_initcall+0xd7/0x470
+ do_init_module+0xe7/0x330
+ load_module+0x122a/0x12c0
+ __do_sys_finit_module+0x124/0x1a0
+ __x64_sys_finit_module+0x46/0x50
+ do_syscall_64+0x38/0x80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+Link: https://lore.kernel.org/r/20230210205200.36973-3-bvanassche@acm.org
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: Yi Zhang <yi.zhang@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core")
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hosts.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
+index 45885e80992fb..b08d963013db6 100644
+--- a/drivers/scsi/hosts.c
++++ b/drivers/scsi/hosts.c
+@@ -179,6 +179,7 @@ void scsi_remove_host(struct Scsi_Host *shost)
+ scsi_forget_host(shost);
+ mutex_unlock(&shost->scan_mutex);
+ scsi_proc_host_rm(shost);
++ scsi_proc_hostdir_rm(shost->hostt);
+
+ spin_lock_irqsave(shost->host_lock, flags);
+ if (scsi_host_set_state(shost, SHOST_DEL))
+@@ -318,6 +319,7 @@ static void scsi_host_dev_release(struct device *dev)
+ struct Scsi_Host *shost = dev_to_shost(dev);
+ struct device *parent = dev->parent;
+
++ /* In case scsi_remove_host() has not been called. */
+ scsi_proc_hostdir_rm(shost->hostt);
+
+ /* Wait for functions invoked through call_rcu(&shost->rcu, ...) */
+--
+2.39.2
+
--- /dev/null
+From 39dd02b07349b6215838f5cc035b29d014bab994 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Mar 2023 16:23:40 +0530
+Subject: scsi: megaraid_sas: Update max supported LD IDs to 240
+
+From: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+
+[ Upstream commit bfa659177dcba48cf13f2bd88c1972f12a60bf1c ]
+
+The firmware only supports Logical Disk IDs up to 240 and LD ID 255 (0xFF)
+is reserved for deleted LDs. However, in some cases, firmware was assigning
+LD ID 254 (0xFE) to deleted LDs and this was causing the driver to mark the
+wrong disk as deleted. This in turn caused the wrong disk device to be
+taken offline by the SCSI midlayer.
+
+To address this issue, limit the LD ID range from 255 to 240. This ensures
+the deleted LD ID is properly identified and removed by the driver without
+accidently deleting any valid LDs.
+
+Fixes: ae6874ba4b43 ("scsi: megaraid_sas: Early detection of VD deletion through RaidMap update")
+Reported-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Chandrakanth Patil <chandrakanth.patil@broadcom.com>
+Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Link: https://lore.kernel.org/r/20230302105342.34933-2-chandrakanth.patil@broadcom.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas.h | 2 ++
+ drivers/scsi/megaraid/megaraid_sas_fp.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
+index aa62cc8ffd0af..ce0c36fa26bf7 100644
+--- a/drivers/scsi/megaraid/megaraid_sas.h
++++ b/drivers/scsi/megaraid/megaraid_sas.h
+@@ -1515,6 +1515,8 @@ struct megasas_ctrl_info {
+ #define MEGASAS_MAX_LD_IDS (MEGASAS_MAX_LD_CHANNELS * \
+ MEGASAS_MAX_DEV_PER_CHANNEL)
+
++#define MEGASAS_MAX_SUPPORTED_LD_IDS 240
++
+ #define MEGASAS_MAX_SECTORS (2*1024)
+ #define MEGASAS_MAX_SECTORS_IEEE (2*128)
+ #define MEGASAS_DBG_LVL 1
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c
+index 8bfb46dbbed3a..ff20f47090810 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
+@@ -359,7 +359,7 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance, u64 map_id)
+ ld = MR_TargetIdToLdGet(i, drv_map);
+
+ /* For non existing VDs, iterate to next VD*/
+- if (ld >= (MAX_LOGICAL_DRIVES_EXT - 1))
++ if (ld >= MEGASAS_MAX_SUPPORTED_LD_IDS)
+ continue;
+
+ raid = MR_LdRaidGet(ld, drv_map);
+--
+2.39.2
+
--- /dev/null
+From 128c9acd2c3ed9356a117e15ccbb3d92a677d481 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Feb 2023 17:36:46 +0800
+Subject: selftests: nft_nat: ensuring the listening side is up before starting
+ the client
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 2067e7a00aa604b94de31d64f29b8893b1696f26 ]
+
+The test_local_dnat_portonly() function initiates the client-side as
+soon as it sets the listening side to the background. This could lead to
+a race condition where the server may not be ready to listen. To ensure
+that the server-side is up and running before initiating the
+client-side, a delay is introduced to the test_local_dnat_portonly()
+function.
+
+Before the fix:
+ # ./nft_nat.sh
+ PASS: netns routing/connectivity: ns0-rthlYrBU can reach ns1-rthlYrBU and ns2-rthlYrBU
+ PASS: ping to ns1-rthlYrBU was ip NATted to ns2-rthlYrBU
+ PASS: ping to ns1-rthlYrBU OK after ip nat output chain flush
+ PASS: ipv6 ping to ns1-rthlYrBU was ip6 NATted to ns2-rthlYrBU
+ 2023/02/27 04:11:03 socat[6055] E connect(5, AF=2 10.0.1.99:2000, 16): Connection refused
+ ERROR: inet port rewrite
+
+After the fix:
+ # ./nft_nat.sh
+ PASS: netns routing/connectivity: ns0-9sPJV6JJ can reach ns1-9sPJV6JJ and ns2-9sPJV6JJ
+ PASS: ping to ns1-9sPJV6JJ was ip NATted to ns2-9sPJV6JJ
+ PASS: ping to ns1-9sPJV6JJ OK after ip nat output chain flush
+ PASS: ipv6 ping to ns1-9sPJV6JJ was ip6 NATted to ns2-9sPJV6JJ
+ PASS: inet port rewrite without l3 address
+
+Fixes: 282e5f8fe907 ("netfilter: nat: really support inet nat without l3 address")
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/netfilter/nft_nat.sh | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh
+index 4e15e81673104..67697d8ea59a5 100755
+--- a/tools/testing/selftests/netfilter/nft_nat.sh
++++ b/tools/testing/selftests/netfilter/nft_nat.sh
+@@ -404,6 +404,8 @@ EOF
+ echo SERVER-$family | ip netns exec "$ns1" timeout 5 socat -u STDIN TCP-LISTEN:2000 &
+ sc_s=$!
