--- /dev/null
+From f2c929293b245e176cc845a5335a9e7f21214d93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Aug 2022 10:59:49 -0400
+Subject: drm/amdgpu: make sure to init common IP before gmc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit a8671493d2074950553da3cf07d1be43185ef6c6 ]
+
+Move common IP init before GMC init so that HDP gets
+remapped before GMC init which uses it.
+
+This fixes the Unsupported Request error reported through
+AER during driver load. The error happens as a write happens
+to the remap offset before real remapping is done.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=216373
+
+The error was unnoticed before and got visible because of the commit
+referenced below. This doesn't fix anything in the commit below, rather
+fixes the issue in amdgpu exposed by the commit. The reference is only
+to associate this commit with below one so that both go together.
+
+Fixes: 8795e182b02d ("PCI/portdrv: Don't disable AER reporting in get_port_device_capability()")
+
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index f443b4630f9d..7450773821f4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2388,8 +2388,16 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+ }
+ adev->ip_blocks[i].status.sw = true;
+
+- /* need to do gmc hw init early so we can allocate gpu mem */
+- if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) {
++ if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_COMMON) {
++ /* need to do common hw init early so everything is set up for gmc */
++ r = adev->ip_blocks[i].version->funcs->hw_init((void *)adev);
++ if (r) {
++ DRM_ERROR("hw_init %d failed %d\n", i, r);
++ goto init_failed;
++ }
++ adev->ip_blocks[i].status.hw = true;
++ } else if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) {
++ /* need to do gmc hw init early so we can allocate gpu mem */
+ /* Try to reserve bad pages early */
+ if (amdgpu_sriov_vf(adev))
+ amdgpu_virt_exchange_data(adev);
+@@ -3037,8 +3045,8 @@ static int amdgpu_device_ip_reinit_early_sriov(struct amdgpu_device *adev)
+ int i, r;
+
+ static enum amd_ip_block_type ip_order[] = {
+- AMD_IP_BLOCK_TYPE_GMC,
+ AMD_IP_BLOCK_TYPE_COMMON,
++ AMD_IP_BLOCK_TYPE_GMC,
+ AMD_IP_BLOCK_TYPE_PSP,
+ AMD_IP_BLOCK_TYPE_IH,
+ };
+--
+2.35.1
+
--- /dev/null
+From 0899699a611e4319114607c3f68d3fb813496dbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Dec 2021 17:01:45 +0000
+Subject: drm/amdgpu: Separate vf2pf work item init from virt data exchange
+
+From: Victor Skvortsov <victor.skvortsov@amd.com>
+
+[ Upstream commit 892deb48269c65376f3eeb5b4c032ff2c2979bd7 ]
+
+We want to be able to call virt data exchange conditionally
+after gmc sw init to reserve bad pages as early as possible.
+Since this is a conditional call, we will need
+to call it again unconditionally later in the init sequence.
+
+Refactor the data exchange function so it can be
+called multiple times without re-initializing the work item.
+
+v2: Cleaned up the code. Kept the original call to init_exchange_data()
+inside early init to initialize the work item, afterwards call
+exchange_data() when needed.
+
+Signed-off-by: Victor Skvortsov <victor.skvortsov@amd.com>
+Reviewed By: Shaoyun.liu <Shaoyun.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 +++-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c | 36 ++++++++++++++--------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h | 1 +
+ 3 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index d1af709cc7dc..f443b4630f9d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2390,6 +2390,10 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+
+ /* need to do gmc hw init early so we can allocate gpu mem */
+ if (adev->ip_blocks[i].version->type == AMD_IP_BLOCK_TYPE_GMC) {
++ /* Try to reserve bad pages early */
++ if (amdgpu_sriov_vf(adev))
++ amdgpu_virt_exchange_data(adev);
++
+ r = amdgpu_device_vram_scratch_init(adev);
+ if (r) {
+ DRM_ERROR("amdgpu_vram_scratch_init failed %d\n", r);
+@@ -2421,7 +2425,7 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
+ }
+
+ if (amdgpu_sriov_vf(adev))
+- amdgpu_virt_init_data_exchange(adev);
++ amdgpu_virt_exchange_data(adev);
+
+ r = amdgpu_ib_pool_init(adev);
+ if (r) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+index 16787c675f35..cce03aad5f0e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.c
+@@ -614,17 +614,35 @@ void amdgpu_virt_fini_data_exchange(struct amdgpu_device *adev)
+
+ void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev)
+ {
+- uint64_t bp_block_offset = 0;
+- uint32_t bp_block_size = 0;
+- struct amd_sriov_msg_pf2vf_info *pf2vf_v2 = NULL;
+-
+ adev->virt.fw_reserve.p_pf2vf = NULL;
+ adev->virt.fw_reserve.p_vf2pf = NULL;
+ adev->virt.vf2pf_update_interval_ms = 0;
+
+- if (adev->mman.fw_vram_usage_va != NULL) {
++ if (adev->bios != NULL) {
+ adev->virt.vf2pf_update_interval_ms = 2000;
+
++ adev->virt.fw_reserve.p_pf2vf =
++ (struct amd_sriov_msg_pf2vf_info_header *)
++ (adev->bios + (AMD_SRIOV_MSG_PF2VF_OFFSET_KB << 10));
++
++ amdgpu_virt_read_pf2vf_data(adev);
++ }
++
++ if (adev->virt.vf2pf_update_interval_ms != 0) {
++ INIT_DELAYED_WORK(&adev->virt.vf2pf_work, amdgpu_virt_update_vf2pf_work_item);
++ schedule_delayed_work(&(adev->virt.vf2pf_work), msecs_to_jiffies(adev->virt.vf2pf_update_interval_ms));
++ }
++}
++
++
++void amdgpu_virt_exchange_data(struct amdgpu_device *adev)
++{
++ uint64_t bp_block_offset = 0;
++ uint32_t bp_block_size = 0;
++ struct amd_sriov_msg_pf2vf_info *pf2vf_v2 = NULL;
++
++ if (adev->mman.fw_vram_usage_va != NULL) {
++
+ adev->virt.fw_reserve.p_pf2vf =
+ (struct amd_sriov_msg_pf2vf_info_header *)
+ (adev->mman.fw_vram_usage_va + (AMD_SRIOV_MSG_PF2VF_OFFSET_KB << 10));
+@@ -655,16 +673,10 @@ void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev)
+ (adev->bios + (AMD_SRIOV_MSG_PF2VF_OFFSET_KB << 10));
+
+ amdgpu_virt_read_pf2vf_data(adev);
+-
+- return;
+- }
+-
+- if (adev->virt.vf2pf_update_interval_ms != 0) {
+- INIT_DELAYED_WORK(&adev->virt.vf2pf_work, amdgpu_virt_update_vf2pf_work_item);
+- schedule_delayed_work(&(adev->virt.vf2pf_work), adev->virt.vf2pf_update_interval_ms);
+ }
+ }
+
++
+ void amdgpu_detect_virtualization(struct amdgpu_device *adev)
+ {
+ uint32_t reg;
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+index 8d4c20bb71c5..9adfb8d63280 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_virt.h
+@@ -308,6 +308,7 @@ int amdgpu_virt_alloc_mm_table(struct amdgpu_device *adev);
+ void amdgpu_virt_free_mm_table(struct amdgpu_device *adev);
+ void amdgpu_virt_release_ras_err_handler_data(struct amdgpu_device *adev);
+ void amdgpu_virt_init_data_exchange(struct amdgpu_device *adev);
++void amdgpu_virt_exchange_data(struct amdgpu_device *adev);
+ void amdgpu_virt_fini_data_exchange(struct amdgpu_device *adev);
+ void amdgpu_detect_virtualization(struct amdgpu_device *adev);
+
+--
+2.35.1
+
--- /dev/null
+From 2dd64f7c6962c18d86d7cf6702143ae4b984a426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Jul 2022 15:07:19 +0200
+Subject: iio: adc: mcp3911: correct "microchip,device-addr" property
+
+From: Marcus Folkesson <marcus.folkesson@gmail.com>
+
+[ Upstream commit cfbd76d5c9c449739bb74288d982bccf9ff822f4 ]
+
+Go for the right property name that is documented in the bindings.
