--- /dev/null
+From 539b513b17fd51e0c9c42647ebd227213e90c6e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jul 2022 13:55:39 +0100
+Subject: ACPI: PPTT: Leave the table mapped for the runtime usage
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 0c80f9e165f8f9cca743d7b6cbdb54362da297e0 ]
+
+Currently, everytime an information needs to be fetched from the PPTT,
+the table is mapped via acpi_get_table() and unmapped after the use via
+acpi_put_table() which is fine. However we do this at runtime especially
+when the CPU is hotplugged out and plugged in back since we re-populate
+the cache topology and other information.
+
+However, with the support to fetch LLC information from the PPTT in the
+cpuhotplug path which is executed in the atomic context, it is preferred
+to avoid mapping and unmapping of the PPTT for every single use as the
+acpi_get_table() might sleep waiting for a mutex.
+
+In order to avoid the same, the table is needs to just mapped once on
+the boot CPU and is never unmapped allowing it to be used at runtime
+with out the hassle of mapping and unmapping the table.
+
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Cc: Rafael J. Wysocki <rafael@kernel.org>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+
+--
+
+Hi Rafael,
+
+Sorry to bother you again on this PPTT changes. Guenter reported an issue
+with lockdep enabled in -next that include my cacheinfo/arch_topology changes
+to utilise LLC from PPTT in the CPU hotplug path.
+
+Please ack the change once you are happy so that I can get it merged with
+other fixes via Greg's tree.
+
+Regards,
+Sudeep
+
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/20220720-arch_topo_fixes-v3-2-43d696288e84@arm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pptt.c | 102 ++++++++++++++++++++------------------------
+ 1 file changed, 47 insertions(+), 55 deletions(-)
+
+diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
+index 701f61c01359..3ad2823eb6f8 100644
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -532,21 +532,37 @@ static int topology_get_acpi_cpu_tag(struct acpi_table_header *table,
+ return -ENOENT;
+ }
+
++
++static struct acpi_table_header *acpi_get_pptt(void)
++{
++ static struct acpi_table_header *pptt;
++ acpi_status status;
++
++ /*
++ * PPTT will be used at runtime on every CPU hotplug in path, so we
++ * don't need to call acpi_put_table() to release the table mapping.
++ */
++ if (!pptt) {
++ status = acpi_get_table(ACPI_SIG_PPTT, 0, &pptt);
++ if (ACPI_FAILURE(status))
++ acpi_pptt_warn_missing();
++ }
++
++ return pptt;
++}
++
+ static int find_acpi_cpu_topology_tag(unsigned int cpu, int level, int flag)
+ {
+ struct acpi_table_header *table;
+- acpi_status status;
+ int retval;
+
+- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table);
+- if (ACPI_FAILURE(status)) {
+- acpi_pptt_warn_missing();
++ table = acpi_get_pptt();
++ if (!table)
+ return -ENOENT;
+- }
++
+ retval = topology_get_acpi_cpu_tag(table, cpu, level, flag);
+ pr_debug("Topology Setup ACPI CPU %d, level %d ret = %d\n",
+ cpu, level, retval);
+- acpi_put_table(table);
+
+ return retval;
+ }
+@@ -567,16 +583,13 @@ static int find_acpi_cpu_topology_tag(unsigned int cpu, int level, int flag)
+ static int check_acpi_cpu_flag(unsigned int cpu, int rev, u32 flag)
+ {
+ struct acpi_table_header *table;
+- acpi_status status;
+ u32 acpi_cpu_id = get_acpi_id_for_cpu(cpu);
+ struct acpi_pptt_processor *cpu_node = NULL;
+ int ret = -ENOENT;
+
+- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table);
+- if (ACPI_FAILURE(status)) {
+- acpi_pptt_warn_missing();
+- return ret;
+- }
++ table = acpi_get_pptt();
++ if (!table)
++ return -ENOENT;
+
+ if (table->revision >= rev)
+ cpu_node = acpi_find_processor_node(table, acpi_cpu_id);
+@@ -584,8 +597,6 @@ static int check_acpi_cpu_flag(unsigned int cpu, int rev, u32 flag)
+ if (cpu_node)
+ ret = (cpu_node->flags & flag) != 0;
+
+- acpi_put_table(table);
+-
+ return ret;
+ }
+
+@@ -604,18 +615,15 @@ int acpi_find_last_cache_level(unsigned int cpu)
+ u32 acpi_cpu_id;
+ struct acpi_table_header *table;
+ int number_of_levels = 0;
+- acpi_status status;
++
++ table = acpi_get_pptt();
++ if (!table)
++ return -ENOENT;
+
+ pr_debug("Cache Setup find last level CPU=%d\n", cpu);
+
+ acpi_cpu_id = get_acpi_id_for_cpu(cpu);
+- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table);
+- if (ACPI_FAILURE(status)) {
+- acpi_pptt_warn_missing();
+- } else {
+- number_of_levels = acpi_find_cache_levels(table, acpi_cpu_id);
+- acpi_put_table(table);
+- }
++ number_of_levels = acpi_find_cache_levels(table, acpi_cpu_id);
+ pr_debug("Cache Setup find last level level=%d\n", number_of_levels);
+
+ return number_of_levels;
+@@ -637,20 +645,16 @@ int acpi_find_last_cache_level(unsigned int cpu)
+ int cache_setup_acpi(unsigned int cpu)
+ {
+ struct acpi_table_header *table;
+- acpi_status status;
+
+- pr_debug("Cache Setup ACPI CPU %d\n", cpu);
+-
+- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table);
+- if (ACPI_FAILURE(status)) {
+- acpi_pptt_warn_missing();
++ table = acpi_get_pptt();
++ if (!table)
+ return -ENOENT;
+- }
++
++ pr_debug("Cache Setup ACPI CPU %d\n", cpu);
+
+ cache_setup_acpi_cpu(table, cpu);
+- acpi_put_table(table);
+
+- return status;
++ return 0;
+ }
+
+ /**
+@@ -766,50 +770,38 @@ int find_acpi_cpu_topology_package(unsigned int cpu)
+ int find_acpi_cpu_topology_cluster(unsigned int cpu)
+ {
+ struct acpi_table_header *table;
+- acpi_status status;
+ struct acpi_pptt_processor *cpu_node, *cluster_node;
+ u32 acpi_cpu_id;
+ int retval;
+ int is_thread;
+
+- status = acpi_get_table(ACPI_SIG_PPTT, 0, &table);
+- if (ACPI_FAILURE(status)) {
+- acpi_pptt_warn_missing();
++ table = acpi_get_pptt();
++ if (!table)
+ return -ENOENT;
+- }
+
+ acpi_cpu_id = get_acpi_id_for_cpu(cpu);
+ cpu_node = acpi_find_processor_node(table, acpi_cpu_id);
+- if (cpu_node == NULL || !cpu_node->parent) {
+- retval = -ENOENT;
+- goto put_table;
+- }
++ if (!cpu_node || !cpu_node->parent)
++ return -ENOENT;
+
+ is_thread = cpu_node->flags & ACPI_PPTT_ACPI_PROCESSOR_IS_THREAD;
+ cluster_node = fetch_pptt_node(table, cpu_node->parent);
+- if (cluster_node == NULL) {
+- retval = -ENOENT;
+- goto put_table;
+- }
++ if (!cluster_node)
++ return -ENOENT;
++
+ if (is_thread) {
+- if (!cluster_node->parent) {
+- retval = -ENOENT;
+- goto put_table;
+- }
++ if (!cluster_node->parent)
++ return -ENOENT;
++
+ cluster_node = fetch_pptt_node(table, cluster_node->parent);
+- if (cluster_node == NULL) {
+- retval = -ENOENT;
+- goto put_table;
+- }
++ if (!cluster_node)
++ return -ENOENT;
+ }
+ if (cluster_node->flags & ACPI_PPTT_ACPI_PROCESSOR_ID_VALID)
+ retval = cluster_node->acpi_processor_id;
+ else
+ retval = ACPI_PTR_DIFF(cluster_node, table);
+
+-put_table:
+- acpi_put_table(table);
+-
+ return retval;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 55c02a68360db9a6be002b473c4f71472f095cfe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 14:59:45 +0200
+Subject: ALSA: control: Use deferred fasync helper
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 4a971e84a7ae10a38d875cd2d4e487c8d1682ca3 ]
+
+For avoiding the potential deadlock via kill_fasync() call, use the
+new fasync helpers to defer the invocation from the control API. Note
+that it's merely a workaround.
+
+Another note: although we haven't received reports about the deadlock
+with the control API, the deadlock is still potentially possible, and
+it's better to align the behavior with other core APIs (PCM and
+timer); so let's move altogether.
+
+Link: https://lore.kernel.org/r/20220728125945.29533-5-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/control.h | 2 +-
+ sound/core/control.c | 7 ++++---
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/include/sound/control.h b/include/sound/control.h
+index 985c51a8fb74..a1fc7e0a47d9 100644
+--- a/include/sound/control.h
++++ b/include/sound/control.h
+@@ -109,7 +109,7 @@ struct snd_ctl_file {
+ int preferred_subdevice[SND_CTL_SUBDEV_ITEMS];
+ wait_queue_head_t change_sleep;
+ spinlock_t read_lock;
+- struct fasync_struct *fasync;
++ struct snd_fasync *fasync;
+ int subscribed; /* read interface is activated */
+ struct list_head events; /* waiting events for read */
+ };
+diff --git a/sound/core/control.c b/sound/core/control.c
+index a25c0d64d104..f66fe4be30d3 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -127,6 +127,7 @@ static int snd_ctl_release(struct inode *inode, struct file *file)
+ if (control->vd[idx].owner == ctl)
+ control->vd[idx].owner = NULL;
+ up_write(&card->controls_rwsem);
++ snd_fasync_free(ctl->fasync);
+ snd_ctl_empty_read_queue(ctl);
+ put_pid(ctl->pid);
+ kfree(ctl);
+@@ -181,7 +182,7 @@ void snd_ctl_notify(struct snd_card *card, unsigned int mask,
+ _found:
+ wake_up(&ctl->change_sleep);
+ spin_unlock(&ctl->read_lock);
+- kill_fasync(&ctl->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_IN);
+ }
+ read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+ }
+@@ -2002,7 +2003,7 @@ static int snd_ctl_fasync(int fd, struct file * file, int on)
+ struct snd_ctl_file *ctl;
+
+ ctl = file->private_data;
+- return fasync_helper(fd, file, on, &ctl->fasync);
++ return snd_fasync_helper(fd, file, on, &ctl->fasync);
+ }
+
+ /* return the preferred subdevice number if already assigned;
+@@ -2170,7 +2171,7 @@ static int snd_ctl_dev_disconnect(struct snd_device *device)
+ read_lock_irqsave(&card->ctl_files_rwlock, flags);
+ list_for_each_entry(ctl, &card->ctl_files, list) {
+ wake_up(&ctl->change_sleep);
+- kill_fasync(&ctl->fasync, SIGIO, POLL_ERR);
++ snd_kill_fasync(ctl->fasync, SIGIO, POLL_ERR);
+ }
+ read_unlock_irqrestore(&card->ctl_files_rwlock, flags);
+
+--
+2.35.1
+
--- /dev/null
+From 399543085d41a91ce2a7e4a4eb9485c04ff666de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 14:59:42 +0200
+Subject: ALSA: core: Add async signal helpers
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit ef34a0ae7a2654bc9e58675e36898217fb2799d8 ]
+
+Currently the call of kill_fasync() from an interrupt handler might
+lead to potential spin deadlocks, as spotted by syzkaller.
+Unfortunately, it's not so trivial to fix this lock chain as it's
+involved with the tasklist_lock that is touched in allover places.
+
+As a temporary workaround, this patch provides the way to defer the
+async signal notification in a work. The new helper functions,
+snd_fasync_helper() and snd_kill_faync() are replacements for
+fasync_helper() and kill_fasync(), respectively. In addition,
+snd_fasync_free() needs to be called at the destructor of the relevant
+file object.
+
+Link: https://lore.kernel.org/r/20220728125945.29533-2-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/core.h | 8 ++++
+ sound/core/misc.c | 94 ++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 102 insertions(+)
+
+diff --git a/include/sound/core.h b/include/sound/core.h
+index 6d4cc49584c6..39cee40ac22e 100644
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -501,4 +501,12 @@ snd_pci_quirk_lookup_id(u16 vendor, u16 device,
+ }
+ #endif
+
++/* async signal helpers */
++struct snd_fasync;
++
++int snd_fasync_helper(int fd, struct file *file, int on,
++ struct snd_fasync **fasyncp);
++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll);
++void snd_fasync_free(struct snd_fasync *fasync);
++
+ #endif /* __SOUND_CORE_H */
+diff --git a/sound/core/misc.c b/sound/core/misc.c
+index 50e4aaa6270d..d32a19976a2b 100644
+--- a/sound/core/misc.c
++++ b/sound/core/misc.c
+@@ -10,6 +10,7 @@
+ #include <linux/time.h>
+ #include <linux/slab.h>
+ #include <linux/ioport.h>
++#include <linux/fs.h>
+ #include <sound/core.h>
+
+ #ifdef CONFIG_SND_DEBUG
+@@ -145,3 +146,96 @@ snd_pci_quirk_lookup(struct pci_dev *pci, const struct snd_pci_quirk *list)
+ }
+ EXPORT_SYMBOL(snd_pci_quirk_lookup);
+ #endif
++
++/*
++ * Deferred async signal helpers
++ *
++ * Below are a few helper functions to wrap the async signal handling
++ * in the deferred work. The main purpose is to avoid the messy deadlock
++ * around tasklist_lock and co at the kill_fasync() invocation.
++ * fasync_helper() and kill_fasync() are replaced with snd_fasync_helper()
++ * and snd_kill_fasync(), respectively. In addition, snd_fasync_free() has
++ * to be called at releasing the relevant file object.
++ */
++struct snd_fasync {
++ struct fasync_struct *fasync;
++ int signal;
++ int poll;
++ int on;
++ struct list_head list;
++};
++
++static DEFINE_SPINLOCK(snd_fasync_lock);
++static LIST_HEAD(snd_fasync_list);
++
++static void snd_fasync_work_fn(struct work_struct *work)
++{
++ struct snd_fasync *fasync;
++
++ spin_lock_irq(&snd_fasync_lock);
++ while (!list_empty(&snd_fasync_list)) {
++ fasync = list_first_entry(&snd_fasync_list, struct snd_fasync, list);
++ list_del_init(&fasync->list);
++ spin_unlock_irq(&snd_fasync_lock);
++ if (fasync->on)
++ kill_fasync(&fasync->fasync, fasync->signal, fasync->poll);
++ spin_lock_irq(&snd_fasync_lock);
++ }
++ spin_unlock_irq(&snd_fasync_lock);
++}
++
++static DECLARE_WORK(snd_fasync_work, snd_fasync_work_fn);
++
++int snd_fasync_helper(int fd, struct file *file, int on,
++ struct snd_fasync **fasyncp)
++{
++ struct snd_fasync *fasync = NULL;
++
++ if (on) {
++ fasync = kzalloc(sizeof(*fasync), GFP_KERNEL);
++ if (!fasync)
++ return -ENOMEM;
++ INIT_LIST_HEAD(&fasync->list);
++ }
++
++ spin_lock_irq(&snd_fasync_lock);
++ if (*fasyncp) {
++ kfree(fasync);
++ fasync = *fasyncp;
++ } else {
++ if (!fasync) {
++ spin_unlock_irq(&snd_fasync_lock);
++ return 0;
++ }
++ *fasyncp = fasync;
++ }
++ fasync->on = on;
++ spin_unlock_irq(&snd_fasync_lock);
++ return fasync_helper(fd, file, on, &fasync->fasync);
++}
++EXPORT_SYMBOL_GPL(snd_fasync_helper);
++
++void snd_kill_fasync(struct snd_fasync *fasync, int signal, int poll)
++{
++ unsigned long flags;
++
++ if (!fasync || !fasync->on)
++ return;
++ spin_lock_irqsave(&snd_fasync_lock, flags);
++ fasync->signal = signal;
++ fasync->poll = poll;
++ list_move(&fasync->list, &snd_fasync_list);
++ schedule_work(&snd_fasync_work);
++ spin_unlock_irqrestore(&snd_fasync_lock, flags);
++}
++EXPORT_SYMBOL_GPL(snd_kill_fasync);
++
++void snd_fasync_free(struct snd_fasync *fasync)
++{
++ if (!fasync)
++ return;
++ fasync->on = 0;
++ flush_work(&snd_fasync_work);
++ kfree(fasync);
++}
++EXPORT_SYMBOL_GPL(snd_fasync_free);
+--
+2.35.1
+
--- /dev/null
+From 8ba3691f41ad5344c85fe37a14df72bd5002862a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jul 2022 14:02:27 +0200
+Subject: ALSA: hda: Fix page fault in snd_hda_codec_shutdown()
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit 980b3a8790b402e959a6d773b38b771019682be1 ]
+
+If early probe of HDAudio bus driver fails e.g.: due to missing
+firmware file, snd_hda_codec_shutdown() ends in manipulating
+uninitialized codec->pcm_list_head causing page fault.
+
+Iinitialization of HDAudio codec in ASoC is split in two:
+- snd_hda_codec_device_init()
+- snd_hda_codec_device_new()
+
+snd_hda_codec_device_init() is called during probe_codecs() by HDAudio
+bus driver while snd_hda_codec_device_new() is called by
+codec-component's ->probe(). The second call will not happen until all
+components required by related sound card are present within the ASoC
+framework. With firmware failing to load during the PCI's deferred
+initialization i.e.: probe_work(), no platform components are ever
+registered. HDAudio codec enumeration is done at that point though, so
+the codec components became registered to ASoC framework, calling
+snd_hda_codec_device_init() in the process.
+
+Now, during platform reboot snd_hda_codec_shutdown() is called for every
+codec found on the HDAudio bus causing oops if any of them has not
+completed both of their initialization steps. Relocating field
+initialization fixes the issue.
+
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/20220706120230.427296-7-cezary.rojewski@intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_codec.c | 41 +++++++++++++++++++--------------------
+ 1 file changed, 20 insertions(+), 21 deletions(-)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index ccb195b7cb08..8828fc3a5c3f 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -931,8 +931,28 @@ snd_hda_codec_device_init(struct hda_bus *bus, unsigned int codec_addr,
+ }
+
+ codec->bus = bus;
++ codec->depop_delay = -1;
++ codec->fixup_id = HDA_FIXUP_ID_NOT_SET;
++ codec->core.dev.release = snd_hda_codec_dev_release;
++ codec->core.exec_verb = codec_exec_verb;
+ codec->core.type = HDA_DEV_LEGACY;
+
++ mutex_init(&codec->spdif_mutex);
++ mutex_init(&codec->control_mutex);
++ snd_array_init(&codec->mixers, sizeof(struct hda_nid_item), 32);
++ snd_array_init(&codec->nids, sizeof(struct hda_nid_item), 32);
++ snd_array_init(&codec->init_pins, sizeof(struct hda_pincfg), 16);
++ snd_array_init(&codec->driver_pins, sizeof(struct hda_pincfg), 16);
++ snd_array_init(&codec->cvt_setups, sizeof(struct hda_cvt_setup), 8);
++ snd_array_init(&codec->spdif_out, sizeof(struct hda_spdif_out), 16);
++ snd_array_init(&codec->jacktbl, sizeof(struct hda_jack_tbl), 16);
++ snd_array_init(&codec->verbs, sizeof(struct hda_verb *), 8);
++ INIT_LIST_HEAD(&codec->conn_list);
++ INIT_LIST_HEAD(&codec->pcm_list_head);
++ INIT_DELAYED_WORK(&codec->jackpoll_work, hda_jackpoll_work);
++ refcount_set(&codec->pcm_ref, 1);
++ init_waitqueue_head(&codec->remove_sleep);
++
+ return codec;
+ }
+ EXPORT_SYMBOL_GPL(snd_hda_codec_device_init);
+@@ -980,29 +1000,8 @@ int snd_hda_codec_device_new(struct hda_bus *bus, struct snd_card *card,
+ if (snd_BUG_ON(codec_addr > HDA_MAX_CODEC_ADDRESS))
+ return -EINVAL;
+
+- codec->core.dev.release = snd_hda_codec_dev_release;
+- codec->core.exec_verb = codec_exec_verb;
+-
+ codec->card = card;
+ codec->addr = codec_addr;
+- mutex_init(&codec->spdif_mutex);
+- mutex_init(&codec->control_mutex);
+- snd_array_init(&codec->mixers, sizeof(struct hda_nid_item), 32);
+- snd_array_init(&codec->nids, sizeof(struct hda_nid_item), 32);
+- snd_array_init(&codec->init_pins, sizeof(struct hda_pincfg), 16);
+- snd_array_init(&codec->driver_pins, sizeof(struct hda_pincfg), 16);
+- snd_array_init(&codec->cvt_setups, sizeof(struct hda_cvt_setup), 8);
+- snd_array_init(&codec->spdif_out, sizeof(struct hda_spdif_out), 16);
+- snd_array_init(&codec->jacktbl, sizeof(struct hda_jack_tbl), 16);
+- snd_array_init(&codec->verbs, sizeof(struct hda_verb *), 8);
+- INIT_LIST_HEAD(&codec->conn_list);
+- INIT_LIST_HEAD(&codec->pcm_list_head);
+- refcount_set(&codec->pcm_ref, 1);
+- init_waitqueue_head(&codec->remove_sleep);
+-
+- INIT_DELAYED_WORK(&codec->jackpoll_work, hda_jackpoll_work);
+- codec->depop_delay = -1;
+- codec->fixup_id = HDA_FIXUP_ID_NOT_SET;
+
+ #ifdef CONFIG_PM
+ codec->power_jiffies = jiffies;
+--
+2.35.1
+
--- /dev/null
+From c2cfa524a41e2117c77e3d9fec46f2b360aeb8b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Jul 2022 22:20:14 +0800
+Subject: ALSA: hda/realtek: Enable speaker and mute LEDs for HP laptops
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit c578d5da10dc429c6676ab09f3fec0b79b31633a ]
+
+Two more HP laptops that use cs35l41 AMP for speaker and GPIO for mute
+LEDs.
+
+So use the existing quirk to enable them accordingly.
+
+[ Sort the entries at the SSID order by tiwai ]
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Reviewed-by: Lucas Tanure <tanureal@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20220719142015.244426-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 09d97a8afdda..1ae9674fa8a3 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9234,6 +9234,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x103c, 0x8aa3, "HP ProBook 450 G9 (MB 8AA1)", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8aa8, "HP EliteBook 640 G9 (MB 8AA6)", ALC236_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8aab, "HP EliteBook 650 G9 (MB 8AA9)", ALC236_FIXUP_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+--
+2.35.1
+
--- /dev/null
+From b0b17c8a6078b31400518c75c0ee338b1d501ab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 14:59:44 +0200
+Subject: ALSA: pcm: Use deferred fasync helper
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 96b097091c66df4f6fbf5cbff21df6cc02a2f055 ]
+
+For avoiding the potential deadlock via kill_fasync() call, use the
+new fasync helpers to defer the invocation from timer API. Note that
+it's merely a workaround.
+
+Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com
+Reported-by: syzbot+669c9abf11a6a011dd09@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20220728125945.29533-4-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/pcm.h | 2 +-
+ sound/core/pcm.c | 1 +
+ sound/core/pcm_lib.c | 2 +-
+ sound/core/pcm_native.c | 2 +-
+ 4 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/include/sound/pcm.h b/include/sound/pcm.h
+index 6b99310b5b88..6987110843f0 100644
+--- a/include/sound/pcm.h
++++ b/include/sound/pcm.h
+@@ -399,7 +399,7 @@ struct snd_pcm_runtime {
+ snd_pcm_uframes_t twake; /* do transfer (!poll) wakeup if non-zero */
+ wait_queue_head_t sleep; /* poll sleep */
+ wait_queue_head_t tsleep; /* transfer sleep */
+- struct fasync_struct *fasync;
++ struct snd_fasync *fasync;
+ bool stop_operating; /* sync_stop will be called */
+ struct mutex buffer_mutex; /* protect for buffer changes */
+ atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index 977d54320a5c..c917ac84a7e5 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -1005,6 +1005,7 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream)
+ substream->runtime = NULL;
+ }
+ mutex_destroy(&runtime->buffer_mutex);
++ snd_fasync_free(runtime->fasync);
+ kfree(runtime);
+ put_pid(substream->pid);
+ substream->pid = NULL;
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 1fc7c50ffa62..40751e5aff09 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1822,7 +1822,7 @@ void snd_pcm_period_elapsed_under_stream_lock(struct snd_pcm_substream *substrea
+ snd_timer_interrupt(substream->timer, 1);
+ #endif
+ _end:
+- kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(runtime->fasync, SIGIO, POLL_IN);
+ }
+ EXPORT_SYMBOL(snd_pcm_period_elapsed_under_stream_lock);
+
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 4adaee62ef33..16fcf57c6f03 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -3945,7 +3945,7 @@ static int snd_pcm_fasync(int fd, struct file * file, int on)
+ runtime = substream->runtime;
+ if (runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
+ return -EBADFD;
+- return fasync_helper(fd, file, on, &runtime->fasync);
++ return snd_fasync_helper(fd, file, on, &runtime->fasync);
+ }
+
+ /*
+--
+2.35.1
+
--- /dev/null
+From abeb03a112b84f7815d9b4e9421c8b8a86fd3c99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 14:59:43 +0200
+Subject: ALSA: timer: Use deferred fasync helper
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 95cc637c1afd83fb7dd3d7c8a53710488f4caf9c ]
+
+For avoiding the potential deadlock via kill_fasync() call, use the
+new fasync helpers to defer the invocation from PCI API. Note that
+it's merely a workaround.
+
+Reported-by: syzbot+1ee0910eca9c94f71f25@syzkaller.appspotmail.com
+Reported-by: syzbot+49b10793b867871ee26f@syzkaller.appspotmail.com
+Reported-by: syzbot+8285e973a41b5aa68902@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20220728125945.29533-3-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/timer.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index b3214baa8919..e08a37c23add 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -83,7 +83,7 @@ struct snd_timer_user {
+ unsigned int filter;
+ struct timespec64 tstamp; /* trigger tstamp */
+ wait_queue_head_t qchange_sleep;
+- struct fasync_struct *fasync;
++ struct snd_fasync *fasync;
+ struct mutex ioctl_lock;
+ };
+
+@@ -1345,7 +1345,7 @@ static void snd_timer_user_interrupt(struct snd_timer_instance *timeri,
+ }
+ __wake:
+ spin_unlock(&tu->qlock);
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1383,7 +1383,7 @@ static void snd_timer_user_ccallback(struct snd_timer_instance *timeri,
+ spin_lock_irqsave(&tu->qlock, flags);
+ snd_timer_user_append_to_tqueue(tu, &r1);
+ spin_unlock_irqrestore(&tu->qlock, flags);
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1453,7 +1453,7 @@ static void snd_timer_user_tinterrupt(struct snd_timer_instance *timeri,
+ spin_unlock(&tu->qlock);
+ if (append == 0)
+ return;
+- kill_fasync(&tu->fasync, SIGIO, POLL_IN);
++ snd_kill_fasync(tu->fasync, SIGIO, POLL_IN);
+ wake_up(&tu->qchange_sleep);
+ }
+
+@@ -1521,6 +1521,7 @@ static int snd_timer_user_release(struct inode *inode, struct file *file)
+ snd_timer_instance_free(tu->timeri);
+ }
+ mutex_unlock(&tu->ioctl_lock);
++ snd_fasync_free(tu->fasync);
+ kfree(tu->queue);
+ kfree(tu->tqueue);
+ kfree(tu);
+@@ -2135,7 +2136,7 @@ static int snd_timer_user_fasync(int fd, struct file * file, int on)
+ struct snd_timer_user *tu;
+
+ tu = file->private_data;
+- return fasync_helper(fd, file, on, &tu->fasync);
++ return snd_fasync_helper(fd, file, on, &tu->fasync);
+ }
+
+ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
+--
+2.35.1
+
--- /dev/null
+From a0bd72bd03dbf77cb242d4fa29744b8e56657b04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jul 2022 13:47:49 +0100
+Subject: ASoC: codecs: va-macro: use fsgen as clock
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 30097967e0566cac817273ef76add100f6b0f463 ]
+
+VA Macro fsgen clock is supplied to other LPASS Macros using proper
+clock apis, however the internal user uses the registers directly without
+clk apis. This approch has race condition where in external users of
+the clock might cut the clock while VA macro is actively using this.
+
+Moving the internal usage to clk apis would provide a proper refcounting
+and avoid such race conditions.
+
+This issue was noticed while headset was pulled out while recording is
+in progress and shifting record patch to DMIC.
+
+Reported-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Tested-by: Srinivasa Rao Mandadapu <quic_srivasam@quicinc.com>
+Link: https://lore.kernel.org/r/20220727124749.4604-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/lpass-va-macro.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/lpass-va-macro.c b/sound/soc/codecs/lpass-va-macro.c
+index d18b56e60433..1ea10dc70748 100644
+--- a/sound/soc/codecs/lpass-va-macro.c
++++ b/sound/soc/codecs/lpass-va-macro.c
+@@ -199,6 +199,7 @@ struct va_macro {
+ struct clk *mclk;
+ struct clk *macro;
+ struct clk *dcodec;
++ struct clk *fsgen;
+ struct clk_hw hw;
+ struct lpass_macro *pds;
+
+@@ -467,9 +468,9 @@ static int va_macro_mclk_event(struct snd_soc_dapm_widget *w,
+
+ switch (event) {
+ case SND_SOC_DAPM_PRE_PMU:
+- return va_macro_mclk_enable(va, true);
++ return clk_prepare_enable(va->fsgen);
+ case SND_SOC_DAPM_POST_PMD:
+- return va_macro_mclk_enable(va, false);
++ clk_disable_unprepare(va->fsgen);
+ }
+
+ return 0;
+@@ -1473,6 +1474,12 @@ static int va_macro_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_clkout;
+
++ va->fsgen = clk_hw_get_clk(&va->hw, "fsgen");
++ if (IS_ERR(va->fsgen)) {
++ ret = PTR_ERR(va->fsgen);
++ goto err_clkout;
++ }
++
+ ret = devm_snd_soc_register_component(dev, &va_macro_component_drv,
+ va_macro_dais,
+ ARRAY_SIZE(va_macro_dais));
+--
+2.35.1
+
--- /dev/null
+From 1e0bbb787d40fd871b855b8be699abd40af32641 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Jul 2022 14:41:48 +0200
+Subject: ASoC: Intel: avs: Set max DMA segment size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+
+[ Upstream commit 8544eebc78c96f1834a46b26ade3e7ebe785d10c ]
+
+Apparently it is possible for code to allocate large buffers which may
+cause warnings as reported in [1]. This was fixed for HDA, SOF and
+skylake in patchset [2], fix it also for avs driver.