+
++ sleep 1
++
+ result=$(ip netns exec "$ns0" timeout 1 socat TCP:$daddr:2000 STDOUT)
+
+ if [ "$result" = "SERVER-inet" ];then
+--
+2.39.2
+
ext4-fix-warning-in-ext4_update_inline_data.patch
ext4-zero-i_disksize-when-initializing-the-bootloader-inode.patch
nfc-change-order-inside-nfc_se_io-error-path.patch
+drm-edid-extract-drm_mode_cea_vic.patch
+drm-edid-fix-hdmi-vic-handling.patch
+drm-edid-add-aspect-ratios-to-hdmi-4k-modes.patch
+drm-edid-fix-avi-infoframe-aspect-ratio-handling.patch
+iommu-amd-add-pci-segment-support-for-ivrs_-ioapic-h.patch
+iommu-amd-fix-ill-formed-ivrs_ioapic-ivrs_hpet-and-i.patch
+iommu-amd-add-a-length-limitation-for-the-ivrs_acpih.patch
+ipmi-ssif-make-ssif_i2c_send-void.patch
+ipmi-ssif-resend_msg-cannot-fail.patch
+ipmi-ssif-remove-rtc_us_timer.patch
+ipmi-ssif-increase-the-message-retry-time.patch
+ipmi-ssif-add-a-timer-between-request-retries.patch
+irqdomain-change-the-type-of-size-in-__irq_domain_ad.patch
+irqdomain-fix-domain-registration-race.patch
+software-node-introduce-device_add_software_node.patch
+usb-dwc3-pci-register-a-software-node-for-the-dwc3-p.patch
+usb-dwc3-pci-id-for-tiger-lake-cpu.patch
+usb-dwc3-pci-add-support-for-the-intel-raptor-lake-s.patch
+usb-dwc3-pci-add-support-for-the-intel-meteor-lake-p.patch
+usb-dwc3-pci-add-support-for-the-intel-meteor-lake-m.patch
+riscv-using-patchable_function_entry-instead-of-mcou.patch
+riscv-ftrace-remove-wasted-nops-for-riscv_isa_c.patch
+iommu-vt-d-fix-pasid-directory-pointer-coherency.patch
+arm-dts-exynos-override-thermal-by-label-in-exynos42.patch
+arm-dts-exynos-correct-tmu-phandle-in-exynos4210.patch
+arm-dts-exynos-override-thermal-by-label-in-exynos52.patch
+arm-dts-exynos-correct-tmu-phandle-in-exynos5250.patch
+arm-dts-exynos-add-gpu-thermal-zone-cooling-maps-for.patch
+arm-dts-exynos-correct-tmu-phandle-in-odroid-hc1.patch
+arm-dts-exynos-correct-tmu-phandle-in-odroid-xu3-fam.patch
+smb3-backup-intent-flag-missing-from-some-more-ops.patch
+cifs-fix-uninitialized-memory-read-in-smb3_qfs_tcon.patch
+riscv-abstract-out-csr-names-for-supervisor-vs-machi.patch
+risc-v-avoid-dereferening-null-regs-in-die.patch
+riscv-avoid-enabling-interrupts-in-die.patch
+scsi-core-remove-the-proc-scsi-proc_name-directory-e.patch
+ext4-fix-possible-corruption-when-moving-a-directory.patch
+drm-msm-a5xx-fix-setting-of-the-cp_preempt_enable_lo.patch
+nfc-fdp-add-null-check-of-devm_kmalloc_array-in-fdp_.patch
+ila-do-not-generate-empty-messages-in-ila_xlat_nl_cm.patch
+selftests-nft_nat-ensuring-the-listening-side-is-up-.patch
+net-usb-lan78xx-remove-lots-of-set-but-unused-ret-va.patch
+net-lan78xx-fix-accessing-the-lan7800-s-internal-phy.patch
+net-caif-fix-use-after-free-in-cfusbl_device_notify.patch
+bnxt_en-avoid-order-5-memory-allocation-for-tpa-data.patch
+netfilter-tproxy-fix-deadlock-due-to-missing-bh-disa.patch
+btf-fix-resolving-btf_kind_var-after-array-struct-un.patch
+scsi-megaraid_sas-update-max-supported-ld-ids-to-240.patch
+net-smc-fix-fallback-failed-while-sendmsg-with-fasto.patch
+riscv-use-read_once_nocheck-in-imprecise-unwinding-s.patch
--- /dev/null
+From 03ac637f11a5b6f4029588387a5b284e8e5da448 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 21:46:43 +0200
+Subject: SMB3: Backup intent flag missing from some more ops
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+[ Upstream commit 0f060936e490c6279dfe773d75d526d3d3d77111 ]
+
+When "backup intent" is requested on the mount (e.g. backupuid or
+backupgid mount options), the corresponding flag was missing from
+some of the operations.
+
+Change all operations to use the macro cifs_create_options() to
+set the backup intent flag if needed.