+
+Fixes: 3a89b289df5d ("iio: adc: add support for mcp3911")
+Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20220722130726.7627-3-marcus.folkesson@gmail.com
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/mcp3911.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
+index 608842632925..7eecbfd491a4 100644
+--- a/drivers/iio/adc/mcp3911.c
++++ b/drivers/iio/adc/mcp3911.c
+@@ -217,7 +217,14 @@ static int mcp3911_config(struct mcp3911 *adc)
+ u32 configreg;
+ int ret;
+
+- device_property_read_u32(dev, "device-addr", &adc->dev_addr);
++ ret = device_property_read_u32(dev, "microchip,device-addr", &adc->dev_addr);
++
++ /*
++ * Fallback to "device-addr" due to historical mismatch between
++ * dt-bindings and implementation
++ */
++ if (ret)
++ device_property_read_u32(dev, "device-addr", &adc->dev_addr);
+ if (adc->dev_addr > 3) {
+ dev_err(&adc->spi->dev,
+ "invalid device address (%i). Must be in range 0-3.\n",
+--
+2.35.1
+
--- /dev/null
+From 92871497273d9f3d3ef377073a6fb668e7ba461c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Dec 2021 17:01:36 +0000
+Subject: iio:adc:mcp3911: Switch to generic firmware properties.
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 4efc1c614d334883cce09c38aa3fe74d3fb0bbf0 ]
+
+This allows use of the driver with other types of firmware such as ACPI
+PRP0001 based probing.
+
+Also part of a general attempt to remove direct use of of_ specific
+accessors from IIO.
+
+Added an include for mod_devicetable.h whilst here to cover the
+struct of_device_id definition.
+
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: Kent Gustavsson <kent@minoris.se>
+Reviewed-by: Marcus Folkesson <marcus.folkesson@gmail.com>
+Stable-dep-of: cfbd76d5c9c4 ("iio: adc: mcp3911: correct "microchip,device-addr" property")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/mcp3911.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iio/adc/mcp3911.c b/drivers/iio/adc/mcp3911.c
+index 65278270a75c..608842632925 100644
+--- a/drivers/iio/adc/mcp3911.c
++++ b/drivers/iio/adc/mcp3911.c
+@@ -10,6 +10,8 @@
+ #include <linux/err.h>
+ #include <linux/iio/iio.h>
+ #include <linux/module.h>
++#include <linux/mod_devicetable.h>
++#include <linux/property.h>
+ #include <linux/regulator/consumer.h>
+ #include <linux/spi/spi.h>
+
+@@ -209,12 +211,13 @@ static const struct iio_info mcp3911_info = {
+ .write_raw = mcp3911_write_raw,
+ };
+
+-static int mcp3911_config(struct mcp3911 *adc, struct device_node *of_node)
++static int mcp3911_config(struct mcp3911 *adc)
+ {
++ struct device *dev = &adc->spi->dev;
+ u32 configreg;
+ int ret;
+
+- of_property_read_u32(of_node, "device-addr", &adc->dev_addr);
++ device_property_read_u32(dev, "device-addr", &adc->dev_addr);
+ if (adc->dev_addr > 3) {
+ dev_err(&adc->spi->dev,
+ "invalid device address (%i). Must be in range 0-3.\n",
+@@ -298,7 +301,7 @@ static int mcp3911_probe(struct spi_device *spi)
+ }
+ }
+
+- ret = mcp3911_config(adc, spi->dev.of_node);
++ ret = mcp3911_config(adc);
+ if (ret)
+ goto clk_disable;
+
+--
+2.35.1
+
--- /dev/null
+From 676abb5e750b97bb96bb428eade0927e86d33761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Sep 2022 15:41:11 +0200
+Subject: net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit fe2c9c61f668cde28dac2b188028c5299cedcc1e ]
+
+When calling debugfs_lookup() the result must have dput() called on it,
+otherwise the memory will leak over time. Fix this up to be much
+simpler logic and only create the root debugfs directory once when the
+driver is first accessed. That resolves the memory leak and makes
+things more obvious as to what the intent is.
+
+Cc: Marcin Wojtas <mw@semihalf.com>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jakub Kicinski <kuba@kernel.org>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Cc: netdev@vger.kernel.org
+Cc: stable <stable@kernel.org>
+Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Parser")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
+index 4a3baa7e0142..0eec05d905eb 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c
+@@ -700,10 +700,10 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv)
+
+ void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name)
+ {
+- struct dentry *mvpp2_dir, *mvpp2_root;
++ static struct dentry *mvpp2_root;
++ struct dentry *mvpp2_dir;
+ int ret, i;
+
+- mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL);
+ if (!mvpp2_root)
+ mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL);
+
+--
+2.35.1
+
--- /dev/null
+From 8e583e1ed46f6b1ea3d883202240a4efc9c1ed3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Aug 2022 21:59:52 +1000
+Subject: powerpc/rtas: Fix RTAS MSR[HV] handling for Cell
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 91926d8b7e71aaf5f84f0cf208fc5a8b7a761050 ]
+
+The semi-recent changes to MSR handling when entering RTAS (firmware)
+cause crashes on IBM Cell machines. An example trace:
+
+ kernel tried to execute user page (2fff01a8) - exploit attempt? (uid: 0)
+ BUG: Unable to handle kernel instruction fetch
+ Faulting instruction address: 0x2fff01a8
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ BE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=4 NUMA Cell
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 6.0.0-rc2-00433-gede0a8d3307a #207
+ NIP: 000000002fff01a8 LR: 0000000000032608 CTR: 0000000000000000
+ REGS: c0000000015236b0 TRAP: 0400 Tainted: G W (6.0.0-rc2-00433-gede0a8d3307a)
+ MSR: 0000000008001002 <ME,RI> CR: 00000000 XER: 20000000
+ ...
+ NIP 0x2fff01a8
+ LR 0x32608
+ Call Trace:
+ 0xc00000000143c5f8 (unreliable)
+ .rtas_call+0x224/0x320
+ .rtas_get_boot_time+0x70/0x150
+ .read_persistent_clock64+0x114/0x140
+ .read_persistent_wall_and_boot_offset+0x24/0x80
+ .timekeeping_init+0x40/0x29c
+ .start_kernel+0x674/0x8f0
+ start_here_common+0x1c/0x50
+
+Unlike PAPR platforms where RTAS is only used in guests, on the IBM Cell
+machines Linux runs with MSR[HV] set but also uses RTAS, provided by
+SLOF.
+
+Fix it by copying the MSR[HV] bit from the MSR value we've just read
+using mfmsr into the value used for RTAS.
+
+It seems like we could also fix it using an #ifdef CELL to set MSR[HV],
+but that doesn't work because it's possible to build a single kernel
+image that runs on both Cell native and pseries.
+
+Fixes: b6b1c3ce06ca ("powerpc/rtas: Keep MSR[RI] set when calling RTAS")
+Cc: stable@vger.kernel.org # v5.19+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Reviewed-by: Jordan Niethe <jniethe5@gmail.com>
+Link: https://lore.kernel.org/r/20220823115952.1203106-2-mpe@ellerman.id.au
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/rtas_entry.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/kernel/rtas_entry.S b/arch/powerpc/kernel/rtas_entry.S
+index 9ae1ca3c6fca..69dd8dd36689 100644
+--- a/arch/powerpc/kernel/rtas_entry.S
++++ b/arch/powerpc/kernel/rtas_entry.S
+@@ -125,8 +125,12 @@ __enter_rtas:
+ * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S]
+ * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if
+ * MSR[S] is set, it will remain when entering RTAS.
++ * If we're in HV mode, RTAS must also run in HV mode, so extract MSR_HV
++ * from the saved MSR value and insert into the value RTAS will use.
+ */
++ extrdi r0, r6, 1, 63 - MSR_HV_LG
+ LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI)
++ insrdi r6, r0, 1, 63 - MSR_HV_LG
+
+ li r0,0
+ mtmsrd r0,1 /* disable RI before using SRR0/1 */
+--
+2.35.1
+
--- /dev/null
+From 32b7b58ac53edb647532407a053c45927ea69bfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Mar 2022 23:50:34 +1000
+Subject: powerpc/rtas: Move rtas entry assembly into its own file
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+[ Upstream commit 838ee286ecc9a3c76e6bd8f5aaad0c8c5c66b9ca ]
+
+This makes working on the code a bit easier.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220308135047.478297-2-npiggin@gmail.com
+Stable-dep-of: 91926d8b7e71 ("powerpc/rtas: Fix RTAS MSR[HV] handling for Cell")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/Makefile | 2 +-
+ arch/powerpc/kernel/entry_32.S | 49 --------
+ arch/powerpc/kernel/entry_64.S | 150 -----------------------
+ arch/powerpc/kernel/rtas_entry.S | 198 +++++++++++++++++++++++++++++++
+ 4 files changed, 199 insertions(+), 200 deletions(-)
+ create mode 100644 arch/powerpc/kernel/rtas_entry.S
+
+diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
+index ed91d5b9ffc6..df1692020693 100644
+--- a/arch/powerpc/kernel/Makefile
++++ b/arch/powerpc/kernel/Makefile
+@@ -69,7 +69,7 @@ obj-$(CONFIG_PPC_BOOK3S_IDLE) += idle_book3s.o
+ procfs-y := proc_powerpc.o
+ obj-$(CONFIG_PROC_FS) += $(procfs-y)
+ rtaspci-$(CONFIG_PPC64)-$(CONFIG_PCI) := rtas_pci.o
+-obj-$(CONFIG_PPC_RTAS) += rtas.o rtas-rtc.o $(rtaspci-y-y)
++obj-$(CONFIG_PPC_RTAS) += rtas_entry.o rtas.o rtas-rtc.o $(rtaspci-y-y)
+ obj-$(CONFIG_PPC_RTAS_DAEMON) += rtasd.o
+ obj-$(CONFIG_RTAS_FLASH) += rtas_flash.o
+ obj-$(CONFIG_RTAS_PROC) += rtas-proc.o
+diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
+index c62dd9815965..77b6b0e4b752 100644
+--- a/arch/powerpc/kernel/entry_32.S
++++ b/arch/powerpc/kernel/entry_32.S
+@@ -526,52 +526,3 @@ ret_from_mcheck_exc:
+ _ASM_NOKPROBE_SYMBOL(ret_from_mcheck_exc)
+ #endif /* CONFIG_BOOKE */
+ #endif /* !(CONFIG_4xx || CONFIG_BOOKE) */
+-
+-/*
+- * PROM code for specific machines follows. Put it
+- * here so it's easy to add arch-specific sections later.