+
+[1] https://github.com/thesofproject/linux/issues/3430
+[2] https://lore.kernel.org/all/20220215132756.31236-1-tiwai@suse.de/
+
+Signed-off-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/20220707124153.1858249-8-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/avs/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/intel/avs/core.c b/sound/soc/intel/avs/core.c
+index 3a0997c3af2b..cf373969bb69 100644
+--- a/sound/soc/intel/avs/core.c
++++ b/sound/soc/intel/avs/core.c
+@@ -445,6 +445,7 @@ static int avs_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ dma_set_mask(dev, DMA_BIT_MASK(32));
+ dma_set_coherent_mask(dev, DMA_BIT_MASK(32));
+ }
++ dma_set_max_seg_size(dev, UINT_MAX);
+
+ ret = avs_hdac_bus_init_streams(bus);
+ if (ret < 0) {
+--
+2.35.1
+
--- /dev/null
+From 79cbc64f5bbda051dbda205928dd67c783f31661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jul 2022 14:49:02 -0500
+Subject: ASoC: Intel: sof_es8336: Fix GPIO quirks set via module option
+
+From: Andrey Turkin <andrey.turkin@gmail.com>
+
+[ Upstream commit 5e60f1cfb830342304200437121f440b72b54f54 ]
+
+The two GPIO quirk bits only affected actual GPIO selection
+when set by the quirks table. They were reported as being
+in effect when set via module options but actually did nothing.
+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Andrey Turkin <andrey.turkin@gmail.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220725194909.145418-4-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 23d03e0f7759..4d0c361fc277 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -77,8 +77,6 @@ static const struct acpi_gpio_mapping acpi_enable_both_gpios_rev_order[] = {
+ { }
+ };
+
+-static const struct acpi_gpio_mapping *gpio_mapping = acpi_speakers_enable_gpio0;
+-
+ static void log_quirks(struct device *dev)
+ {
+ dev_info(dev, "quirk mask %#lx\n", quirk);
+@@ -272,15 +270,6 @@ static int sof_es8336_quirk_cb(const struct dmi_system_id *id)
+ {
+ quirk = (unsigned long)id->driver_data;
+
+- if (quirk & SOF_ES8336_HEADPHONE_GPIO) {
+- if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK)
+- gpio_mapping = acpi_enable_both_gpios;
+- else
+- gpio_mapping = acpi_enable_both_gpios_rev_order;
+- } else if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK) {
+- gpio_mapping = acpi_speakers_enable_gpio1;
+- }
+-
+ return 1;
+ }
+
+@@ -529,6 +518,7 @@ static int sof_es8336_probe(struct platform_device *pdev)
+ struct acpi_device *adev;
+ struct snd_soc_dai_link *dai_links;
+ struct device *codec_dev;
++ const struct acpi_gpio_mapping *gpio_mapping;
+ unsigned int cnt = 0;
+ int dmic_be_num = 0;
+ int hdmi_num = 3;
+@@ -635,6 +625,17 @@ static int sof_es8336_probe(struct platform_device *pdev)
+ }
+
+ /* get speaker enable GPIO */
++ if (quirk & SOF_ES8336_HEADPHONE_GPIO) {
++ if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK)
++ gpio_mapping = acpi_enable_both_gpios;
++ else
++ gpio_mapping = acpi_enable_both_gpios_rev_order;
++ } else if (quirk & SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK) {
++ gpio_mapping = acpi_speakers_enable_gpio1;
++ } else {
++ gpio_mapping = acpi_speakers_enable_gpio0;
++ }
++
+ ret = devm_acpi_dev_add_driver_gpios(codec_dev, gpio_mapping);
+ if (ret)
+ dev_warn(codec_dev, "unable to add GPIO mapping table\n");
+--
+2.35.1
+
--- /dev/null
+From ee53231c52f69c2eb5397f142cef2100ef5c2440 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jul 2022 14:49:03 -0500
+Subject: ASoC: Intel: sof_es8336: ignore GpioInt when looking for
+ speaker/headset GPIO lines
+
+From: Andrey Turkin <andrey.turkin@gmail.com>
+
+[ Upstream commit 751e77011f7a43a204bf2a5d02fbf5f8219bc531 ]
+
+This fixes speaker GPIO detection on machines those ACPI tables
+list their jack detection GpioInt before output GpioIo.
+GpioInt entry can never be the speaker/headphone amplifier control
+so it makes sense to only look for GpioIo entries when looking for them.
+
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Andrey Turkin <andrey.turkin@gmail.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220725194909.145418-5-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_es8336.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
+index 4d0c361fc277..d70d8255b8c7 100644
+--- a/sound/soc/intel/boards/sof_es8336.c
++++ b/sound/soc/intel/boards/sof_es8336.c
+@@ -57,23 +57,23 @@ static const struct acpi_gpio_params enable_gpio0 = { 0, 0, true };
+ static const struct acpi_gpio_params enable_gpio1 = { 1, 0, true };
+
+ static const struct acpi_gpio_mapping acpi_speakers_enable_gpio0[] = {
+- { "speakers-enable-gpios", &enable_gpio0, 1 },
++ { "speakers-enable-gpios", &enable_gpio0, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO },
+ { }
+ };
+
+ static const struct acpi_gpio_mapping acpi_speakers_enable_gpio1[] = {
+- { "speakers-enable-gpios", &enable_gpio1, 1 },
++ { "speakers-enable-gpios", &enable_gpio1, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO },
+ };
+
+ static const struct acpi_gpio_mapping acpi_enable_both_gpios[] = {
+- { "speakers-enable-gpios", &enable_gpio0, 1 },
+- { "headphone-enable-gpios", &enable_gpio1, 1 },
++ { "speakers-enable-gpios", &enable_gpio0, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO },
++ { "headphone-enable-gpios", &enable_gpio1, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO },
+ { }
+ };
+
+ static const struct acpi_gpio_mapping acpi_enable_both_gpios_rev_order[] = {
+- { "speakers-enable-gpios", &enable_gpio1, 1 },
+- { "headphone-enable-gpios", &enable_gpio0, 1 },
++ { "speakers-enable-gpios", &enable_gpio1, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO },
++ { "headphone-enable-gpios", &enable_gpio0, 1, ACPI_GPIO_QUIRK_ONLY_GPIOIO },
+ { }
+ };
+
+--
+2.35.1
+
--- /dev/null
+From c5fba0e46cac996f7aaeb279b63a998d44989758 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jul 2022 14:49:09 -0500
+Subject: ASoC: Intel: sof_nau8825: Move quirk check to the front in late probe
+
+From: Yong Zhi <yong.zhi@intel.com>
+
+[ Upstream commit 5b56db90bbaf9d8581e5e6268727d8ad706555e4 ]
+
+The sof_rt5682_quirk check was placed in the middle of
+hdmi handling code, move it to the front to be consistent
+with sof_rt5682.c/sof_card_late_probe().
+
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Yong Zhi <yong.zhi@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220725194909.145418-11-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_nau8825.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_nau8825.c b/sound/soc/intel/boards/sof_nau8825.c
+index 97dcd204a246..9b3a2ff4d9cd 100644
+--- a/sound/soc/intel/boards/sof_nau8825.c
++++ b/sound/soc/intel/boards/sof_nau8825.c
+@@ -177,11 +177,6 @@ static int sof_card_late_probe(struct snd_soc_card *card)
+ struct sof_hdmi_pcm *pcm;
+ int err;
+
+- if (list_empty(&ctx->hdmi_pcm_list))
+- return -EINVAL;
+-
+- pcm = list_first_entry(&ctx->hdmi_pcm_list, struct sof_hdmi_pcm, head);
+-
+ if (sof_nau8825_quirk & SOF_MAX98373_SPEAKER_AMP_PRESENT) {
+ /* Disable Left and Right Spk pin after boot */
+ snd_soc_dapm_disable_pin(dapm, "Left Spk");
+@@ -191,6 +186,11 @@ static int sof_card_late_probe(struct snd_soc_card *card)
+ return err;
+ }
+
++ if (list_empty(&ctx->hdmi_pcm_list))
++ return -EINVAL;
++
++ pcm = list_first_entry(&ctx->hdmi_pcm_list, struct sof_hdmi_pcm, head);
++
+ return hda_dsp_hdmi_build_controls(card, pcm->codec_dai->component);
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 5281dd2aea5ee8ebaadcf2c5b17a16081535ef83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Jul 2022 15:04:05 +0100
+Subject: ASoC: nau8821: Don't unconditionally free interrupt
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit 2d86cef353b8f3d20b16f8c5615742fd6938c801 ]
+
+The remove() operation unconditionally frees the interrupt for the device
+but we may not actually have an interrupt so there might be nothing to
+free. Since the interrupt is requested after all other resources we don't
+need the explicit free anyway, unwinding is guaranteed to be safe, so just
+delete the remove() function and let devm take care of things.
+
+Reported-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Tested-by: Zheyu Ma <zheyuma97@gmail.com>
+Link: https://lore.kernel.org/r/20220718140405.57233-1-broonie@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8821.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8821.c b/sound/soc/codecs/nau8821.c
+index ce4e7f46bb06..e078d2ffb3f6 100644
+--- a/sound/soc/codecs/nau8821.c
++++ b/sound/soc/codecs/nau8821.c
+@@ -1665,15 +1665,6 @@ static int nau8821_i2c_probe(struct i2c_client *i2c)
+ return ret;
+ }
+
+-static int nau8821_i2c_remove(struct i2c_client *i2c_client)
+-{
+- struct nau8821 *nau8821 = i2c_get_clientdata(i2c_client);
+-
+- devm_free_irq(nau8821->dev, nau8821->irq, nau8821);
+-
+- return 0;
+-}
+-
+ static const struct i2c_device_id nau8821_i2c_ids[] = {
+ { "nau8821", 0 },
+ { }
+@@ -1703,7 +1694,6 @@ static struct i2c_driver nau8821_driver = {
+ .acpi_match_table = ACPI_PTR(nau8821_acpi_match),
+ },
+ .probe_new = nau8821_i2c_probe,
+- .remove = nau8821_i2c_remove,
+ .id_table = nau8821_i2c_ids,
+ };
+ module_i2c_driver(nau8821_driver);
+--
+2.35.1
+
--- /dev/null
+From 1a3c94cf88cc8638477afea2efb4ac0edd2a165b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jul 2022 06:28:15 +0000
+Subject: ASoC: rsnd: care default case on rsnd_ssiu_busif_err_irq_ctrl()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit ef30911d3c39fd57884c348c29b9cbff88def155 ]
+
+Before, ssiu.c didn't care SSI5-8, thus,
+commit b1384d4c95088d0 ("ASoC: rsnd: care default case on
+rsnd_ssiu_busif_err_status_clear()") cares it for status clear.
+
+But we should care it for error irq handling, too.
+This patch cares it.
+
+Reported-by: Nguyen Bao Nguyen <nguyen.nguyen.yj@renesas.com>
+Reported-by: Nishiyama Kunihiko <kunihiko.nishiyama.dn@renesas.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/871quocio1.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/ssiu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/sh/rcar/ssiu.c b/sound/soc/sh/rcar/ssiu.c
+index 4b8a63e336c7..d7f4646ee029 100644
+--- a/sound/soc/sh/rcar/ssiu.c
++++ b/sound/soc/sh/rcar/ssiu.c
+@@ -67,6 +67,8 @@ static void rsnd_ssiu_busif_err_irq_ctrl(struct rsnd_mod *mod, int enable)
+ shift = 1;
+ offset = 1;
+ break;
++ default:
++ return;
+ }
+
+ for (i = 0; i < 4; i++) {
+--
+2.35.1
+
--- /dev/null
+From 3850543fee9c9de2e8472fd4aa734a0e09709496 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 15:23:55 +0300
+Subject: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit acacd9eefd0def5a83244d88e5483b5f38ee7287 ]
+
+It is not yet clear, but it is possible to create a firmware so broken
+that it will send a reply message before a FW_READY message (it is not
+yet clear if FW_READY will arrive later).
+Since the reply_data is allocated only after the FW_READY message, this
+will lead to a NULL pointer dereference if not filtered out.
+
+The issue was reported with IPC4 firmware but the same condition is present
+for IPC3.
+
+Reported-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220712122357.31282-2-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/cnl.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/sound/soc/sof/intel/cnl.c b/sound/soc/sof/intel/cnl.c
+index cd6e5f8a5eb4..6c98f65635fc 100644
+--- a/sound/soc/sof/intel/cnl.c
++++ b/sound/soc/sof/intel/cnl.c
+@@ -60,17 +60,23 @@ irqreturn_t cnl_ipc4_irq_thread(int irq, void *context)
+
+ if (primary & SOF_IPC4_MSG_DIR_MASK) {
+ /* Reply received */
+- struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data;
++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {
++ struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data;
+
+- data->primary = primary;
+- data->extension = extension;
++ data->primary = primary;
++ data->extension = extension;
+
+- spin_lock_irq(&sdev->ipc_lock);
++ spin_lock_irq(&sdev->ipc_lock);
+
+- snd_sof_ipc_get_reply(sdev);
+- snd_sof_ipc_reply(sdev, data->primary);
++ snd_sof_ipc_get_reply(sdev);
++ snd_sof_ipc_reply(sdev, data->primary);
+
+- spin_unlock_irq(&sdev->ipc_lock);
++ spin_unlock_irq(&sdev->ipc_lock);
++ } else {
++ dev_dbg_ratelimited(sdev->dev,
++ "IPC reply before FW_READY: %#x|%#x\n",
++ primary, extension);
++ }
+ } else {
+ /* Notification received */
+ notification_data.primary = primary;
+@@ -124,15 +130,20 @@ irqreturn_t cnl_ipc_irq_thread(int irq, void *context)
+ CNL_DSP_REG_HIPCCTL,
+ CNL_DSP_REG_HIPCCTL_DONE, 0);
+
+- spin_lock_irq(&sdev->ipc_lock);
++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {
++ spin_lock_irq(&sdev->ipc_lock);
+
+- /* handle immediate reply from DSP core */
+- hda_dsp_ipc_get_reply(sdev);
+- snd_sof_ipc_reply(sdev, msg);
++ /* handle immediate reply from DSP core */
++ hda_dsp_ipc_get_reply(sdev);
++ snd_sof_ipc_reply(sdev, msg);
+
+- cnl_ipc_dsp_done(sdev);
++ cnl_ipc_dsp_done(sdev);
+
+- spin_unlock_irq(&sdev->ipc_lock);
++ spin_unlock_irq(&sdev->ipc_lock);
++ } else {
++ dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_READY: %#x\n",
++ msg);
++ }
+
+ ipc_irq = true;
+ }
+--
+2.35.1
+
--- /dev/null
+From 7b3e48bab2a5e30e324d570bebb2ab29155ceb30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jul 2022 14:53:41 -0500
+Subject: ASoC: SOF: Intel: hda: add sanity check on SSP index reported by NHLT
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit e51699505042fb365df3a0ce68b850ccd9ad0108 ]
+
+We should have a limited trust in the BIOS and verify that the SSP
+index reported in NHLT is valid for each platform.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Link: https://lore.kernel.org/r/20220725195343.145603-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c
+index ed495b7ad1a9..17f2f3a982c3 100644
+--- a/sound/soc/sof/intel/hda.c
++++ b/sound/soc/sof/intel/hda.c
+@@ -1395,6 +1395,7 @@ struct snd_soc_acpi_mach *hda_machine_select(struct snd_sof_dev *sdev)
+
+ if (mach->tplg_quirk_mask & SND_SOC_ACPI_TPLG_INTEL_SSP_NUMBER &&
+ mach->mach_params.i2s_link_mask) {
++ const struct sof_intel_dsp_desc *chip = get_chip_info(sdev->pdata);
+ int ssp_num;
+
+ if (hweight_long(mach->mach_params.i2s_link_mask) > 1 &&
+@@ -1404,6 +1405,12 @@ struct snd_soc_acpi_mach *hda_machine_select(struct snd_sof_dev *sdev)
+ /* fls returns 1-based results, SSPs indices are 0-based */
+ ssp_num = fls(mach->mach_params.i2s_link_mask) - 1;
+
++ if (ssp_num >= chip->ssp_count) {
++ dev_err(sdev->dev, "Invalid SSP %d, max on this platform is %d\n",
++ ssp_num, chip->ssp_count);
++ return NULL;
++ }
++
+ tplg_filename = devm_kasprintf(sdev->dev, GFP_KERNEL,
+ "%s%s%d",
+ sof_pdata->tplg_filename,
+--
+2.35.1
+
--- /dev/null
+From a0292afc0874b5eafad38275e5d4ff8f69c3ba3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 15:23:56 +0300
+Subject: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware
+ boot
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 499cc881b09c8283ab5e75b0d6d21cb427722161 ]
+
+It is not yet clear, but it is possible to create a firmware so broken
+that it will send a reply message before a FW_READY message (it is not
+yet clear if FW_READY will arrive later).
+Since the reply_data is allocated only after the FW_READY message, this
+will lead to a NULL pointer dereference if not filtered out.
+
+The issue was reported with IPC4 firmware but the same condition is present
+for IPC3.
+
+Reported-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20220712122357.31282-3-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-ipc.c | 39 ++++++++++++++++++++++-------------
+ 1 file changed, 25 insertions(+), 14 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-ipc.c b/sound/soc/sof/intel/hda-ipc.c
+index f08011249955..65e688f749ea 100644
+--- a/sound/soc/sof/intel/hda-ipc.c
++++ b/sound/soc/sof/intel/hda-ipc.c
+@@ -148,17 +148,23 @@ irqreturn_t hda_dsp_ipc4_irq_thread(int irq, void *context)
+
+ if (primary & SOF_IPC4_MSG_DIR_MASK) {
+ /* Reply received */
+- struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data;
++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {
++ struct sof_ipc4_msg *data = sdev->ipc->msg.reply_data;
+
+- data->primary = primary;
+- data->extension = extension;
++ data->primary = primary;
++ data->extension = extension;
+
+- spin_lock_irq(&sdev->ipc_lock);
++ spin_lock_irq(&sdev->ipc_lock);
+
+- snd_sof_ipc_get_reply(sdev);
+- snd_sof_ipc_reply(sdev, data->primary);
++ snd_sof_ipc_get_reply(sdev);
++ snd_sof_ipc_reply(sdev, data->primary);
+
+- spin_unlock_irq(&sdev->ipc_lock);
++ spin_unlock_irq(&sdev->ipc_lock);
++ } else {
++ dev_dbg_ratelimited(sdev->dev,
++ "IPC reply before FW_READY: %#x|%#x\n",
++ primary, extension);
++ }
+ } else {
+ /* Notification received */
+
+@@ -225,16 +231,21 @@ irqreturn_t hda_dsp_ipc_irq_thread(int irq, void *context)
+ * place, the message might not yet be marked as expecting a
+ * reply.
+ */
+- spin_lock_irq(&sdev->ipc_lock);
++ if (likely(sdev->fw_state == SOF_FW_BOOT_COMPLETE)) {
++ spin_lock_irq(&sdev->ipc_lock);
+
+- /* handle immediate reply from DSP core */
+- hda_dsp_ipc_get_reply(sdev);
+- snd_sof_ipc_reply(sdev, msg);
++ /* handle immediate reply from DSP core */
++ hda_dsp_ipc_get_reply(sdev);
++ snd_sof_ipc_reply(sdev, msg);
+
+- /* set the done bit */
+- hda_dsp_ipc_dsp_done(sdev);
++ /* set the done bit */
++ hda_dsp_ipc_dsp_done(sdev);
+
+- spin_unlock_irq(&sdev->ipc_lock);
++ spin_unlock_irq(&sdev->ipc_lock);
++ } else {
++ dev_dbg_ratelimited(sdev->dev, "IPC reply before FW_READY: %#x\n",
++ msg);
++ }
+
+ ipc_irq = true;
+ }
+--
+2.35.1
+
--- /dev/null
+From c0c6f40d13f12519a476f3aea9c86459d527e83e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 16:10:22 +0300
+Subject: ASoC: SOF: sof-client-probes: Only load the driver if IPC3 is used
+
+From: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+
+[ Upstream commit 9b93eda355089b36482f7a2f134bdd24be70f907 ]
+
+The current implementation of probes only supports IPC3 and should not be
+loaded for other IPC implementation.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Link: https://lore.kernel.org/r/20220712131022.1124-1-peter.ujfalusi@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/sof-client-probes.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/soc/sof/sof-client-probes.c b/sound/soc/sof/sof-client-probes.c
+index 34e6bd356e71..60e4250fac87 100644
+--- a/sound/soc/sof/sof-client-probes.c
++++ b/sound/soc/sof/sof-client-probes.c
+@@ -693,6 +693,10 @@ static int sof_probes_client_probe(struct auxiliary_device *auxdev,
+ if (!sof_probes_enabled)
+ return -ENXIO;
+
++ /* only ipc3 is supported */
++ if (sof_client_get_ipc_type(cdev) != SOF_IPC)
++ return -ENXIO;
++
+ if (!dev->platform_data) {
+ dev_err(dev, "missing platform data\n");
+ return -ENODEV;
+--
+2.35.1
+
--- /dev/null
+From e03ac36a8d597b99e33f6423b2df914415a5673f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 09:27:11 +0300
+Subject: clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
+
+From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+
+[ Upstream commit 94bed9bb05c7850ff5d80b87cc29004901f37956 ]
+
+After merging lucid and trion pll functions in commit 0b01489475c6
+("clk: qcom: clk-alpha-pll: same regs and ops for trion and lucid")
+the function clk_trion_pll_configure() is left with an old description
+header, which results in a W=2 compile time warning, fix it.
+
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220701062711.2757855-1-vladimir.zapolskiy@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-alpha-pll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c
+index 4406cf609aae..288692f0ea39 100644
+--- a/drivers/clk/qcom/clk-alpha-pll.c
++++ b/drivers/clk/qcom/clk-alpha-pll.c
+@@ -1439,7 +1439,7 @@ const struct clk_ops clk_alpha_pll_postdiv_fabia_ops = {
+ EXPORT_SYMBOL_GPL(clk_alpha_pll_postdiv_fabia_ops);
+
+ /**
+- * clk_lucid_pll_configure - configure the lucid pll
++ * clk_trion_pll_configure - configure the trion pll
+ *
+ * @pll: clk alpha pll
+ * @regmap: register map
+--
+2.35.1
+
--- /dev/null
+From 5f8256e3c75dc67393372bee5586d2432276776f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 May 2022 23:00:47 +0200
+Subject: clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
+
+From: Robert Marko <robimarko@gmail.com>
+
+[ Upstream commit 1bf7305e79aab095196131bdc87a97796e0e3fac ]
+
+Once the usb sleep clocks are disabled, clock framework is trying to
+disable the sleep clock source also.
+
+However, it seems that it cannot be disabled and trying to do so produces:
+[ 245.436390] ------------[ cut here ]------------
+[ 245.441233] gcc_sleep_clk_src status stuck at 'on'
+[ 245.441254] WARNING: CPU: 2 PID: 223 at clk_branch_wait+0x130/0x140
+[ 245.450435] Modules linked in: xhci_plat_hcd xhci_hcd dwc3 dwc3_qcom leds_gpio
+[ 245.456601] CPU: 2 PID: 223 Comm: sh Not tainted 5.18.0-rc4 #215
+[ 245.463889] Hardware name: Xiaomi AX9000 (DT)
+[ 245.470050] pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+[ 245.474307] pc : clk_branch_wait+0x130/0x140
+[ 245.481073] lr : clk_branch_wait+0x130/0x140
+[ 245.485588] sp : ffffffc009f2bad0
+[ 245.489838] x29: ffffffc009f2bad0 x28: ffffff8003e6c800 x27: 0000000000000000
+[ 245.493057] x26: 0000000000000000 x25: 0000000000000000 x24: ffffff800226ef20
+[ 245.500175] x23: ffffffc0089ff550 x22: 0000000000000000 x21: ffffffc008476ad0
+[ 245.507294] x20: 0000000000000000 x19: ffffffc00965ac70 x18: fffffffffffc51a7
+[ 245.514413] x17: 68702e3030303837 x16: 3a6d726f6674616c x15: ffffffc089f2b777
+[ 245.521531] x14: ffffffc0095c9d18 x13: 0000000000000129 x12: 0000000000000129
+[ 245.528649] x11: 00000000ffffffea x10: ffffffc009621d18 x9 : 0000000000000001
+[ 245.535767] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : 0000000000000001
+[ 245.542885] x5 : ffffff803fdca6d8 x4 : 0000000000000000 x3 : 0000000000000027
+[ 245.550002] x2 : 0000000000000027 x1 : 0000000000000023 x0 : 0000000000000026
+[ 245.557122] Call trace:
+[ 245.564229] clk_branch_wait+0x130/0x140
+[ 245.566490] clk_branch2_disable+0x2c/0x40
+[ 245.570656] clk_core_disable+0x60/0xb0
+[ 245.574561] clk_core_disable+0x68/0xb0
+[ 245.578293] clk_disable+0x30/0x50
+[ 245.582113] dwc3_qcom_remove+0x60/0xc0 [dwc3_qcom]
+[ 245.585588] platform_remove+0x28/0x60
+[ 245.590361] device_remove+0x4c/0x80
+[ 245.594179] device_release_driver_internal+0x1dc/0x230
+[ 245.597914] device_driver_detach+0x18/0x30
+[ 245.602861] unbind_store+0xec/0x110
+[ 245.607027] drv_attr_store+0x24/0x40
+[ 245.610847] sysfs_kf_write+0x44/0x60
+[ 245.614405] kernfs_fop_write_iter+0x128/0x1c0
+[ 245.618052] new_sync_write+0xc0/0x130
+[ 245.622391] vfs_write+0x1d4/0x2a0
+[ 245.626123] ksys_write+0x58/0xe0
+[ 245.629508] __arm64_sys_write+0x1c/0x30
+[ 245.632895] invoke_syscall.constprop.0+0x5c/0x110
+[ 245.636890] do_el0_svc+0xa0/0x150
+[ 245.641488] el0_svc+0x18/0x60
+[ 245.644872] el0t_64_sync_handler+0xa4/0x130
+[ 245.647914] el0t_64_sync+0x174/0x178
+[ 245.652340] ---[ end trace 0000000000000000 ]---
+
+So, add CLK_IS_CRITICAL flag to the clock so that the kernel won't try
+to disable the sleep clock.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20220515210048.483898-10-robimarko@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-ipq8074.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c
+index 2c2ecfc5e61f..d6d5defb82c9 100644
+--- a/drivers/clk/qcom/gcc-ipq8074.c
++++ b/drivers/clk/qcom/gcc-ipq8074.c
+@@ -662,6 +662,7 @@ static struct clk_branch gcc_sleep_clk_src = {
+ },
+ .num_parents = 1,
+ .ops = &clk_branch2_ops,
++ .flags = CLK_IS_CRITICAL,
+ },
+ },
+ };
+--
+2.35.1
+
--- /dev/null
+From 7058b3526542083de4810ad1af11677243bf8efb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jun 2022 09:43:06 +0300
+Subject: clk: ti: Stop using legacy clkctrl names for omap4 and 5
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 255584b138343d4a28c6d25bd82d04b09460d672 ]
+
+With the addition of clock-output-names, we can now unify the internal
+clock naming for omap4 and 5 to follow the other TI SoCs.
+
+We are still using legacy clkctrl names for omap4 and 5 based on the clock
+manager name which is wrong. Instead, we want to use the clkctrl clock
+based naming.
+
+We must now also drop the legacy TI_CLK_CLKCTRL_COMPAT quirk for the
+clkctrl clock.
+
+This change will allow further devicetree warning cleanup as already
+done for am3/4 and dra7.