+
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Stable-dep-of: d447e794a372 ("cifs: Fix uninitialized memory read in smb3_qfs_tcon()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsacl.c | 14 +++-----
+ fs/cifs/cifsfs.c | 2 +-
+ fs/cifs/cifsglob.h | 6 ++--
+ fs/cifs/cifsproto.h | 8 +++++
+ fs/cifs/connect.c | 2 +-
+ fs/cifs/dir.c | 5 +--
+ fs/cifs/file.c | 10 ++----
+ fs/cifs/inode.c | 8 ++---
+ fs/cifs/ioctl.c | 2 +-
+ fs/cifs/link.c | 18 +++-------
+ fs/cifs/smb1ops.c | 19 +++++------
+ fs/cifs/smb2inode.c | 9 ++---
+ fs/cifs/smb2ops.c | 81 +++++++++++++++------------------------------
+ fs/cifs/smb2proto.h | 2 +-
+ 14 files changed, 68 insertions(+), 118 deletions(-)
+
+diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
+index 1f55072aa3023..1766d6d077f26 100644
+--- a/fs/cifs/cifsacl.c
++++ b/fs/cifs/cifsacl.c
+@@ -1056,7 +1056,7 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
+ struct cifs_ntsd *pntsd = NULL;
+ int oplock = 0;
+ unsigned int xid;
+- int rc, create_options = 0;
++ int rc;
+ struct cifs_tcon *tcon;
+ struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
+ struct cifs_fid fid;
+@@ -1068,13 +1068,10 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb,
+ tcon = tlink_tcon(tlink);
+ xid = get_xid();
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = READ_CONTROL;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = path;
+ oparms.fid = &fid;
+@@ -1119,7 +1116,7 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
+ {
+ int oplock = 0;
+ unsigned int xid;
+- int rc, access_flags, create_options = 0;
++ int rc, access_flags;
+ struct cifs_tcon *tcon;
+ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+ struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
+@@ -1132,9 +1129,6 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
+ tcon = tlink_tcon(tlink);
+ xid = get_xid();
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ if (aclflag == CIFS_ACL_OWNER || aclflag == CIFS_ACL_GROUP)
+ access_flags = WRITE_OWNER;
+ else
+@@ -1143,7 +1137,7 @@ int set_cifs_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = access_flags;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = path;
+ oparms.fid = &fid;
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index aa7827da7b178..871a7b044c1b8 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -275,7 +275,7 @@ cifs_statfs(struct dentry *dentry, struct kstatfs *buf)
+ buf->f_ffree = 0; /* unlimited */
+
+ if (server->ops->queryfs)
+- rc = server->ops->queryfs(xid, tcon, buf);
++ rc = server->ops->queryfs(xid, tcon, cifs_sb, buf);
+
+ free_xid(xid);
+ return rc;
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 7c0eb110e2630..253321adc2664 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -300,7 +300,8 @@ struct smb_version_operations {
+ const char *, struct dfs_info3_param **,
+ unsigned int *, const struct nls_table *, int);
+ /* informational QFS call */
+- void (*qfs_tcon)(const unsigned int, struct cifs_tcon *);
++ void (*qfs_tcon)(const unsigned int, struct cifs_tcon *,
++ struct cifs_sb_info *);
+ /* check if a path is accessible or not */
+ int (*is_path_accessible)(const unsigned int, struct cifs_tcon *,
+ struct cifs_sb_info *, const char *);
+@@ -408,7 +409,7 @@ struct smb_version_operations {
+ struct cifsInodeInfo *);
+ /* query remote filesystem */
+ int (*queryfs)(const unsigned int, struct cifs_tcon *,
+- struct kstatfs *);
++ struct cifs_sb_info *, struct kstatfs *);
+ /* send mandatory brlock to the server */
+ int (*mand_lock)(const unsigned int, struct cifsFileInfo *, __u64,
+ __u64, __u32, int, int, bool);
+@@ -489,6 +490,7 @@ struct smb_version_operations {
+ /* ioctl passthrough for query_info */
+ int (*ioctl_query_info)(const unsigned int xid,
+ struct cifs_tcon *tcon,
++ struct cifs_sb_info *cifs_sb,
+ __le16 *path, int is_dir,
+ unsigned long p);
+ /* make unix special files (block, char, fifo, socket) */
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index 56a4740ae93ab..a5fab9afd699f 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -600,4 +600,12 @@ static inline int get_dfs_path(const unsigned int xid, struct cifs_ses *ses,
+ }
+ #endif
+
++static inline int cifs_create_options(struct cifs_sb_info *cifs_sb, int options)
++{
++ if (backup_cred(cifs_sb))
++ return options | CREATE_OPEN_BACKUP_INTENT;
++ else
++ return options;
++}
++
+ #endif /* _CIFSPROTO_H */
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 25a2a98ebda8d..6c8dd7c0b83a2 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -4319,7 +4319,7 @@ static int mount_get_conns(struct smb_vol *vol, struct cifs_sb_info *cifs_sb,
+
+ /* do not care if a following call succeed - informational */
+ if (!tcon->pipe && server->ops->qfs_tcon) {
+- server->ops->qfs_tcon(*xid, tcon);
++ server->ops->qfs_tcon(*xid, tcon, cifs_sb);
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_RO_CACHE) {
+ if (tcon->fsDevInfo.DeviceCharacteristics &
+ cpu_to_le32(FILE_READ_ONLY_DEVICE))
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 9ae9a514676c3..548047a709bfc 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -357,13 +357,10 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
+ if (!tcon->unix_ext && (mode & S_IWUGO) == 0)
+ create_options |= CREATE_OPTION_READONLY;
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = desired_access;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, create_options);
+ oparms.disposition = disposition;
+ oparms.path = full_path;
+ oparms.fid = fid;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index eb9b34442b1d3..86924831fd4ba 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -223,9 +223,6 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