+- * -- Cort
+- */
+-#ifdef CONFIG_PPC_RTAS
+-/*
+- * On CHRP, the Run-Time Abstraction Services (RTAS) have to be
+- * called with the MMU off.
+- */
+-_GLOBAL(enter_rtas)
+- stwu r1,-INT_FRAME_SIZE(r1)
+- mflr r0
+- stw r0,INT_FRAME_SIZE+4(r1)
+- LOAD_REG_ADDR(r4, rtas)
+- lis r6,1f@ha /* physical return address for rtas */
+- addi r6,r6,1f@l
+- tophys(r6,r6)
+- lwz r8,RTASENTRY(r4)
+- lwz r4,RTASBASE(r4)
+- mfmsr r9
+- stw r9,8(r1)
+- LOAD_REG_IMMEDIATE(r0,MSR_KERNEL)
+- mtmsr r0 /* disable interrupts so SRR0/1 don't get trashed */
+- li r9,MSR_KERNEL & ~(MSR_IR|MSR_DR)
+- mtlr r6
+- stw r1, THREAD + RTAS_SP(r2)
+- mtspr SPRN_SRR0,r8
+- mtspr SPRN_SRR1,r9
+- rfi
+-1:
+- lis r8, 1f@h
+- ori r8, r8, 1f@l
+- LOAD_REG_IMMEDIATE(r9,MSR_KERNEL)
+- mtspr SPRN_SRR0,r8
+- mtspr SPRN_SRR1,r9
+- rfi /* Reactivate MMU translation */
+-1:
+- lwz r8,INT_FRAME_SIZE+4(r1) /* get return address */
+- lwz r9,8(r1) /* original msr value */
+- addi r1,r1,INT_FRAME_SIZE
+- li r0,0
+- stw r0, THREAD + RTAS_SP(r2)
+- mtlr r8
+- mtmsr r9
+- blr /* return to caller */
+-_ASM_NOKPROBE_SYMBOL(enter_rtas)
+-#endif /* CONFIG_PPC_RTAS */
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index 07a1448146e2..d1ec22fe59f6 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -264,156 +264,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
+ addi r1,r1,SWITCH_FRAME_SIZE
+ blr
+
+-#ifdef CONFIG_PPC_RTAS
+-/*
+- * On CHRP, the Run-Time Abstraction Services (RTAS) have to be
+- * called with the MMU off.
+- *
+- * In addition, we need to be in 32b mode, at least for now.
+- *
+- * Note: r3 is an input parameter to rtas, so don't trash it...
+- */
+-_GLOBAL(enter_rtas)
+- mflr r0
+- std r0,16(r1)
+- stdu r1,-SWITCH_FRAME_SIZE(r1) /* Save SP and create stack space. */
+-
+- /* Because RTAS is running in 32b mode, it clobbers the high order half
+- * of all registers that it saves. We therefore save those registers
+- * RTAS might touch to the stack. (r0, r3-r13 are caller saved)
+- */
+- SAVE_GPR(2, r1) /* Save the TOC */
+- SAVE_GPR(13, r1) /* Save paca */
+- SAVE_NVGPRS(r1) /* Save the non-volatiles */
+-
+- mfcr r4
+- std r4,_CCR(r1)
+- mfctr r5
+- std r5,_CTR(r1)
+- mfspr r6,SPRN_XER
+- std r6,_XER(r1)
+- mfdar r7
+- std r7,_DAR(r1)
+- mfdsisr r8
+- std r8,_DSISR(r1)
+-
+- /* Temporary workaround to clear CR until RTAS can be modified to
+- * ignore all bits.
+- */
+- li r0,0
+- mtcr r0
+-
+-#ifdef CONFIG_BUG
+- /* There is no way it is acceptable to get here with interrupts enabled,
+- * check it with the asm equivalent of WARN_ON
+- */
+- lbz r0,PACAIRQSOFTMASK(r13)
+-1: tdeqi r0,IRQS_ENABLED
+- EMIT_WARN_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING
+-#endif
+-
+- /* Hard-disable interrupts */
+- mfmsr r6
+- rldicl r7,r6,48,1
+- rotldi r7,r7,16
+- mtmsrd r7,1
+-
+- /* Unfortunately, the stack pointer and the MSR are also clobbered,
+- * so they are saved in the PACA which allows us to restore
+- * our original state after RTAS returns.
+- */
+- std r1,PACAR1(r13)
+- std r6,PACASAVEDMSR(r13)
+-
+- /* Setup our real return addr */
+- LOAD_REG_ADDR(r4,rtas_return_loc)
+- clrldi r4,r4,2 /* convert to realmode address */
+- mtlr r4
+-
+-__enter_rtas:
+- LOAD_REG_ADDR(r4, rtas)
+- ld r5,RTASENTRY(r4) /* get the rtas->entry value */
+- ld r4,RTASBASE(r4) /* get the rtas->base value */
+-
+- /*
+- * RTAS runs in 32-bit big endian real mode, but leave MSR[RI] on as we
+- * may hit NMI (SRESET or MCE) while in RTAS. RTAS should disable RI in
+- * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S]
+- * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if
+- * MSR[S] is set, it will remain when entering RTAS.
+- */
+- LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI)
+-
+- li r0,0
+- mtmsrd r0,1 /* disable RI before using SRR0/1 */
+-
+- mtspr SPRN_SRR0,r5
+- mtspr SPRN_SRR1,r6
+- RFI_TO_KERNEL
+- b . /* prevent speculative execution */
+-
+-rtas_return_loc:
+- FIXUP_ENDIAN
+-
+- /*
+- * Clear RI and set SF before anything.
+- */
+- mfmsr r6
+- li r0,MSR_RI
+- andc r6,r6,r0
+- sldi r0,r0,(MSR_SF_LG - MSR_RI_LG)
+- or r6,r6,r0
+- sync
+- mtmsrd r6
+-
+- /* relocation is off at this point */
+- GET_PACA(r4)
+- clrldi r4,r4,2 /* convert to realmode address */
+-
+- bcl 20,31,$+4
+-0: mflr r3
+- ld r3,(1f-0b)(r3) /* get &rtas_restore_regs */
+-
+- ld r1,PACAR1(r4) /* Restore our SP */
+- ld r4,PACASAVEDMSR(r4) /* Restore our MSR */
+-
+- mtspr SPRN_SRR0,r3
+- mtspr SPRN_SRR1,r4
+- RFI_TO_KERNEL
+- b . /* prevent speculative execution */
+-_ASM_NOKPROBE_SYMBOL(__enter_rtas)
+-_ASM_NOKPROBE_SYMBOL(rtas_return_loc)
+-
+- .align 3
+-1: .8byte rtas_restore_regs
+-
+-rtas_restore_regs:
+- /* relocation is on at this point */
+- REST_GPR(2, r1) /* Restore the TOC */
+- REST_GPR(13, r1) /* Restore paca */
+- REST_NVGPRS(r1) /* Restore the non-volatiles */
+-
+- GET_PACA(r13)
+-
+- ld r4,_CCR(r1)
+- mtcr r4
+- ld r5,_CTR(r1)
+- mtctr r5
+- ld r6,_XER(r1)
+- mtspr SPRN_XER,r6
+- ld r7,_DAR(r1)
+- mtdar r7
+- ld r8,_DSISR(r1)
+- mtdsisr r8
+-
+- addi r1,r1,SWITCH_FRAME_SIZE /* Unstack our frame */
+- ld r0,16(r1) /* get return address */
+-
+- mtlr r0
+- blr /* return to caller */
+-
+-#endif /* CONFIG_PPC_RTAS */
+-
+ _GLOBAL(enter_prom)
+ mflr r0
+ std r0,16(r1)
+diff --git a/arch/powerpc/kernel/rtas_entry.S b/arch/powerpc/kernel/rtas_entry.S
+new file mode 100644
+index 000000000000..9ae1ca3c6fca
+--- /dev/null
++++ b/arch/powerpc/kernel/rtas_entry.S
+@@ -0,0 +1,198 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++
++#include <asm/asm-offsets.h>
++#include <asm/bug.h>
++#include <asm/page.h>
++#include <asm/ppc_asm.h>
++
++/*
++ * RTAS is called with MSR IR, DR, EE disabled, and LR in the return address.