+
+Cc: linux-clk@vger.kernel.org
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Tero Kristo <kristo@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lore.kernel.org/r/20220615064306.22254-1-tony@atomide.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-44xx.c | 210 +++++++++++++++++++-------------------
+ drivers/clk/ti/clk-54xx.c | 160 ++++++++++++++---------------
+ drivers/clk/ti/clkctrl.c | 4 -
+ 3 files changed, 185 insertions(+), 189 deletions(-)
+
+diff --git a/drivers/clk/ti/clk-44xx.c b/drivers/clk/ti/clk-44xx.c
+index d078e5d73ed9..868bc7af21b0 100644
+--- a/drivers/clk/ti/clk-44xx.c
++++ b/drivers/clk/ti/clk-44xx.c
+@@ -56,7 +56,7 @@ static const struct omap_clkctrl_bit_data omap4_aess_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_func_dmic_abe_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0018:26",
++ "abe-clkctrl:0018:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -76,7 +76,7 @@ static const struct omap_clkctrl_bit_data omap4_dmic_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_func_mcasp_abe_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0020:26",
++ "abe-clkctrl:0020:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -89,7 +89,7 @@ static const struct omap_clkctrl_bit_data omap4_mcasp_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_func_mcbsp1_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0028:26",
++ "abe-clkctrl:0028:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -102,7 +102,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp1_bit_data[] __initconst =
+ };
+
+ static const char * const omap4_func_mcbsp2_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0030:26",
++ "abe-clkctrl:0030:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -115,7 +115,7 @@ static const struct omap_clkctrl_bit_data omap4_mcbsp2_bit_data[] __initconst =
+ };
+
+ static const char * const omap4_func_mcbsp3_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0038:26",
++ "abe-clkctrl:0038:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -183,18 +183,18 @@ static const struct omap_clkctrl_bit_data omap4_timer8_bit_data[] __initconst =
+
+ static const struct omap_clkctrl_reg_data omap4_abe_clkctrl_regs[] __initconst = {
+ { OMAP4_L4_ABE_CLKCTRL, NULL, 0, "ocp_abe_iclk" },
+- { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" },
++ { OMAP4_AESS_CLKCTRL, omap4_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" },
+ { OMAP4_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" },
+- { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" },
+- { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe_cm:clk:0020:24" },
+- { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" },
+- { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" },
+- { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" },
+- { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0040:8" },
+- { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" },
+- { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" },
+- { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" },
+- { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" },
++ { OMAP4_DMIC_CLKCTRL, omap4_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" },
++ { OMAP4_MCASP_CLKCTRL, omap4_mcasp_bit_data, CLKF_SW_SUP, "abe-clkctrl:0020:24" },
++ { OMAP4_MCBSP1_CLKCTRL, omap4_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" },
++ { OMAP4_MCBSP2_CLKCTRL, omap4_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" },
++ { OMAP4_MCBSP3_CLKCTRL, omap4_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" },
++ { OMAP4_SLIMBUS1_CLKCTRL, omap4_slimbus1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0040:8" },
++ { OMAP4_TIMER5_CLKCTRL, omap4_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" },
++ { OMAP4_TIMER6_CLKCTRL, omap4_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" },
++ { OMAP4_TIMER7_CLKCTRL, omap4_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" },
++ { OMAP4_TIMER8_CLKCTRL, omap4_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" },
+ { OMAP4_WD_TIMER3_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { 0 },
+ };
+@@ -287,7 +287,7 @@ static const struct omap_clkctrl_bit_data omap4_fdif_bit_data[] __initconst = {
+
+ static const struct omap_clkctrl_reg_data omap4_iss_clkctrl_regs[] __initconst = {
+ { OMAP4_ISS_CLKCTRL, omap4_iss_bit_data, CLKF_SW_SUP, "ducati_clk_mux_ck" },
+- { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss_cm:clk:0008:24" },
++ { OMAP4_FDIF_CLKCTRL, omap4_fdif_bit_data, CLKF_SW_SUP, "iss-clkctrl:0008:24" },
+ { 0 },
+ };
+
+@@ -320,7 +320,7 @@ static const struct omap_clkctrl_bit_data omap4_dss_core_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l3_dss_clkctrl_regs[] __initconst = {
+- { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3_dss_cm:clk:0000:8" },
++ { OMAP4_DSS_CORE_CLKCTRL, omap4_dss_core_bit_data, CLKF_SW_SUP, "l3-dss-clkctrl:0000:8" },
+ { 0 },
+ };
+
+@@ -336,7 +336,7 @@ static const struct omap_clkctrl_bit_data omap4_gpu_bit_data[] __initconst = {
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l3_gfx_clkctrl_regs[] __initconst = {
+- { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3_gfx_cm:clk:0000:24" },
++ { OMAP4_GPU_CLKCTRL, omap4_gpu_bit_data, CLKF_SW_SUP, "l3-gfx-clkctrl:0000:24" },
+ { 0 },
+ };
+
+@@ -372,12 +372,12 @@ static const struct omap_clkctrl_bit_data omap4_hsi_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_usb_host_hs_utmi_p1_clk_parents[] __initconst = {
+- "l3_init_cm:clk:0038:24",
++ "l3-init-clkctrl:0038:24",
+ NULL,
+ };
+
+ static const char * const omap4_usb_host_hs_utmi_p2_clk_parents[] __initconst = {
+- "l3_init_cm:clk:0038:25",
++ "l3-init-clkctrl:0038:25",
+ NULL,
+ };
+
+@@ -418,7 +418,7 @@ static const struct omap_clkctrl_bit_data omap4_usb_host_hs_bit_data[] __initcon
+ };
+
+ static const char * const omap4_usb_otg_hs_xclk_parents[] __initconst = {
+- "l3_init_cm:clk:0040:24",
++ "l3-init-clkctrl:0040:24",
+ NULL,
+ };
+
+@@ -452,14 +452,14 @@ static const struct omap_clkctrl_bit_data omap4_ocp2scp_usb_phy_bit_data[] __ini
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l3_init_clkctrl_regs[] __initconst = {
+- { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0008:24" },
+- { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3_init_cm:clk:0010:24" },
+- { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:0018:24" },
++ { OMAP4_MMC1_CLKCTRL, omap4_mmc1_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0008:24" },
++ { OMAP4_MMC2_CLKCTRL, omap4_mmc2_bit_data, CLKF_SW_SUP, "l3-init-clkctrl:0010:24" },
++ { OMAP4_HSI_CLKCTRL, omap4_hsi_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:0018:24" },
+ { OMAP4_USB_HOST_HS_CLKCTRL, omap4_usb_host_hs_bit_data, CLKF_SW_SUP, "init_60m_fclk" },
+ { OMAP4_USB_OTG_HS_CLKCTRL, omap4_usb_otg_hs_bit_data, CLKF_HW_SUP, "l3_div_ck" },
+ { OMAP4_USB_TLL_HS_CLKCTRL, omap4_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_div_ck" },
+ { OMAP4_USB_HOST_FS_CLKCTRL, NULL, CLKF_SW_SUP, "func_48mc_fclk" },
+- { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3_init_cm:clk:00c0:8" },
++ { OMAP4_OCP2SCP_USB_PHY_CLKCTRL, omap4_ocp2scp_usb_phy_bit_data, CLKF_HW_SUP, "l3-init-clkctrl:00c0:8" },
+ { 0 },
+ };
+
+@@ -530,7 +530,7 @@ static const struct omap_clkctrl_bit_data omap4_gpio6_bit_data[] __initconst = {
+ };
+
+ static const char * const omap4_per_mcbsp4_gfclk_parents[] __initconst = {
+- "l4_per_cm:clk:00c0:26",
++ "l4-per-clkctrl:00c0:26",
+ "pad_clks_ck",
+ NULL,
+ };
+@@ -570,12 +570,12 @@ static const struct omap_clkctrl_bit_data omap4_slimbus2_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initconst = {
+- { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0008:24" },
+- { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0010:24" },
+- { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0018:24" },
+- { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0020:24" },
+- { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0028:24" },
+- { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0030:24" },
++ { OMAP4_TIMER10_CLKCTRL, omap4_timer10_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0008:24" },
++ { OMAP4_TIMER11_CLKCTRL, omap4_timer11_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0010:24" },
++ { OMAP4_TIMER2_CLKCTRL, omap4_timer2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0018:24" },
++ { OMAP4_TIMER3_CLKCTRL, omap4_timer3_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0020:24" },
++ { OMAP4_TIMER4_CLKCTRL, omap4_timer4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0028:24" },
++ { OMAP4_TIMER9_CLKCTRL, omap4_timer9_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0030:24" },
+ { OMAP4_ELM_CLKCTRL, NULL, 0, "l4_div_ck" },
+ { OMAP4_GPIO2_CLKCTRL, omap4_gpio2_bit_data, CLKF_HW_SUP, "l4_div_ck" },
+ { OMAP4_GPIO3_CLKCTRL, omap4_gpio3_bit_data, CLKF_HW_SUP, "l4_div_ck" },
+@@ -588,14 +588,14 @@ static const struct omap_clkctrl_reg_data omap4_l4_per_clkctrl_regs[] __initcons
+ { OMAP4_I2C3_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" },
+ { OMAP4_I2C4_CLKCTRL, NULL, CLKF_SW_SUP, "func_96m_fclk" },
+ { OMAP4_L4_PER_CLKCTRL, NULL, 0, "l4_div_ck" },
+- { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:00c0:24" },
++ { OMAP4_MCBSP4_CLKCTRL, omap4_mcbsp4_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:00c0:24" },
+ { OMAP4_MCSPI1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MCSPI2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MCSPI3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MCSPI4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MMC3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_MMC4_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+- { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4_per_cm:clk:0118:8" },
++ { OMAP4_SLIMBUS2_CLKCTRL, omap4_slimbus2_bit_data, CLKF_SW_SUP, "l4-per-clkctrl:0118:8" },
+ { OMAP4_UART1_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_UART2_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+ { OMAP4_UART3_CLKCTRL, NULL, CLKF_SW_SUP, "func_48m_fclk" },
+@@ -630,7 +630,7 @@ static const struct omap_clkctrl_reg_data omap4_l4_wkup_clkctrl_regs[] __initcon
+ { OMAP4_L4_WKUP_CLKCTRL, NULL, 0, "l4_wkup_clk_mux_ck" },
+ { OMAP4_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { OMAP4_GPIO1_CLKCTRL, omap4_gpio1_bit_data, CLKF_HW_SUP, "l4_wkup_clk_mux_ck" },
+- { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4_wkup_cm:clk:0020:24" },
++ { OMAP4_TIMER1_CLKCTRL, omap4_timer1_bit_data, CLKF_SW_SUP, "l4-wkup-clkctrl:0020:24" },
+ { OMAP4_COUNTER_32K_CLKCTRL, NULL, 0, "sys_32k_ck" },
+ { OMAP4_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { 0 },
+@@ -644,7 +644,7 @@ static const char * const omap4_pmd_stm_clock_mux_ck_parents[] __initconst = {
+ };
+
+ static const char * const omap4_trace_clk_div_div_ck_parents[] __initconst = {
+- "emu_sys_cm:clk:0000:22",
++ "emu-sys-clkctrl:0000:22",
+ NULL,
+ };
+
+@@ -662,7 +662,7 @@ static const struct omap_clkctrl_div_data omap4_trace_clk_div_div_ck_data __init
+ };
+
+ static const char * const omap4_stm_clk_div_ck_parents[] __initconst = {
+- "emu_sys_cm:clk:0000:20",
++ "emu-sys-clkctrl:0000:20",
+ NULL,
+ };
+
+@@ -716,73 +716,73 @@ static struct ti_dt_clk omap44xx_clks[] = {
+ * hwmod support. Once hwmod is removed, these can be removed
+ * also.
+ */
+- DT_CLK(NULL, "aess_fclk", "abe_cm:0008:24"),
+- DT_CLK(NULL, "cm2_dm10_mux", "l4_per_cm:0008:24"),
+- DT_CLK(NULL, "cm2_dm11_mux", "l4_per_cm:0010:24"),
+- DT_CLK(NULL, "cm2_dm2_mux", "l4_per_cm:0018:24"),
+- DT_CLK(NULL, "cm2_dm3_mux", "l4_per_cm:0020:24"),
+- DT_CLK(NULL, "cm2_dm4_mux", "l4_per_cm:0028:24"),
+- DT_CLK(NULL, "cm2_dm9_mux", "l4_per_cm:0030:24"),
+- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"),
+- DT_CLK(NULL, "dmt1_clk_mux", "l4_wkup_cm:0020:24"),
+- DT_CLK(NULL, "dss_48mhz_clk", "l3_dss_cm:0000:9"),
+- DT_CLK(NULL, "dss_dss_clk", "l3_dss_cm:0000:8"),
+- DT_CLK(NULL, "dss_sys_clk", "l3_dss_cm:0000:10"),
+- DT_CLK(NULL, "dss_tv_clk", "l3_dss_cm:0000:11"),
+- DT_CLK(NULL, "fdif_fck", "iss_cm:0008:24"),
+- DT_CLK(NULL, "func_dmic_abe_gfclk", "abe_cm:0018:24"),
+- DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe_cm:0020:24"),
+- DT_CLK(NULL, "func_mcbsp1_gfclk", "abe_cm:0028:24"),
+- DT_CLK(NULL, "func_mcbsp2_gfclk", "abe_cm:0030:24"),
+- DT_CLK(NULL, "func_mcbsp3_gfclk", "abe_cm:0038:24"),
+- DT_CLK(NULL, "gpio1_dbclk", "l4_wkup_cm:0018:8"),
+- DT_CLK(NULL, "gpio2_dbclk", "l4_per_cm:0040:8"),
+- DT_CLK(NULL, "gpio3_dbclk", "l4_per_cm:0048:8"),
+- DT_CLK(NULL, "gpio4_dbclk", "l4_per_cm:0050:8"),
+- DT_CLK(NULL, "gpio5_dbclk", "l4_per_cm:0058:8"),
+- DT_CLK(NULL, "gpio6_dbclk", "l4_per_cm:0060:8"),
+- DT_CLK(NULL, "hsi_fck", "l3_init_cm:0018:24"),
+- DT_CLK(NULL, "hsmmc1_fclk", "l3_init_cm:0008:24"),
+- DT_CLK(NULL, "hsmmc2_fclk", "l3_init_cm:0010:24"),
+- DT_CLK(NULL, "iss_ctrlclk", "iss_cm:0000:8"),
+- DT_CLK(NULL, "mcasp_sync_mux_ck", "abe_cm:0020:26"),
+- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"),
+- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"),
+- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"),
+- DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4_per_cm:00c0:26"),
+- DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3_init_cm:00c0:8"),
+- DT_CLK(NULL, "otg_60m_gfclk", "l3_init_cm:0040:24"),
+- DT_CLK(NULL, "per_mcbsp4_gfclk", "l4_per_cm:00c0:24"),
+- DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu_sys_cm:0000:20"),
+- DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu_sys_cm:0000:22"),
+- DT_CLK(NULL, "sgx_clk_mux", "l3_gfx_cm:0000:24"),
+- DT_CLK(NULL, "slimbus1_fclk_0", "abe_cm:0040:8"),
+- DT_CLK(NULL, "slimbus1_fclk_1", "abe_cm:0040:9"),
+- DT_CLK(NULL, "slimbus1_fclk_2", "abe_cm:0040:10"),
+- DT_CLK(NULL, "slimbus1_slimbus_clk", "abe_cm:0040:11"),
+- DT_CLK(NULL, "slimbus2_fclk_0", "l4_per_cm:0118:8"),
+- DT_CLK(NULL, "slimbus2_fclk_1", "l4_per_cm:0118:9"),
+- DT_CLK(NULL, "slimbus2_slimbus_clk", "l4_per_cm:0118:10"),
+- DT_CLK(NULL, "stm_clk_div_ck", "emu_sys_cm:0000:27"),
+- DT_CLK(NULL, "timer5_sync_mux", "abe_cm:0048:24"),
+- DT_CLK(NULL, "timer6_sync_mux", "abe_cm:0050:24"),
+- DT_CLK(NULL, "timer7_sync_mux", "abe_cm:0058:24"),
+- DT_CLK(NULL, "timer8_sync_mux", "abe_cm:0060:24"),
+- DT_CLK(NULL, "trace_clk_div_div_ck", "emu_sys_cm:0000:24"),
+- DT_CLK(NULL, "usb_host_hs_func48mclk", "l3_init_cm:0038:15"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3_init_cm:0038:13"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3_init_cm:0038:14"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3_init_cm:0038:11"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3_init_cm:0038:12"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3_init_cm:0038:8"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3_init_cm:0038:9"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init_cm:0038:10"),
+- DT_CLK(NULL, "usb_otg_hs_xclk", "l3_init_cm:0040:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3_init_cm:0048:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3_init_cm:0048:9"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3_init_cm:0048:10"),
+- DT_CLK(NULL, "utmi_p1_gfclk", "l3_init_cm:0038:24"),
+- DT_CLK(NULL, "utmi_p2_gfclk", "l3_init_cm:0038:25"),
++ DT_CLK(NULL, "aess_fclk", "abe-clkctrl:0008:24"),
++ DT_CLK(NULL, "cm2_dm10_mux", "l4-per-clkctrl:0008:24"),
++ DT_CLK(NULL, "cm2_dm11_mux", "l4-per-clkctrl:0010:24"),
++ DT_CLK(NULL, "cm2_dm2_mux", "l4-per-clkctrl:0018:24"),
++ DT_CLK(NULL, "cm2_dm3_mux", "l4-per-clkctrl:0020:24"),
++ DT_CLK(NULL, "cm2_dm4_mux", "l4-per-clkctrl:0028:24"),
++ DT_CLK(NULL, "cm2_dm9_mux", "l4-per-clkctrl:0030:24"),
++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"),
++ DT_CLK(NULL, "dmt1_clk_mux", "l4-wkup-clkctrl:0020:24"),
++ DT_CLK(NULL, "dss_48mhz_clk", "l3-dss-clkctrl:0000:9"),
++ DT_CLK(NULL, "dss_dss_clk", "l3-dss-clkctrl:0000:8"),
++ DT_CLK(NULL, "dss_sys_clk", "l3-dss-clkctrl:0000:10"),
++ DT_CLK(NULL, "dss_tv_clk", "l3-dss-clkctrl:0000:11"),
++ DT_CLK(NULL, "fdif_fck", "iss-clkctrl:0008:24"),
++ DT_CLK(NULL, "func_dmic_abe_gfclk", "abe-clkctrl:0018:24"),
++ DT_CLK(NULL, "func_mcasp_abe_gfclk", "abe-clkctrl:0020:24"),
++ DT_CLK(NULL, "func_mcbsp1_gfclk", "abe-clkctrl:0028:24"),
++ DT_CLK(NULL, "func_mcbsp2_gfclk", "abe-clkctrl:0030:24"),
++ DT_CLK(NULL, "func_mcbsp3_gfclk", "abe-clkctrl:0038:24"),
++ DT_CLK(NULL, "gpio1_dbclk", "l4-wkup-clkctrl:0018:8"),
++ DT_CLK(NULL, "gpio2_dbclk", "l4-per-clkctrl:0040:8"),
++ DT_CLK(NULL, "gpio3_dbclk", "l4-per-clkctrl:0048:8"),
++ DT_CLK(NULL, "gpio4_dbclk", "l4-per-clkctrl:0050:8"),
++ DT_CLK(NULL, "gpio5_dbclk", "l4-per-clkctrl:0058:8"),
++ DT_CLK(NULL, "gpio6_dbclk", "l4-per-clkctrl:0060:8"),
++ DT_CLK(NULL, "hsi_fck", "l3-init-clkctrl:0018:24"),
++ DT_CLK(NULL, "hsmmc1_fclk", "l3-init-clkctrl:0008:24"),
++ DT_CLK(NULL, "hsmmc2_fclk", "l3-init-clkctrl:0010:24"),
++ DT_CLK(NULL, "iss_ctrlclk", "iss-clkctrl:0000:8"),
++ DT_CLK(NULL, "mcasp_sync_mux_ck", "abe-clkctrl:0020:26"),
++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"),
++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"),
++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"),
++ DT_CLK(NULL, "mcbsp4_sync_mux_ck", "l4-per-clkctrl:00c0:26"),
++ DT_CLK(NULL, "ocp2scp_usb_phy_phy_48m", "l3-init-clkctrl:00c0:8"),
++ DT_CLK(NULL, "otg_60m_gfclk", "l3-init-clkctrl:0040:24"),
++ DT_CLK(NULL, "per_mcbsp4_gfclk", "l4-per-clkctrl:00c0:24"),
++ DT_CLK(NULL, "pmd_stm_clock_mux_ck", "emu-sys-clkctrl:0000:20"),
++ DT_CLK(NULL, "pmd_trace_clk_mux_ck", "emu-sys-clkctrl:0000:22"),
++ DT_CLK(NULL, "sgx_clk_mux", "l3-gfx-clkctrl:0000:24"),
++ DT_CLK(NULL, "slimbus1_fclk_0", "abe-clkctrl:0040:8"),
++ DT_CLK(NULL, "slimbus1_fclk_1", "abe-clkctrl:0040:9"),
++ DT_CLK(NULL, "slimbus1_fclk_2", "abe-clkctrl:0040:10"),
++ DT_CLK(NULL, "slimbus1_slimbus_clk", "abe-clkctrl:0040:11"),
++ DT_CLK(NULL, "slimbus2_fclk_0", "l4-per-clkctrl:0118:8"),
++ DT_CLK(NULL, "slimbus2_fclk_1", "l4-per-clkctrl:0118:9"),
++ DT_CLK(NULL, "slimbus2_slimbus_clk", "l4-per-clkctrl:0118:10"),
++ DT_CLK(NULL, "stm_clk_div_ck", "emu-sys-clkctrl:0000:27"),
++ DT_CLK(NULL, "timer5_sync_mux", "abe-clkctrl:0048:24"),
++ DT_CLK(NULL, "timer6_sync_mux", "abe-clkctrl:0050:24"),
++ DT_CLK(NULL, "timer7_sync_mux", "abe-clkctrl:0058:24"),
++ DT_CLK(NULL, "timer8_sync_mux", "abe-clkctrl:0060:24"),
++ DT_CLK(NULL, "trace_clk_div_div_ck", "emu-sys-clkctrl:0000:24"),
++ DT_CLK(NULL, "usb_host_hs_func48mclk", "l3-init-clkctrl:0038:15"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3-init-clkctrl:0038:13"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3-init-clkctrl:0038:14"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3-init-clkctrl:0038:11"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3-init-clkctrl:0038:12"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3-init-clkctrl:0038:8"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3-init-clkctrl:0038:9"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3_init-clkctrl:0038:10"),
++ DT_CLK(NULL, "usb_otg_hs_xclk", "l3-init-clkctrl:0040:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3-init-clkctrl:0048:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3-init-clkctrl:0048:9"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3-init-clkctrl:0048:10"),
++ DT_CLK(NULL, "utmi_p1_gfclk", "l3-init-clkctrl:0038:24"),
++ DT_CLK(NULL, "utmi_p2_gfclk", "l3-init-clkctrl:0038:25"),
+ { .node_name = NULL },
+ };
+
+diff --git a/drivers/clk/ti/clk-54xx.c b/drivers/clk/ti/clk-54xx.c
+index 90e0a9ea6351..b4aff76eb373 100644
+--- a/drivers/clk/ti/clk-54xx.c
++++ b/drivers/clk/ti/clk-54xx.c
+@@ -50,7 +50,7 @@ static const struct omap_clkctrl_bit_data omap5_aess_bit_data[] __initconst = {
+ };
+
+ static const char * const omap5_dmic_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0018:26",
++ "abe-clkctrl:0018:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -70,7 +70,7 @@ static const struct omap_clkctrl_bit_data omap5_dmic_bit_data[] __initconst = {
+ };
+
+ static const char * const omap5_mcbsp1_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0028:26",
++ "abe-clkctrl:0028:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -83,7 +83,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp1_bit_data[] __initconst =
+ };
+
+ static const char * const omap5_mcbsp2_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0030:26",
++ "abe-clkctrl:0030:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -96,7 +96,7 @@ static const struct omap_clkctrl_bit_data omap5_mcbsp2_bit_data[] __initconst =
+ };
+
+ static const char * const omap5_mcbsp3_gfclk_parents[] __initconst = {
+- "abe_cm:clk:0038:26",
++ "abe-clkctrl:0038:26",
+ "pad_clks_ck",
+ "slimbus_clk",
+ NULL,
+@@ -136,16 +136,16 @@ static const struct omap_clkctrl_bit_data omap5_timer8_bit_data[] __initconst =
+
+ static const struct omap_clkctrl_reg_data omap5_abe_clkctrl_regs[] __initconst = {
+ { OMAP5_L4_ABE_CLKCTRL, NULL, 0, "abe_iclk" },
+- { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe_cm:clk:0008:24" },
++ { OMAP5_AESS_CLKCTRL, omap5_aess_bit_data, CLKF_SW_SUP, "abe-clkctrl:0008:24" },
+ { OMAP5_MCPDM_CLKCTRL, NULL, CLKF_SW_SUP, "pad_clks_ck" },
+- { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe_cm:clk:0018:24" },
+- { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe_cm:clk:0028:24" },
+- { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe_cm:clk:0030:24" },
+- { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe_cm:clk:0038:24" },
+- { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe_cm:clk:0048:24" },
+- { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe_cm:clk:0050:24" },
+- { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe_cm:clk:0058:24" },
+- { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe_cm:clk:0060:24" },
++ { OMAP5_DMIC_CLKCTRL, omap5_dmic_bit_data, CLKF_SW_SUP, "abe-clkctrl:0018:24" },
++ { OMAP5_MCBSP1_CLKCTRL, omap5_mcbsp1_bit_data, CLKF_SW_SUP, "abe-clkctrl:0028:24" },
++ { OMAP5_MCBSP2_CLKCTRL, omap5_mcbsp2_bit_data, CLKF_SW_SUP, "abe-clkctrl:0030:24" },
++ { OMAP5_MCBSP3_CLKCTRL, omap5_mcbsp3_bit_data, CLKF_SW_SUP, "abe-clkctrl:0038:24" },
++ { OMAP5_TIMER5_CLKCTRL, omap5_timer5_bit_data, CLKF_SW_SUP, "abe-clkctrl:0048:24" },
++ { OMAP5_TIMER6_CLKCTRL, omap5_timer6_bit_data, CLKF_SW_SUP, "abe-clkctrl:0050:24" },
++ { OMAP5_TIMER7_CLKCTRL, omap5_timer7_bit_data, CLKF_SW_SUP, "abe-clkctrl:0058:24" },
++ { OMAP5_TIMER8_CLKCTRL, omap5_timer8_bit_data, CLKF_SW_SUP, "abe-clkctrl:0060:24" },
+ { 0 },
+ };
+
+@@ -268,12 +268,12 @@ static const struct omap_clkctrl_bit_data omap5_gpio8_bit_data[] __initconst = {
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_l4per_clkctrl_regs[] __initconst = {
+- { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0008:24" },
+- { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0010:24" },
+- { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0018:24" },
+- { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0020:24" },
+- { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0028:24" },
+- { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per_cm:clk:0030:24" },
++ { OMAP5_TIMER10_CLKCTRL, omap5_timer10_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0008:24" },
++ { OMAP5_TIMER11_CLKCTRL, omap5_timer11_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0010:24" },
++ { OMAP5_TIMER2_CLKCTRL, omap5_timer2_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0018:24" },
++ { OMAP5_TIMER3_CLKCTRL, omap5_timer3_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0020:24" },
++ { OMAP5_TIMER4_CLKCTRL, omap5_timer4_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0028:24" },
++ { OMAP5_TIMER9_CLKCTRL, omap5_timer9_bit_data, CLKF_SW_SUP, "l4per-clkctrl:0030:24" },
+ { OMAP5_GPIO2_CLKCTRL, omap5_gpio2_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+ { OMAP5_GPIO3_CLKCTRL, omap5_gpio3_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+ { OMAP5_GPIO4_CLKCTRL, omap5_gpio4_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+@@ -345,7 +345,7 @@ static const struct omap_clkctrl_bit_data omap5_dss_core_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_dss_clkctrl_regs[] __initconst = {
+- { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss_cm:clk:0000:8" },
++ { OMAP5_DSS_CORE_CLKCTRL, omap5_dss_core_bit_data, CLKF_SW_SUP, "dss-clkctrl:0000:8" },
+ { 0 },
+ };
+
+@@ -378,7 +378,7 @@ static const struct omap_clkctrl_bit_data omap5_gpu_core_bit_data[] __initconst
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_gpu_clkctrl_regs[] __initconst = {
+- { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu_cm:clk:0000:24" },
++ { OMAP5_GPU_CLKCTRL, omap5_gpu_core_bit_data, CLKF_SW_SUP, "gpu-clkctrl:0000:24" },
+ { 0 },
+ };
+
+@@ -389,7 +389,7 @@ static const char * const omap5_mmc1_fclk_mux_parents[] __initconst = {
+ };
+
+ static const char * const omap5_mmc1_fclk_parents[] __initconst = {
+- "l3init_cm:clk:0008:24",
++ "l3init-clkctrl:0008:24",
+ NULL,
+ };
+
+@@ -405,7 +405,7 @@ static const struct omap_clkctrl_bit_data omap5_mmc1_bit_data[] __initconst = {
+ };
+
+ static const char * const omap5_mmc2_fclk_parents[] __initconst = {
+- "l3init_cm:clk:0010:24",
++ "l3init-clkctrl:0010:24",
+ NULL,
+ };
+
+@@ -430,12 +430,12 @@ static const char * const omap5_usb_host_hs_hsic480m_p3_clk_parents[] __initcons
+ };
+
+ static const char * const omap5_usb_host_hs_utmi_p1_clk_parents[] __initconst = {
+- "l3init_cm:clk:0038:24",
++ "l3init-clkctrl:0038:24",
+ NULL,
+ };
+
+ static const char * const omap5_usb_host_hs_utmi_p2_clk_parents[] __initconst = {
+- "l3init_cm:clk:0038:25",
++ "l3init-clkctrl:0038:25",
+ NULL,
+ };
+
+@@ -494,8 +494,8 @@ static const struct omap_clkctrl_bit_data omap5_usb_otg_ss_bit_data[] __initcons
+ };
+
+ static const struct omap_clkctrl_reg_data omap5_l3init_clkctrl_regs[] __initconst = {
+- { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0008:25" },
+- { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init_cm:clk:0010:25" },
++ { OMAP5_MMC1_CLKCTRL, omap5_mmc1_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0008:25" },
++ { OMAP5_MMC2_CLKCTRL, omap5_mmc2_bit_data, CLKF_SW_SUP, "l3init-clkctrl:0010:25" },
+ { OMAP5_USB_HOST_HS_CLKCTRL, omap5_usb_host_hs_bit_data, CLKF_SW_SUP, "l3init_60m_fclk" },
+ { OMAP5_USB_TLL_HS_CLKCTRL, omap5_usb_tll_hs_bit_data, CLKF_HW_SUP, "l4_root_clk_div" },
+ { OMAP5_SATA_CLKCTRL, omap5_sata_bit_data, CLKF_SW_SUP, "func_48m_fclk" },
+@@ -519,7 +519,7 @@ static const struct omap_clkctrl_reg_data omap5_wkupaon_clkctrl_regs[] __initcon
+ { OMAP5_L4_WKUP_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" },
+ { OMAP5_WD_TIMER2_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { OMAP5_GPIO1_CLKCTRL, omap5_gpio1_bit_data, CLKF_HW_SUP, "wkupaon_iclk_mux" },
+- { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon_cm:clk:0020:24" },
++ { OMAP5_TIMER1_CLKCTRL, omap5_timer1_bit_data, CLKF_SW_SUP, "wkupaon-clkctrl:0020:24" },
+ { OMAP5_COUNTER_32K_CLKCTRL, NULL, 0, "wkupaon_iclk_mux" },
+ { OMAP5_KBD_CLKCTRL, NULL, CLKF_SW_SUP, "sys_32k_ck" },
+ { 0 },
+@@ -549,58 +549,58 @@ const struct omap_clkctrl_data omap5_clkctrl_data[] __initconst = {
+ static struct ti_dt_clk omap54xx_clks[] = {
+ DT_CLK(NULL, "timer_32k_ck", "sys_32k_ck"),
+ DT_CLK(NULL, "sys_clkin_ck", "sys_clkin"),
+- DT_CLK(NULL, "dmic_gfclk", "abe_cm:0018:24"),
+- DT_CLK(NULL, "dmic_sync_mux_ck", "abe_cm:0018:26"),
+- DT_CLK(NULL, "dss_32khz_clk", "dss_cm:0000:11"),
+- DT_CLK(NULL, "dss_48mhz_clk", "dss_cm:0000:9"),
+- DT_CLK(NULL, "dss_dss_clk", "dss_cm:0000:8"),
+- DT_CLK(NULL, "dss_sys_clk", "dss_cm:0000:10"),
+- DT_CLK(NULL, "gpio1_dbclk", "wkupaon_cm:0018:8"),
+- DT_CLK(NULL, "gpio2_dbclk", "l4per_cm:0040:8"),
+- DT_CLK(NULL, "gpio3_dbclk", "l4per_cm:0048:8"),