+ if (!buf)
+ return -ENOMEM;
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ /* O_SYNC also has bit for O_DSYNC so following check picks up either */
+ if (f_flags & O_SYNC)
+ create_options |= CREATE_WRITE_THROUGH;
+@@ -236,7 +233,7 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = desired_access;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, create_options);
+ oparms.disposition = disposition;
+ oparms.path = full_path;
+ oparms.fid = fid;
+@@ -751,9 +748,6 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush)
+
+ desired_access = cifs_convert_flags(cfile->f_flags);
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ /* O_SYNC also has bit for O_DSYNC so following check picks up either */
+ if (cfile->f_flags & O_SYNC)
+ create_options |= CREATE_WRITE_THROUGH;
+@@ -767,7 +761,7 @@ cifs_reopen_file(struct cifsFileInfo *cfile, bool can_flush)
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = desired_access;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, create_options);
+ oparms.disposition = disposition;
+ oparms.path = full_path;
+ oparms.fid = &cfile->fid;
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index fd9e289f3e72a..af0980c720c78 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -472,9 +472,7 @@ cifs_sfu_type(struct cifs_fattr *fattr, const char *path,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_READ;
+- oparms.create_options = CREATE_NOT_DIR;
+- if (backup_cred(cifs_sb))
+- oparms.create_options |= CREATE_OPEN_BACKUP_INTENT;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = path;
+ oparms.fid = &fid;
+@@ -1225,7 +1223,7 @@ cifs_rename_pending_delete(const char *full_path, struct dentry *dentry,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = DELETE | FILE_WRITE_ATTRIBUTES;
+- oparms.create_options = CREATE_NOT_DIR;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = full_path;
+ oparms.fid = &fid;
+@@ -1763,7 +1761,7 @@ cifs_do_rename(const unsigned int xid, struct dentry *from_dentry,
+ oparms.cifs_sb = cifs_sb;
+ /* open the file to be renamed -- we need DELETE perms */
+ oparms.desired_access = DELETE;
+- oparms.create_options = CREATE_NOT_DIR;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = from_path;
+ oparms.fid = &fid;
+diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
+index 9266dddd4b1eb..bc08d856ee05f 100644
+--- a/fs/cifs/ioctl.c
++++ b/fs/cifs/ioctl.c
+@@ -65,7 +65,7 @@ static long cifs_ioctl_query_info(unsigned int xid, struct file *filep,
+
+ if (tcon->ses->server->ops->ioctl_query_info)
+ rc = tcon->ses->server->ops->ioctl_query_info(
+- xid, tcon, utf16_path,
++ xid, tcon, cifs_sb, utf16_path,
+ filep->private_data ? 0 : 1, p);
+ else
+ rc = -EOPNOTSUPP;
+diff --git a/fs/cifs/link.c b/fs/cifs/link.c
+index b4b15d611deda..02949a2f28608 100644
+--- a/fs/cifs/link.c
++++ b/fs/cifs/link.c
+@@ -318,7 +318,7 @@ cifs_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_READ;
+- oparms.create_options = CREATE_NOT_DIR;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = path;
+ oparms.fid = &fid;
+@@ -356,15 +356,11 @@ cifs_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
+ struct cifs_fid fid;
+ struct cifs_open_parms oparms;
+ struct cifs_io_parms io_parms;
+- int create_options = CREATE_NOT_DIR;
+-
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_WRITE;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_CREATE;
+ oparms.path = path;
+ oparms.fid = &fid;
+@@ -405,9 +401,7 @@ smb3_query_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_READ;
+- oparms.create_options = CREATE_NOT_DIR;
+- if (backup_cred(cifs_sb))
+- oparms.create_options |= CREATE_OPEN_BACKUP_INTENT;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_OPEN;
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+@@ -460,14 +454,10 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
+ struct cifs_fid fid;
+ struct cifs_open_parms oparms;
+ struct cifs_io_parms io_parms;
+- int create_options = CREATE_NOT_DIR;
+ __le16 *utf16_path;
+ __u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
+ struct kvec iov[2];
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ cifs_dbg(FYI, "%s: path: %s\n", __func__, path);
+
+ utf16_path = cifs_convert_path_to_utf16(path, cifs_sb);
+@@ -477,7 +467,7 @@ smb3_create_mf_symlink(unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_WRITE;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_CREATE;
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index e523c05a44876..b130efaf8feb2 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -504,7 +504,8 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *volume_info)
+ }
+
+ static void
+-cifs_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
++cifs_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon,
++ struct cifs_sb_info *cifs_sb)
+ {
+ CIFSSMBQFSDeviceInfo(xid, tcon);
+ CIFSSMBQFSAttributeInfo(xid, tcon);
+@@ -565,7 +566,7 @@ cifs_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = full_path;
+ oparms.fid = &fid;
+@@ -793,7 +794,7 @@ smb_set_file_info(struct inode *inode, const char *full_path,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = SYNCHRONIZE | FILE_WRITE_ATTRIBUTES;
+- oparms.create_options = CREATE_NOT_DIR;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = full_path;
+ oparms.fid = &fid;
+@@ -872,7 +873,7 @@ cifs_oplock_response(struct cifs_tcon *tcon, struct cifs_fid *fid,
+
+ static int
+ cifs_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
+- struct kstatfs *buf)
++ struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
+ {
+ int rc = -EOPNOTSUPP;
+
+@@ -970,7 +971,8 @@ cifs_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+- oparms.create_options = OPEN_REPARSE_POINT;