++ *
++ * Note: r3 is an input parameter to rtas, so don't trash it...
++ */
++
++#ifdef CONFIG_PPC32
++_GLOBAL(enter_rtas)
++ stwu r1,-INT_FRAME_SIZE(r1)
++ mflr r0
++ stw r0,INT_FRAME_SIZE+4(r1)
++ LOAD_REG_ADDR(r4, rtas)
++ lis r6,1f@ha /* physical return address for rtas */
++ addi r6,r6,1f@l
++ tophys(r6,r6)
++ lwz r8,RTASENTRY(r4)
++ lwz r4,RTASBASE(r4)
++ mfmsr r9
++ stw r9,8(r1)
++ LOAD_REG_IMMEDIATE(r0,MSR_KERNEL)
++ mtmsr r0 /* disable interrupts so SRR0/1 don't get trashed */
++ li r9,MSR_KERNEL & ~(MSR_IR|MSR_DR)
++ mtlr r6
++ stw r1, THREAD + RTAS_SP(r2)
++ mtspr SPRN_SRR0,r8
++ mtspr SPRN_SRR1,r9
++ rfi
++1:
++ lis r8, 1f@h
++ ori r8, r8, 1f@l
++ LOAD_REG_IMMEDIATE(r9,MSR_KERNEL)
++ mtspr SPRN_SRR0,r8
++ mtspr SPRN_SRR1,r9
++ rfi /* Reactivate MMU translation */
++1:
++ lwz r8,INT_FRAME_SIZE+4(r1) /* get return address */
++ lwz r9,8(r1) /* original msr value */
++ addi r1,r1,INT_FRAME_SIZE
++ li r0,0
++ stw r0, THREAD + RTAS_SP(r2)
++ mtlr r8
++ mtmsr r9
++ blr /* return to caller */
++_ASM_NOKPROBE_SYMBOL(enter_rtas)
++
++#else /* CONFIG_PPC32 */
++#include <asm/exception-64s.h>
++
++/*
++ * 32-bit rtas on 64-bit machines has the additional problem that RTAS may
++ * not preserve the upper parts of registers it uses.
++ */
++_GLOBAL(enter_rtas)
++ mflr r0
++ std r0,16(r1)
++ stdu r1,-SWITCH_FRAME_SIZE(r1) /* Save SP and create stack space. */
++
++ /* Because RTAS is running in 32b mode, it clobbers the high order half
++ * of all registers that it saves. We therefore save those registers
++ * RTAS might touch to the stack. (r0, r3-r13 are caller saved)
++ */
++ SAVE_GPR(2, r1) /* Save the TOC */
++ SAVE_GPR(13, r1) /* Save paca */
++ SAVE_NVGPRS(r1) /* Save the non-volatiles */
++
++ mfcr r4
++ std r4,_CCR(r1)
++ mfctr r5
++ std r5,_CTR(r1)
++ mfspr r6,SPRN_XER
++ std r6,_XER(r1)
++ mfdar r7
++ std r7,_DAR(r1)
++ mfdsisr r8
++ std r8,_DSISR(r1)
++
++ /* Temporary workaround to clear CR until RTAS can be modified to
++ * ignore all bits.
++ */
++ li r0,0
++ mtcr r0
++
++#ifdef CONFIG_BUG
++ /* There is no way it is acceptable to get here with interrupts enabled,
++ * check it with the asm equivalent of WARN_ON
++ */
++ lbz r0,PACAIRQSOFTMASK(r13)
++1: tdeqi r0,IRQS_ENABLED
++ EMIT_WARN_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING
++#endif
++
++ /* Hard-disable interrupts */
++ mfmsr r6
++ rldicl r7,r6,48,1
++ rotldi r7,r7,16
++ mtmsrd r7,1
++
++ /* Unfortunately, the stack pointer and the MSR are also clobbered,
++ * so they are saved in the PACA which allows us to restore
++ * our original state after RTAS returns.
++ */
++ std r1,PACAR1(r13)
++ std r6,PACASAVEDMSR(r13)
++
++ /* Setup our real return addr */
++ LOAD_REG_ADDR(r4,rtas_return_loc)
++ clrldi r4,r4,2 /* convert to realmode address */
++ mtlr r4
++
++__enter_rtas:
++ LOAD_REG_ADDR(r4, rtas)
++ ld r5,RTASENTRY(r4) /* get the rtas->entry value */
++ ld r4,RTASBASE(r4) /* get the rtas->base value */
++
++ /*
++ * RTAS runs in 32-bit big endian real mode, but leave MSR[RI] on as we
++ * may hit NMI (SRESET or MCE) while in RTAS. RTAS should disable RI in
++ * its critical regions (as specified in PAPR+ section 7.2.1). MSR[S]
++ * is not impacted by RFI_TO_KERNEL (only urfid can unset it). So if
++ * MSR[S] is set, it will remain when entering RTAS.
++ */
++ LOAD_REG_IMMEDIATE(r6, MSR_ME | MSR_RI)
++
++ li r0,0
++ mtmsrd r0,1 /* disable RI before using SRR0/1 */
++
++ mtspr SPRN_SRR0,r5
++ mtspr SPRN_SRR1,r6
++ RFI_TO_KERNEL
++ b . /* prevent speculative execution */
++rtas_return_loc:
++ FIXUP_ENDIAN
++
++ /*
++ * Clear RI and set SF before anything.
++ */
++ mfmsr r6
++ li r0,MSR_RI
++ andc r6,r6,r0
++ sldi r0,r0,(MSR_SF_LG - MSR_RI_LG)
++ or r6,r6,r0
++ sync
++ mtmsrd r6
++
++ /* relocation is off at this point */
++ GET_PACA(r4)
++ clrldi r4,r4,2 /* convert to realmode address */
++
++ bcl 20,31,$+4
++0: mflr r3
++ ld r3,(1f-0b)(r3) /* get &rtas_restore_regs */
++
++ ld r1,PACAR1(r4) /* Restore our SP */
++ ld r4,PACASAVEDMSR(r4) /* Restore our MSR */
++
++ mtspr SPRN_SRR0,r3
++ mtspr SPRN_SRR1,r4
++ RFI_TO_KERNEL
++ b . /* prevent speculative execution */
++_ASM_NOKPROBE_SYMBOL(__enter_rtas)
++_ASM_NOKPROBE_SYMBOL(rtas_return_loc)
++
++ .align 3
++1: .8byte rtas_restore_regs
++
++rtas_restore_regs:
++ /* relocation is on at this point */
++ REST_GPR(2, r1) /* Restore the TOC */
++ REST_GPR(13, r1) /* Restore paca */
++ REST_NVGPRS(r1) /* Restore the non-volatiles */
++
++ GET_PACA(r13)
++
++ ld r4,_CCR(r1)
++ mtcr r4
++ ld r5,_CTR(r1)
++ mtctr r5
++ ld r6,_XER(r1)
++ mtspr SPRN_XER,r6
++ ld r7,_DAR(r1)
++ mtdar r7
++ ld r8,_DSISR(r1)
++ mtdsisr r8
++
++ addi r1,r1,SWITCH_FRAME_SIZE /* Unstack our frame */
++ ld r0,16(r1) /* get return address */
++
++ mtlr r0
++ blr /* return to caller */
++
++#endif /* CONFIG_PPC32 */
+--
+2.35.1
+
--- /dev/null
+From 8ad8b88c00db4ec026c38004ee9325265617cff0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Aug 2022 10:34:25 +0200
+Subject: Revert "usb: add quirks for Lenovo OneLink+ Dock"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 58bfe7d8e31014d7ce246788df99c56e3cfe6c68 ]
+
+This reverts commit 3d5f70949f1b1168fbb17d06eb5c57e984c56c58.