+- DT_CLK(NULL, "gpio4_dbclk", "l4per_cm:0050:8"),
+- DT_CLK(NULL, "gpio5_dbclk", "l4per_cm:0058:8"),
+- DT_CLK(NULL, "gpio6_dbclk", "l4per_cm:0060:8"),
+- DT_CLK(NULL, "gpio7_dbclk", "l4per_cm:00f0:8"),
+- DT_CLK(NULL, "gpio8_dbclk", "l4per_cm:00f8:8"),
+- DT_CLK(NULL, "mcbsp1_gfclk", "abe_cm:0028:24"),
+- DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe_cm:0028:26"),
+- DT_CLK(NULL, "mcbsp2_gfclk", "abe_cm:0030:24"),
+- DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe_cm:0030:26"),
+- DT_CLK(NULL, "mcbsp3_gfclk", "abe_cm:0038:24"),
+- DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe_cm:0038:26"),
+- DT_CLK(NULL, "mmc1_32khz_clk", "l3init_cm:0008:8"),
+- DT_CLK(NULL, "mmc1_fclk", "l3init_cm:0008:25"),
+- DT_CLK(NULL, "mmc1_fclk_mux", "l3init_cm:0008:24"),
+- DT_CLK(NULL, "mmc2_fclk", "l3init_cm:0010:25"),
+- DT_CLK(NULL, "mmc2_fclk_mux", "l3init_cm:0010:24"),
+- DT_CLK(NULL, "sata_ref_clk", "l3init_cm:0068:8"),
+- DT_CLK(NULL, "timer10_gfclk_mux", "l4per_cm:0008:24"),
+- DT_CLK(NULL, "timer11_gfclk_mux", "l4per_cm:0010:24"),
+- DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon_cm:0020:24"),
+- DT_CLK(NULL, "timer2_gfclk_mux", "l4per_cm:0018:24"),
+- DT_CLK(NULL, "timer3_gfclk_mux", "l4per_cm:0020:24"),
+- DT_CLK(NULL, "timer4_gfclk_mux", "l4per_cm:0028:24"),
+- DT_CLK(NULL, "timer5_gfclk_mux", "abe_cm:0048:24"),
+- DT_CLK(NULL, "timer6_gfclk_mux", "abe_cm:0050:24"),
+- DT_CLK(NULL, "timer7_gfclk_mux", "abe_cm:0058:24"),
+- DT_CLK(NULL, "timer8_gfclk_mux", "abe_cm:0060:24"),
+- DT_CLK(NULL, "timer9_gfclk_mux", "l4per_cm:0030:24"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init_cm:0038:13"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init_cm:0038:14"),
+- DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init_cm:0038:7"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init_cm:0038:11"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init_cm:0038:12"),
+- DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init_cm:0038:6"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init_cm:0038:8"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init_cm:0038:9"),
+- DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init_cm:0038:10"),
+- DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init_cm:00d0:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init_cm:0048:8"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init_cm:0048:9"),
+- DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init_cm:0048:10"),
+- DT_CLK(NULL, "utmi_p1_gfclk", "l3init_cm:0038:24"),
+- DT_CLK(NULL, "utmi_p2_gfclk", "l3init_cm:0038:25"),
++ DT_CLK(NULL, "dmic_gfclk", "abe-clkctrl:0018:24"),
++ DT_CLK(NULL, "dmic_sync_mux_ck", "abe-clkctrl:0018:26"),
++ DT_CLK(NULL, "dss_32khz_clk", "dss-clkctrl:0000:11"),
++ DT_CLK(NULL, "dss_48mhz_clk", "dss-clkctrl:0000:9"),
++ DT_CLK(NULL, "dss_dss_clk", "dss-clkctrl:0000:8"),
++ DT_CLK(NULL, "dss_sys_clk", "dss-clkctrl:0000:10"),
++ DT_CLK(NULL, "gpio1_dbclk", "wkupaon-clkctrl:0018:8"),
++ DT_CLK(NULL, "gpio2_dbclk", "l4per-clkctrl:0040:8"),
++ DT_CLK(NULL, "gpio3_dbclk", "l4per-clkctrl:0048:8"),
++ DT_CLK(NULL, "gpio4_dbclk", "l4per-clkctrl:0050:8"),
++ DT_CLK(NULL, "gpio5_dbclk", "l4per-clkctrl:0058:8"),
++ DT_CLK(NULL, "gpio6_dbclk", "l4per-clkctrl:0060:8"),
++ DT_CLK(NULL, "gpio7_dbclk", "l4per-clkctrl:00f0:8"),
++ DT_CLK(NULL, "gpio8_dbclk", "l4per-clkctrl:00f8:8"),
++ DT_CLK(NULL, "mcbsp1_gfclk", "abe-clkctrl:0028:24"),
++ DT_CLK(NULL, "mcbsp1_sync_mux_ck", "abe-clkctrl:0028:26"),
++ DT_CLK(NULL, "mcbsp2_gfclk", "abe-clkctrl:0030:24"),
++ DT_CLK(NULL, "mcbsp2_sync_mux_ck", "abe-clkctrl:0030:26"),
++ DT_CLK(NULL, "mcbsp3_gfclk", "abe-clkctrl:0038:24"),
++ DT_CLK(NULL, "mcbsp3_sync_mux_ck", "abe-clkctrl:0038:26"),
++ DT_CLK(NULL, "mmc1_32khz_clk", "l3init-clkctrl:0008:8"),
++ DT_CLK(NULL, "mmc1_fclk", "l3init-clkctrl:0008:25"),
++ DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"),
++ DT_CLK(NULL, "mmc2_fclk", "l3init-clkctrl:0010:25"),
++ DT_CLK(NULL, "mmc2_fclk_mux", "l3init-clkctrl:0010:24"),
++ DT_CLK(NULL, "sata_ref_clk", "l3init-clkctrl:0068:8"),
++ DT_CLK(NULL, "timer10_gfclk_mux", "l4per-clkctrl:0008:24"),
++ DT_CLK(NULL, "timer11_gfclk_mux", "l4per-clkctrl:0010:24"),
++ DT_CLK(NULL, "timer1_gfclk_mux", "wkupaon-clkctrl:0020:24"),
++ DT_CLK(NULL, "timer2_gfclk_mux", "l4per-clkctrl:0018:24"),
++ DT_CLK(NULL, "timer3_gfclk_mux", "l4per-clkctrl:0020:24"),
++ DT_CLK(NULL, "timer4_gfclk_mux", "l4per-clkctrl:0028:24"),
++ DT_CLK(NULL, "timer5_gfclk_mux", "abe-clkctrl:0048:24"),
++ DT_CLK(NULL, "timer6_gfclk_mux", "abe-clkctrl:0050:24"),
++ DT_CLK(NULL, "timer7_gfclk_mux", "abe-clkctrl:0058:24"),
++ DT_CLK(NULL, "timer8_gfclk_mux", "abe-clkctrl:0060:24"),
++ DT_CLK(NULL, "timer9_gfclk_mux", "l4per-clkctrl:0030:24"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p1_clk", "l3init-clkctrl:0038:13"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p2_clk", "l3init-clkctrl:0038:14"),
++ DT_CLK(NULL, "usb_host_hs_hsic480m_p3_clk", "l3init-clkctrl:0038:7"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p1_clk", "l3init-clkctrl:0038:11"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p2_clk", "l3init-clkctrl:0038:12"),
++ DT_CLK(NULL, "usb_host_hs_hsic60m_p3_clk", "l3init-clkctrl:0038:6"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p1_clk", "l3init-clkctrl:0038:8"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p2_clk", "l3init-clkctrl:0038:9"),
++ DT_CLK(NULL, "usb_host_hs_utmi_p3_clk", "l3init-clkctrl:0038:10"),
++ DT_CLK(NULL, "usb_otg_ss_refclk960m", "l3init-clkctrl:00d0:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch0_clk", "l3init-clkctrl:0048:8"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch1_clk", "l3init-clkctrl:0048:9"),
++ DT_CLK(NULL, "usb_tll_hs_usb_ch2_clk", "l3init-clkctrl:0048:10"),
++ DT_CLK(NULL, "utmi_p1_gfclk", "l3init-clkctrl:0038:24"),
++ DT_CLK(NULL, "utmi_p2_gfclk", "l3init-clkctrl:0038:25"),
+ { .node_name = NULL },
+ };
+
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index 617360e20d86..e23bf0458632 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -528,10 +528,6 @@ static void __init _ti_omap4_clkctrl_setup(struct device_node *node)
+ char *c;
+ u16 soc_mask = 0;
+
+- if (!(ti_clk_get_features()->flags & TI_CLK_CLKCTRL_COMPAT) &&
+- of_node_name_eq(node, "clk"))
+- ti_clk_features.flags |= TI_CLK_CLKCTRL_COMPAT;
+-
+ addrp = of_get_address(node, 0, NULL, NULL);
+ addr = (u32)of_translate_address(node, addrp);
+
+--
+2.35.1
+
--- /dev/null
+From f45700a2bb8134211236db73f16457398bb565c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 16:15:20 -0700
+Subject: coresight: etm4x: avoid build failure with unrolled loops
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 4d45bc82df667ad9e9cb8361830e54fc1264e993 ]
+
+When the following configs are enabled:
+* CORESIGHT
+* CORESIGHT_SOURCE_ETM4X
+* UBSAN
+* UBSAN_TRAP
+
+Clang fails assemble the kernel with the error:
+<instantiation>:1:7: error: expected constant expression in '.inst' directive
+.inst (0xd5200000|((((2) << 19) | ((1) << 16) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 7) & 0x7)) << 12) | ((((((((((0x160 + (i * 4))))) >> 2))) & 0xf)) << 8) | (((((((((((0x160 + (i * 4))))) >> 2))) >> 4) & 0x7)) << 5)))|(.L__reg_num_x8))
+ ^
+drivers/hwtracing/coresight/coresight-etm4x-core.c:702:4: note: while in
+macro instantiation
+etm4x_relaxed_read32(csa, TRCCNTVRn(i));
+^
+drivers/hwtracing/coresight/coresight-etm4x.h:403:4: note: expanded from
+macro 'etm4x_relaxed_read32'
+read_etm4x_sysreg_offset((offset), false)))
+^
+drivers/hwtracing/coresight/coresight-etm4x.h:383:12: note: expanded
+from macro 'read_etm4x_sysreg_offset'
+__val = read_etm4x_sysreg_const_offset((offset)); \
+ ^
+drivers/hwtracing/coresight/coresight-etm4x.h:149:2: note: expanded from
+macro 'read_etm4x_sysreg_const_offset'
+READ_ETM4x_REG(ETM4x_OFFSET_TO_REG(offset))
+^
+drivers/hwtracing/coresight/coresight-etm4x.h:144:2: note: expanded from
+macro 'READ_ETM4x_REG'
+read_sysreg_s(ETM4x_REG_NUM_TO_SYSREG((reg)))
+^
+arch/arm64/include/asm/sysreg.h:1108:15: note: expanded from macro
+'read_sysreg_s'
+asm volatile(__mrs_s("%0", r) : "=r" (__val)); \
+ ^
+arch/arm64/include/asm/sysreg.h:1074:2: note: expanded from macro '__mrs_s'
+" mrs_s " v ", " __stringify(r) "\n" \
+ ^
+
+Consider the definitions of TRCSSCSRn and TRCCNTVRn:
+drivers/hwtracing/coresight/coresight-etm4x.h:56
+ #define TRCCNTVRn(n) (0x160 + (n * 4))
+drivers/hwtracing/coresight/coresight-etm4x.h:81
+ #define TRCSSCSRn(n) (0x2A0 + (n * 4))
+
+Where the macro parameter is expanded to i; a loop induction variable
+from etm4_disable_hw.
+
+When any compiler can determine that loops may be unrolled, then the
+__builtin_constant_p check in read_etm4x_sysreg_offset() defined in
+drivers/hwtracing/coresight/coresight-etm4x.h may evaluate to true. This
+can lead to the expression `(0x160 + (i * 4))` being passed to
+read_etm4x_sysreg_const_offset. Via the trace above, this is passed
+through READ_ETM4x_REG, read_sysreg_s, and finally to __mrs_s where it
+is string-ified and used directly in inline asm.
+
+Regardless of which compiler or compiler options determine whether a
+loop can or can't be unrolled, which determines whether
+__builtin_constant_p evaluates to true when passed an expression using a
+loop induction variable, it is NEVER safe to allow the preprocessor to
+construct inline asm like:
+ asm volatile (".inst (0x160 + (i * 4))" : "=r"(__val));
+ ^ expected constant expression
+
+Instead of read_etm4x_sysreg_offset() using __builtin_constant_p(), use
+__is_constexpr from include/linux/const.h instead to ensure only
+expressions that are valid integer constant expressions get passed
+through to read_sysreg_s().
+
+This is not a bug in clang; it's a potentially unsafe use of the macro
+arguments in read_etm4x_sysreg_offset dependent on __builtin_constant_p.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/1310
+Reported-by: Arnd Bergmann <arnd@kernel.org>
+Reported-by: Tao Zhang <quic_taozha@quicinc.com>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Acked-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Link: https://lore.kernel.org/r/20220708231520.3958391-1-ndesaulniers@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwtracing/coresight/coresight-etm4x.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h
+index 33869c1d20c3..a7bfea31f7d8 100644
+--- a/drivers/hwtracing/coresight/coresight-etm4x.h
++++ b/drivers/hwtracing/coresight/coresight-etm4x.h
+@@ -7,6 +7,7 @@
+ #define _CORESIGHT_CORESIGHT_ETM_H
+
+ #include <asm/local.h>
++#include <linux/const.h>
+ #include <linux/spinlock.h>
+ #include <linux/types.h>
+ #include "coresight-priv.h"
+@@ -515,7 +516,7 @@
+ ({ \
+ u64 __val; \
+ \
+- if (__builtin_constant_p((offset))) \
++ if (__is_constexpr((offset))) \
+ __val = read_etm4x_sysreg_const_offset((offset)); \
+ else \
+ __val = etm4x_sysreg_read((offset), true, (_64bit)); \
+--
+2.35.1
+
--- /dev/null
+From e5057f01b3e93a5046966536d637e8e8fbbecaf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 May 2022 16:02:41 +0800
+Subject: csky/kprobe: reclaim insn_slot on kprobe unregistration
+
+From: Liao Chang <liaochang1@huawei.com>
+
+[ Upstream commit a2310c74d418deca0f1d749c45f1f43162510f51 ]
+
+On kprobe registration kernel allocate one insn_slot for new kprobe,
+but it forget to reclaim the insn_slot on unregistration, leading to a
+potential leakage.
+
+Reported-by: Chen Guokai <chenguokai17@mails.ucas.ac.cn>
+Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Liao Chang <liaochang1@huawei.com>
+Signed-off-by: Guo Ren <guoren@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/csky/kernel/probes/kprobes.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/csky/kernel/probes/kprobes.c b/arch/csky/kernel/probes/kprobes.c
+index 34ba684d5962..3c6e5c725d81 100644
+--- a/arch/csky/kernel/probes/kprobes.c
++++ b/arch/csky/kernel/probes/kprobes.c
+@@ -124,6 +124,10 @@ void __kprobes arch_disarm_kprobe(struct kprobe *p)
+
+ void __kprobes arch_remove_kprobe(struct kprobe *p)
+ {
++ if (p->ainsn.api.insn) {
++ free_insn_slot(p->ainsn.api.insn, 0);
++ p->ainsn.api.insn = NULL;
++ }
+ }
+
+ static void __kprobes save_previous_kprobe(struct kprobe_ctlblk *kcb)
+--
+2.35.1
+
--- /dev/null
+From 7ea2221243932210e42099e8cb509d54441214df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jul 2022 21:14:48 +0200
+Subject: cxl: Fix a memory leak in an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3a15b45b5454da862376b5d69a4967f5c6fa1368 ]
+
+A bitmap_zalloc() must be balanced by a corresponding bitmap_free() in the
+error handling path of afu_allocate_irqs().
+
+Acked-by: Andrew Donnellan <ajd@linux.ibm.com>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/ce5869418f5838187946eb6b11a52715a93ece3d.1657566849.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/cxl/irq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/misc/cxl/irq.c b/drivers/misc/cxl/irq.c
+index 5f0e2dcebb34..ac3795a7e1f6 100644
+--- a/drivers/misc/cxl/irq.c
++++ b/drivers/misc/cxl/irq.c
+@@ -350,6 +350,7 @@ int afu_allocate_irqs(struct cxl_context *ctx, u32 count)
+
+ out:
+ cxl_ops->release_irq_ranges(&ctx->irqs, ctx->afu->adapter);
++ bitmap_free(ctx->irq_bitmap);
+ afu_irq_name_free(ctx);
+ return -ENOMEM;
+ }
+--
+2.35.1
+
--- /dev/null
+From 119d620610aea4ed5c19f3354c736f9ebf0896eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 18:01:52 +0100
+Subject: dmaengine: dw-axi-dmac: do not print NULL LLI during error
+
+From: Ben Dooks <ben.dooks@sifive.com>
+
+[ Upstream commit 86cb0defe0e275453bc39e856bb523eb425a6537 ]
+
+During debugging we have seen an issue where axi_chan_dump_lli()
+is passed a NULL LLI pointer which ends up causing an OOPS due
+to trying to get fields from it. Simply print NULL LLI and exit
+to avoid this.
+
+Signed-off-by: Ben Dooks <ben.dooks@sifive.com>
+Link: https://lore.kernel.org/r/20220708170153.269991-3-ben.dooks@sifive.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+index c741da02b67e..41583f01a360 100644
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -982,6 +982,11 @@ static int dw_axi_dma_chan_slave_config(struct dma_chan *dchan,
+ static void axi_chan_dump_lli(struct axi_dma_chan *chan,
+ struct axi_dma_hw_desc *desc)
+ {
++ if (!desc->lli) {
++ dev_err(dchan2dev(&chan->vc.chan), "NULL LLI\n");
++ return;
++ }
++
+ dev_err(dchan2dev(&chan->vc.chan),
+ "SAR: 0x%llx DAR: 0x%llx LLP: 0x%llx BTS 0x%x CTL: 0x%x:%08x",
+ le64_to_cpu(desc->lli->sar),
+--
+2.35.1
+
--- /dev/null
+From e1d410535622944a2c3b9eff3178d2a07cb685f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 18:01:53 +0100
+Subject: dmaengine: dw-axi-dmac: ignore interrupt if no descriptor
+
+From: Ben Dooks <ben.dooks@sifive.com>
+
+[ Upstream commit 820f5ce999d2f99961e88c16d65cd26764df0590 ]
+
+If the channel has no descriptor and the interrupt is raised then the
+kernel will OOPS. Check the result of vchan_next_desc() in the handler
+axi_chan_block_xfer_complete() to avoid the error happening.
+
+Signed-off-by: Ben Dooks <ben.dooks@sifive.com>
+Link: https://lore.kernel.org/r/20220708170153.269991-4-ben.dooks@sifive.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+index 41583f01a360..a183d93bd7e2 100644
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -1054,6 +1054,11 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)
+
+ /* The completed descriptor currently is in the head of vc list */
+ vd = vchan_next_desc(&chan->vc);
++ if (!vd) {
++ dev_err(chan2dev(chan), "BUG: %s, IRQ with no descriptors\n",
++ axi_chan_name(chan));
++ goto out;
++ }
+
+ if (chan->cyclic) {
+ desc = vd_to_axi_desc(vd);
+@@ -1083,6 +1088,7 @@ static void axi_chan_block_xfer_complete(struct axi_dma_chan *chan)
+ axi_chan_start_first_queued(chan);
+ }
+
++out:
+ spin_unlock_irqrestore(&chan->vc.lock, flags);
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 9a519efe8e0783eaf7416b86eda0b6341189de75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jul 2022 22:40:54 +0200
+Subject: dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync()
+ failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 1e42f82cbec7b2cc4873751e7791e6611901c5fc ]
+
+It's not allowed to quit remove early without cleaning up completely.
+Otherwise this results in resource leaks that probably yield graver
+problems later. Here for example some tasklets might survive the lifetime
+of the sprd-dma device and access sdev which is freed after .remove()
+returns.
+
+As none of the device freeing requires an active device, just ignore the
+return value of pm_runtime_get_sync().
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Baolin Wang <baolin.wang7@gmail.com>
+Link: https://lore.kernel.org/r/20220721204054.323602-1-u.kleine-koenig@pengutronix.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/sprd-dma.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c
+index 2138b80435ab..474d3ba8ec9f 100644
+--- a/drivers/dma/sprd-dma.c
++++ b/drivers/dma/sprd-dma.c
+@@ -1237,11 +1237,8 @@ static int sprd_dma_remove(struct platform_device *pdev)
+ {
+ struct sprd_dma_dev *sdev = platform_get_drvdata(pdev);
+ struct sprd_dma_chn *c, *cn;
+- int ret;
+
+- ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
+- return ret;
++ pm_runtime_get_sync(&pdev->dev);
+
+ /* explicitly free the irq */
+ if (sdev->irq > 0)
+--
+2.35.1
+
--- /dev/null
+From 8144258630f5ff210c859401591d06991be29594 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jul 2022 16:10:44 +0530
+Subject: dmaengine: tegra: Add terminate() for Tegra234
+
+From: Akhil R <akhilrajeev@nvidia.com>
+
+[ Upstream commit 36834c67016794b8fa03d7672a5b7f2cc4529298 ]
+
+In certain cases where the DMA client bus gets corrupted or if the
+end device ceases to send/receive data, DMA can wait indefinitely
+for the data to be received/sent. Attempting to terminate the transfer
+will put the DMA in pause flush mode and it remains there.
+
+The channel is irrecoverable once this pause times out in Tegra194 and
+earlier chips. Whereas, from Tegra234, it can be recovered by disabling
+the channel and reprograming it.
+
+Hence add a new terminate() function that ignores the outcome of
+dma_pause() so that terminate_all() can proceed to disable the channel.
+
+Signed-off-by: Akhil R <akhilrajeev@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20220720104045.16099-3-akhilrajeev@nvidia.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra186-gpc-dma.c | 26 ++++++++++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/tegra186-gpc-dma.c b/drivers/dma/tegra186-gpc-dma.c
+index 05cd451f541d..fa9bda4a2bc6 100644
+--- a/drivers/dma/tegra186-gpc-dma.c
++++ b/drivers/dma/tegra186-gpc-dma.c
+@@ -157,8 +157,8 @@
+ * If any burst is in flight and DMA paused then this is the time to complete
+ * on-flight burst and update DMA status register.
+ */
+-#define TEGRA_GPCDMA_BURST_COMPLETE_TIME 20
+-#define TEGRA_GPCDMA_BURST_COMPLETION_TIMEOUT 100
++#define TEGRA_GPCDMA_BURST_COMPLETE_TIME 10
++#define TEGRA_GPCDMA_BURST_COMPLETION_TIMEOUT 5000 /* 5 msec */
+
+ /* Channel base address offset from GPCDMA base address */
+ #define TEGRA_GPCDMA_CHANNEL_BASE_ADD_OFFSET 0x20000
+@@ -432,6 +432,17 @@ static int tegra_dma_device_resume(struct dma_chan *dc)
+ return 0;
+ }
+
++static inline int tegra_dma_pause_noerr(struct tegra_dma_channel *tdc)
++{
++ /* Return 0 irrespective of PAUSE status.
++ * This is useful to recover channels that can exit out of flush
++ * state when the channel is disabled.
++ */
++
++ tegra_dma_pause(tdc);
++ return 0;
++}
++
+ static void tegra_dma_disable(struct tegra_dma_channel *tdc)
+ {
+ u32 csr, status;
+@@ -1292,6 +1303,14 @@ static const struct tegra_dma_chip_data tegra194_dma_chip_data = {
+ .terminate = tegra_dma_pause,
+ };
+
++static const struct tegra_dma_chip_data tegra234_dma_chip_data = {
++ .nr_channels = 31,
++ .channel_reg_size = SZ_64K,
++ .max_dma_count = SZ_1G,
++ .hw_support_pause = true,
++ .terminate = tegra_dma_pause_noerr,
++};
++
+ static const struct of_device_id tegra_dma_of_match[] = {
+ {
+ .compatible = "nvidia,tegra186-gpcdma",
+@@ -1299,6 +1318,9 @@ static const struct of_device_id tegra_dma_of_match[] = {
+ }, {
+ .compatible = "nvidia,tegra194-gpcdma",
+ .data = &tegra194_dma_chip_data,
++ }, {
++ .compatible = "nvidia,tegra234-gpcdma",
++ .data = &tegra234_dma_chip_data,
+ }, {
+ },
+ };
+--
+2.35.1
+
--- /dev/null
+From 2462453efbabffb727c255977060d7215389bb28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Jul 2022 19:39:19 +0800
+Subject: drivers:md:fix a potential use-after-free bug
+
+From: Wentao_Liang <Wentao_Liang_g@163.com>
+
+[ Upstream commit 104212471b1c1817b311771d817fb692af983173 ]
+
+In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and
+may cause sh to be released. However, sh is subsequently used in lines
+2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an
+use-after-free bug.
+
+It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of
+the function.
+
+Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 45482cebacdb..1c1310d539f2 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2881,10 +2881,10 @@ static void raid5_end_write_request(struct bio *bi)
+ if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags))
+ clear_bit(R5_LOCKED, &sh->dev[i].flags);
+ set_bit(STRIPE_HANDLE, &sh->state);
+- raid5_release_stripe(sh);
+
+ if (sh->batch_head && sh != sh->batch_head)
+ raid5_release_stripe(sh->batch_head);
++ raid5_release_stripe(sh);
+ }
+
+ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
+--
+2.35.1
+
--- /dev/null
+From dee7746f527b3ac5587d3b5969efd623e5ecec72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Aug 2022 16:54:24 +0530
+Subject: drm/amdgpu: Avoid another list of reset devices
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+[ Upstream commit 0a83bb35d8a6ff3d18c2772afe616780c23293a6 ]
+
+A list of devices to be reset is already created in
+amdgpu_device_gpu_recover function. Creating another list with the
+same nodes is incorrect and not supported in list_head. Instead, pass
+the device list as part of reset context.
+
+Fixes: 9e08564727fc (drm/amdgpu: Refactor mode2 reset logic for v13.0.2)
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/aldebaran.c | 45 +++++++---------------
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +
+ drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h | 1 +
+ 3 files changed, 17 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/aldebaran.c b/drivers/gpu/drm/amd/amdgpu/aldebaran.c
+index c6cc493a5486..2b97b8a96fb4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/aldebaran.c
++++ b/drivers/gpu/drm/amd/amdgpu/aldebaran.c
+@@ -148,30 +148,22 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl,
+ struct amdgpu_reset_context *reset_context)
+ {
+ struct amdgpu_device *adev = (struct amdgpu_device *)reset_ctl->handle;
++ struct list_head *reset_device_list = reset_context->reset_device_list;
+ struct amdgpu_device *tmp_adev = NULL;
+- struct list_head reset_device_list;
+ int r = 0;
+
+ dev_dbg(adev->dev, "aldebaran perform hw reset\n");
++
++ if (reset_device_list == NULL)
++ return -EINVAL;
++
+ if (adev->ip_versions[MP1_HWIP][0] == IP_VERSION(13, 0, 2) &&
+ reset_context->hive == NULL) {
+ /* Wrong context, return error */
+ return -EINVAL;
+ }
+
+- INIT_LIST_HEAD(&reset_device_list);
+- if (reset_context->hive) {
+- list_for_each_entry (tmp_adev,
+- &reset_context->hive->device_list,
+- gmc.xgmi.head)
+- list_add_tail(&tmp_adev->reset_list,
+- &reset_device_list);
+- } else {
+- list_add_tail(&reset_context->reset_req_dev->reset_list,
+- &reset_device_list);
+- }
+-
+- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) {
++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) {
+ mutex_lock(&tmp_adev->reset_cntl->reset_lock);
+ tmp_adev->reset_cntl->active_reset = AMD_RESET_METHOD_MODE2;
+ }
+@@ -179,7 +171,7 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl,
+ * Mode2 reset doesn't need any sync between nodes in XGMI hive, instead launch
+ * them together so that they can be completed asynchronously on multiple nodes
+ */
+- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) {
++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) {
+ /* For XGMI run all resets in parallel to speed up the process */
+ if (tmp_adev->gmc.xgmi.num_physical_nodes > 1) {
+ if (!queue_work(system_unbound_wq,
+@@ -197,7 +189,7 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl,
+
+ /* For XGMI wait for all resets to complete before proceed */
+ if (!r) {
+- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) {
++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) {
+ if (tmp_adev->gmc.xgmi.num_physical_nodes > 1) {
+ flush_work(&tmp_adev->reset_cntl->reset_work);
+ r = tmp_adev->asic_reset_res;
+@@ -207,7 +199,7 @@ aldebaran_mode2_perform_reset(struct amdgpu_reset_control *reset_ctl,
+ }
+ }
+
+- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) {
++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) {
+ mutex_unlock(&tmp_adev->reset_cntl->reset_lock);
+ tmp_adev->reset_cntl->active_reset = AMD_RESET_METHOD_NONE;
+ }
+@@ -339,10 +331,13 @@ static int
+ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl,
+ struct amdgpu_reset_context *reset_context)
+ {
++ struct list_head *reset_device_list = reset_context->reset_device_list;
+ struct amdgpu_device *tmp_adev = NULL;
+- struct list_head reset_device_list;
+ int r;
+
++ if (reset_device_list == NULL)
++ return -EINVAL;
++
+ if (reset_context->reset_req_dev->ip_versions[MP1_HWIP][0] ==
+ IP_VERSION(13, 0, 2) &&
+ reset_context->hive == NULL) {
+@@ -350,19 +345,7 @@ aldebaran_mode2_restore_hwcontext(struct amdgpu_reset_control *reset_ctl,
+ return -EINVAL;
+ }
+
+- INIT_LIST_HEAD(&reset_device_list);
+- if (reset_context->hive) {
+- list_for_each_entry (tmp_adev,
+- &reset_context->hive->device_list,
+- gmc.xgmi.head)
+- list_add_tail(&tmp_adev->reset_list,
+- &reset_device_list);
+- } else {
+- list_add_tail(&reset_context->reset_req_dev->reset_list,
+- &reset_device_list);
+- }
+-
+- list_for_each_entry (tmp_adev, &reset_device_list, reset_list) {
++ list_for_each_entry(tmp_adev, reset_device_list, reset_list) {
+ dev_info(tmp_adev->dev,
+ "GPU reset succeeded, trying to resume\n");
+ r = aldebaran_mode2_restore_ip(tmp_adev);
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 58df107e3beb..3adebb63680e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4746,6 +4746,8 @@ int amdgpu_do_asic_reset(struct list_head *device_list_handle,
+ tmp_adev = list_first_entry(device_list_handle, struct amdgpu_device,
+ reset_list);
+ amdgpu_reset_reg_dumps(tmp_adev);
++
++ reset_context->reset_device_list = device_list_handle;
+ r = amdgpu_reset_perform_reset(tmp_adev, reset_context);
+ /* If reset handler not implemented, continue; otherwise return */
+ if (r == -ENOSYS)
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h
+index 1949dbe28a86..0c3ad85d84a4 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_reset.h
+@@ -37,6 +37,7 @@ struct amdgpu_reset_context {
+ struct amdgpu_device *reset_req_dev;
+ struct amdgpu_job *job;
+ struct amdgpu_hive_info *hive;
++ struct list_head *reset_device_list;
+ unsigned long flags;
+ };
+
+--
+2.35.1
+
--- /dev/null
+From c951319e40a49e0866bd4b7639ca513cc6e9b603 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Aug 2022 08:39:31 -0300
+Subject: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maíra Canal <mairacanal@riseup.net>
+
+[ Upstream commit bbca24d0a3c11193bafb9e174f89f52a379006e3 ]
+
+If amdgpu_cs_vm_handling returns r != 0, then it will unlock the
+bo_list_mutex inside the function amdgpu_cs_vm_handling and again on
+amdgpu_cs_parser_fini. This problem results in the following
+use-after-free problem:
+
+[ 220.280990] ------------[ cut here ]------------
+[ 220.281000] refcount_t: underflow; use-after-free.