++ oparms.create_options = cifs_create_options(cifs_sb,
++ OPEN_REPARSE_POINT);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = full_path;
+ oparms.fid = &fid;
+@@ -1029,7 +1031,6 @@ cifs_make_node(unsigned int xid, struct inode *inode,
+ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+ struct inode *newinode = NULL;
+ int rc = -EPERM;
+- int create_options = CREATE_NOT_DIR | CREATE_OPTION_SPECIAL;
+ FILE_ALL_INFO *buf = NULL;
+ struct cifs_io_parms io_parms;
+ __u32 oplock = 0;
+@@ -1090,13 +1091,11 @@ cifs_make_node(unsigned int xid, struct inode *inode,
+ goto out;
+ }
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_WRITE;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR |
++ CREATE_OPTION_SPECIAL);
+ oparms.disposition = FILE_CREATE;
+ oparms.path = full_path;
+ oparms.fid = &fid;
+diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c
+index f2a6f7f28340d..c9abda93d65b4 100644
+--- a/fs/cifs/smb2inode.c
++++ b/fs/cifs/smb2inode.c
+@@ -98,9 +98,7 @@ smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.desired_access = desired_access;
+ oparms.disposition = create_disposition;
+- oparms.create_options = create_options;
+- if (backup_cred(cifs_sb))
+- oparms.create_options |= CREATE_OPEN_BACKUP_INTENT;
++ oparms.create_options = cifs_create_options(cifs_sb, create_options);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+ oparms.mode = mode;
+@@ -456,7 +454,7 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+
+ /* If it is a root and its handle is cached then use it */
+ if (!strlen(full_path) && !no_cached_open) {
+- rc = open_shroot(xid, tcon, &fid);
++ rc = open_shroot(xid, tcon, cifs_sb, &fid);
+ if (rc)
+ goto out;
+
+@@ -473,9 +471,6 @@ smb2_query_path_info(const unsigned int xid, struct cifs_tcon *tcon,
+ goto out;
+ }
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ cifs_get_readable_path(tcon, full_path, &cfile);
+ rc = smb2_compound_op(xid, tcon, cifs_sb, full_path,
+ FILE_READ_ATTRIBUTES, FILE_OPEN, create_options,
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 944c575a4a705..a3bb2c7468c75 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -644,7 +644,8 @@ smb2_cached_lease_break(struct work_struct *work)
+ /*
+ * Open the directory at the root of a share
+ */
+-int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
++int open_shroot(unsigned int xid, struct cifs_tcon *tcon,
++ struct cifs_sb_info *cifs_sb, struct cifs_fid *pfid)
+ {
+ struct cifs_ses *ses = tcon->ses;
+ struct TCP_Server_Info *server = ses->server;
+@@ -696,7 +697,7 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
+ rqst[0].rq_nvec = SMB2_CREATE_IOV_SIZE;
+
+ oparms.tcon = tcon;
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+ oparms.disposition = FILE_OPEN;
+ oparms.fid = pfid;
+@@ -812,7 +813,8 @@ int open_shroot(unsigned int xid, struct cifs_tcon *tcon, struct cifs_fid *pfid)
+ }
+
+ static void
+-smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
++smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon,
++ struct cifs_sb_info *cifs_sb)
+ {
+ int rc;
+ __le16 srch_path = 0; /* Null - open root of share */
+@@ -824,7 +826,7 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
+ oparms.tcon = tcon;
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+ oparms.disposition = FILE_OPEN;
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -832,7 +834,7 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
+ rc = SMB2_open(xid, &oparms, &srch_path, &oplock, NULL, NULL,
+ NULL);
+ else
+- rc = open_shroot(xid, tcon, &fid);
++ rc = open_shroot(xid, tcon, cifs_sb, &fid);
+
+ if (rc)
+ return;
+@@ -854,7 +856,8 @@ smb3_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
+ }
+
+ static void
+-smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
++smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon,
++ struct cifs_sb_info *cifs_sb)
+ {
+ int rc;
+ __le16 srch_path = 0; /* Null - open root of share */
+@@ -865,7 +868,7 @@ smb2_qfs_tcon(const unsigned int xid, struct cifs_tcon *tcon)
+ oparms.tcon = tcon;
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+ oparms.disposition = FILE_OPEN;
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -900,10 +903,7 @@ smb2_is_path_accessible(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+ oparms.disposition = FILE_OPEN;
+- if (backup_cred(cifs_sb))
+- oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+- else
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -1179,10 +1179,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.desired_access = FILE_WRITE_EA;
+ oparms.disposition = FILE_OPEN;
+- if (backup_cred(cifs_sb))
+- oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+- else
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -1414,6 +1411,7 @@ SMB2_request_res_key(const unsigned int xid, struct cifs_tcon *tcon,
+ static int
+ smb2_ioctl_query_info(const unsigned int xid,
+ struct cifs_tcon *tcon,
++ struct cifs_sb_info *cifs_sb,
+ __le16 *path, int is_dir,
+ unsigned long p)
+ {
+@@ -1439,6 +1437,7 @@ smb2_ioctl_query_info(const unsigned int xid,
+ struct kvec close_iov[1];
+ unsigned int size[2];
+ void *data[2];
++ int create_options = is_dir ? CREATE_NOT_FILE : CREATE_NOT_DIR;
+
+ memset(rqst, 0, sizeof(rqst));
+ resp_buftype[0] = resp_buftype[1] = resp_buftype[2] = CIFS_NO_BUFFER;
+@@ -1474,10 +1473,7 @@ smb2_ioctl_query_info(const unsigned int xid,
+ memset(&oparms, 0, sizeof(oparms));
+ oparms.tcon = tcon;
+ oparms.disposition = FILE_OPEN;
+- if (is_dir)
+- oparms.create_options = CREATE_NOT_FILE;
+- else
+- oparms.create_options = CREATE_NOT_DIR;