+
+The quirk does not work properly, more work is needed to determine what
+should be done here.
+
+Reported-by: Oliver Neukum <oneukum@suse.com>
+Cc: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+Cc: stable <stable@kernel.org>
+Fixes: 3d5f70949f1b ("usb: add quirks for Lenovo OneLink+ Dock")
+Link: https://lore.kernel.org/r/9a17ea86-079f-510d-e919-01bc53a6d09f@gmx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/quirks.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 999b7c9697fc..f99a65a64588 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -437,10 +437,6 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
+- /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */
+- { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME },
+- { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME },
+-
+ /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */
+ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
+
+--
+2.35.1
+
--- /dev/null
+From 86e97617480fb94eeae93b7254402b57c4e7fdeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Sep 2022 09:10:08 +0200
+Subject: Revert "usb: gadget: udc-xilinx: replace memcpy with memcpy_toio"
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit fe0a2ac7c627b064c479ad0c3b25e531d342e048 ]
+
+This reverts commit 8cb339f1c1f04baede9d54c1e40ac96247a6393b as it
+throws up a bunch of sparse warnings as reported by the kernel test
+robot.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Link: https://lore.kernel.org/r/202209020044.CX2PfZzM-lkp@intel.com
+Fixes: 8cb339f1c1f0 ("usb: gadget: udc-xilinx: replace memcpy with memcpy_toio")
+Cc: stable@vger.kernel.org
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Piyush Mehta <piyush.mehta@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/udc-xilinx.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
+index 218d9423807a..9cf43731bcd1 100644
+--- a/drivers/usb/gadget/udc/udc-xilinx.c
++++ b/drivers/usb/gadget/udc/udc-xilinx.c
+@@ -496,11 +496,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req,
+ /* Get the Buffer address and copy the transmit data.*/
+ eprambase = (u32 __force *)(udc->addr + ep->rambase);
+ if (ep->is_in) {
+- memcpy_toio(eprambase, bufferptr, bytestosend);
++ memcpy(eprambase, bufferptr, bytestosend);
+ udc->write_fn(udc->addr, ep->offset +
+ XUSB_EP_BUF0COUNT_OFFSET, bufferlen);
+ } else {
+- memcpy_toio(bufferptr, eprambase, bytestosend);
++ memcpy(bufferptr, eprambase, bytestosend);
+ }
+ /*
+ * Enable the buffer for transmission.
+@@ -514,11 +514,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req,
+ eprambase = (u32 __force *)(udc->addr + ep->rambase +
+ ep->ep_usb.maxpacket);
+ if (ep->is_in) {
+- memcpy_toio(eprambase, bufferptr, bytestosend);
++ memcpy(eprambase, bufferptr, bytestosend);
+ udc->write_fn(udc->addr, ep->offset +
+ XUSB_EP_BUF1COUNT_OFFSET, bufferlen);
+ } else {
+- memcpy_toio(bufferptr, eprambase, bytestosend);
++ memcpy(bufferptr, eprambase, bytestosend);
+ }
+ /*
+ * Enable the buffer for transmission.
+@@ -1020,7 +1020,7 @@ static int __xudc_ep0_queue(struct xusb_ep *ep0, struct xusb_req *req)
+ udc->addr);
+ length = req->usb_req.actual = min_t(u32, length,
+ EP0_MAX_PACKET);
+- memcpy_toio(corebuf, req->usb_req.buf, length);
++ memcpy(corebuf, req->usb_req.buf, length);
+ udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, length);
+ udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);
+ } else {
+@@ -1746,7 +1746,7 @@ static void xudc_handle_setup(struct xusb_udc *udc)
+
+ /* Load up the chapter 9 command buffer.*/
+ ep0rambase = (u32 __force *) (udc->addr + XUSB_SETUP_PKT_ADDR_OFFSET);
+- memcpy_toio(&setup, ep0rambase, 8);
++ memcpy(&setup, ep0rambase, 8);
+
+ udc->setup = setup;
+ udc->setup.wValue = cpu_to_le16(setup.wValue);
+@@ -1833,7 +1833,7 @@ static void xudc_ep0_out(struct xusb_udc *udc)
+ (ep0->rambase << 2));
+ buffer = req->usb_req.buf + req->usb_req.actual;
+ req->usb_req.actual = req->usb_req.actual + bytes_to_rx;
+- memcpy_toio(buffer, ep0rambase, bytes_to_rx);
++ memcpy(buffer, ep0rambase, bytes_to_rx);
+
+ if (req->usb_req.length == req->usb_req.actual) {
+ /* Data transfer completed get ready for Status stage */
+@@ -1909,7 +1909,7 @@ static void xudc_ep0_in(struct xusb_udc *udc)
+ (ep0->rambase << 2));
+ buffer = req->usb_req.buf + req->usb_req.actual;
+ req->usb_req.actual = req->usb_req.actual + length;
+- memcpy_toio(ep0rambase, buffer, length);
++ memcpy(ep0rambase, buffer, length);
+ }
+ udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, count);
+ udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);
+--
+2.35.1
+
--- /dev/null
+drm-amdgpu-separate-vf2pf-work-item-init-from-virt-d.patch
+drm-amdgpu-make-sure-to-init-common-ip-before-gmc.patch
+staging-r8188eu-remove-support-for-devices-with-8188.patch
+staging-r8188eu-add-rosewill-usb-n150-nano-to-device.patch
+usb-dwc3-gadget-avoid-starting-dwc3-gadget-during-ud.patch
+usb-dwc3-issue-core-soft-reset-before-enabling-run-s.patch
+usb-dwc3-gadget-prevent-repeat-pullup.patch
+usb-dwc3-gadget-refactor-pullup.patch
+usb-dwc3-gadget-don-t-modify-gevntcount-in-pullup.patch
+usb-dwc3-gadget-avoid-duplicate-requests-to-enable-r.patch
+iio-adc-mcp3911-switch-to-generic-firmware-propertie.patch
+iio-adc-mcp3911-correct-microchip-device-addr-proper.patch
+powerpc-rtas-move-rtas-entry-assembly-into-its-own-f.patch
+powerpc-rtas-fix-rtas-msr-hv-handling-for-cell.patch
+usb-add-quirks-for-lenovo-onelink-dock.patch
+usb-gadget-udc-xilinx-replace-memcpy-with-memcpy_toi.patch
+revert-usb-add-quirks-for-lenovo-onelink-dock.patch
+revert-usb-gadget-udc-xilinx-replace-memcpy-with-mem.patch
+net-mvpp2-debugfs-fix-memory-leak-when-using-debugfs.patch
--- /dev/null
+From 728b7a417be68e65b364c44fdc8077e429759bf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 14 Aug 2022 12:50:27 -0500
+Subject: staging: r8188eu: Add Rosewill USB-N150 Nano to device tables
+
+From: Larry Finger <Larry.Finger@lwfinger.net>
+
+[ Upstream commit e01f5c8d6af231b3b09e23c1fe8a4057cdcc4e42 ]
+
+This device is reported as using the RTL8188EUS chip.
+
+It has the improbable USB ID of 0bda:ffef, which normally would belong
+to Realtek, but this ID works for the reporter.
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220814175027.2689-1-Larry.Finger@lwfinger.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/os_dep/usb_intf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/staging/r8188eu/os_dep/usb_intf.c b/drivers/staging/r8188eu/os_dep/usb_intf.c
+index b6c6fa72de44..640f1ca2d985 100644
+--- a/drivers/staging/r8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/r8188eu/os_dep/usb_intf.c
+@@ -30,6 +30,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
+ /*=== Realtek demoboard ===*/
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8179)}, /* 8188EUS */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */
++ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill USB-N150 Nano */
+ /*=== Customer ID ===*/
+ /****** 8188EUS ********/
+ {USB_DEVICE(0x07B8, 0x8179)}, /* Abocom - Abocom */
+--
+2.35.1
+
--- /dev/null
+From 9e798b5047f50d53da77465f976d05077530ed4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Nov 2021 23:37:34 +0700
+Subject: staging: r8188eu: Remove support for devices with 8188FU chipset
+ (0bda:f179)
+
+From: Candy Febriyanto <cfebriyanto@gmail.com>
+
+[ Upstream commit 6723b283c44a3fdf9f922ae9788aab38bd909211 ]
+
+The new r8188eu driver doesn't actually support devices with vendor ID 0bda
+and product ID f179[0][1][2], remove the ID so owners of these devices
+don't have to blacklist the staging driver.