+[ 220.281019] WARNING: CPU: 1 PID: 3746 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110
+[ 220.281029] ------------[ cut here ]------------
+[ 220.281415] CPU: 1 PID: 3746 Comm: chrome:cs0 Tainted: G W L ------- --- 5.20.0-0.rc0.20220812git7ebfc85e2cd7.10.fc38.x86_64 #1
+[ 220.281421] Hardware name: System manufacturer System Product Name/ROG STRIX X570-I GAMING, BIOS 4403 04/27/2022
+[ 220.281426] RIP: 0010:refcount_warn_saturate+0xba/0x110
+[ 220.281431] Code: 01 01 e8 79 4a 6f 00 0f 0b e9 42 47 a5 00 80 3d de
+7e be 01 00 75 85 48 c7 c7 f8 98 8e 98 c6 05 ce 7e be 01 01 e8 56 4a
+6f 00 <0f> 0b e9 1f 47 a5 00 80 3d b9 7e be 01 00 0f 85 5e ff ff ff 48
+c7
+[ 220.281437] RSP: 0018:ffffb4b0d18d7a80 EFLAGS: 00010282
+[ 220.281443] RAX: 0000000000000026 RBX: 0000000000000003 RCX: 0000000000000000
+[ 220.281448] RDX: 0000000000000001 RSI: ffffffff988d06dc RDI: 00000000ffffffff
+[ 220.281452] RBP: 00000000ffffffff R08: 0000000000000000 R09: ffffb4b0d18d7930
+[ 220.281457] R10: 0000000000000003 R11: ffffa0672e2fffe8 R12: ffffa058ca360400
+[ 220.281461] R13: ffffa05846c50a18 R14: 00000000fffffe00 R15: 0000000000000003
+[ 220.281465] FS: 00007f82683e06c0(0000) GS:ffffa066e2e00000(0000) knlGS:0000000000000000
+[ 220.281470] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 220.281475] CR2: 00003590005cc000 CR3: 00000001fca46000 CR4: 0000000000350ee0
+[ 220.281480] Call Trace:
+[ 220.281485] <TASK>
+[ 220.281490] amdgpu_cs_ioctl+0x4e2/0x2070 [amdgpu]
+[ 220.281806] ? amdgpu_cs_find_mapping+0xe0/0xe0 [amdgpu]
+[ 220.282028] drm_ioctl_kernel+0xa4/0x150
+[ 220.282043] drm_ioctl+0x21f/0x420
+[ 220.282053] ? amdgpu_cs_find_mapping+0xe0/0xe0 [amdgpu]
+[ 220.282275] ? lock_release+0x14f/0x460
+[ 220.282282] ? _raw_spin_unlock_irqrestore+0x30/0x60
+[ 220.282290] ? _raw_spin_unlock_irqrestore+0x30/0x60
+[ 220.282297] ? lockdep_hardirqs_on+0x7d/0x100
+[ 220.282305] ? _raw_spin_unlock_irqrestore+0x40/0x60
+[ 220.282317] amdgpu_drm_ioctl+0x4a/0x80 [amdgpu]
+[ 220.282534] __x64_sys_ioctl+0x90/0xd0
+[ 220.282545] do_syscall_64+0x5b/0x80
+[ 220.282551] ? futex_wake+0x6c/0x150
+[ 220.282568] ? lock_is_held_type+0xe8/0x140
+[ 220.282580] ? do_syscall_64+0x67/0x80
+[ 220.282585] ? lockdep_hardirqs_on+0x7d/0x100
+[ 220.282592] ? do_syscall_64+0x67/0x80
+[ 220.282597] ? do_syscall_64+0x67/0x80
+[ 220.282602] ? lockdep_hardirqs_on+0x7d/0x100
+[ 220.282609] entry_SYSCALL_64_after_hwframe+0x63/0xcd
+[ 220.282616] RIP: 0033:0x7f8282a4f8bf
+[ 220.282639] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10
+00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00
+0f 05 <89> c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00
+00
+[ 220.282644] RSP: 002b:00007f82683df410 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
+[ 220.282651] RAX: ffffffffffffffda RBX: 00007f82683df588 RCX: 00007f8282a4f8bf
+[ 220.282655] RDX: 00007f82683df4d0 RSI: 00000000c0186444 RDI: 0000000000000018
+[ 220.282659] RBP: 00007f82683df4d0 R08: 00007f82683df5e0 R09: 00007f82683df4b0
+[ 220.282663] R10: 00001d04000a0600 R11: 0000000000000246 R12: 00000000c0186444
+[ 220.282667] R13: 0000000000000018 R14: 00007f82683df588 R15: 0000000000000003
+[ 220.282689] </TASK>
+[ 220.282693] irq event stamp: 6232311
+[ 220.282697] hardirqs last enabled at (6232319): [<ffffffff9718cd7e>] __up_console_sem+0x5e/0x70
+[ 220.282704] hardirqs last disabled at (6232326): [<ffffffff9718cd63>] __up_console_sem+0x43/0x70
+[ 220.282709] softirqs last enabled at (6232072): [<ffffffff970ff669>] __irq_exit_rcu+0xf9/0x170
+[ 220.282716] softirqs last disabled at (6232061): [<ffffffff970ff669>] __irq_exit_rcu+0xf9/0x170
+[ 220.282722] ---[ end trace 0000000000000000 ]---
+
+Therefore, remove the mutex_unlock from the amdgpu_cs_vm_handling
+function, so that amdgpu_cs_submit and amdgpu_cs_parser_fini can handle
+the unlock.
+
+Fixes: 90af0ca047f3 ("drm/amdgpu: Protect the amdgpu_bo_list list with a mutex v2")
+Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Maíra Canal <mairacanal@riseup.net>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+index d8f1335bc68f..b7bae833c804 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -837,16 +837,12 @@ static int amdgpu_cs_vm_handling(struct amdgpu_cs_parser *p)
+ continue;
+
+ r = amdgpu_vm_bo_update(adev, bo_va, false);
+- if (r) {
+- mutex_unlock(&p->bo_list->bo_list_mutex);
++ if (r)
+ return r;
+- }
+
+ r = amdgpu_sync_fence(&p->job->sync, bo_va->last_pt_update);
+- if (r) {
+- mutex_unlock(&p->bo_list->bo_list_mutex);
++ if (r)
+ return r;
+- }
+ }
+
+ r = amdgpu_vm_handle_moved(adev, vm);
+--
+2.35.1
+
--- /dev/null
+From c945c118eb2ac76e5ef95a6b6f6ab3cb6ea5aecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Aug 2022 14:54:19 +0200
+Subject: drm/bridge: lvds-codec: Fix error checking of
+ drm_of_lvds_get_data_mapping()
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 2bba782002c5dab6ca8d608b778b386fb912adff ]
+
+The drm_of_lvds_get_data_mapping() returns either negative value on
+error or MEDIA_BUS_FMT_* otherwise. The check for 'ret' would also
+catch the positive case of MEDIA_BUS_FMT_* and lead to probe failure
+every time 'data-mapping' DT property is specified.
+
+Fixes: 7c4dd0a266527 ("drm: of: Add drm_of_lvds_get_data_mapping")
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+To: dri-devel@lists.freedesktop.org
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220801125419.167562-1-marex@denx.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/lvds-codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/lvds-codec.c b/drivers/gpu/drm/bridge/lvds-codec.c
+index 702ea803a743..39e7004de720 100644
+--- a/drivers/gpu/drm/bridge/lvds-codec.c
++++ b/drivers/gpu/drm/bridge/lvds-codec.c
+@@ -180,7 +180,7 @@ static int lvds_codec_probe(struct platform_device *pdev)
+ of_node_put(bus_node);
+ if (ret == -ENODEV) {
+ dev_warn(dev, "missing 'data-mapping' DT property\n");
+- } else if (ret) {
++ } else if (ret < 0) {
+ dev_err(dev, "invalid 'data-mapping' DT property\n");
+ return ret;
+ } else {
+--
+2.35.1
+
--- /dev/null
+From 5bc73b481d4abcedfb43d8460b28cc331966332f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jul 2022 17:43:46 +0100
+Subject: drm/i915/ttm: don't leak the ccs state
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+[ Upstream commit 232d150fa15606e96c0e01e5c7a2d4e03f621787 ]
+
+The kernel only manages the ccs state with lmem-only objects, however
+the kernel should still take care not to leak the CCS state from the
+previous user.
+
+Fixes: 48760ffe923a ("drm/i915/gt: Clear compress metadata for Flat-ccs objects")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Cc: Ramalingam C <ramalingam.c@intel.com>
+Reviewed-by: Ramalingam C <ramalingam.c@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220727164346.282407-1-matthew.auld@intel.com
+(cherry picked from commit 353819d85f87be46aeb9c1dd929d445a006fc6ec)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/i915/gt/intel_migrate.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c b/drivers/gpu/drm/i915/gt/intel_migrate.c
+index 2c35324b5f68..2b10b96b17b5 100644
+--- a/drivers/gpu/drm/i915/gt/intel_migrate.c
++++ b/drivers/gpu/drm/i915/gt/intel_migrate.c
+@@ -708,7 +708,7 @@ intel_context_migrate_copy(struct intel_context *ce,
+ u8 src_access, dst_access;
+ struct i915_request *rq;
+ int src_sz, dst_sz;
+- bool ccs_is_src;
++ bool ccs_is_src, overwrite_ccs;
+ int err;
+
+ GEM_BUG_ON(ce->vm != ce->engine->gt->migrate.context->vm);
+@@ -749,6 +749,8 @@ intel_context_migrate_copy(struct intel_context *ce,
+ get_ccs_sg_sgt(&it_ccs, bytes_to_cpy);
+ }
+
++ overwrite_ccs = HAS_FLAT_CCS(i915) && !ccs_bytes_to_cpy && dst_is_lmem;
++
+ src_offset = 0;
+ dst_offset = CHUNK_SZ;
+ if (HAS_64K_PAGES(ce->engine->i915)) {
+@@ -852,6 +854,25 @@ intel_context_migrate_copy(struct intel_context *ce,
+ if (err)
+ goto out_rq;
+ ccs_bytes_to_cpy -= ccs_sz;
++ } else if (overwrite_ccs) {
++ err = rq->engine->emit_flush(rq, EMIT_INVALIDATE);
++ if (err)
++ goto out_rq;
++
++ /*
++ * While we can't always restore/manage the CCS state,
++ * we still need to ensure we don't leak the CCS state
++ * from the previous user, so make sure we overwrite it
++ * with something.
++ */
++ err = emit_copy_ccs(rq, dst_offset, INDIRECT_ACCESS,
++ dst_offset, DIRECT_ACCESS, len);
++ if (err)
++ goto out_rq;
++
++ err = rq->engine->emit_flush(rq, EMIT_INVALIDATE);
++ if (err)
++ goto out_rq;
+ }
+
+ /* Arbitration is re-enabled between requests. */
+--
+2.35.1
+
--- /dev/null
+From 486ea1fa27f9e21d7f8f64c0315ee1afcfb031ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jul 2022 15:09:12 +0300
+Subject: drm/imx/dcss: get rid of HPD warning message
+
+From: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
+
+[ Upstream commit 30bdc36b8c776cd4fce5de2a96ff28b37f96942f ]
+
+When DCSS + MIPI_DSI is used, and the last bridge in the chain supports
+HPD, we can see a "Hot plug detection already enabled" warning stack
+trace dump that's thrown when DCSS is initialized.
+
+The problem appeared when HPD was enabled by default in the
+bridge_connector initialization, which made the
+drm_bridge_connector_enable_hpd() call, in DCSS init path, redundant.
+So, let's remove that call.
+
+Fixes: 09077bc311658 ("drm/bridge_connector: enable HPD by default if supported")
+Signed-off-by: Laurentiu Palcu <laurentiu.palcu@oss.nxp.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220721120912.6639-1-laurentiu.palcu@oss.nxp.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/imx/dcss/dcss-kms.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/imx/dcss/dcss-kms.c b/drivers/gpu/drm/imx/dcss/dcss-kms.c
+index 9b84df34a6a1..8cf3352d8858 100644
+--- a/drivers/gpu/drm/imx/dcss/dcss-kms.c
++++ b/drivers/gpu/drm/imx/dcss/dcss-kms.c
+@@ -142,8 +142,6 @@ struct dcss_kms_dev *dcss_kms_attach(struct dcss_dev *dcss)
+
+ drm_kms_helper_poll_init(drm);
+
+- drm_bridge_connector_enable_hpd(kms->connector);
+-
+ ret = drm_dev_register(drm, 0);
+ if (ret)
+ goto cleanup_crtc;
+--
+2.35.1
+
--- /dev/null
+From 6ae8f48c948cca6f8581a14c5549a84a8adc8313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 May 2022 22:14:13 +0530
+Subject: drm/meson: Fix overflow implicit truncation warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+
+[ Upstream commit 98692f52c588225034cbff458622c2c06dfcb544 ]
+
+Fix -Woverflow warnings for drm/meson driver which is a result
+of moving arm64 custom MMIO accessor macros to asm-generic function
+implementations giving a bonus type-checking now and uncovering these
+overflow warnings.
+
+drivers/gpu/drm/meson/meson_viu.c: In function ‘meson_viu_init’:
+drivers/gpu/drm/meson/meson_registers.h:1826:48: error: large integer implicitly truncated to unsigned type [-Werror=overflow]
+ #define VIU_OSD_BLEND_REORDER(dest, src) ((src) << (dest * 4))
+ ^
+drivers/gpu/drm/meson/meson_viu.c:472:18: note: in expansion of macro ‘VIU_OSD_BLEND_REORDER’
+ writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) |
+ ^~~~~~~~~~~~~~~~~~~~~
+
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_viu.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_viu.c b/drivers/gpu/drm/meson/meson_viu.c
+index 259f3e6bec90..bb7e109534de 100644
+--- a/drivers/gpu/drm/meson/meson_viu.c
++++ b/drivers/gpu/drm/meson/meson_viu.c
+@@ -469,17 +469,17 @@ void meson_viu_init(struct meson_drm *priv)
+ priv->io_base + _REG(VD2_IF0_LUMA_FIFO_SIZE));
+
+ if (meson_vpu_is_compatible(priv, VPU_COMPATIBLE_G12A)) {
+- writel_relaxed(VIU_OSD_BLEND_REORDER(0, 1) |
+- VIU_OSD_BLEND_REORDER(1, 0) |
+- VIU_OSD_BLEND_REORDER(2, 0) |
+- VIU_OSD_BLEND_REORDER(3, 0) |
+- VIU_OSD_BLEND_DIN_EN(1) |
+- VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 |
+- VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 |
+- VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 |
+- VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) |
+- VIU_OSD_BLEND_HOLD_LINES(4),
+- priv->io_base + _REG(VIU_OSD_BLEND_CTRL));
++ u32 val = (u32)VIU_OSD_BLEND_REORDER(0, 1) |
++ (u32)VIU_OSD_BLEND_REORDER(1, 0) |
++ (u32)VIU_OSD_BLEND_REORDER(2, 0) |
++ (u32)VIU_OSD_BLEND_REORDER(3, 0) |
++ (u32)VIU_OSD_BLEND_DIN_EN(1) |
++ (u32)VIU_OSD_BLEND1_DIN3_BYPASS_TO_DOUT1 |
++ (u32)VIU_OSD_BLEND1_DOUT_BYPASS_TO_BLEND2 |
++ (u32)VIU_OSD_BLEND_DIN0_BYPASS_TO_DOUT0 |
++ (u32)VIU_OSD_BLEND_BLEN2_PREMULT_EN(1) |
++ (u32)VIU_OSD_BLEND_HOLD_LINES(4);
++ writel_relaxed(val, priv->io_base + _REG(VIU_OSD_BLEND_CTRL));
+
+ writel_relaxed(OSD_BLEND_PATH_SEL_ENABLE,
+ priv->io_base + _REG(OSD1_BLEND_SRC_CTRL));
+--
+2.35.1
+
--- /dev/null
+From c57068000da67a47d909cb143e11bc196f896792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jul 2022 09:07:22 +0800
+Subject: drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 91b3c8dbe898df158fd2a84675f3a284ff6666f7 ]
+
+In this function, there are two refcount leak bugs:
+(1) when breaking out of for_each_endpoint_of_node(), we need call
+the of_node_put() for the 'ep';
+(2) we should call of_node_put() for the reference returned by
+of_graph_get_remote_port() when it is not used anymore.
+
+Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")
+Signed-off-by: Liang He <windhl@126.com>
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220726010722.1319416-1-windhl@126.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 1b70938cfd2c..bd4ca11d3ff5 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -115,8 +115,11 @@ static bool meson_vpu_has_available_connectors(struct device *dev)
+ for_each_endpoint_of_node(dev->of_node, ep) {
+ /* If the endpoint node exists, consider it enabled */
+ remote = of_graph_get_remote_port(ep);
+- if (remote)
++ if (remote) {
++ of_node_put(remote);
++ of_node_put(ep);
+ return true;
++ }
+ }
+
+ return false;
+--
+2.35.1
+
--- /dev/null
+From 3cd74eff9b31a7e7092d43c9168830e298672fe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Aug 2022 22:16:23 -0500
+Subject: drm/sun4i: dsi: Prevent underflow when computing packet sizes
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 82a1356a933d8443139f8886f11b63c974a09a67 ]
+
+Currently, the packet overhead is subtracted using unsigned arithmetic.
+With a short sync pulse, this could underflow and wrap around to near
+the maximal u16 value. Fix this by using signed subtraction. The call to
+max() will correctly handle any negative numbers that are produced.
+
+Apply the same fix to the other timings, even though those subtractions
+are less likely to underflow.
+
+Fixes: 133add5b5ad4 ("drm/sun4i: Add Allwinner A31 MIPI-DSI controller support")
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/r/20220812031623.34057-1-samuel@sholland.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+index b4dfa166eccd..34234a144e87 100644
+--- a/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
++++ b/drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c
+@@ -531,7 +531,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ struct drm_display_mode *mode)
+ {
+ struct mipi_dsi_device *device = dsi->device;
+- unsigned int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8;
++ int Bpp = mipi_dsi_pixel_format_to_bpp(device->format) / 8;
+ u16 hbp = 0, hfp = 0, hsa = 0, hblk = 0, vblk = 0;
+ u32 basic_ctl = 0;
+ size_t bytes;
+@@ -555,7 +555,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * (4 bytes). Its minimal size is therefore 10 bytes
+ */
+ #define HSA_PACKET_OVERHEAD 10
+- hsa = max((unsigned int)HSA_PACKET_OVERHEAD,
++ hsa = max(HSA_PACKET_OVERHEAD,
+ (mode->hsync_end - mode->hsync_start) * Bpp - HSA_PACKET_OVERHEAD);
+
+ /*
+@@ -564,7 +564,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * therefore 6 bytes
+ */
+ #define HBP_PACKET_OVERHEAD 6
+- hbp = max((unsigned int)HBP_PACKET_OVERHEAD,
++ hbp = max(HBP_PACKET_OVERHEAD,
+ (mode->htotal - mode->hsync_end) * Bpp - HBP_PACKET_OVERHEAD);
+
+ /*
+@@ -574,7 +574,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * 16 bytes
+ */
+ #define HFP_PACKET_OVERHEAD 16
+- hfp = max((unsigned int)HFP_PACKET_OVERHEAD,
++ hfp = max(HFP_PACKET_OVERHEAD,
+ (mode->hsync_start - mode->hdisplay) * Bpp - HFP_PACKET_OVERHEAD);
+
+ /*
+@@ -583,7 +583,7 @@ static void sun6i_dsi_setup_timings(struct sun6i_dsi *dsi,
+ * bytes). Its minimal size is therefore 10 bytes.
+ */
+ #define HBLK_PACKET_OVERHEAD 10
+- hblk = max((unsigned int)HBLK_PACKET_OVERHEAD,
++ hblk = max(HBLK_PACKET_OVERHEAD,
+ (mode->htotal - (mode->hsync_end - mode->hsync_start)) * Bpp -
+ HBLK_PACKET_OVERHEAD);
+
+--
+2.35.1
+
--- /dev/null
+From 17073c072075984f2dd7f919bef62dc49c49b884 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jun 2022 17:02:23 +0800
+Subject: ext4: avoid remove directory when directory is corrupted
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit b24e77ef1c6d4dbf42749ad4903c97539cc9755a ]
+
+Now if check directoy entry is corrupted, ext4_empty_dir may return true
+then directory will be removed when file system mounted with "errors=continue".
+In order not to make things worse just return false when directory is corrupted.
+
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20220622090223.682234-1-yebin10@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/namei.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 4af441494e09..3a31b662f661 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3090,11 +3090,8 @@ bool ext4_empty_dir(struct inode *inode)
+ de = (struct ext4_dir_entry_2 *) (bh->b_data +
+ (offset & (sb->s_blocksize - 1)));
+ if (ext4_check_dir_entry(inode, NULL, de, bh,
+- bh->b_data, bh->b_size, offset)) {
+- offset = (offset | (sb->s_blocksize - 1)) + 1;
+- continue;
+- }
+- if (le32_to_cpu(de->inode)) {
++ bh->b_data, bh->b_size, offset) ||
++ le32_to_cpu(de->inode)) {
+ brelse(bh);
+ return false;
+ }
+--
+2.35.1
+
--- /dev/null
+From 8c6329cbee8ca211e98a3fcbddba3631d2e7725c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jul 2022 04:27:48 +0000
+Subject: ext4: avoid resizing to a partial cluster size
+
+From: Kiselev, Oleg <okiselev@amazon.com>
+
+[ Upstream commit 69cb8e9d8cd97cdf5e293b26d70a9dee3e35e6bd ]
+
+This patch avoids an attempt to resize the filesystem to an
+unaligned cluster boundary. An online resize to a size that is not
+integral to cluster size results in the last iteration attempting to
+grow the fs by a negative amount, which trips a BUG_ON and leaves the fs
+with a corrupted in-memory superblock.
+
+Signed-off-by: Oleg Kiselev <okiselev@amazon.com>
+Link: https://lore.kernel.org/r/0E92A0AB-4F16-4F1A-94B7-702CC6504FDE@amazon.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/resize.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index e5c2713aa11a..cb5a64293881 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1989,6 +1989,16 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count)
+ }
+ brelse(bh);
+
++ /*
++ * For bigalloc, trim the requested size to the nearest cluster
++ * boundary to avoid creating an unusable filesystem. We do this
++ * silently, instead of returning an error, to avoid breaking
++ * callers that blindly resize the filesystem to the full size of
++ * the underlying block device.
++ */
++ if (ext4_has_feature_bigalloc(sb))
++ n_blocks_count &= ~((1 << EXT4_CLUSTER_BITS(sb)) - 1);
++
+ retry:
+ o_blocks_count = ext4_blocks_count(es);
+
+--
+2.35.1
+
--- /dev/null
+From 0f47fa7dcfa0691c0ae42afc8f3d78e981e1ba8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jul 2022 18:59:03 +0200
+Subject: ext4: block range must be validated before use in ext4_mb_clear_bb()
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+[ Upstream commit 1e1c2b86ef86a8477fd9b9a4f48a6bfe235606f6 ]
+
+Block range to free is validated in ext4_free_blocks() using
+ext4_inode_block_valid() and then it's passed to ext4_mb_clear_bb().
+However in some situations on bigalloc file system the range might be
+adjusted after the validation in ext4_free_blocks() which can lead to
+troubles on corrupted file systems such as one found by syzkaller that
+resulted in the following BUG
+
+kernel BUG at fs/ext4/ext4.h:3319!
+PREEMPT SMP NOPTI
+CPU: 28 PID: 4243 Comm: repro Kdump: loaded Not tainted 5.19.0-rc6+ #1
+Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1.fc35 04/01/2014
+RIP: 0010:ext4_free_blocks+0x95e/0xa90
+Call Trace:
+ <TASK>
+ ? lock_timer_base+0x61/0x80
+ ? __es_remove_extent+0x5a/0x760
+ ? __mod_timer+0x256/0x380
+ ? ext4_ind_truncate_ensure_credits+0x90/0x220
+ ext4_clear_blocks+0x107/0x1b0
+ ext4_free_data+0x15b/0x170
+ ext4_ind_truncate+0x214/0x2c0
+ ? _raw_spin_unlock+0x15/0x30
+ ? ext4_discard_preallocations+0x15a/0x410
+ ? ext4_journal_check_start+0xe/0x90
+ ? __ext4_journal_start_sb+0x2f/0x110
+ ext4_truncate+0x1b5/0x460
+ ? __ext4_journal_start_sb+0x2f/0x110
+ ext4_evict_inode+0x2b4/0x6f0
+ evict+0xd0/0x1d0
+ ext4_enable_quotas+0x11f/0x1f0
+ ext4_orphan_cleanup+0x3de/0x430
+ ? proc_create_seq_private+0x43/0x50
+ ext4_fill_super+0x295f/0x3ae0
+ ? snprintf+0x39/0x40
+ ? sget_fc+0x19c/0x330
+ ? ext4_reconfigure+0x850/0x850
+ get_tree_bdev+0x16d/0x260
+ vfs_get_tree+0x25/0xb0
+ path_mount+0x431/0xa70
+ __x64_sys_mount+0xe2/0x120
+ do_syscall_64+0x5b/0x80
+ ? do_user_addr_fault+0x1e2/0x670
+ ? exc_page_fault+0x70/0x170
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+RIP: 0033:0x7fdf4e512ace
+
+Fix it by making sure that the block range is properly validated before
+used every time it changes in ext4_free_blocks() or ext4_mb_clear_bb().
+
+Link: https://syzkaller.appspot.com/bug?id=5266d464285a03cee9dbfda7d2452a72c3c2ae7c
+Reported-by: syzbot+15cd994e273307bf5cfa@syzkaller.appspotmail.com
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Cc: Tadeusz Struk <tadeusz.struk@linaro.org>
+Tested-by: Tadeusz Struk <tadeusz.struk@linaro.org>
+Link: https://lore.kernel.org/r/20220714165903.58260-1-lczerner@redhat.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/mballoc.c | 21 ++++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 9e06334771a3..38e7dc2531b1 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -5928,6 +5928,15 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode,
+
+ sbi = EXT4_SB(sb);
+
++ if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) &&
++ !ext4_inode_block_valid(inode, block, count)) {
++ ext4_error(sb, "Freeing blocks in system zone - "
++ "Block = %llu, count = %lu", block, count);
++ /* err = 0. ext4_std_error should be a no op */
++ goto error_return;
++ }
++ flags |= EXT4_FREE_BLOCKS_VALIDATED;
++
+ do_more:
+ overflow = 0;
+ ext4_get_group_no_and_offset(sb, block, &block_group, &bit);
+@@ -5944,6 +5953,8 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode,
+ overflow = EXT4_C2B(sbi, bit) + count -
+ EXT4_BLOCKS_PER_GROUP(sb);
+ count -= overflow;
++ /* The range changed so it's no longer validated */
++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED;
+ }
+ count_clusters = EXT4_NUM_B2C(sbi, count);
+ bitmap_bh = ext4_read_block_bitmap(sb, block_group);
+@@ -5958,7 +5969,8 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode,
+ goto error_return;
+ }
+
+- if (!ext4_inode_block_valid(inode, block, count)) {
++ if (!(flags & EXT4_FREE_BLOCKS_VALIDATED) &&
++ !ext4_inode_block_valid(inode, block, count)) {
+ ext4_error(sb, "Freeing blocks in system zone - "
+ "Block = %llu, count = %lu", block, count);
+ /* err = 0. ext4_std_error should be a no op */
+@@ -6081,6 +6093,8 @@ static void ext4_mb_clear_bb(handle_t *handle, struct inode *inode,
+ block += count;
+ count = overflow;
+ put_bh(bitmap_bh);
++ /* The range changed so it's no longer validated */
++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED;
+ goto do_more;
+ }
+ error_return:
+@@ -6127,6 +6141,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
+ "block = %llu, count = %lu", block, count);
+ return;
+ }
++ flags |= EXT4_FREE_BLOCKS_VALIDATED;
+
+ ext4_debug("freeing block %llu\n", block);
+ trace_ext4_free_blocks(inode, block, count, flags);
+@@ -6158,6 +6173,8 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
+ block -= overflow;
+ count += overflow;
+ }
++ /* The range changed so it's no longer validated */
++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED;
+ }
+ overflow = EXT4_LBLK_COFF(sbi, count);
+ if (overflow) {
+@@ -6168,6 +6185,8 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
+ return;
+ } else
+ count += sbi->s_cluster_ratio - overflow;
++ /* The range changed so it's no longer validated */
++ flags &= ~EXT4_FREE_BLOCKS_VALIDATED;
+ }
+
+ if (!bh && (flags & EXT4_FREE_BLOCKS_FORGET)) {
+--
+2.35.1
+
--- /dev/null
+From eed55d04d4185ca2f32fad85385ca5c91a79253b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Aug 2022 19:26:04 +0800
+Subject: f2fs: fix null-ptr-deref in f2fs_get_dnode_of_data
+
+From: Ye Bin <yebin10@huawei.com>
+
+[ Upstream commit 4a2c5b7994960fac29cf8a3f4e62855bae1b27d4 ]
+
+There is issue as follows when test f2fs atomic write:
+F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
+F2FS-fs (loop0): invalid crc_offset: 0
+F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.
+F2FS-fs (loop0): f2fs_check_nid_range: out-of-range nid=2, run fsck to fix.