++ oparms.create_options = cifs_create_options(cifs_sb, create_options);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -2074,10 +2070,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.desired_access = FILE_READ_ATTRIBUTES | FILE_READ_DATA;
+ oparms.disposition = FILE_OPEN;
+- if (backup_cred(cifs_sb))
+- oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+- else
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = fid;
+ oparms.reconnect = false;
+
+@@ -2278,10 +2271,7 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.desired_access = desired_access;
+ oparms.disposition = FILE_OPEN;
+- if (cifs_sb && backup_cred(cifs_sb))
+- oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+- else
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -2337,7 +2327,7 @@ smb2_query_info_compound(const unsigned int xid, struct cifs_tcon *tcon,
+
+ static int
+ smb2_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
+- struct kstatfs *buf)
++ struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
+ {
+ struct smb2_query_info_rsp *rsp;
+ struct smb2_fs_full_size_info *info = NULL;
+@@ -2374,7 +2364,7 @@ smb2_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
+
+ static int
+ smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
+- struct kstatfs *buf)
++ struct cifs_sb_info *cifs_sb, struct kstatfs *buf)
+ {
+ int rc;
+ __le16 srch_path = 0; /* Null - open root of share */
+@@ -2383,12 +2373,12 @@ smb311_queryfs(const unsigned int xid, struct cifs_tcon *tcon,
+ struct cifs_fid fid;
+
+ if (!tcon->posix_extensions)
+- return smb2_queryfs(xid, tcon, buf);
++ return smb2_queryfs(xid, tcon, cifs_sb, buf);
+
+ oparms.tcon = tcon;
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+ oparms.disposition = FILE_OPEN;
+- oparms.create_options = 0;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -2657,6 +2647,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+ struct smb2_create_rsp *create_rsp;
+ struct smb2_ioctl_rsp *ioctl_rsp;
+ struct reparse_data_buffer *reparse_buf;
++ int create_options = is_reparse_point ? OPEN_REPARSE_POINT : 0;
+ u32 plen;
+
+ cifs_dbg(FYI, "%s: path: %s\n", __func__, full_path);
+@@ -2683,14 +2674,7 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+ oparms.tcon = tcon;
+ oparms.desired_access = FILE_READ_ATTRIBUTES;
+ oparms.disposition = FILE_OPEN;
+-
+- if (backup_cred(cifs_sb))
+- oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+- else
+- oparms.create_options = 0;
+- if (is_reparse_point)
+- oparms.create_options = OPEN_REPARSE_POINT;
+-
++ oparms.create_options = cifs_create_options(cifs_sb, create_options);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -2869,11 +2853,6 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb,
+ tcon = tlink_tcon(tlink);
+ xid = get_xid();
+
+- if (backup_cred(cifs_sb))
+- oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+- else
+- oparms.create_options = 0;
+-
+ utf16_path = cifs_convert_path_to_utf16(path, cifs_sb);
+ if (!utf16_path) {
+ rc = -ENOMEM;
+@@ -2884,6 +2863,7 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb,
+ oparms.tcon = tcon;
+ oparms.desired_access = READ_CONTROL;
+ oparms.disposition = FILE_OPEN;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.fid = &fid;
+ oparms.reconnect = false;
+
+@@ -2925,11 +2905,6 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
+ tcon = tlink_tcon(tlink);
+ xid = get_xid();
+
+- if (backup_cred(cifs_sb))
+- oparms.create_options = CREATE_OPEN_BACKUP_INTENT;
+- else
+- oparms.create_options = 0;
+-
+ if (aclflag == CIFS_ACL_OWNER || aclflag == CIFS_ACL_GROUP)
+ access_flags = WRITE_OWNER;
+ else
+@@ -2944,6 +2919,7 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen,
+
+ oparms.tcon = tcon;
+ oparms.desired_access = access_flags;
++ oparms.create_options = cifs_create_options(cifs_sb, 0);
+ oparms.disposition = FILE_OPEN;
+ oparms.path = path;
+ oparms.fid = &fid;
+@@ -4481,7 +4457,6 @@ smb2_make_node(unsigned int xid, struct inode *inode,
+ {
+ struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
+ int rc = -EPERM;
+- int create_options = CREATE_NOT_DIR | CREATE_OPTION_SPECIAL;
+ FILE_ALL_INFO *buf = NULL;
+ struct cifs_io_parms io_parms;
+ __u32 oplock = 0;
+@@ -4517,13 +4492,11 @@ smb2_make_node(unsigned int xid, struct inode *inode,
+ goto out;
+ }
+
+- if (backup_cred(cifs_sb))
+- create_options |= CREATE_OPEN_BACKUP_INTENT;
+-
+ oparms.tcon = tcon;
+ oparms.cifs_sb = cifs_sb;
+ oparms.desired_access = GENERIC_WRITE;
+- oparms.create_options = create_options;
++ oparms.create_options = cifs_create_options(cifs_sb, CREATE_NOT_DIR |
++ CREATE_OPTION_SPECIAL);
+ oparms.disposition = FILE_CREATE;
+ oparms.path = full_path;
+ oparms.fid = &fid;
+diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h
+index 57f7075a35871..4d4c0faa3d8a3 100644
+--- a/fs/cifs/smb2proto.h
++++ b/fs/cifs/smb2proto.h
+@@ -67,7 +67,7 @@ extern int smb3_handle_read_data(struct TCP_Server_Info *server,
+ struct mid_q_entry *mid);
+
+ extern int open_shroot(unsigned int xid, struct cifs_tcon *tcon,
+- struct cifs_fid *pfid);
++ struct cifs_sb_info *cifs_sb, struct cifs_fid *pfid);
+ extern void close_shroot(struct cached_fid *cfid);
+ extern void move_smb2_info_to_cifs(FILE_ALL_INFO *dst,
+ struct smb2_file_all_info *src);
+--
+2.39.2
+
--- /dev/null
+From 6c614a4240ce1d54d7630d8256d6f010f03dc925 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 12:49:11 +0300
+Subject: software node: Introduce device_add_software_node()
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit e68d0119e3284334de5650a1ac42ef4e179f895e ]
+
+This helper will register a software node and then assign
+it to device at the same time. The function will also make
+sure that the device can't have more than one software node.