+
+[0] https://github.com/lwfinger/rtl8188eu/issues/366#issuecomment-888511731
+[1] https://github.com/lwfinger/rtl8188eu/issues/385
+[2] https://github.com/lwfinger/rtl8188eu/issues/385#issuecomment-973013539
+
+Cc: Larry Finger <Larry.Finger@lwfinger.net>
+CC: Phillip Potter <phil@philpotter.co.uk>
+Signed-off-by: Candy Febriyanto <cfebriyanto@gmail.com>
+Link: https://lore.kernel.org/r/YZaBTq9vlMaJDFz2@mainframe.localdomain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: e01f5c8d6af2 ("staging: r8188eu: Add Rosewill USB-N150 Nano to device tables")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/os_dep/usb_intf.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/staging/r8188eu/os_dep/usb_intf.c b/drivers/staging/r8188eu/os_dep/usb_intf.c
+index bb85ab77fd26..b6c6fa72de44 100644
+--- a/drivers/staging/r8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/r8188eu/os_dep/usb_intf.c
+@@ -30,7 +30,6 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
+ /*=== Realtek demoboard ===*/
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x8179)}, /* 8188EUS */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0x0179)}, /* 8188ETV */
+- {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xf179)}, /* 8188FU */
+ /*=== Customer ID ===*/
+ /****** 8188EUS ********/
+ {USB_DEVICE(0x07B8, 0x8179)}, /* Abocom - Abocom */
+--
+2.35.1
+
--- /dev/null
+From ffa6dbaec4b45d345607abc9e961f9a0d9579d3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 21:13:21 +0200
+Subject: usb: add quirks for Lenovo OneLink+ Dock
+
+From: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+
+[ Upstream commit 3d5f70949f1b1168fbb17d06eb5c57e984c56c58 ]
+
+The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers:
+17ef:1018 upstream
+17ef:1019 downstream
+
+Those two controllers both have problems with some USB3.0 devices,
+particularly self-powered ones. Typical error messages include:
+
+ Timeout while waiting for setup device command
+ device not accepting address X, error -62
+ unable to enumerate USB device
+
+By process of elimination the controllers themselves were identified as
+the cause of the problem. Through trial and error the issue was solved
+by using USB_QUIRK_RESET_RESUME for both chips.
+
+Signed-off-by: Jean-Francois Le Fillatre <jflf_kernel@gmx.com>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/20220824191320.17883-1-jflf_kernel@gmx.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/core/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index f99a65a64588..999b7c9697fc 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -437,6 +437,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x1532, 0x0116), .driver_info =
+ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+
++ /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */
++ { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME },
++ { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */
+ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
+
+--
+2.35.1
+
--- /dev/null
+From 764b064fdc8f4b289941786711040ea65dc54118 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jul 2022 19:06:47 -0700
+Subject: usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop
+
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+
+[ Upstream commit 040f2dbd2010c43f33ad27249e6dac48456f4d99 ]
+
+Relocate the pullups_connected check until after it is ensured that there
+are no runtime PM transitions. If another context triggered the DWC3
+core's runtime resume, it may have already enabled the Run/Stop. Do not
+re-run the entire pullup sequence again, as it may issue a core soft
+reset while Run/Stop is already set.
+
+This patch depends on
+ commit 69e131d1ac4e ("usb: dwc3: gadget: Prevent repeat pullup()")
+
+Fixes: 77adb8bdf422 ("usb: dwc3: gadget: Allow runtime suspend if UDC unbinded")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Link: https://lore.kernel.org/r/20220728020647.9377-1-quic_wcheng@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 484b5e1d921a..14dcdb923f40 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2470,9 +2470,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+
+ is_on = !!is_on;
+
+- if (dwc->pullups_connected == is_on)
+- return 0;
+-
+ dwc->softconnect = is_on;
+ /*
+ * Per databook, when we want to stop the gadget, if a control transfer
+@@ -2509,6 +2506,11 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ return 0;
+ }
+
++ if (dwc->pullups_connected == is_on) {
++ pm_runtime_put(dwc->dev);
++ return 0;
++ }
++
+ if (!is_on) {
+ ret = dwc3_gadget_soft_disconnect(dwc);
+ } else {
+--
+2.35.1
+
--- /dev/null
+From ba4c266d299165a701d6c7ec5e9811eef9c37c39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Sep 2021 19:18:52 -0700
+Subject: usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind
+
+From: Wesley Cheng <wcheng@codeaurora.org>
+
+[ Upstream commit 8217f07a50236779880f13e87f99224cd9117f83 ]
+
+There is a race present where the DWC3 runtime resume runs in parallel
+to the UDC unbind sequence. This will eventually lead to a possible
+scenario where we are enabling the run/stop bit, without a valid
+composition defined.
+
+Thread#1 (handling UDC unbind):
+usb_gadget_remove_driver()
+-->usb_gadget_disconnect()
+ -->dwc3_gadget_pullup(0)
+--> continue UDC unbind sequence
+-->Thread#2 is running in parallel here
+
+Thread#2 (handing next cable connect)
+__dwc3_set_mode()
+ -->pm_runtime_get_sync()
+ -->dwc3_gadget_resume()
+ -->dwc->gadget_driver is NOT NULL yet
+ -->dwc3_gadget_run_stop(1)
+ --> _dwc3gadget_start()
+...
+
+Fix this by tracking the pullup disable routine, and avoiding resuming
+of the DWC3 gadget. Once the UDC is re-binded, that will trigger the
+pullup enable routine, which would handle enabling the DWC3 gadget.
+
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Wesley Cheng <wcheng@codeaurora.org>
+Link: https://lore.kernel.org/r/20210917021852.2037-1-wcheng@codeaurora.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/core.h | 2 ++
+ drivers/usb/dwc3/gadget.c | 4 ++--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index fd5d42ec5350..dbae57725f52 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -1028,6 +1028,7 @@ struct dwc3_scratchpad_array {
+ * @tx_fifo_resize_max_num: max number of fifos allocated during txfifo resize
+ * @hsphy_interface: "utmi" or "ulpi"
+ * @connected: true when we're connected to a host, false otherwise
++ * @softconnect: true when gadget connect is called, false when disconnect runs
+ * @delayed_status: true when gadget driver asks for delayed status
+ * @ep0_bounced: true when we used bounce buffer
+ * @ep0_expect_in: true when we expect a DATA IN transfer
+@@ -1247,6 +1248,7 @@ struct dwc3 {
+ const char *hsphy_interface;
+
+ unsigned connected:1;
++ unsigned softconnect:1;
+ unsigned delayed_status:1;
+ unsigned ep0_bounced:1;
+ unsigned ep0_expect_in:1;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 322754a7f91c..5f9a0ab09f4b 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2442,7 +2442,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ int ret;
+
+ is_on = !!is_on;
+-
++ dwc->softconnect = is_on;
+ /*
+ * Per databook, when we want to stop the gadget, if a control transfer
+ * is still in process, complete it and get the core into setup phase.
+@@ -4421,7 +4421,7 @@ int dwc3_gadget_resume(struct dwc3 *dwc)
+ {
+ int ret;
+
+- if (!dwc->gadget_driver)
++ if (!dwc->gadget_driver || !dwc->softconnect)
+ return 0;
+
+ ret = __dwc3_gadget_start(dwc);
+--
+2.35.1
+
--- /dev/null
+From 14604b0553494d9f3a6241c6778310bf88111675 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Apr 2022 19:22:44 -0700
+Subject: usb: dwc3: gadget: Don't modify GEVNTCOUNT in pullup()
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit 8f8034f493b5eb1ad21ff392fd30c0cf9e71f73f ]
+
+If the GEVNTCOUNT indicates events in the event buffer, the driver needs
+to acknowledge them before the controller can halt. Simply let the
+interrupt handler acknowledges the remaining event generated by the
+controller while polling for DSTS.DEVCTLHLT. This avoids disabling irq
+and taking care of race condition between the interrupt handlers and
+pullup().
+
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/ea306ec93c41ccafbdb5d16404ff3b6eca299613.1650593829.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 35 ++++++++---------------------------
+ 1 file changed, 8 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index cdc03ee439f8..484b5e1d921a 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2437,8 +2437,9 @@ static int __dwc3_gadget_start(struct dwc3 *dwc);
+
+ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
+ {
+- u32 count;
++ unsigned long flags;
+
++ spin_lock_irqsave(&dwc->lock, flags);
+ dwc->connected = false;
+
+ /*
+@@ -2450,29 +2451,21 @@ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
+ */
+ dwc3_stop_active_transfers(dwc);
+ __dwc3_gadget_stop(dwc);
++ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ /*
+- * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a
+- * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the
+- * "software needs to acknowledge the events that are generated
+- * (by writing to GEVNTCOUNTn) while it is waiting for this bit
+- * to be set to '1'."
++ * Note: if the GEVNTCOUNT indicates events in the event buffer, the
++ * driver needs to acknowledge them before the controller can halt.