+==================================================================
+BUG: KASAN: null-ptr-deref in f2fs_get_dnode_of_data+0xac/0x16d0
+Read of size 8 at addr 0000000000000028 by task rep/1990
+
+CPU: 4 PID: 1990 Comm: rep Not tainted 5.19.0-rc6-next-20220715 #266
+Call Trace:
+ <TASK>
+ dump_stack_lvl+0x6e/0x91
+ print_report.cold+0x49a/0x6bb
+ kasan_report+0xa8/0x130
+ f2fs_get_dnode_of_data+0xac/0x16d0
+ f2fs_do_write_data_page+0x2a5/0x1030
+ move_data_page+0x3c5/0xdf0
+ do_garbage_collect+0x2015/0x36c0
+ f2fs_gc+0x554/0x1d30
+ f2fs_balance_fs+0x7f5/0xda0
+ f2fs_write_single_data_page+0xb66/0xdc0
+ f2fs_write_cache_pages+0x716/0x1420
+ f2fs_write_data_pages+0x84f/0x9a0
+ do_writepages+0x130/0x3a0
+ filemap_fdatawrite_wbc+0x87/0xa0
+ file_write_and_wait_range+0x157/0x1c0
+ f2fs_do_sync_file+0x206/0x12d0
+ f2fs_sync_file+0x99/0xc0
+ vfs_fsync_range+0x75/0x140
+ f2fs_file_write_iter+0xd7b/0x1850
+ vfs_write+0x645/0x780
+ ksys_write+0xf1/0x1e0
+ do_syscall_64+0x3b/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+As 3db1de0e582c commit changed atomic write way which new a cow_inode for
+atomic write file, and also mark cow_inode as FI_ATOMIC_FILE.
+When f2fs_do_write_data_page write cow_inode will use cow_inode's cow_inode
+which is NULL. Then will trigger null-ptr-deref.
+To solve above issue, introduce FI_COW_FILE flag for COW inode.
+
+Fiexes: 3db1de0e582c("f2fs: change the current atomic write way")
+Signed-off-by: Ye Bin <yebin10@huawei.com>
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/f2fs.h | 6 ++++++
+ fs/f2fs/file.c | 2 +-
+ fs/f2fs/segment.c | 4 ++--
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 5c950298837f..7006fa7dd5cb 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -757,6 +757,7 @@ enum {
+ FI_ENABLE_COMPRESS, /* enable compression in "user" compression mode */
+ FI_COMPRESS_RELEASED, /* compressed blocks were released */
+ FI_ALIGNED_WRITE, /* enable aligned write */
++ FI_COW_FILE, /* indicate COW file */
+ FI_MAX, /* max flag, never be used */
+ };
+
+@@ -3208,6 +3209,11 @@ static inline bool f2fs_is_atomic_file(struct inode *inode)
+ return is_inode_flag_set(inode, FI_ATOMIC_FILE);
+ }
+
++static inline bool f2fs_is_cow_file(struct inode *inode)
++{
++ return is_inode_flag_set(inode, FI_COW_FILE);
++}
++
+ static inline bool f2fs_is_first_block_written(struct inode *inode)
+ {
+ return is_inode_flag_set(inode, FI_FIRST_BLOCK_WRITTEN);
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 41547604f192..ecd833ba35fc 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2061,7 +2061,7 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)
+ spin_unlock(&sbi->inode_lock[ATOMIC_FILE]);
+
+ set_inode_flag(inode, FI_ATOMIC_FILE);
+- set_inode_flag(fi->cow_inode, FI_ATOMIC_FILE);
++ set_inode_flag(fi->cow_inode, FI_COW_FILE);
+ clear_inode_flag(fi->cow_inode, FI_INLINE_DATA);
+ f2fs_up_write(&fi->i_gc_rwsem[WRITE]);
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index ac890c9fa8a1..52df19a0638b 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -193,7 +193,7 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)
+ if (f2fs_is_atomic_file(inode)) {
+ if (clean)
+ truncate_inode_pages_final(inode->i_mapping);
+- clear_inode_flag(fi->cow_inode, FI_ATOMIC_FILE);
++ clear_inode_flag(fi->cow_inode, FI_COW_FILE);
+ iput(fi->cow_inode);
+ fi->cow_inode = NULL;
+ clear_inode_flag(inode, FI_ATOMIC_FILE);
+@@ -3166,7 +3166,7 @@ static int __get_segment_type_6(struct f2fs_io_info *fio)
+ return CURSEG_COLD_DATA;
+ if (file_is_hot(inode) ||
+ is_inode_flag_set(inode, FI_HOT_DATA) ||
+- f2fs_is_atomic_file(inode))
++ f2fs_is_cow_file(inode))
+ return CURSEG_HOT_DATA;
+ return f2fs_rw_hint_to_seg_type(inode->i_write_hint);
+ } else {
+--
+2.35.1
+
--- /dev/null
+From 84aac8b3a09404badd69aaab62ded09b2e42e43a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Jul 2022 00:03:23 +0800
+Subject: f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
+
+From: Chao Yu <chao.yu@oppo.com>
+
+[ Upstream commit 141170b759e03958f296033bb7001be62d1d363b ]
+
+As Dipanjan Das <mail.dipanjan.das@gmail.com> reported, syzkaller
+found a f2fs bug as below:
+
+RIP: 0010:f2fs_new_node_page+0x19ac/0x1fc0 fs/f2fs/node.c:1295
+Call Trace:
+ write_all_xattrs fs/f2fs/xattr.c:487 [inline]
+ __f2fs_setxattr+0xe76/0x2e10 fs/f2fs/xattr.c:743
+ f2fs_setxattr+0x233/0xab0 fs/f2fs/xattr.c:790
+ f2fs_xattr_generic_set+0x133/0x170 fs/f2fs/xattr.c:86
+ __vfs_setxattr+0x115/0x180 fs/xattr.c:182
+ __vfs_setxattr_noperm+0x125/0x5f0 fs/xattr.c:216
+ __vfs_setxattr_locked+0x1cf/0x260 fs/xattr.c:277
+ vfs_setxattr+0x13f/0x330 fs/xattr.c:303
+ setxattr+0x146/0x160 fs/xattr.c:611
+ path_setxattr+0x1a7/0x1d0 fs/xattr.c:630
+ __do_sys_lsetxattr fs/xattr.c:653 [inline]
+ __se_sys_lsetxattr fs/xattr.c:649 [inline]
+ __x64_sys_lsetxattr+0xbd/0x150 fs/xattr.c:649
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x46/0xb0
+
+NAT entry and nat bitmap can be inconsistent, e.g. one nid is free
+in nat bitmap, and blkaddr in its NAT entry is not NULL_ADDR, it
+may trigger BUG_ON() in f2fs_new_node_page(), fix it.
+
+Reported-by: Dipanjan Das <mail.dipanjan.das@gmail.com>
+Signed-off-by: Chao Yu <chao.yu@oppo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/node.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index cf6f7fc83c08..02e92a72511b 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -1292,7 +1292,11 @@ struct page *f2fs_new_node_page(struct dnode_of_data *dn, unsigned int ofs)
+ dec_valid_node_count(sbi, dn->inode, !ofs);
+ goto fail;
+ }
+- f2fs_bug_on(sbi, new_ni.blk_addr != NULL_ADDR);
++ if (unlikely(new_ni.blk_addr != NULL_ADDR)) {
++ err = -EFSCORRUPTED;
++ set_sbi_flag(sbi, SBI_NEED_FSCK);
++ goto fail;
++ }
+ #endif
+ new_ni.nid = dn->nid;
+ new_ni.ino = dn->inode->i_ino;
+--
+2.35.1
+
--- /dev/null
+From ca7a549a0d8761037df603d77756a9699f24e95d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jul 2022 22:51:05 +0800
+Subject: f2fs: fix to do sanity check on segment type in build_sit_entries()
+
+From: Chao Yu <chao.yu@oppo.com>
+
+[ Upstream commit 09beadf289d6e300553e60d6e76f13c0427ecab3 ]
+
+As Wenqing Liu <wenqingliu0120@gmail.com> reported in bugzilla:
+
+https://bugzilla.kernel.org/show_bug.cgi?id=216285
+
+RIP: 0010:memcpy_erms+0x6/0x10
+ f2fs_update_meta_page+0x84/0x570 [f2fs]
+ change_curseg.constprop.0+0x159/0xbd0 [f2fs]
+ f2fs_do_replace_block+0x5c7/0x18a0 [f2fs]
+ f2fs_replace_block+0xeb/0x180 [f2fs]
+ recover_data+0x1abd/0x6f50 [f2fs]
+ f2fs_recover_fsync_data+0x12ce/0x3250 [f2fs]
+ f2fs_fill_super+0x4459/0x6190 [f2fs]
+ mount_bdev+0x2cf/0x3b0
+ legacy_get_tree+0xed/0x1d0
+ vfs_get_tree+0x81/0x2b0
+ path_mount+0x47e/0x19d0
+ do_mount+0xce/0xf0
+ __x64_sys_mount+0x12c/0x1a0
+ do_syscall_64+0x38/0x90
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+
+The root cause is segment type is invalid, so in f2fs_do_replace_block(),
+f2fs accesses f2fs_sm_info::curseg_array with out-of-range segment type,
+result in accessing invalid curseg->sum_blk during memcpy in
+f2fs_update_meta_page(). Fix this by adding sanity check on segment type
+in build_sit_entries().
+
+Reported-by: Wenqing Liu <wenqingliu0120@gmail.com>
+Signed-off-by: Chao Yu <chao.yu@oppo.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 874c1b9c41a2..ac890c9fa8a1 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -4362,6 +4362,12 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ return err;
+ seg_info_from_raw_sit(se, &sit);
+
++ if (se->type >= NR_PERSISTENT_LOG) {
++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u",
++ se->type, start);
++ return -EFSCORRUPTED;
++ }
++
+ sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks;
+
+ if (f2fs_block_unit_discard(sbi)) {
+@@ -4410,6 +4416,13 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
+ break;
+ seg_info_from_raw_sit(se, &sit);
+
++ if (se->type >= NR_PERSISTENT_LOG) {
++ f2fs_err(sbi, "Invalid segment type: %u, segno: %u",
++ se->type, start);
++ err = -EFSCORRUPTED;
++ break;
++ }
++
+ sit_valid_blocks[SE_PAGETYPE(se)] += se->valid_blocks;
+
+ if (f2fs_block_unit_discard(sbi)) {
+--
+2.35.1
+
--- /dev/null
+From ffc931d64638e53ec0504c9d2d3e57045fcd70d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Aug 2022 10:08:08 -0700
+Subject: f2fs: revive F2FS_IOC_ABORT_VOLATILE_WRITE
+
+From: Daeho Jeong <daehojeong@google.com>
+
+[ Upstream commit 23339e5752d01a4b5e122759b002cf896d26f6c1 ]
+
+F2FS_IOC_ABORT_VOLATILE_WRITE was used to abort a atomic write before.
+However it was removed accidentally. So revive it by changing the name,
+since volatile write had gone.
+
+Signed-off-by: Daeho Jeong <daehojeong@google.com>
+Fiexes: 7bc155fec5b3("f2fs: kill volatile write support")
+Reviewed-by: Chao Yu <chao@kernel.org>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 30 ++++++++++++++++++++++++++++--
+ include/uapi/linux/f2fs.h | 2 +-
+ 2 files changed, 29 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index fc0f30738b21..41547604f192 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2108,6 +2108,31 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)
+ return ret;
+ }
+
++static int f2fs_ioc_abort_atomic_write(struct file *filp)
++{
++ struct inode *inode = file_inode(filp);
++ struct user_namespace *mnt_userns = file_mnt_user_ns(filp);
++ int ret;
++
++ if (!inode_owner_or_capable(mnt_userns, inode))
++ return -EACCES;
++
++ ret = mnt_want_write_file(filp);
++ if (ret)
++ return ret;
++
++ inode_lock(inode);
++
++ if (f2fs_is_atomic_file(inode))
++ f2fs_abort_atomic_write(inode, true);
++
++ inode_unlock(inode);
++
++ mnt_drop_write_file(filp);
++ f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
++ return ret;
++}
++
+ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
+ {
+ struct inode *inode = file_inode(filp);
+@@ -4063,9 +4088,10 @@ static long __f2fs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ return f2fs_ioc_start_atomic_write(filp);
+ case F2FS_IOC_COMMIT_ATOMIC_WRITE:
+ return f2fs_ioc_commit_atomic_write(filp);
++ case F2FS_IOC_ABORT_ATOMIC_WRITE:
++ return f2fs_ioc_abort_atomic_write(filp);
+ case F2FS_IOC_START_VOLATILE_WRITE:
+ case F2FS_IOC_RELEASE_VOLATILE_WRITE:
+- case F2FS_IOC_ABORT_VOLATILE_WRITE:
+ return -EOPNOTSUPP;
+ case F2FS_IOC_SHUTDOWN:
+ return f2fs_ioc_shutdown(filp, arg);
+@@ -4734,7 +4760,7 @@ long f2fs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ case F2FS_IOC_COMMIT_ATOMIC_WRITE:
+ case F2FS_IOC_START_VOLATILE_WRITE:
+ case F2FS_IOC_RELEASE_VOLATILE_WRITE:
+- case F2FS_IOC_ABORT_VOLATILE_WRITE:
++ case F2FS_IOC_ABORT_ATOMIC_WRITE:
+ case F2FS_IOC_SHUTDOWN:
+ case FITRIM:
+ case FS_IOC_SET_ENCRYPTION_POLICY:
+diff --git a/include/uapi/linux/f2fs.h b/include/uapi/linux/f2fs.h
+index 352a822d4370..3121d127d5aa 100644
+--- a/include/uapi/linux/f2fs.h
++++ b/include/uapi/linux/f2fs.h
+@@ -13,7 +13,7 @@
+ #define F2FS_IOC_COMMIT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 2)
+ #define F2FS_IOC_START_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 3)
+ #define F2FS_IOC_RELEASE_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 4)
+-#define F2FS_IOC_ABORT_VOLATILE_WRITE _IO(F2FS_IOCTL_MAGIC, 5)
++#define F2FS_IOC_ABORT_ATOMIC_WRITE _IO(F2FS_IOCTL_MAGIC, 5)
+ #define F2FS_IOC_GARBAGE_COLLECT _IOW(F2FS_IOCTL_MAGIC, 6, __u32)
+ #define F2FS_IOC_WRITE_CHECKPOINT _IO(F2FS_IOCTL_MAGIC, 7)
+ #define F2FS_IOC_DEFRAGMENT _IOWR(F2FS_IOCTL_MAGIC, 8, \
+--
+2.35.1
+
--- /dev/null
+From 02daf2437f6a7e7f12e4577c57f1a0c085566899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 09:06:44 +0200
+Subject: gadgetfs: ep_io - wait until IRQ finishes
+
+From: Jozef Martiniak <jomajm@gmail.com>
+
+[ Upstream commit 04cb742d4d8f30dc2e83b46ac317eec09191c68e ]
+
+after usb_ep_queue() if wait_for_completion_interruptible() is
+interrupted we need to wait until IRQ gets finished.
+
+Otherwise complete() from epio_complete() can corrupt stack.
+
+Signed-off-by: Jozef Martiniak <jomajm@gmail.com>
+Link: https://lore.kernel.org/r/20220708070645.6130-1-jomajm@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/legacy/inode.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index 79990597c39f..01c3ead7d1b4 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -362,6 +362,7 @@ ep_io (struct ep_data *epdata, void *buf, unsigned len)
+ spin_unlock_irq (&epdata->dev->lock);
+
+ DBG (epdata->dev, "endpoint gone\n");
++ wait_for_completion(&done);
+ epdata->status = -ENODEV;
+ }
+ }
+--
+2.35.1
+
--- /dev/null
+From a9ad6dadd5b79eb16149dcfff6145b496d3f87a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 May 2022 10:54:30 +0300
+Subject: habanalabs: add terminating NULL to attrs arrays
+
+From: Dafna Hirschfeld <dhirschfeld@habana.ai>
+
+[ Upstream commit 78d503087be190eab36290644ccec050135e7c70 ]
+
+Arrays of struct attribute are expected to be NULL terminated.
+This is required by API methods such as device_add_groups.
+This fixes a crash when loading the driver for Goya device.
+
+Signed-off-by: Dafna Hirschfeld <dhirschfeld@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/common/sysfs.c | 2 ++
+ drivers/misc/habanalabs/gaudi/gaudi.c | 1 +
+ drivers/misc/habanalabs/goya/goya_hwmgr.c | 2 ++
+ 3 files changed, 5 insertions(+)
+
+diff --git a/drivers/misc/habanalabs/common/sysfs.c b/drivers/misc/habanalabs/common/sysfs.c
+index 9ebeb18ab85e..da8181068895 100644
+--- a/drivers/misc/habanalabs/common/sysfs.c
++++ b/drivers/misc/habanalabs/common/sysfs.c
+@@ -73,6 +73,7 @@ static DEVICE_ATTR_RO(clk_cur_freq_mhz);
+ static struct attribute *hl_dev_clk_attrs[] = {
+ &dev_attr_clk_max_freq_mhz.attr,
+ &dev_attr_clk_cur_freq_mhz.attr,
++ NULL,
+ };
+
+ static ssize_t vrm_ver_show(struct device *dev, struct device_attribute *attr, char *buf)
+@@ -93,6 +94,7 @@ static DEVICE_ATTR_RO(vrm_ver);
+
+ static struct attribute *hl_dev_vrm_attrs[] = {
+ &dev_attr_vrm_ver.attr,
++ NULL,
+ };
+
+ static ssize_t uboot_ver_show(struct device *dev, struct device_attribute *attr,
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index fba322241096..25d735aee6a3 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -9187,6 +9187,7 @@ static DEVICE_ATTR_RO(infineon_ver);
+
+ static struct attribute *gaudi_vrm_dev_attrs[] = {
+ &dev_attr_infineon_ver.attr,
++ NULL,
+ };
+
+ static void gaudi_add_device_attr(struct hl_device *hdev, struct attribute_group *dev_clk_attr_grp,
+diff --git a/drivers/misc/habanalabs/goya/goya_hwmgr.c b/drivers/misc/habanalabs/goya/goya_hwmgr.c
+index 6580fc6a486a..b595721751c1 100644
+--- a/drivers/misc/habanalabs/goya/goya_hwmgr.c
++++ b/drivers/misc/habanalabs/goya/goya_hwmgr.c
+@@ -359,6 +359,7 @@ static struct attribute *goya_clk_dev_attrs[] = {
+ &dev_attr_pm_mng_profile.attr,
+ &dev_attr_tpc_clk.attr,
+ &dev_attr_tpc_clk_curr.attr,
++ NULL,
+ };
+
+ static ssize_t infineon_ver_show(struct device *dev, struct device_attribute *attr, char *buf)
+@@ -375,6 +376,7 @@ static DEVICE_ATTR_RO(infineon_ver);
+
+ static struct attribute *goya_vrm_dev_attrs[] = {
+ &dev_attr_infineon_ver.attr,
++ NULL,
+ };
+
+ void goya_add_device_attr(struct hl_device *hdev, struct attribute_group *dev_clk_attr_grp,
+--
+2.35.1
+
--- /dev/null
+From c0175ed49cb1a873a552bac110bccc6d4b21182f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jun 2022 16:11:31 +0300
+Subject: habanalabs/gaudi: fix shift out of bounds
+
+From: Ofir Bitton <obitton@habana.ai>
+
+[ Upstream commit 01622098aeb05a5efbb727199bbc2a4653393255 ]
+
+When validating NIC queues, queue offset calculation must be
+performed only for NIC queues.
+
+Signed-off-by: Ofir Bitton <obitton@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/gaudi/gaudi.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index e6bfaf55c6b6..3fb221f2e393 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -5654,15 +5654,17 @@ static int gaudi_parse_cb_no_ext_queue(struct hl_device *hdev,
+ {
+ struct asic_fixed_properties *asic_prop = &hdev->asic_prop;
+ struct gaudi_device *gaudi = hdev->asic_specific;
+- u32 nic_mask_q_id = 1 << (HW_CAP_NIC_SHIFT +
+- ((parser->hw_queue_id - GAUDI_QUEUE_ID_NIC_0_0) >> 2));
++ u32 nic_queue_offset, nic_mask_q_id;
+
+ if ((parser->hw_queue_id >= GAUDI_QUEUE_ID_NIC_0_0) &&
+- (parser->hw_queue_id <= GAUDI_QUEUE_ID_NIC_9_3) &&
+- (!(gaudi->hw_cap_initialized & nic_mask_q_id))) {
+- dev_err(hdev->dev, "h/w queue %d is disabled\n",
+- parser->hw_queue_id);
+- return -EINVAL;
++ (parser->hw_queue_id <= GAUDI_QUEUE_ID_NIC_9_3)) {
++ nic_queue_offset = parser->hw_queue_id - GAUDI_QUEUE_ID_NIC_0_0;
++ nic_mask_q_id = 1 << (HW_CAP_NIC_SHIFT + (nic_queue_offset >> 2));
++
++ if (!(gaudi->hw_cap_initialized & nic_mask_q_id)) {
++ dev_err(hdev->dev, "h/w queue %d is disabled\n", parser->hw_queue_id);
++ return -EINVAL;
++ }
+ }
+
+ /* For internal queue jobs just check if CB address is valid */
+--
+2.35.1
+
--- /dev/null
+From 624981f2eaffbdf5a9824c24afa7992224ae93e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jun 2022 16:02:09 +0300
+Subject: habanalabs/gaudi: invoke device reset from one code block
+
+From: Tal Cohen <talcohen@habana.ai>
+
+[ Upstream commit be572e67dafbf8004d46a2c9d97338c107efb60e ]
+
+In order to prepare the driver code for device reset event
+notification, change the event handler function flow to call
+device reset from one code block.
+
+In addition, the commit fixes an issue that reset was performed
+w/o checking the 'hard_reset_on_fw_event' state and w/o setting
+the HL_DRV_RESET_DELAY flag.
+
+Signed-off-by: Tal Cohen <talcohen@habana.ai>
+Reviewed-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/gaudi/gaudi.c | 25 ++++++++++++++++---------
+ 1 file changed, 16 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 25d735aee6a3..e6bfaf55c6b6 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -7717,10 +7717,10 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
+ struct gaudi_device *gaudi = hdev->asic_specific;
+ u64 data = le64_to_cpu(eq_entry->data[0]);
+ u32 ctl = le32_to_cpu(eq_entry->hdr.ctl);
+- u32 fw_fatal_err_flag = 0;
++ u32 fw_fatal_err_flag = 0, flags = 0;
+ u16 event_type = ((ctl & EQ_CTL_EVENT_TYPE_MASK)
+ >> EQ_CTL_EVENT_TYPE_SHIFT);
+- bool reset_required;
++ bool reset_required, reset_direct = false;
+ u8 cause;
+ int rc;
+
+@@ -7808,7 +7808,8 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
+ dev_err(hdev->dev, "reset required due to %s\n",
+ gaudi_irq_map_table[event_type].name);
+
+- hl_device_reset(hdev, 0);
++ reset_direct = true;
++ goto reset_device;
+ } else {
+ hl_fw_unmask_irq(hdev, event_type);
+ }
+@@ -7830,7 +7831,8 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
+ dev_err(hdev->dev, "reset required due to %s\n",
+ gaudi_irq_map_table[event_type].name);
+
+- hl_device_reset(hdev, 0);
++ reset_direct = true;
++ goto reset_device;
+ } else {
+ hl_fw_unmask_irq(hdev, event_type);
+ }
+@@ -7981,12 +7983,17 @@ static void gaudi_handle_eqe(struct hl_device *hdev,
+ return;
+
+ reset_device:
+- if (hdev->asic_prop.fw_security_enabled)
+- hl_device_reset(hdev, HL_DRV_RESET_HARD
+- | HL_DRV_RESET_BYPASS_REQ_TO_FW
+- | fw_fatal_err_flag);
++ reset_required = true;
++
++ if (hdev->asic_prop.fw_security_enabled && !reset_direct)
++ flags = HL_DRV_RESET_HARD | HL_DRV_RESET_BYPASS_REQ_TO_FW | fw_fatal_err_flag;
+ else if (hdev->hard_reset_on_fw_events)
+- hl_device_reset(hdev, HL_DRV_RESET_HARD | HL_DRV_RESET_DELAY | fw_fatal_err_flag);
++ flags = HL_DRV_RESET_HARD | HL_DRV_RESET_DELAY | fw_fatal_err_flag;
++ else
++ reset_required = false;
++
++ if (reset_required)
++ hl_device_reset(hdev, flags);
+ else
+ hl_fw_unmask_irq(hdev, event_type);
+ }
+--
+2.35.1
+
--- /dev/null
+From 908f80ac92bd7a09c2ed4eec3967433a42aad72d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jun 2022 16:45:02 +0300
+Subject: habanalabs/gaudi: mask constant value before cast
+
+From: Oded Gabbay <ogabbay@kernel.org>
+
+[ Upstream commit e3f49437a2e0221a387ecd192d742ae1434e1e3a ]
+
+This fixes a sparse warning of
+"cast truncates bits from constant value"
+
+Signed-off-by: Oded Gabbay <ogabbay@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/gaudi/gaudi.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c
+index 3fb221f2e393..b33616aacb33 100644
+--- a/drivers/misc/habanalabs/gaudi/gaudi.c
++++ b/drivers/misc/habanalabs/gaudi/gaudi.c
+@@ -3339,19 +3339,19 @@ static void gaudi_init_nic_qman(struct hl_device *hdev, u32 nic_offset,
+ u32 nic_qm_err_cfg, irq_handler_offset;
+ u32 q_off;
+
+- mtr_base_en_lo = lower_32_bits(CFG_BASE +
++ mtr_base_en_lo = lower_32_bits((CFG_BASE & U32_MAX) +
+ mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0);
+ mtr_base_en_hi = upper_32_bits(CFG_BASE +
+ mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0);
+- so_base_en_lo = lower_32_bits(CFG_BASE +
++ so_base_en_lo = lower_32_bits((CFG_BASE & U32_MAX) +
+ mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0);
+ so_base_en_hi = upper_32_bits(CFG_BASE +
+ mmSYNC_MNGR_E_N_SYNC_MNGR_OBJS_SOB_OBJ_0);
+- mtr_base_ws_lo = lower_32_bits(CFG_BASE +
++ mtr_base_ws_lo = lower_32_bits((CFG_BASE & U32_MAX) +
+ mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0);
+ mtr_base_ws_hi = upper_32_bits(CFG_BASE +
+ mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_MON_PAY_ADDRL_0);
+- so_base_ws_lo = lower_32_bits(CFG_BASE +
++ so_base_ws_lo = lower_32_bits((CFG_BASE & U32_MAX) +
+ mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0);
+ so_base_ws_hi = upper_32_bits(CFG_BASE +
+ mmSYNC_MNGR_W_S_SYNC_MNGR_OBJS_SOB_OBJ_0);
+--
+2.35.1
+
--- /dev/null
+From 5103cbc7f16f247eefc38b68fd69c2b1655affd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 May 2022 23:51:32 -0400
+Subject: HID: multitouch: new device class fix Lenovo X12 trackpad sticky
+
+From: Tao Jin <tao-j@outlook.com>
+
+[ Upstream commit 54eed5c7b938dc4ef6b14d4ee048bbdafdbce352 ]
+
+The trackpad of the given device sends continuous report of pointers
+status as per wxn8 spec. However, the spec did not clarify when the
+fingers are lifted so fast that between the interval of two report
+frames fingers on pad reduced from >=2 to 0. The second last report
+contains >=2 fingers with tip state 1 and the last report contains only
+1 finger with tip state 0. Although this can happen unfrequently, a
+ quick fix will be improve the consistency to 100%. A quick fix is to
+disable MT_QUIRK_ALWAYS_VALID and enable MT_QUIRK_NOT_SEEN_MEANS_UP.
+
+Test for hid-tools is added in [1]
+
+In addition to this, I2C device 04CA:00B1 may also need similar class
+but with MT_QUIRK_FORCE_MULTI_INPUT disabled (but it does not harm to
+ enable it on non-multi-input device either). The respective owner has
+been notified and a patch may coming soon after test.
+
+[1]: https://gitlab.freedesktop.org/libevdev/hid-tools/-/merge_requests/130
+
+Signed-off-by: Tao Jin <tao-j@outlook.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-multitouch.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
+index 6bb3890b0f2c..2e72922e36f5 100644
+--- a/drivers/hid/hid-multitouch.c
++++ b/drivers/hid/hid-multitouch.c
+@@ -194,6 +194,7 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app);
+ #define MT_CLS_WIN_8_FORCE_MULTI_INPUT 0x0015
+ #define MT_CLS_WIN_8_DISABLE_WAKEUP 0x0016
+ #define MT_CLS_WIN_8_NO_STICKY_FINGERS 0x0017
++#define MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU 0x0018
+
+ /* vendor specific classes */
+ #define MT_CLS_3M 0x0101
+@@ -286,6 +287,15 @@ static const struct mt_class mt_classes[] = {
+ MT_QUIRK_WIN8_PTP_BUTTONS |
+ MT_QUIRK_FORCE_MULTI_INPUT,
+ .export_all_inputs = true },
++ { .name = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
++ .quirks = MT_QUIRK_IGNORE_DUPLICATES |
++ MT_QUIRK_HOVERING |
++ MT_QUIRK_CONTACT_CNT_ACCURATE |
++ MT_QUIRK_STICKY_FINGERS |
++ MT_QUIRK_WIN8_PTP_BUTTONS |
++ MT_QUIRK_FORCE_MULTI_INPUT |
++ MT_QUIRK_NOT_SEEN_MEANS_UP,
++ .export_all_inputs = true },
+ { .name = MT_CLS_WIN_8_DISABLE_WAKEUP,
+ .quirks = MT_QUIRK_ALWAYS_VALID |
+ MT_QUIRK_IGNORE_DUPLICATES |
+@@ -783,6 +793,7 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ case HID_DG_CONFIDENCE:
+ if ((cls->name == MT_CLS_WIN_8 ||
+ cls->name == MT_CLS_WIN_8_FORCE_MULTI_INPUT ||
++ cls->name == MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU ||
+ cls->name == MT_CLS_WIN_8_DISABLE_WAKEUP) &&
+ (field->application == HID_DG_TOUCHPAD ||
+ field->application == HID_DG_TOUCHSCREEN))
+@@ -2035,7 +2046,7 @@ static const struct hid_device_id mt_devices[] = {
+ USB_DEVICE_ID_LENOVO_X1_TAB3) },
+
+ /* Lenovo X12 TAB Gen 1 */
+- { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT_NSMU,
+ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_LENOVO,
+ USB_DEVICE_ID_LENOVO_X12_TAB) },
+--
+2.35.1
+
--- /dev/null
+From 2b787cc9f3c69b1ed63cfc01181f77208f18da48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Aug 2022 15:25:49 +0200
+Subject: ice: Fix clearing of promisc mode with bridge over bond
+
+From: Grzegorz Siwik <grzegorz.siwik@intel.com>
+
+[ Upstream commit abddafd4585cc825d454da3cf308ad1226f6c554 ]
+
+When at least two interfaces are bonded and a bridge is enabled on the
+bond, an error can occur when the bridge is removed and re-added. The
+reason for the error is because promiscuous mode was not fully cleared from
+the VLAN VSI in the hardware. With this change, promiscuous mode is
+properly removed when the bridge disconnects from bonding.