+
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115094914.88401-2-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/swnode.c | 71 +++++++++++++++++++++++++++++++++++-----
+ include/linux/property.h | 3 ++
+ 2 files changed, 65 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
+index 4c3b9813b2843..4f9c6898e86e8 100644
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -48,6 +48,19 @@ EXPORT_SYMBOL_GPL(is_software_node);
+ struct swnode, fwnode) : NULL; \
+ })
+
++static inline struct swnode *dev_to_swnode(struct device *dev)
++{
++ struct fwnode_handle *fwnode = dev_fwnode(dev);
++
++ if (!fwnode)
++ return NULL;
++
++ if (!is_software_node(fwnode))
++ fwnode = fwnode->secondary;
++
++ return to_swnode(fwnode);
++}
++
+ static struct swnode *
+ software_node_to_swnode(const struct software_node *node)
+ {
+@@ -862,22 +875,62 @@ void fwnode_remove_software_node(struct fwnode_handle *fwnode)
+ }
+ EXPORT_SYMBOL_GPL(fwnode_remove_software_node);
+
++/**
++ * device_add_software_node - Assign software node to a device
++ * @dev: The device the software node is meant for.
++ * @swnode: The software node.
++ *
++ * This function will register @swnode and make it the secondary firmware node
++ * pointer of @dev. If @dev has no primary node, then @swnode will become the primary
++ * node.
++ */
++int device_add_software_node(struct device *dev, const struct software_node *swnode)
++{
++ int ret;
++
++ /* Only one software node per device. */
++ if (dev_to_swnode(dev))
++ return -EBUSY;
++
++ ret = software_node_register(swnode);
++ if (ret)
++ return ret;
++
++ set_secondary_fwnode(dev, software_node_fwnode(swnode));
++
++ return 0;
++}
++EXPORT_SYMBOL_GPL(device_add_software_node);
++
++/**
++ * device_remove_software_node - Remove device's software node
++ * @dev: The device with the software node.
++ *
++ * This function will unregister the software node of @dev.
++ */
++void device_remove_software_node(struct device *dev)
++{
++ struct swnode *swnode;
++
++ swnode = dev_to_swnode(dev);
++ if (!swnode)
++ return;
++
++ software_node_notify(dev, KOBJ_REMOVE);
++ set_secondary_fwnode(dev, NULL);
++ kobject_put(&swnode->kobj);
++}
++EXPORT_SYMBOL_GPL(device_remove_software_node);
++
+ int software_node_notify(struct device *dev, unsigned long action)
+ {
+- struct fwnode_handle *fwnode = dev_fwnode(dev);
+ struct swnode *swnode;
+ int ret;
+
+- if (!fwnode)
+- return 0;
+-
+- if (!is_software_node(fwnode))
+- fwnode = fwnode->secondary;
+- if (!is_software_node(fwnode))
++ swnode = dev_to_swnode(dev);
++ if (!swnode)
+ return 0;
+
+- swnode = to_swnode(fwnode);
+-
+ switch (action) {
+ case KOBJ_ADD:
+ ret = sysfs_create_link(&dev->kobj, &swnode->kobj,
+diff --git a/include/linux/property.h b/include/linux/property.h
+index 9b3d4ca3a73a9..99fdafa20cd1d 100644
+--- a/include/linux/property.h
++++ b/include/linux/property.h
+@@ -437,4 +437,7 @@ fwnode_create_software_node(const struct property_entry *properties,
+ const struct fwnode_handle *parent);
+ void fwnode_remove_software_node(struct fwnode_handle *fwnode);
+
++int device_add_software_node(struct device *dev, const struct software_node *swnode);
++void device_remove_software_node(struct device *dev);
++
+ #endif /* _LINUX_PROPERTY_H_ */
+--
+2.39.2
+
--- /dev/null
+From c38ecec7686b355a0a47e3d7dd7572130eaa98ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Feb 2023 15:27:11 +0200
+Subject: usb: dwc3: pci: add support for the Intel Meteor Lake-M
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 8e5248c3a8778f3e394e9a19195bc7a48f567ca2 ]
+
+This patch adds the necessary PCI IDs for Intel Meteor Lake-M
+devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230215132711.35668-1-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 46d7c3904fe08..6eb39631a9e2e 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -42,6 +42,7 @@
+ #define PCI_DEVICE_ID_INTEL_JSP 0x4dee
+ #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1
+ #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61
++#define PCI_DEVICE_ID_INTEL_MTLM 0x7eb1
+ #define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1
+ #define PCI_DEVICE_ID_INTEL_MTL 0x7e7e
+ #define PCI_DEVICE_ID_INTEL_TGL 0x9a15
+@@ -392,6 +393,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLM),
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+--
+2.39.2
+
--- /dev/null
+From cd015705af78189bf5efa666c6694f55f83efbb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Apr 2022 13:35:18 +0300
+Subject: usb: dwc3: pci: add support for the Intel Meteor Lake-P
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 973e0f7a847ef13ade840d4c30729ce329a66895 ]
+
+This patch adds the necessary PCI IDs for Intel Meteor Lake-P
+devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220425103518.44028-1-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 291f73fdd4be0..46d7c3904fe08 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -42,6 +42,8 @@
+ #define PCI_DEVICE_ID_INTEL_JSP 0x4dee
+ #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1
+ #define PCI_DEVICE_ID_INTEL_RPLS 0x7a61
++#define PCI_DEVICE_ID_INTEL_MTLP 0x7ec1
++#define PCI_DEVICE_ID_INTEL_MTL 0x7e7e
+ #define PCI_DEVICE_ID_INTEL_TGL 0x9a15
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+@@ -390,6 +392,12 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTLP),
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL),
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+--
+2.39.2
+
--- /dev/null
+From ca22d3b19801363a988d2a3d34e808d6bbab9baf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Feb 2022 17:19:48 +0300
+Subject: usb: dwc3: pci: add support for the Intel Raptor Lake-S
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 038438a25c45d5ac996e95a22fa9e76ff3d1f8c7 ]
+
+This patch adds the necessary PCI ID for Intel Raptor Lake-S
+devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20220214141948.18637-1-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index a1b135153137a..291f73fdd4be0 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -41,6 +41,7 @@
+ #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee
+ #define PCI_DEVICE_ID_INTEL_JSP 0x4dee
+ #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1
++#define PCI_DEVICE_ID_INTEL_RPLS 0x7a61
+ #define PCI_DEVICE_ID_INTEL_TGL 0x9a15
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+@@ -386,6 +387,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_RPLS),
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+--
+2.39.2
+
--- /dev/null
+From 342b88e45896b874876d56581839f4ebb3ae1cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 12:49:13 +0300
+Subject: usb: dwc3: pci: ID for Tiger Lake CPU
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit 73203bde3a95a48f27b2454dc6b955280c641afe ]
+
+Tiger Lake SOC (the versions of it that have integrated USB4
+controller) may have two DWC3 controllers. One is part of
+the PCH (Platform Controller Hub, i.e. the chipset) as
+usual, and the other is inside the actual CPU block.