++ * Simply let the interrupt handler acknowledges and handle the
++ * remaining event generated by the controller while polling for
++ * DSTS.DEVCTLHLT.
+ */
+- count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
+- count &= DWC3_GEVNTCOUNT_MASK;
+- if (count > 0) {
+- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count);
+- dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) %
+- dwc->ev_buf->length;
+- }
+-
+ return dwc3_gadget_run_stop(dwc, false, false);
+ }
+
+ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ {
+ struct dwc3 *dwc = gadget_to_dwc(g);
+- unsigned long flags;
+ int ret;
+
+ is_on = !!is_on;
+@@ -2516,14 +2509,6 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ return 0;
+ }
+
+- /*
+- * Synchronize and disable any further event handling while controller
+- * is being enabled/disabled.
+- */
+- disable_irq(dwc->irq_gadget);
+-
+- spin_lock_irqsave(&dwc->lock, flags);
+-
+ if (!is_on) {
+ ret = dwc3_gadget_soft_disconnect(dwc);
+ } else {
+@@ -2533,16 +2518,12 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ * device-initiated disconnect requires a core soft reset
+ * (DCTL.CSftRst) before enabling the run/stop bit.
+ */
+- spin_unlock_irqrestore(&dwc->lock, flags);
+ dwc3_core_soft_reset(dwc);
+- spin_lock_irqsave(&dwc->lock, flags);
+
+ dwc3_event_buffers_setup(dwc);
+ __dwc3_gadget_start(dwc);
+ ret = dwc3_gadget_run_stop(dwc, true, false);
+ }
+- spin_unlock_irqrestore(&dwc->lock, flags);
+- enable_irq(dwc->irq_gadget);
+
+ pm_runtime_put(dwc->dev);
+
+--
+2.35.1
+
--- /dev/null
+From beb57089f4057802801d51973a5a8128d834edd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Apr 2022 19:22:31 -0700
+Subject: usb: dwc3: gadget: Prevent repeat pullup()
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit 69e131d1ac4e52a59ec181ab4f8aa8c48cd8fb64 ]
+
+Don't do soft-disconnect if it's previously done. Likewise, don't do
+soft-connect if the device is currently connected and running. It would
+break normal operation.
+
+Currently the caller of pullup() (udc's sysfs soft_connect) only checks
+if it had initiated disconnect to prevent repeating soft-disconnect. It
+doesn't check for soft-connect. To be safe, let's keep the check here
+regardless whether the udc core is fixed.
+
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/1c1345bd66c97a9d32f77d63aaadd04b7b037143.1650593829.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 761065336322..61499b657129 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2442,6 +2442,10 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ int ret;
+
+ is_on = !!is_on;
++
++ if (dwc->pullups_connected == is_on)
++ return 0;
++
+ dwc->softconnect = is_on;
+ /*
+ * Per databook, when we want to stop the gadget, if a control transfer
+--
+2.35.1
+
--- /dev/null
+From 585f2ac752c8631327ba1a3b646db35a2a2ae4bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Apr 2022 19:22:38 -0700
+Subject: usb: dwc3: gadget: Refactor pullup()
+
+From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+
+[ Upstream commit 861c010a2ee1bc4a66d23f0da4aa22e75d8eaa24 ]
+
+Move soft-disconnect sequence out of dwc3_gadget_pullup(). No
+functional change here.
+
+Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Link: https://lore.kernel.org/r/4c0f259b17d95acaaa931f90276683a48a32fe22.1650593829.git.Thinh.Nguyen@synopsys.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/gadget.c | 65 ++++++++++++++++++++++-----------------
+ 1 file changed, 36 insertions(+), 29 deletions(-)
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 61499b657129..cdc03ee439f8 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2435,6 +2435,40 @@ static void dwc3_gadget_disable_irq(struct dwc3 *dwc);
+ static void __dwc3_gadget_stop(struct dwc3 *dwc);
+ static int __dwc3_gadget_start(struct dwc3 *dwc);
+
++static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
++{
++ u32 count;
++
++ dwc->connected = false;
++
++ /*
++ * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a
++ * Section 4.1.8 Table 4-7, it states that for a device-initiated
++ * disconnect, the SW needs to ensure that it sends "a DEPENDXFER
++ * command for any active transfers" before clearing the RunStop
++ * bit.
++ */
++ dwc3_stop_active_transfers(dwc);
++ __dwc3_gadget_stop(dwc);
++
++ /*
++ * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a
++ * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the
++ * "software needs to acknowledge the events that are generated
++ * (by writing to GEVNTCOUNTn) while it is waiting for this bit
++ * to be set to '1'."
++ */
++ count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
++ count &= DWC3_GEVNTCOUNT_MASK;
++ if (count > 0) {
++ dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count);
++ dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) %
++ dwc->ev_buf->length;
++ }
++
++ return dwc3_gadget_run_stop(dwc, false, false);
++}
++
+ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ {
+ struct dwc3 *dwc = gadget_to_dwc(g);
+@@ -2491,33 +2525,7 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ spin_lock_irqsave(&dwc->lock, flags);
+
+ if (!is_on) {
+- u32 count;
+-
+- dwc->connected = false;
+- /*
+- * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
+- * Section 4.1.8 Table 4-7, it states that for a device-initiated
+- * disconnect, the SW needs to ensure that it sends "a DEPENDXFER
+- * command for any active transfers" before clearing the RunStop
+- * bit.
+- */
+- dwc3_stop_active_transfers(dwc);
+- __dwc3_gadget_stop(dwc);
+-
+- /*
+- * In the Synopsis DesignWare Cores USB3 Databook Rev. 3.30a
+- * Section 1.3.4, it mentions that for the DEVCTRLHLT bit, the
+- * "software needs to acknowledge the events that are generated
+- * (by writing to GEVNTCOUNTn) while it is waiting for this bit
+- * to be set to '1'."
+- */
+- count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
+- count &= DWC3_GEVNTCOUNT_MASK;
+- if (count > 0) {
+- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count);
+- dwc->ev_buf->lpos = (dwc->ev_buf->lpos + count) %
+- dwc->ev_buf->length;
+- }
++ ret = dwc3_gadget_soft_disconnect(dwc);
+ } else {
+ /*
+ * In the Synopsys DWC_usb31 1.90a programming guide section
+@@ -2531,9 +2539,8 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+
+ dwc3_event_buffers_setup(dwc);
+ __dwc3_gadget_start(dwc);
++ ret = dwc3_gadget_run_stop(dwc, true, false);
+ }
+-
+- ret = dwc3_gadget_run_stop(dwc, is_on, false);
+ spin_unlock_irqrestore(&dwc->lock, flags);
+ enable_irq(dwc->irq_gadget);
+
+--
+2.35.1
+
--- /dev/null
+From cc4e79fd0f0484d928e71747873faf32fca649c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Mar 2022 18:13:58 -0700
+Subject: usb: dwc3: Issue core soft reset before enabling run/stop
+
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+
+[ Upstream commit 0066472de157439d58454f4a55786f1045ea5681 ]
+
+It is recommended by the Synopsis databook to issue a DCTL.CSftReset
+when reconnecting from a device-initiated disconnect routine. This
+resolves issues with enumeration during fast composition switching
+cases, which result in an unknown device on the host.
+
+Reviewed-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Link: https://lore.kernel.org/r/20220316011358.3057-1-quic_wcheng@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Stable-dep-of: 040f2dbd2010 ("usb: dwc3: gadget: Avoid duplicate requests to enable Run/Stop")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/core.c | 4 +---
+ drivers/usb/dwc3/core.h | 2 ++
+ drivers/usb/dwc3/gadget.c | 11 +++++++++++
+ 3 files changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 9c24cf46b9a0..b2ea4c2448d4 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -114,8 +114,6 @@ void dwc3_set_prtcap(struct dwc3 *dwc, u32 mode)
+ dwc->current_dr_role = mode;
+ }
+
+-static int dwc3_core_soft_reset(struct dwc3 *dwc);
+-
+ static void __dwc3_set_mode(struct work_struct *work)
+ {
+ struct dwc3 *dwc = work_to_dwc(work);
+@@ -265,7 +263,7 @@ u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type)
+ * dwc3_core_soft_reset - Issues core soft reset and PHY reset
+ * @dwc: pointer to our context structure
+ */
+-static int dwc3_core_soft_reset(struct dwc3 *dwc)
++int dwc3_core_soft_reset(struct dwc3 *dwc)
+ {
+ u32 reg;
+ int retries = 1000;
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index dbae57725f52..077d03a33388 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -1510,6 +1510,8 @@ bool dwc3_has_imod(struct dwc3 *dwc);
+ int dwc3_event_buffers_setup(struct dwc3 *dwc);
+ void dwc3_event_buffers_cleanup(struct dwc3 *dwc);
+
++int dwc3_core_soft_reset(struct dwc3 *dwc);
++
+ #if IS_ENABLED(CONFIG_USB_DWC3_HOST) || IS_ENABLED(CONFIG_USB_DWC3_DUAL_ROLE)
+ int dwc3_host_init(struct dwc3 *dwc);
+ void dwc3_host_exit(struct dwc3 *dwc);
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 5f9a0ab09f4b..761065336322 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2515,6 +2515,17 @@ static int dwc3_gadget_pullup(struct usb_gadget *g, int is_on)
+ dwc->ev_buf->length;
+ }
+ } else {
++ /*
++ * In the Synopsys DWC_usb31 1.90a programming guide section
++ * 4.1.9, it specifies that for a reconnect after a
++ * device-initiated disconnect requires a core soft reset
++ * (DCTL.CSftRst) before enabling the run/stop bit.