+
+[ 1033.676359] bond1: link status definitely down for interface enp95s0f0, disabling it
+[ 1033.676366] bond1: making interface enp175s0f0 the new active one
+[ 1033.676369] device enp95s0f0 left promiscuous mode
+[ 1033.676522] device enp175s0f0 entered promiscuous mode
+[ 1033.676901] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6
+[ 1041.795662] ice 0000:af:00.0 enp175s0f0: Error setting Multicast promiscuous mode on VSI 6
+[ 1041.944826] bond1: link status definitely down for interface enp175s0f0, disabling it
+[ 1041.944874] device enp175s0f0 left promiscuous mode
+[ 1041.944918] bond1: now running without any active interface!
+
+Fixes: c31af68a1b94 ("ice: Add outer_vlan_ops and VSI specific VLAN ops implementations")
+Co-developed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Signed-off-by: Grzegorz Siwik <grzegorz.siwik@intel.com>
+Link: https://lore.kernel.org/all/CAK8fFZ7m-KR57M_rYX6xZN39K89O=LGooYkKsu6HKt0Bs+x6xQ@mail.gmail.com/
+Tested-by: Jaroslav Pulchart <jaroslav.pulchart@gooddata.com>
+Tested-by: Igor Raits <igor@gooddata.com>
+Tested-by: Gurucharan <gurucharanx.g@intel.com> (A Contingent worker at Intel)
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_lib.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
+index f5f744345fe7..da1a9cc47bd9 100644
+--- a/drivers/net/ethernet/intel/ice/ice_lib.c
++++ b/drivers/net/ethernet/intel/ice/ice_lib.c
+@@ -4082,7 +4082,11 @@ int ice_vsi_del_vlan_zero(struct ice_vsi *vsi)
+ if (err && err != -EEXIST)
+ return err;
+
+- return 0;
++ /* when deleting the last VLAN filter, make sure to disable the VLAN
++ * promisc mode so the filter isn't left by accident
++ */
++ return ice_clear_vsi_promisc(&vsi->back->hw, vsi->idx,
++ ICE_MCAST_VLAN_PROMISC_BITS, 0);
+ }
+
+ /**
+--
+2.35.1
+
--- /dev/null
+From 83868e96436314a3f2e9abe54e56ec136e7d7b8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jun 2022 17:29:25 +0800
+Subject: iommu/io-pgtable-arm-v7s: Add a quirk to allow pgtable PA up to 35bit
+
+From: Yunfei Wang <yf.wang@mediatek.com>
+
+[ Upstream commit bfdd231374181254742c5e2faef0bef2d30c0ee4 ]
+
+Single memory zone feature will remove ZONE_DMA32 and ZONE_DMA and
+cause pgtable PA size larger than 32bit.
+
+Since Mediatek IOMMU hardware support at most 35bit PA in pgtable,
+so add a quirk to allow the PA of pgtables support up to bit35.
+
+Signed-off-by: Ning Li <ning.li@mediatek.com>
+Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20220630092927.24925-2-yf.wang@mediatek.com
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/io-pgtable-arm-v7s.c | 75 ++++++++++++++++++++++--------
+ include/linux/io-pgtable.h | 15 ++++--
+ 2 files changed, 66 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
+index be066c1503d3..ba3115fd0f86 100644
+--- a/drivers/iommu/io-pgtable-arm-v7s.c
++++ b/drivers/iommu/io-pgtable-arm-v7s.c
+@@ -182,14 +182,8 @@ static bool arm_v7s_is_mtk_enabled(struct io_pgtable_cfg *cfg)
+ (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_EXT);
+ }
+
+-static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl,
+- struct io_pgtable_cfg *cfg)
++static arm_v7s_iopte to_mtk_iopte(phys_addr_t paddr, arm_v7s_iopte pte)
+ {
+- arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl);
+-
+- if (!arm_v7s_is_mtk_enabled(cfg))
+- return pte;
+-
+ if (paddr & BIT_ULL(32))
+ pte |= ARM_V7S_ATTR_MTK_PA_BIT32;
+ if (paddr & BIT_ULL(33))
+@@ -199,6 +193,17 @@ static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl,
+ return pte;
+ }
+
++static arm_v7s_iopte paddr_to_iopte(phys_addr_t paddr, int lvl,
++ struct io_pgtable_cfg *cfg)
++{
++ arm_v7s_iopte pte = paddr & ARM_V7S_LVL_MASK(lvl);
++
++ if (arm_v7s_is_mtk_enabled(cfg))
++ return to_mtk_iopte(paddr, pte);
++
++ return pte;
++}
++
+ static phys_addr_t iopte_to_paddr(arm_v7s_iopte pte, int lvl,
+ struct io_pgtable_cfg *cfg)
+ {
+@@ -240,10 +245,17 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
+ dma_addr_t dma;
+ size_t size = ARM_V7S_TABLE_SIZE(lvl, cfg);
+ void *table = NULL;
++ gfp_t gfp_l1;
++
++ /*
++ * ARM_MTK_TTBR_EXT extend the translation table base support larger
++ * memory address.
++ */
++ gfp_l1 = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ?
++ GFP_KERNEL : ARM_V7S_TABLE_GFP_DMA;
+
+ if (lvl == 1)
+- table = (void *)__get_free_pages(
+- __GFP_ZERO | ARM_V7S_TABLE_GFP_DMA, get_order(size));
++ table = (void *)__get_free_pages(gfp_l1 | __GFP_ZERO, get_order(size));
+ else if (lvl == 2)
+ table = kmem_cache_zalloc(data->l2_tables, gfp);
+
+@@ -251,7 +263,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
+ return NULL;
+
+ phys = virt_to_phys(table);
+- if (phys != (arm_v7s_iopte)phys) {
++ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ?
++ phys >= (1ULL << cfg->oas) : phys != (arm_v7s_iopte)phys) {
+ /* Doesn't fit in PTE */
+ dev_err(dev, "Page table does not fit in PTE: %pa", &phys);
+ goto out_free;
+@@ -457,9 +470,14 @@ static arm_v7s_iopte arm_v7s_install_table(arm_v7s_iopte *table,
+ arm_v7s_iopte curr,
+ struct io_pgtable_cfg *cfg)
+ {
++ phys_addr_t phys = virt_to_phys(table);
+ arm_v7s_iopte old, new;
+
+- new = virt_to_phys(table) | ARM_V7S_PTE_TYPE_TABLE;
++ new = phys | ARM_V7S_PTE_TYPE_TABLE;
++
++ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT)
++ new = to_mtk_iopte(phys, new);
++
+ if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
+ new |= ARM_V7S_ATTR_NS_TABLE;
+
+@@ -779,6 +797,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
+ void *cookie)
+ {
+ struct arm_v7s_io_pgtable *data;
++ slab_flags_t slab_flag;
++ phys_addr_t paddr;
+
+ if (cfg->ias > (arm_v7s_is_mtk_enabled(cfg) ? 34 : ARM_V7S_ADDR_BITS))
+ return NULL;
+@@ -788,7 +808,8 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
+
+ if (cfg->quirks & ~(IO_PGTABLE_QUIRK_ARM_NS |
+ IO_PGTABLE_QUIRK_NO_PERMS |
+- IO_PGTABLE_QUIRK_ARM_MTK_EXT))
++ IO_PGTABLE_QUIRK_ARM_MTK_EXT |
++ IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT))
+ return NULL;
+
+ /* If ARM_MTK_4GB is enabled, the NO_PERMS is also expected. */
+@@ -796,15 +817,27 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
+ !(cfg->quirks & IO_PGTABLE_QUIRK_NO_PERMS))
+ return NULL;
+
++ if ((cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT) &&
++ !arm_v7s_is_mtk_enabled(cfg))
++ return NULL;
++
+ data = kmalloc(sizeof(*data), GFP_KERNEL);
+ if (!data)
+ return NULL;
+
+ spin_lock_init(&data->split_lock);
++
++ /*
++ * ARM_MTK_TTBR_EXT extend the translation table base support larger
++ * memory address.
++ */
++ slab_flag = cfg->quirks & IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT ?
++ 0 : ARM_V7S_TABLE_SLAB_FLAGS;
++
+ data->l2_tables = kmem_cache_create("io-pgtable_armv7s_l2",
+ ARM_V7S_TABLE_SIZE(2, cfg),
+ ARM_V7S_TABLE_SIZE(2, cfg),
+- ARM_V7S_TABLE_SLAB_FLAGS, NULL);
++ slab_flag, NULL);
+ if (!data->l2_tables)
+ goto out_free_data;
+
+@@ -850,12 +883,16 @@ static struct io_pgtable *arm_v7s_alloc_pgtable(struct io_pgtable_cfg *cfg,
+ wmb();
+
+ /* TTBR */
+- cfg->arm_v7s_cfg.ttbr = virt_to_phys(data->pgd) | ARM_V7S_TTBR_S |
+- (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS |
+- ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_WBWA) |
+- ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_WBWA)) :
+- (ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_NC) |
+- ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_NC)));
++ paddr = virt_to_phys(data->pgd);
++ if (arm_v7s_is_mtk_enabled(cfg))
++ cfg->arm_v7s_cfg.ttbr = paddr | upper_32_bits(paddr);
++ else
++ cfg->arm_v7s_cfg.ttbr = paddr | ARM_V7S_TTBR_S |
++ (cfg->coherent_walk ? (ARM_V7S_TTBR_NOS |
++ ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_WBWA) |
++ ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_WBWA)) :
++ (ARM_V7S_TTBR_IRGN_ATTR(ARM_V7S_RGN_NC) |
++ ARM_V7S_TTBR_ORGN_ATTR(ARM_V7S_RGN_NC)));
+ return &data->iop;
+
+ out_free_data:
+diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h
+index 86af6f0a00a2..ca98aeadcc80 100644
+--- a/include/linux/io-pgtable.h
++++ b/include/linux/io-pgtable.h
+@@ -74,17 +74,22 @@ struct io_pgtable_cfg {
+ * to support up to 35 bits PA where the bit32, bit33 and bit34 are
+ * encoded in the bit9, bit4 and bit5 of the PTE respectively.
+ *
++ * IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT: (ARM v7s format) MediaTek IOMMUs
++ * extend the translation table base support up to 35 bits PA, the
++ * encoding format is same with IO_PGTABLE_QUIRK_ARM_MTK_EXT.
++ *
+ * IO_PGTABLE_QUIRK_ARM_TTBR1: (ARM LPAE format) Configure the table
+ * for use in the upper half of a split address space.
+ *
+ * IO_PGTABLE_QUIRK_ARM_OUTER_WBWA: Override the outer-cacheability
+ * attributes set in the TCR for a non-coherent page-table walker.
+ */
+- #define IO_PGTABLE_QUIRK_ARM_NS BIT(0)
+- #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1)
+- #define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3)
+- #define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5)
+- #define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6)
++ #define IO_PGTABLE_QUIRK_ARM_NS BIT(0)
++ #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1)
++ #define IO_PGTABLE_QUIRK_ARM_MTK_EXT BIT(3)
++ #define IO_PGTABLE_QUIRK_ARM_MTK_TTBR_EXT BIT(4)
++ #define IO_PGTABLE_QUIRK_ARM_TTBR1 BIT(5)
++ #define IO_PGTABLE_QUIRK_ARM_OUTER_WBWA BIT(6)
+ unsigned long quirks;
+ unsigned long pgsize_bitmap;
+ unsigned int ias;
+--
+2.35.1
+
--- /dev/null
+From ed7987e7a851b5d55c4bb279bd5bcdef4494c86b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 May 2022 22:14:12 +0530
+Subject: irqchip/tegra: Fix overflow implicit truncation warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+
+[ Upstream commit 443685992bda9bb4f8b17fc02c9f6c60e62b1461 ]
+
+Fix -Woverflow warnings for tegra irqchip driver which is a result
+of moving arm64 custom MMIO accessor macros to asm-generic function
+implementations giving a bonus type-checking now and uncovering these
+overflow warnings.
+
+drivers/irqchip/irq-tegra.c: In function ‘tegra_ictlr_suspend’:
+drivers/irqchip/irq-tegra.c:151:18: warning: large integer implicitly truncated to unsigned type [-Woverflow]
+ writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
+ ^
+
+Suggested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sai Prakash Ranjan <quic_saipraka@quicinc.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Cc: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-tegra.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/irqchip/irq-tegra.c b/drivers/irqchip/irq-tegra.c
+index e1f771c72fc4..ad3e2c1b3c87 100644
+--- a/drivers/irqchip/irq-tegra.c
++++ b/drivers/irqchip/irq-tegra.c
+@@ -148,10 +148,10 @@ static int tegra_ictlr_suspend(void)
+ lic->cop_iep[i] = readl_relaxed(ictlr + ICTLR_COP_IEP_CLASS);
+
+ /* Disable COP interrupts */
+- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR);
+
+ /* Disable CPU interrupts */
+- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR);
+
+ /* Enable the wakeup sources of ictlr */
+ writel_relaxed(lic->ictlr_wake_mask[i], ictlr + ICTLR_CPU_IER_SET);
+@@ -172,12 +172,12 @@ static void tegra_ictlr_resume(void)
+
+ writel_relaxed(lic->cpu_iep[i],
+ ictlr + ICTLR_CPU_IEP_CLASS);
+- writel_relaxed(~0ul, ictlr + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_CPU_IER_CLR);
+ writel_relaxed(lic->cpu_ier[i],
+ ictlr + ICTLR_CPU_IER_SET);
+ writel_relaxed(lic->cop_iep[i],
+ ictlr + ICTLR_COP_IEP_CLASS);
+- writel_relaxed(~0ul, ictlr + ICTLR_COP_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), ictlr + ICTLR_COP_IER_CLR);
+ writel_relaxed(lic->cop_ier[i],
+ ictlr + ICTLR_COP_IER_SET);
+ }
+@@ -312,7 +312,7 @@ static int __init tegra_ictlr_init(struct device_node *node,
+ lic->base[i] = base;
+
+ /* Disable all interrupts */
+- writel_relaxed(~0UL, base + ICTLR_CPU_IER_CLR);
++ writel_relaxed(GENMASK(31, 0), base + ICTLR_CPU_IER_CLR);
+ /* All interrupts target IRQ */
+ writel_relaxed(0, base + ICTLR_CPU_IEP_CLASS);
+
+--
+2.35.1
+
--- /dev/null
+From 3bd897d4dea1079aa9ab8d0abfbeb1e528e3d846 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Aug 2022 19:25:54 +0000
+Subject: KVM: arm64: Reject 32bit user PSTATE on asymmetric systems
+
+From: Oliver Upton <oliver.upton@linux.dev>
+
+[ Upstream commit b10d86fb8e46cc812171728bcd326df2f34e9ed5 ]
+
+KVM does not support AArch32 EL0 on asymmetric systems. To that end,
+prevent userspace from configuring a vCPU in such a state through
+setting PSTATE.
+
+It is already ABI that KVM rejects such a write on a system where
+AArch32 EL0 is unsupported. Though the kernel's definition of a 32bit
+system changed in commit 2122a833316f ("arm64: Allow mismatched
+32-bit EL0 support"), KVM's did not.
+
+Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support")
+Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220816192554.1455559-3-oliver.upton@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/guest.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
+index 8c607199cad1..f802a3b3f8db 100644
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -242,7 +242,7 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ u64 mode = (*(u64 *)valp) & PSR_AA32_MODE_MASK;
+ switch (mode) {
+ case PSR_AA32_MODE_USR:
+- if (!system_supports_32bit_el0())
++ if (!kvm_supports_32bit_el0())
+ return -EINVAL;
+ break;
+ case PSR_AA32_MODE_FIQ:
+--
+2.35.1
+
--- /dev/null
+From 248e5f093be0410db173806119269ea519ffb784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Aug 2022 19:25:53 +0000
+Subject: KVM: arm64: Treat PMCR_EL1.LC as RES1 on asymmetric systems
+
+From: Oliver Upton <oliver.upton@linux.dev>
+
+[ Upstream commit f3c6efc72f3b20ec23566e768979802f0a398f04 ]
+
+KVM does not support AArch32 on asymmetric systems. To that end, enforce
+AArch64-only behavior on PMCR_EL1.LC when on an asymmetric system.
+
+Fixes: 2122a833316f ("arm64: Allow mismatched 32-bit EL0 support")
+Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20220816192554.1455559-2-oliver.upton@linux.dev
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/kvm_host.h | 4 ++++
+ arch/arm64/kvm/arm.c | 3 +--
+ arch/arm64/kvm/sys_regs.c | 4 ++--
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
+index de32152cea04..7aaf75577096 100644
+--- a/arch/arm64/include/asm/kvm_host.h
++++ b/arch/arm64/include/asm/kvm_host.h
+@@ -838,6 +838,10 @@ bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu);
+ (system_supports_mte() && \
+ test_bit(KVM_ARCH_FLAG_MTE_ENABLED, &(kvm)->arch.flags))
+
++#define kvm_supports_32bit_el0() \
++ (system_supports_32bit_el0() && \
++ !static_branch_unlikely(&arm64_mismatched_32bit_el0))
++
+ int kvm_trng_call(struct kvm_vcpu *vcpu);
+ #ifdef CONFIG_KVM
+ extern phys_addr_t hyp_mem_base;
+diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c
+index 83a7f61354d3..e21b24574118 100644
+--- a/arch/arm64/kvm/arm.c
++++ b/arch/arm64/kvm/arm.c
+@@ -751,8 +751,7 @@ static bool vcpu_mode_is_bad_32bit(struct kvm_vcpu *vcpu)
+ if (likely(!vcpu_mode_is_32bit(vcpu)))
+ return false;
+
+- return !system_supports_32bit_el0() ||
+- static_branch_unlikely(&arm64_mismatched_32bit_el0);
++ return !kvm_supports_32bit_el0();
+ }
+
+ /**
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index c06c0477fab5..be7edd21537f 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -692,7 +692,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
+ */
+ val = ((pmcr & ~ARMV8_PMU_PMCR_MASK)
+ | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E);
+- if (!system_supports_32bit_el0())
++ if (!kvm_supports_32bit_el0())
+ val |= ARMV8_PMU_PMCR_LC;
+ __vcpu_sys_reg(vcpu, r->reg) = val;
+ }
+@@ -741,7 +741,7 @@ static bool access_pmcr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+ val = __vcpu_sys_reg(vcpu, PMCR_EL0);
+ val &= ~ARMV8_PMU_PMCR_MASK;
+ val |= p->regval & ARMV8_PMU_PMCR_MASK;
+- if (!system_supports_32bit_el0())
++ if (!kvm_supports_32bit_el0())
+ val |= ARMV8_PMU_PMCR_LC;
+ __vcpu_sys_reg(vcpu, PMCR_EL0) = val;
+ kvm_pmu_handle_pmcr(vcpu, val);
+--
+2.35.1
+
--- /dev/null
+From bbbb1c2702f4d4efc36a722c25afec980c362212 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 May 2022 10:05:50 -0300
+Subject: KVM: PPC: Book3S HV: Fix "rm_exit" entry in debugfs timings
+
+From: Fabiano Rosas <farosas@linux.ibm.com>
+
+[ Upstream commit 9981bace85d816ed8724ac46e49285e8488d29e6 ]
+
+At debugfs/kvm/<pid>/vcpu0/timings we show how long each part of the
+code takes to run:
+
+$ cat /sys/kernel/debug/kvm/*-*/vcpu0/timings
+rm_entry: 123785 49398892 118 4898
+rm_intr: 123780 6075890 22 390
+rm_exit: 0 0 0 0 <-- NOK
+guest: 123780 46732919988 402 9997638
+cede: 0 0 0 0 <-- OK, no cede napping in P9
+
+The "rm_exit" is always showing zero because it is the last one and
+end_timing does not increment the counter of the previous entry.
+
+We can fix it by calling accumulate_time again instead of
+end_timing. That way the counter gets incremented. The rest of the
+arithmetic can be ignored because there are no timing points after
+this and the accumulators are reset before the next round.
+
+Signed-off-by: Fabiano Rosas <farosas@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220525130554.2614394-2-farosas@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_hv_p9_entry.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv_p9_entry.c b/arch/powerpc/kvm/book3s_hv_p9_entry.c
+index 112a09b33328..7f88be386b27 100644
+--- a/arch/powerpc/kvm/book3s_hv_p9_entry.c
++++ b/arch/powerpc/kvm/book3s_hv_p9_entry.c
+@@ -438,15 +438,6 @@ void restore_p9_host_os_sprs(struct kvm_vcpu *vcpu,
+ EXPORT_SYMBOL_GPL(restore_p9_host_os_sprs);
+
+ #ifdef CONFIG_KVM_BOOK3S_HV_EXIT_TIMING
+-static void __start_timing(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator *next)
+-{
+- struct kvmppc_vcore *vc = vcpu->arch.vcore;
+- u64 tb = mftb() - vc->tb_offset_applied;
+-
+- vcpu->arch.cur_activity = next;
+- vcpu->arch.cur_tb_start = tb;
+-}
+-
+ static void __accumulate_time(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator *next)
+ {
+ struct kvmppc_vcore *vc = vcpu->arch.vcore;
+@@ -478,8 +469,8 @@ static void __accumulate_time(struct kvm_vcpu *vcpu, struct kvmhv_tb_accumulator
+ curr->seqcount = seq + 2;
+ }
+
+-#define start_timing(vcpu, next) __start_timing(vcpu, next)
+-#define end_timing(vcpu) __start_timing(vcpu, NULL)
++#define start_timing(vcpu, next) __accumulate_time(vcpu, next)
++#define end_timing(vcpu) __accumulate_time(vcpu, NULL)
+ #define accumulate_time(vcpu, next) __accumulate_time(vcpu, next)
+ #else
+ #define start_timing(vcpu, next) do {} while (0)
+--
+2.35.1
+
--- /dev/null
+From f9202f19c90c3a56155402fa876195c4de53940d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 May 2022 15:29:51 -0700
+Subject: lib/list_debug.c: Detect uninitialized lists
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 0cc011c576aaa4de505046f7a6c90933d7c749a9 ]
+
+In some circumstances, attempts are made to add entries to or to remove
+entries from an uninitialized list. A prime example is
+amdgpu_bo_vm_destroy(): It is indirectly called from
+ttm_bo_init_reserved() if that function fails, and tries to remove an
+entry from a list. However, that list is only initialized in
+amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned
+success. This results in crashes such as
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: 0000 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5
+ Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020
+ RIP: 0010:__list_del_entry_valid+0x26/0x7d
+ ...
+ Call Trace:
+ amdgpu_bo_vm_destroy+0x48/0x8b
+ ttm_bo_init_reserved+0x1d7/0x1e0
+ amdgpu_bo_create+0x212/0x476
+ ? amdgpu_bo_user_destroy+0x23/0x23
+ ? kmem_cache_alloc+0x60/0x271
+ amdgpu_bo_create_vm+0x40/0x7d
+ amdgpu_vm_pt_create+0xe8/0x24b
+ ...
+
+Check if the list's prev and next pointers are NULL to catch such problems.
+
+Link: https://lkml.kernel.org/r/20220531222951.92073-1-linux@roeck-us.net
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/list_debug.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/lib/list_debug.c b/lib/list_debug.c
+index 9daa3fb9d1cd..d98d43f80958 100644
+--- a/lib/list_debug.c
++++ b/lib/list_debug.c
+@@ -20,7 +20,11 @@
+ bool __list_add_valid(struct list_head *new, struct list_head *prev,
+ struct list_head *next)
+ {
+- if (CHECK_DATA_CORRUPTION(next->prev != prev,
++ if (CHECK_DATA_CORRUPTION(prev == NULL,
++ "list_add corruption. prev is NULL.\n") ||
++ CHECK_DATA_CORRUPTION(next == NULL,
++ "list_add corruption. next is NULL.\n") ||
++ CHECK_DATA_CORRUPTION(next->prev != prev,
+ "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n",
+ prev, next->prev, next) ||
+ CHECK_DATA_CORRUPTION(prev->next != next,
+@@ -42,7 +46,11 @@ bool __list_del_entry_valid(struct list_head *entry)
+ prev = entry->prev;
+ next = entry->next;
+
+- if (CHECK_DATA_CORRUPTION(next == LIST_POISON1,
++ if (CHECK_DATA_CORRUPTION(next == NULL,
++ "list_del corruption, %px->next is NULL\n", entry) ||
++ CHECK_DATA_CORRUPTION(prev == NULL,
++ "list_del corruption, %px->prev is NULL\n", entry) ||
++ CHECK_DATA_CORRUPTION(next == LIST_POISON1,
+ "list_del corruption, %px->next is LIST_POISON1 (%px)\n",
+ entry, LIST_POISON1) ||
+ CHECK_DATA_CORRUPTION(prev == LIST_POISON2,
+--
+2.35.1
+
--- /dev/null
+From 903d216d6e03e3a3732e058db50a906615c55675 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jun 2022 10:27:56 -0600
+Subject: md: Notify sysfs sync_completed in md_reap_sync_thread()
+
+From: Logan Gunthorpe <logang@deltatee.com>
+
+[ Upstream commit 9973f0fa7d20269fe6fefe6333997fb5914449c1 ]
+
+The mdadm test 07layouts randomly produces a kernel hung task deadlock.
+The deadlock is caused by the suspend_lo/suspend_hi files being set by
+the mdadm background process during reshape and not being cleared
+because the process hangs. (Leaving aside the issue of the fragility of
+freezing kernel tasks by buggy userspace processes...)
+
+When the background mdadm process hangs it, is waiting (without a
+timeout) on a change to the sync_completed file signalling that the
+reshape has completed. The process is woken up a couple times when
+the reshape finishes but it is woken up before MD_RECOVERY_RUNNING
+is cleared so sync_completed_show() reports 0 instead of "none".
+
+To fix this, notify the sysfs file in md_reap_sync_thread() after
+MD_RECOVERY_RUNNING has been cleared. This wakes up mdadm and causes
+it to continue and write to suspend_lo/suspend_hi to allow IO to
+continue.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 660c52d48256..522b3d6b8c46 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9466,6 +9466,7 @@ void md_reap_sync_thread(struct mddev *mddev)
+ wake_up(&resync_wait);
+ /* flag recovery needed just to double check */
+ set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
++ sysfs_notify_dirent_safe(mddev->sysfs_completed);
+ sysfs_notify_dirent_safe(mddev->sysfs_action);
+ md_new_event();
+ if (mddev->event_work.func)
+--
+2.35.1
+
--- /dev/null
+From 717ec37cffd7db04106109fc722613a552926938 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jun 2022 13:19:31 -0600
+Subject: md/raid5: Make logic blocking check consistent with logic that blocks
+
+From: Logan Gunthorpe <logang@deltatee.com>
+
+[ Upstream commit 6e3f50d30af847bebce072182bd735e90a294c6a ]
+
+The check in raid5_make_request differs very slightly from the logic
+that causes it to block lower down. This likely does not cause a bug
+as the check is fuzzy anyway (as reshape may move on between the first
+check and the subsequent check). However, make it consistent so it can
+be cleaned up in a subsequent patch.
+
+The condition which causes the schedule is:
+
+ !(mddev->reshape_backwards ? logical_sector < conf->reshape_progress :
+ logical_sector >= conf->reshape_progress) &&
+ (mddev->reshape_backwards ? logical_sector < conf->reshape_safe :
+ logical_sector >= conf->reshape_safe)
+
+The condition that causes the early bailout is made to match this.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/raid5.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c8539d0e12dd..45482cebacdb 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -5841,7 +5841,7 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi)
+ if ((bi->bi_opf & REQ_NOWAIT) &&
+ (conf->reshape_progress != MaxSector) &&
+ (mddev->reshape_backwards
+- ? (logical_sector > conf->reshape_progress && logical_sector <= conf->reshape_safe)
++ ? (logical_sector >= conf->reshape_progress && logical_sector < conf->reshape_safe)
+ : (logical_sector >= conf->reshape_safe && logical_sector < conf->reshape_progress))) {
+ bio_wouldblock_error(bi);
+ if (rw == WRITE)
+--
+2.35.1
+
--- /dev/null
+From 5ea5ca1f1042f86c59fe7b92de44f71fffb0f18a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 20:41:12 +0800
+Subject: mips: cavium-octeon: Fix missing of_node_put() in
+ octeon2_usb_clocks_start
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 7a9f743ceead60ed454c46fbc3085ee9a79cbebb ]
+
+We should call of_node_put() for the reference 'uctl_node' returned by
+of_get_parent() which will increase the refcount. Otherwise, there will
+be a refcount leak bug.
+
+Signed-off-by: Liang He <windhl@126.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/octeon-platform.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index a994022e32c9..ce05c0dd3acd 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -86,11 +86,12 @@ static void octeon2_usb_clocks_start(struct device *dev)
+ "refclk-frequency", &clock_rate);
+ if (i) {
+ dev_err(dev, "No UCTL \"refclk-frequency\"\n");
++ of_node_put(uctl_node);
+ goto exit;
+ }
+ i = of_property_read_string(uctl_node,
+ "refclk-type", &clock_type);
+-
++ of_node_put(uctl_node);
+ if (!i && strcmp("crystal", clock_type) == 0)
+ is_crystal_clock = true;
+ }
+--
+2.35.1
+
--- /dev/null
+From 33cf03fea7ff5400262557ef585477bb8a1c7fc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Aug 2022 10:59:36 -0700
+Subject: MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
+
+From: Nathan Chancellor <nathan@kernel.org>
+
+[ Upstream commit 74de14fe05dd6b151d73cb0c73c8ec874cbdcde6 ]
+
+When CONFIG_XPA is enabled, Clang warns:
+
+ arch/mips/mm/tlbex.c:629:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context]
+ if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
+ ^
+ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC'
+ # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT)
+ ^
+ arch/mips/mm/tlbex.c:2568:24: error: converting the result of '<<' to a boolean; did you mean '(1 << _PAGE_NO_EXEC_SHIFT) != 0'? [-Werror,-Wint-in-bool-context]
+ if (!cpu_has_rixi || !_PAGE_NO_EXEC) {
+ ^
+ arch/mips/include/asm/pgtable-bits.h:174:28: note: expanded from macro '_PAGE_NO_EXEC'
+ # define _PAGE_NO_EXEC (1 << _PAGE_NO_EXEC_SHIFT)
+ ^
+ 2 errors generated.
+
+_PAGE_NO_EXEC can be '0' or '1 << _PAGE_NO_EXEC_SHIFT' depending on the
+build and runtime configuration, which is what the negation operators
+are trying to convey. To silence the warning, explicitly compare against
+0 so the result of the '<<' operator is not implicitly converted to a
+boolean.