+
+On all Intel platforms that have the two separate DWC3
+controllers, the one inside the CPU handles USB3 and only
+USB3 traffic, while the PCH version handles USB2 and USB2
+alone. The reason for splitting the two busses like this is
+to allow easy USB3 tunneling over USB4 connections. As USB2
+is not tunneled over USB4, it has dedicated USB controllers
+(both xHCI and DWC3).
+
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115094914.88401-4-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index a4439ea3cebaf..a1b135153137a 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -41,6 +41,7 @@
+ #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee
+ #define PCI_DEVICE_ID_INTEL_JSP 0x4dee
+ #define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1
++#define PCI_DEVICE_ID_INTEL_TGL 0x9a15
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR 4
+@@ -385,6 +386,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS),
+ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGL),
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
++
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB),
+ (kernel_ulong_t) &dwc3_pci_amd_swnode, },
+ { } /* Terminating Entry */
+--
+2.39.2
+
--- /dev/null
+From 6b165f987752cbde325d799327a98f6b3c150ced Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jan 2021 12:49:12 +0300
+Subject: usb: dwc3: pci: Register a software node for the dwc3 platform device
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit e492ce9bcaa1c9661cd3dd6cff0eedf2fa640f31 ]
+
+By registering the software node directly instead of just
+the properties in it, the driver can take advantage of also
+the other features the software nodes have.
+
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20210115094914.88401-3-heikki.krogerus@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 8e5248c3a877 ("usb: dwc3: pci: add support for the Intel Meteor Lake-M")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 61 ++++++++++++++++++++++---------------
+ 1 file changed, 37 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 955bf820f4102..a4439ea3cebaf 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -143,6 +143,18 @@ static const struct property_entry dwc3_pci_amd_properties[] = {
+ {}
+ };
+
++static const struct software_node dwc3_pci_intel_swnode = {
++ .properties = dwc3_pci_intel_properties,
++};
++
++static const struct software_node dwc3_pci_intel_mrfld_swnode = {
++ .properties = dwc3_pci_mrfld_properties,
++};
++
++static const struct software_node dwc3_pci_amd_swnode = {
++ .properties = dwc3_pci_amd_properties,
++};
++
+ static int dwc3_pci_quirks(struct dwc3_pci *dwc)
+ {
+ struct pci_dev *pdev = dwc->pci;
+@@ -223,7 +235,6 @@ static void dwc3_pci_resume_work(struct work_struct *work)
+
+ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ {
+- struct property_entry *p = (struct property_entry *)id->driver_data;
+ struct dwc3_pci *dwc;
+ struct resource res[2];
+ int ret;
+@@ -266,7 +277,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ dwc->dwc3->dev.parent = dev;
+ ACPI_COMPANION_SET(&dwc->dwc3->dev, ACPI_COMPANION(dev));
+
+- ret = platform_device_add_properties(dwc->dwc3, p);
++ ret = device_add_software_node(&dwc->dwc3->dev, (void *)id->driver_data);
+ if (ret < 0)
+ goto err;
+
+@@ -289,6 +300,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+
+ return 0;
+ err:
++ device_remove_software_node(&dwc->dwc3->dev);
+ platform_device_put(dwc->dwc3);
+ return ret;
+ }
+@@ -305,75 +317,76 @@ static void dwc3_pci_remove(struct pci_dev *pci)
+ #endif
+ device_init_wakeup(&pci->dev, false);
+ pm_runtime_get(&pci->dev);
++ device_remove_software_node(&dwc->dwc3->dev);
+ platform_device_unregister(dwc->dwc3);
+ }
+
+ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BSW),
+- (kernel_ulong_t) &dwc3_pci_intel_properties },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BYT),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MRFLD),
+- (kernel_ulong_t) &dwc3_pci_mrfld_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_mrfld_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLLP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CMLH),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SPTLP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_SPTH),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BXT),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BXT_M),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_APL),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_KBP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_GLK),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPLP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPH),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_CNPV),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ICLLP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_EHLLP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS),
+- (kernel_ulong_t) &dwc3_pci_intel_properties, },
++ (kernel_ulong_t) &dwc3_pci_intel_swnode, },
+
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB),
+- (kernel_ulong_t) &dwc3_pci_amd_properties, },
++ (kernel_ulong_t) &dwc3_pci_amd_swnode, },
+ { } /* Terminating Entry */
+ };
+ MODULE_DEVICE_TABLE(pci, dwc3_pci_id_table);
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