++ */
++ spin_unlock_irqrestore(&dwc->lock, flags);
++ dwc3_core_soft_reset(dwc);
++ spin_lock_irqsave(&dwc->lock, flags);
++
++ dwc3_event_buffers_setup(dwc);
+ __dwc3_gadget_start(dwc);
+ }
+
+--
+2.35.1
+
--- /dev/null
+From f4665a360f153d508d020082f574f9a634d88111 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Aug 2022 12:42:53 +0530
+Subject: usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
+
+From: Piyush Mehta <piyush.mehta@amd.com>
+
+[ Upstream commit 8cb339f1c1f04baede9d54c1e40ac96247a6393b ]
+
+For ARM processor, unaligned access to device memory is not allowed.
+Method memcpy does not take care of alignment.
+
+USB detection failure with the unaligned address of memory access, with
+below kernel crash. To fix the unaligned address the kernel panic issue,
+replace memcpy with memcpy_toio method.
+
+Kernel crash:
+Unable to handle kernel paging request at virtual address ffff80000c05008a
+Mem abort info:
+ ESR = 0x96000061
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ FSC = 0x21: alignment fault
+Data abort info:
+ ISV = 0, ISS = 0x00000061
+ CM = 0, WnR = 1
+swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000000143b000
+[ffff80000c05008a] pgd=100000087ffff003, p4d=100000087ffff003,
+pud=100000087fffe003, pmd=1000000800bcc003, pte=00680000a0010713
+Internal error: Oops: 96000061 [#1] SMP
+Modules linked in:
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.19-xilinx-v2022.1 #1
+Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
+pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+pc : __memcpy+0x30/0x260
+lr : __xudc_ep0_queue+0xf0/0x110
+sp : ffff800008003d00
+x29: ffff800008003d00 x28: ffff800009474e80 x27: 00000000000000a0
+x26: 0000000000000100 x25: 0000000000000012 x24: ffff000800bc8080
+x23: 0000000000000001 x22: 0000000000000012 x21: ffff000800bc8080
+x20: 0000000000000012 x19: ffff000800bc8080 x18: 0000000000000000
+x17: ffff800876482000 x16: ffff800008004000 x15: 0000000000004000
+x14: 00001f09785d0400 x13: 0103020101005567 x12: 0781400000000200
+x11: 00000000c5672a10 x10: 00000000000008d0 x9 : ffff800009463cf0
+x8 : ffff8000094757b0 x7 : 0201010055670781 x6 : 4000000002000112
+x5 : ffff80000c05009a x4 : ffff000800a15012 x3 : ffff00080362ad80
+x2 : 0000000000000012 x1 : ffff000800a15000 x0 : ffff80000c050088
+Call trace:
+ __memcpy+0x30/0x260
+ xudc_ep0_queue+0x3c/0x60
+ usb_ep_queue+0x38/0x44
+ composite_ep0_queue.constprop.0+0x2c/0xc0
+ composite_setup+0x8d0/0x185c
+ configfs_composite_setup+0x74/0xb0
+ xudc_irq+0x570/0xa40
+ __handle_irq_event_percpu+0x58/0x170
+ handle_irq_event+0x60/0x120
+ handle_fasteoi_irq+0xc0/0x220
+ handle_domain_irq+0x60/0x90
+ gic_handle_irq+0x74/0xa0
+ call_on_irq_stack+0x2c/0x60
+ do_interrupt_handler+0x54/0x60
+ el1_interrupt+0x30/0x50
+ el1h_64_irq_handler+0x18/0x24
+ el1h_64_irq+0x78/0x7c
+ arch_cpu_idle+0x18/0x2c
+ do_idle+0xdc/0x15c
+ cpu_startup_entry+0x28/0x60
+ rest_init+0xc8/0xe0
+ arch_call_rest_init+0x10/0x1c
+ start_kernel+0x694/0x6d4
+ __primary_switched+0xa4/0xac
+
+Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support")
+Cc: stable@vger.kernel.org
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Piyush Mehta <piyush.mehta@amd.com>
+Link: https://lore.kernel.org/r/20220824071253.1261096-1-piyush.mehta@amd.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/udc-xilinx.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/udc-xilinx.c b/drivers/usb/gadget/udc/udc-xilinx.c
+index 9cf43731bcd1..218d9423807a 100644
+--- a/drivers/usb/gadget/udc/udc-xilinx.c
++++ b/drivers/usb/gadget/udc/udc-xilinx.c
+@@ -496,11 +496,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req,
+ /* Get the Buffer address and copy the transmit data.*/
+ eprambase = (u32 __force *)(udc->addr + ep->rambase);
+ if (ep->is_in) {
+- memcpy(eprambase, bufferptr, bytestosend);
++ memcpy_toio(eprambase, bufferptr, bytestosend);
+ udc->write_fn(udc->addr, ep->offset +
+ XUSB_EP_BUF0COUNT_OFFSET, bufferlen);
+ } else {
+- memcpy(bufferptr, eprambase, bytestosend);
++ memcpy_toio(bufferptr, eprambase, bytestosend);
+ }
+ /*
+ * Enable the buffer for transmission.
+@@ -514,11 +514,11 @@ static int xudc_eptxrx(struct xusb_ep *ep, struct xusb_req *req,
+ eprambase = (u32 __force *)(udc->addr + ep->rambase +
+ ep->ep_usb.maxpacket);
+ if (ep->is_in) {
+- memcpy(eprambase, bufferptr, bytestosend);
++ memcpy_toio(eprambase, bufferptr, bytestosend);
+ udc->write_fn(udc->addr, ep->offset +
+ XUSB_EP_BUF1COUNT_OFFSET, bufferlen);
+ } else {
+- memcpy(bufferptr, eprambase, bytestosend);
++ memcpy_toio(bufferptr, eprambase, bytestosend);
+ }
+ /*
+ * Enable the buffer for transmission.
+@@ -1020,7 +1020,7 @@ static int __xudc_ep0_queue(struct xusb_ep *ep0, struct xusb_req *req)
+ udc->addr);
+ length = req->usb_req.actual = min_t(u32, length,
+ EP0_MAX_PACKET);
+- memcpy(corebuf, req->usb_req.buf, length);
++ memcpy_toio(corebuf, req->usb_req.buf, length);
+ udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, length);
+ udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);
+ } else {
+@@ -1746,7 +1746,7 @@ static void xudc_handle_setup(struct xusb_udc *udc)
+
+ /* Load up the chapter 9 command buffer.*/
+ ep0rambase = (u32 __force *) (udc->addr + XUSB_SETUP_PKT_ADDR_OFFSET);
+- memcpy(&setup, ep0rambase, 8);
++ memcpy_toio(&setup, ep0rambase, 8);
+
+ udc->setup = setup;
+ udc->setup.wValue = cpu_to_le16(setup.wValue);
+@@ -1833,7 +1833,7 @@ static void xudc_ep0_out(struct xusb_udc *udc)
+ (ep0->rambase << 2));
+ buffer = req->usb_req.buf + req->usb_req.actual;
+ req->usb_req.actual = req->usb_req.actual + bytes_to_rx;
+- memcpy(buffer, ep0rambase, bytes_to_rx);
++ memcpy_toio(buffer, ep0rambase, bytes_to_rx);
+
+ if (req->usb_req.length == req->usb_req.actual) {
+ /* Data transfer completed get ready for Status stage */
+@@ -1909,7 +1909,7 @@ static void xudc_ep0_in(struct xusb_udc *udc)
+ (ep0->rambase << 2));
+ buffer = req->usb_req.buf + req->usb_req.actual;
+ req->usb_req.actual = req->usb_req.actual + length;
+- memcpy(ep0rambase, buffer, length);
++ memcpy_toio(ep0rambase, buffer, length);
+ }
+ udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, count);
+ udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