+
+According to its documentation, GCC enables -Wint-in-bool-context with
+-Wall but this warning is not visible when building the same
+configuration with GCC. It appears GCC only warns when compiling C++,
+not C, although the documentation makes no note of this:
+https://godbolt.org/z/x39q3brxf
+
+Reported-by: Sudip Mukherjee (Codethink) <sudipm.mukherjee@gmail.com>
+Signed-off-by: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/mm/tlbex.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 8dbbd99fc7e8..be4d4670d649 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -626,7 +626,7 @@ static __maybe_unused void build_convert_pte_to_entrylo(u32 **p,
+ return;
+ }
+
+- if (cpu_has_rixi && !!_PAGE_NO_EXEC) {
++ if (cpu_has_rixi && _PAGE_NO_EXEC != 0) {
+ if (fill_includes_sw_bits) {
+ UASM_i_ROTR(p, reg, reg, ilog2(_PAGE_GLOBAL));
+ } else {
+@@ -2565,7 +2565,7 @@ static void check_pabits(void)
+ unsigned long entry;
+ unsigned pabits, fillbits;
+
+- if (!cpu_has_rixi || !_PAGE_NO_EXEC) {
++ if (!cpu_has_rixi || _PAGE_NO_EXEC == 0) {
+ /*
+ * We'll only be making use of the fact that we can rotate bits
+ * into the fill if the CPU supports RIXI, so don't bother
+--
+2.35.1
+
--- /dev/null
+From aebd6d3090c016f17d1d8c49e974d6e901de7d83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Jul 2022 09:29:01 +0200
+Subject: mmc: renesas_sdhi: newer SoCs don't need manual tap correction
+
+From: Takeshi Saito <takeshi.saito.xv@renesas.com>
+
+[ Upstream commit 00e8c11c137b2e4b2bf54dc9881cf32e3441ddb4 ]
+
+The newest Gen3 SoCs and Gen4 SoCs do not need manual tap correction
+with HS400 anymore. So, instead of checking the SDHI version, add a
+quirk flag and set manual tap correction only for affected SoCs.
+
+Signed-off-by: Takeshi Saito <takeshi.saito.xv@renesas.com>
+[wsa: rebased, renamed the quirk variable, removed stale comment]
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20220720072901.1266-1-wsa+renesas@sang-engineering.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi.h | 1 +
+ drivers/mmc/host/renesas_sdhi_core.c | 5 ++---
+ drivers/mmc/host/renesas_sdhi_internal_dmac.c | 6 ++++++
+ 3 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi.h b/drivers/mmc/host/renesas_sdhi.h
+index 1a1e3e020a8c..c4abfee1ebae 100644
+--- a/drivers/mmc/host/renesas_sdhi.h
++++ b/drivers/mmc/host/renesas_sdhi.h
+@@ -43,6 +43,7 @@ struct renesas_sdhi_quirks {
+ bool hs400_4taps;
+ bool fixed_addr_mode;
+ bool dma_one_rx_only;
++ bool manual_tap_correction;
+ u32 hs400_bad_taps;
+ const u8 (*hs400_calib_table)[SDHI_CALIB_TABLE_MAX];
+ };
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 55f7b27c3de7..6edbf5c161ab 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -380,8 +380,7 @@ static void renesas_sdhi_hs400_complete(struct mmc_host *mmc)
+ sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DT2FF,
+ priv->scc_tappos_hs400);
+
+- /* Gen3 can't do automatic tap correction with HS400, so disable it */
+- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN3_SDMMC)
++ if (priv->quirks && priv->quirks->manual_tap_correction)
+ sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_RVSCNTL,
+ ~SH_MOBILE_SDHI_SCC_RVSCNTL_RVSEN &
+ sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_RVSCNTL));
+@@ -718,7 +717,7 @@ static bool renesas_sdhi_manual_correction(struct tmio_mmc_host *host, bool use_
+ sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_RVSREQ, 0);
+
+ /* Change TAP position according to correction status */
+- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN3_SDMMC &&
++ if (priv->quirks && priv->quirks->manual_tap_correction &&
+ host->mmc->ios.timing == MMC_TIMING_MMC_HS400) {
+ u32 bad_taps = priv->quirks ? priv->quirks->hs400_bad_taps : 0;
+ /*
+diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+index 3084b15ae2cb..52915404eb07 100644
+--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+@@ -170,6 +170,7 @@ static const struct renesas_sdhi_quirks sdhi_quirks_4tap_nohs400_one_rx = {
+ static const struct renesas_sdhi_quirks sdhi_quirks_4tap = {
+ .hs400_4taps = true,
+ .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7),
++ .manual_tap_correction = true,
+ };
+
+ static const struct renesas_sdhi_quirks sdhi_quirks_nohs400 = {
+@@ -182,25 +183,30 @@ static const struct renesas_sdhi_quirks sdhi_quirks_fixed_addr = {
+
+ static const struct renesas_sdhi_quirks sdhi_quirks_bad_taps1357 = {
+ .hs400_bad_taps = BIT(1) | BIT(3) | BIT(5) | BIT(7),
++ .manual_tap_correction = true,
+ };
+
+ static const struct renesas_sdhi_quirks sdhi_quirks_bad_taps2367 = {
+ .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7),
++ .manual_tap_correction = true,
+ };
+
+ static const struct renesas_sdhi_quirks sdhi_quirks_r8a7796_es13 = {
+ .hs400_4taps = true,
+ .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7),
+ .hs400_calib_table = r8a7796_es13_calib_table,
++ .manual_tap_correction = true,
+ };
+
+ static const struct renesas_sdhi_quirks sdhi_quirks_r8a77965 = {
+ .hs400_bad_taps = BIT(2) | BIT(3) | BIT(6) | BIT(7),
+ .hs400_calib_table = r8a77965_calib_table,
++ .manual_tap_correction = true,
+ };
+
+ static const struct renesas_sdhi_quirks sdhi_quirks_r8a77990 = {
+ .hs400_calib_table = r8a77990_calib_table,
++ .manual_tap_correction = true,
+ };
+
+ /*
+--
+2.35.1
+
--- /dev/null
+From 145663909dfe644881cda8daddb0e54d1bf02c53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jun 2022 15:17:22 +0200
+Subject: mmc: tmio: avoid glitches when resetting
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit 2e586f8a5b0ed4a525014a692923ac96f6647816 ]
+
+If we reset because of an error, we need to preserve values for the
+clock frequency. Otherwise, glitches may be seen on the bus.
+
+To achieve that, we introduce a 'preserve' parameter to the reset
+function and the IP core specific reset callbacks to handle everything
+accordingly.
+
+Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/20220625131722.1397-1-wsa@kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/renesas_sdhi_core.c | 29 ++++++++++++++--------------
+ drivers/mmc/host/tmio_mmc.c | 2 +-
+ drivers/mmc/host/tmio_mmc.h | 6 +++++-
+ drivers/mmc/host/tmio_mmc_core.c | 28 +++++++++++++++++++++------
+ 4 files changed, 42 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
+index 0d258b6e1a43..55f7b27c3de7 100644
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -49,9 +49,6 @@
+ #define HOST_MODE_GEN3_32BIT (HOST_MODE_GEN3_WMODE | HOST_MODE_GEN3_BUSWIDTH)
+ #define HOST_MODE_GEN3_64BIT 0
+
+-#define CTL_SDIF_MODE 0xe6
+-#define SDIF_MODE_HS400 BIT(0)
+-
+ #define SDHI_VER_GEN2_SDR50 0x490c
+ #define SDHI_VER_RZ_A1 0x820b
+ /* very old datasheets said 0x490c for SDR104, too. They are wrong! */
+@@ -562,23 +559,25 @@ static void renesas_sdhi_scc_reset(struct tmio_mmc_host *host, struct renesas_sd
+ }
+
+ /* only populated for TMIO_MMC_MIN_RCAR2 */
+-static void renesas_sdhi_reset(struct tmio_mmc_host *host)
++static void renesas_sdhi_reset(struct tmio_mmc_host *host, bool preserve)
+ {
+ struct renesas_sdhi *priv = host_to_priv(host);
+ int ret;
+ u16 val;
+
+- if (priv->rstc) {
+- reset_control_reset(priv->rstc);
+- /* Unknown why but without polling reset status, it will hang */
+- read_poll_timeout(reset_control_status, ret, ret == 0, 1, 100,
+- false, priv->rstc);
+- /* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */
+- sd_ctrl_write16(host, CTL_RESET_SD, 0x0001);
+- priv->needs_adjust_hs400 = false;
+- renesas_sdhi_set_clock(host, host->clk_cache);
+- } else if (priv->scc_ctl) {
+- renesas_sdhi_scc_reset(host, priv);
++ if (!preserve) {
++ if (priv->rstc) {
++ reset_control_reset(priv->rstc);
++ /* Unknown why but without polling reset status, it will hang */
++ read_poll_timeout(reset_control_status, ret, ret == 0, 1, 100,
++ false, priv->rstc);
++ /* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */
++ sd_ctrl_write16(host, CTL_RESET_SD, 0x0001);
++ priv->needs_adjust_hs400 = false;
++ renesas_sdhi_set_clock(host, host->clk_cache);
++ } else if (priv->scc_ctl) {
++ renesas_sdhi_scc_reset(host, priv);
++ }
+ }
+
+ if (sd_ctrl_read16(host, CTL_VERSION) >= SDHI_VER_GEN3_SD) {
+diff --git a/drivers/mmc/host/tmio_mmc.c b/drivers/mmc/host/tmio_mmc.c
+index b55a29c53d9c..53a2ad9a24b8 100644
+--- a/drivers/mmc/host/tmio_mmc.c
++++ b/drivers/mmc/host/tmio_mmc.c
+@@ -75,7 +75,7 @@ static void tmio_mmc_set_clock(struct tmio_mmc_host *host,
+ tmio_mmc_clk_start(host);
+ }
+
+-static void tmio_mmc_reset(struct tmio_mmc_host *host)
++static void tmio_mmc_reset(struct tmio_mmc_host *host, bool preserve)
+ {
+ sd_ctrl_write16(host, CTL_RESET_SDIO, 0x0000);
+ usleep_range(10000, 11000);
+diff --git a/drivers/mmc/host/tmio_mmc.h b/drivers/mmc/host/tmio_mmc.h
+index e754bb3f5c32..501613c74406 100644
+--- a/drivers/mmc/host/tmio_mmc.h
++++ b/drivers/mmc/host/tmio_mmc.h
+@@ -42,6 +42,7 @@
+ #define CTL_DMA_ENABLE 0xd8
+ #define CTL_RESET_SD 0xe0
+ #define CTL_VERSION 0xe2
++#define CTL_SDIF_MODE 0xe6 /* only known on R-Car 2+ */
+
+ /* Definitions for values the CTL_STOP_INTERNAL_ACTION register can take */
+ #define TMIO_STOP_STP BIT(0)
+@@ -98,6 +99,9 @@
+ /* Definitions for values the CTL_DMA_ENABLE register can take */
+ #define DMA_ENABLE_DMASDRW BIT(1)
+
++/* Definitions for values the CTL_SDIF_MODE register can take */
++#define SDIF_MODE_HS400 BIT(0) /* only known on R-Car 2+ */
++
+ /* Define some IRQ masks */
+ /* This is the mask used at reset by the chip */
+ #define TMIO_MASK_ALL 0x837f031d
+@@ -181,7 +185,7 @@ struct tmio_mmc_host {
+ int (*multi_io_quirk)(struct mmc_card *card,
+ unsigned int direction, int blk_size);
+ int (*write16_hook)(struct tmio_mmc_host *host, int addr);
+- void (*reset)(struct tmio_mmc_host *host);
++ void (*reset)(struct tmio_mmc_host *host, bool preserve);
+ bool (*check_retune)(struct tmio_mmc_host *host, struct mmc_request *mrq);
+ void (*fixup_request)(struct tmio_mmc_host *host, struct mmc_request *mrq);
+ unsigned int (*get_timeout_cycles)(struct tmio_mmc_host *host);
+diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c
+index a5850d83908b..437048bb8027 100644
+--- a/drivers/mmc/host/tmio_mmc_core.c
++++ b/drivers/mmc/host/tmio_mmc_core.c
+@@ -179,8 +179,17 @@ static void tmio_mmc_set_bus_width(struct tmio_mmc_host *host,
+ sd_ctrl_write16(host, CTL_SD_MEM_CARD_OPT, reg);
+ }
+
+-static void tmio_mmc_reset(struct tmio_mmc_host *host)
++static void tmio_mmc_reset(struct tmio_mmc_host *host, bool preserve)
+ {
++ u16 card_opt, clk_ctrl, sdif_mode;
++
++ if (preserve) {
++ card_opt = sd_ctrl_read16(host, CTL_SD_MEM_CARD_OPT);
++ clk_ctrl = sd_ctrl_read16(host, CTL_SD_CARD_CLK_CTL);
++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2)
++ sdif_mode = sd_ctrl_read16(host, CTL_SDIF_MODE);
++ }
++
+ /* FIXME - should we set stop clock reg here */
+ sd_ctrl_write16(host, CTL_RESET_SD, 0x0000);
+ usleep_range(10000, 11000);
+@@ -190,7 +199,7 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host)
+ tmio_mmc_abort_dma(host);
+
+ if (host->reset)
+- host->reset(host);
++ host->reset(host, preserve);
+
+ sd_ctrl_write32_as_16_and_16(host, CTL_IRQ_MASK, host->sdcard_irq_mask_all);
+ host->sdcard_irq_mask = host->sdcard_irq_mask_all;
+@@ -206,6 +215,13 @@ static void tmio_mmc_reset(struct tmio_mmc_host *host)
+ sd_ctrl_write16(host, CTL_TRANSACTION_CTL, 0x0001);
+ }
+
++ if (preserve) {
++ sd_ctrl_write16(host, CTL_SD_MEM_CARD_OPT, card_opt);
++ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk_ctrl);
++ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2)
++ sd_ctrl_write16(host, CTL_SDIF_MODE, sdif_mode);
++ }
++
+ if (host->mmc->card)
+ mmc_retune_needed(host->mmc);
+ }
+@@ -248,7 +264,7 @@ static void tmio_mmc_reset_work(struct work_struct *work)
+
+ spin_unlock_irqrestore(&host->lock, flags);
+
+- tmio_mmc_reset(host);
++ tmio_mmc_reset(host, true);
+
+ /* Ready for new calls */
+ host->mrq = NULL;
+@@ -961,7 +977,7 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ tmio_mmc_power_off(host);
+ /* For R-Car Gen2+, we need to reset SDHI specific SCC */
+ if (host->pdata->flags & TMIO_MMC_MIN_RCAR2)
+- tmio_mmc_reset(host);
++ tmio_mmc_reset(host, false);
+
+ host->set_clock(host, 0);
+ break;
+@@ -1189,7 +1205,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)
+ _host->sdcard_irq_mask_all = TMIO_MASK_ALL;
+
+ _host->set_clock(_host, 0);
+- tmio_mmc_reset(_host);
++ tmio_mmc_reset(_host, false);
+
+ spin_lock_init(&_host->lock);
+ mutex_init(&_host->ios_lock);
+@@ -1285,7 +1301,7 @@ int tmio_mmc_host_runtime_resume(struct device *dev)
+ struct tmio_mmc_host *host = dev_get_drvdata(dev);
+
+ tmio_mmc_clk_enable(host);
+- tmio_mmc_reset(host);
++ tmio_mmc_reset(host, false);
+
+ if (host->clk_cache)
+ host->set_clock(host, host->clk_cache);
+--
+2.35.1
+
--- /dev/null
+From fa911db0bf34c1140d85bd57937eb2c244f7f332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Jul 2022 11:44:54 +0200
+Subject: modules: Ensure natural alignment for .altinstructions and
+ __bug_table sections
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 87c482bdfa79f378297d92af49cdf265be199df5 ]
+
+In the kernel image vmlinux.lds.S linker scripts the .altinstructions
+and __bug_table sections are 4- or 8-byte aligned because they hold 32-
+and/or 64-bit values.
+
+Most architectures use altinstructions and BUG() or WARN() in modules as
+well, but in the module linker script (module.lds.S) those sections are
+currently missing. As consequence the linker will store their content
+byte-aligned by default, which then can lead to unnecessary unaligned
+memory accesses by the CPU when those tables are processed at runtime.
+
+Usually unaligned memory accesses are unnoticed, because either the
+hardware (as on x86 CPUs) or in-kernel exception handlers (e.g. on
+parisc or sparc) emulate and fix them up at runtime. Nevertheless, such
+unaligned accesses introduce a performance penalty and can even crash
+the kernel if there is a bug in the unalignment exception handlers
+(which happened once to me on the parisc architecture and which is why I
+noticed that issue at all).
+
+This patch fixes a non-critical issue and might be backported at any time.
+It's trivial and shouldn't introduce any regression because it simply
+tells the linker to use a different (8-byte alignment) for those
+sections by default.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Link: https://lore.kernel.org/all/Yr8%2Fgr8e8I7tVX4d@p100/
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/module.lds.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/scripts/module.lds.S b/scripts/module.lds.S
+index 1d0e1e4dc3d2..3a3aa2354ed8 100644
+--- a/scripts/module.lds.S
++++ b/scripts/module.lds.S
+@@ -27,6 +27,8 @@ SECTIONS {
+ .ctors 0 : ALIGN(8) { *(SORT(.ctors.*)) *(.ctors) }
+ .init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) }
+
++ .altinstructions 0 : ALIGN(8) { KEEP(*(.altinstructions)) }
++ __bug_table 0 : ALIGN(8) { KEEP(*(__bug_table)) }
+ __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) }
+
+ __patchable_function_entries : { *(__patchable_function_entries) }
+--
+2.35.1
+
--- /dev/null
+From f50e3a71780a66871c652ba8646fdb322529eed3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Aug 2022 16:53:49 +0300
+Subject: net: mscc: ocelot: fix race between ndo_get_stats64 and
+ ocelot_check_stats_work
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 18d8e67df184081bc6ce6220a2dd965cfd3d7e6b ]
+
+The 2 methods can run concurrently, and one will change the window of
+counters (SYS_STAT_CFG_STAT_VIEW) that the other sees. The fix is
+similar to what commit 7fbf6795d127 ("net: mscc: ocelot: fix mutex lock
+error during ethtool stats read") has done for ethtool -S.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_net.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_net.c b/drivers/net/ethernet/mscc/ocelot_net.c
+index 9d8cea16245e..6b9d37138844 100644
+--- a/drivers/net/ethernet/mscc/ocelot_net.c
++++ b/drivers/net/ethernet/mscc/ocelot_net.c
+@@ -726,6 +726,8 @@ static void ocelot_get_stats64(struct net_device *dev,
+ struct ocelot *ocelot = priv->port.ocelot;
+ int port = priv->port.index;
+
++ spin_lock(&ocelot->stats_lock);
++
+ /* Configure the port to read the stats from */
+ ocelot_write(ocelot, SYS_STAT_CFG_STAT_VIEW(port),
+ SYS_STAT_CFG);
+@@ -758,6 +760,8 @@ static void ocelot_get_stats64(struct net_device *dev,
+ stats->tx_dropped = ocelot_read(ocelot, SYS_COUNT_TX_DROPS) +
+ ocelot_read(ocelot, SYS_COUNT_TX_AGING);
+ stats->collisions = ocelot_read(ocelot, SYS_COUNT_TX_COLLISION);
++
++ spin_unlock(&ocelot->stats_lock);
+ }
+
+ static int ocelot_port_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
+--
+2.35.1
+
--- /dev/null
+From 42ddc918d20d34268eb774cfb7a28ae0e3256826 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Aug 2022 16:53:50 +0300
+Subject: net: mscc: ocelot: make struct ocelot_stat_layout array indexable
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 9190460084ddd0e9235f55eab0fdd5456b5f2fd5 ]
+
+The ocelot counters are 32-bit and require periodic reading, every 2
+seconds, by ocelot_port_update_stats(), so that wraparounds are
+detected.
+
+Currently, the counters reported by ocelot_get_stats64() come from the
+32-bit hardware counters directly, rather than from the 64-bit
+accumulated ocelot->stats, and this is a problem for their integrity.
+
+The strategy is to make ocelot_get_stats64() able to cherry-pick
+individual stats from ocelot->stats the way in which it currently reads
+them out from SYS_COUNT_* registers. But currently it can't, because
+ocelot->stats is an opaque u64 array that's used only to feed data into
+ethtool -S.
+
+To solve that problem, we need to make ocelot->stats indexable, and
+associate each element with an element of struct ocelot_stat_layout used
+by ethtool -S.
+
+This makes ocelot_stat_layout a fat (and possibly sparse) array, so we
+need to change the way in which we access it. We no longer need
+OCELOT_STAT_END as a sentinel, because we know the array's size
+(OCELOT_NUM_STATS). We just need to skip the array elements that were
+left unpopulated for the switch revision (ocelot, felix, seville).
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 468 ++++++++++++++++-----
+ drivers/net/dsa/ocelot/seville_vsc9953.c | 468 ++++++++++++++++-----
+ drivers/net/ethernet/mscc/ocelot.c | 40 +-
+ drivers/net/ethernet/mscc/ocelot_vsc7514.c | 468 ++++++++++++++++-----
+ include/soc/mscc/ocelot.h | 105 ++++-
+ 5 files changed, 1243 insertions(+), 306 deletions(-)
+
+diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
+index 601fae886b26..6439b56f381f 100644
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -550,101 +550,379 @@ static const struct reg_field vsc9959_regfields[REGFIELD_MAX] = {
+ [SYS_PAUSE_CFG_PAUSE_ENA] = REG_FIELD_ID(SYS_PAUSE_CFG, 0, 1, 7, 4),
+ };
+
+-static const struct ocelot_stat_layout vsc9959_stats_layout[] = {
+- { .offset = 0x00, .name = "rx_octets", },
+- { .offset = 0x01, .name = "rx_unicast", },
+- { .offset = 0x02, .name = "rx_multicast", },
+- { .offset = 0x03, .name = "rx_broadcast", },
+- { .offset = 0x04, .name = "rx_shorts", },
+- { .offset = 0x05, .name = "rx_fragments", },
+- { .offset = 0x06, .name = "rx_jabbers", },
+- { .offset = 0x07, .name = "rx_crc_align_errs", },
+- { .offset = 0x08, .name = "rx_sym_errs", },
+- { .offset = 0x09, .name = "rx_frames_below_65_octets", },
+- { .offset = 0x0A, .name = "rx_frames_65_to_127_octets", },
+- { .offset = 0x0B, .name = "rx_frames_128_to_255_octets", },
+- { .offset = 0x0C, .name = "rx_frames_256_to_511_octets", },
+- { .offset = 0x0D, .name = "rx_frames_512_to_1023_octets", },
+- { .offset = 0x0E, .name = "rx_frames_1024_to_1526_octets", },
+- { .offset = 0x0F, .name = "rx_frames_over_1526_octets", },
+- { .offset = 0x10, .name = "rx_pause", },
+- { .offset = 0x11, .name = "rx_control", },
+- { .offset = 0x12, .name = "rx_longs", },
+- { .offset = 0x13, .name = "rx_classified_drops", },
+- { .offset = 0x14, .name = "rx_red_prio_0", },
+- { .offset = 0x15, .name = "rx_red_prio_1", },
+- { .offset = 0x16, .name = "rx_red_prio_2", },
+- { .offset = 0x17, .name = "rx_red_prio_3", },
+- { .offset = 0x18, .name = "rx_red_prio_4", },
+- { .offset = 0x19, .name = "rx_red_prio_5", },
+- { .offset = 0x1A, .name = "rx_red_prio_6", },
+- { .offset = 0x1B, .name = "rx_red_prio_7", },
+- { .offset = 0x1C, .name = "rx_yellow_prio_0", },
+- { .offset = 0x1D, .name = "rx_yellow_prio_1", },
+- { .offset = 0x1E, .name = "rx_yellow_prio_2", },
+- { .offset = 0x1F, .name = "rx_yellow_prio_3", },
+- { .offset = 0x20, .name = "rx_yellow_prio_4", },
+- { .offset = 0x21, .name = "rx_yellow_prio_5", },
+- { .offset = 0x22, .name = "rx_yellow_prio_6", },
+- { .offset = 0x23, .name = "rx_yellow_prio_7", },
+- { .offset = 0x24, .name = "rx_green_prio_0", },
+- { .offset = 0x25, .name = "rx_green_prio_1", },
+- { .offset = 0x26, .name = "rx_green_prio_2", },
+- { .offset = 0x27, .name = "rx_green_prio_3", },
+- { .offset = 0x28, .name = "rx_green_prio_4", },
+- { .offset = 0x29, .name = "rx_green_prio_5", },
+- { .offset = 0x2A, .name = "rx_green_prio_6", },
+- { .offset = 0x2B, .name = "rx_green_prio_7", },
+- { .offset = 0x80, .name = "tx_octets", },
+- { .offset = 0x81, .name = "tx_unicast", },
+- { .offset = 0x82, .name = "tx_multicast", },
+- { .offset = 0x83, .name = "tx_broadcast", },
+- { .offset = 0x84, .name = "tx_collision", },
+- { .offset = 0x85, .name = "tx_drops", },
+- { .offset = 0x86, .name = "tx_pause", },
+- { .offset = 0x87, .name = "tx_frames_below_65_octets", },
+- { .offset = 0x88, .name = "tx_frames_65_to_127_octets", },
+- { .offset = 0x89, .name = "tx_frames_128_255_octets", },
+- { .offset = 0x8A, .name = "tx_frames_256_511_octets", },
+- { .offset = 0x8B, .name = "tx_frames_512_1023_octets", },
+- { .offset = 0x8C, .name = "tx_frames_1024_1526_octets", },
+- { .offset = 0x8D, .name = "tx_frames_over_1526_octets", },
+- { .offset = 0x8E, .name = "tx_yellow_prio_0", },
+- { .offset = 0x8F, .name = "tx_yellow_prio_1", },
+- { .offset = 0x90, .name = "tx_yellow_prio_2", },
+- { .offset = 0x91, .name = "tx_yellow_prio_3", },
+- { .offset = 0x92, .name = "tx_yellow_prio_4", },
+- { .offset = 0x93, .name = "tx_yellow_prio_5", },
+- { .offset = 0x94, .name = "tx_yellow_prio_6", },
+- { .offset = 0x95, .name = "tx_yellow_prio_7", },
+- { .offset = 0x96, .name = "tx_green_prio_0", },
+- { .offset = 0x97, .name = "tx_green_prio_1", },
+- { .offset = 0x98, .name = "tx_green_prio_2", },
+- { .offset = 0x99, .name = "tx_green_prio_3", },
+- { .offset = 0x9A, .name = "tx_green_prio_4", },
+- { .offset = 0x9B, .name = "tx_green_prio_5", },
+- { .offset = 0x9C, .name = "tx_green_prio_6", },
+- { .offset = 0x9D, .name = "tx_green_prio_7", },
+- { .offset = 0x9E, .name = "tx_aged", },
+- { .offset = 0x100, .name = "drop_local", },
+- { .offset = 0x101, .name = "drop_tail", },
+- { .offset = 0x102, .name = "drop_yellow_prio_0", },
+- { .offset = 0x103, .name = "drop_yellow_prio_1", },
+- { .offset = 0x104, .name = "drop_yellow_prio_2", },
+- { .offset = 0x105, .name = "drop_yellow_prio_3", },
+- { .offset = 0x106, .name = "drop_yellow_prio_4", },
+- { .offset = 0x107, .name = "drop_yellow_prio_5", },
+- { .offset = 0x108, .name = "drop_yellow_prio_6", },
+- { .offset = 0x109, .name = "drop_yellow_prio_7", },
+- { .offset = 0x10A, .name = "drop_green_prio_0", },
+- { .offset = 0x10B, .name = "drop_green_prio_1", },
+- { .offset = 0x10C, .name = "drop_green_prio_2", },
+- { .offset = 0x10D, .name = "drop_green_prio_3", },
+- { .offset = 0x10E, .name = "drop_green_prio_4", },
+- { .offset = 0x10F, .name = "drop_green_prio_5", },
+- { .offset = 0x110, .name = "drop_green_prio_6", },
+- { .offset = 0x111, .name = "drop_green_prio_7", },
+- OCELOT_STAT_END
++static const struct ocelot_stat_layout vsc9959_stats_layout[OCELOT_NUM_STATS] = {
++ [OCELOT_STAT_RX_OCTETS] = {
++ .name = "rx_octets",
++ .offset = 0x00,
++ },
++ [OCELOT_STAT_RX_UNICAST] = {
++ .name = "rx_unicast",
++ .offset = 0x01,
++ },
++ [OCELOT_STAT_RX_MULTICAST] = {
++ .name = "rx_multicast",
++ .offset = 0x02,
++ },
++ [OCELOT_STAT_RX_BROADCAST] = {
++ .name = "rx_broadcast",
++ .offset = 0x03,
++ },
++ [OCELOT_STAT_RX_SHORTS] = {
++ .name = "rx_shorts",
++ .offset = 0x04,
++ },
++ [OCELOT_STAT_RX_FRAGMENTS] = {
++ .name = "rx_fragments",
++ .offset = 0x05,
++ },
++ [OCELOT_STAT_RX_JABBERS] = {
++ .name = "rx_jabbers",
++ .offset = 0x06,
++ },
++ [OCELOT_STAT_RX_CRC_ALIGN_ERRS] = {
++ .name = "rx_crc_align_errs",
++ .offset = 0x07,
++ },
++ [OCELOT_STAT_RX_SYM_ERRS] = {
++ .name = "rx_sym_errs",
++ .offset = 0x08,
++ },
++ [OCELOT_STAT_RX_64] = {
++ .name = "rx_frames_below_65_octets",
++ .offset = 0x09,
++ },
++ [OCELOT_STAT_RX_65_127] = {
++ .name = "rx_frames_65_to_127_octets",
++ .offset = 0x0A,
++ },
++ [OCELOT_STAT_RX_128_255] = {
++ .name = "rx_frames_128_to_255_octets",
++ .offset = 0x0B,
++ },
++ [OCELOT_STAT_RX_256_511] = {
++ .name = "rx_frames_256_to_511_octets",
++ .offset = 0x0C,
++ },
++ [OCELOT_STAT_RX_512_1023] = {
++ .name = "rx_frames_512_to_1023_octets",
++ .offset = 0x0D,
++ },
++ [OCELOT_STAT_RX_1024_1526] = {
++ .name = "rx_frames_1024_to_1526_octets",
++ .offset = 0x0E,
++ },
++ [OCELOT_STAT_RX_1527_MAX] = {
++ .name = "rx_frames_over_1526_octets",
++ .offset = 0x0F,
++ },
++ [OCELOT_STAT_RX_PAUSE] = {
++ .name = "rx_pause",
++ .offset = 0x10,
++ },
++ [OCELOT_STAT_RX_CONTROL] = {
++ .name = "rx_control",
++ .offset = 0x11,
++ },
++ [OCELOT_STAT_RX_LONGS] = {
++ .name = "rx_longs",
++ .offset = 0x12,
++ },
++ [OCELOT_STAT_RX_CLASSIFIED_DROPS] = {
++ .name = "rx_classified_drops",
++ .offset = 0x13,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_0] = {
++ .name = "rx_red_prio_0",
++ .offset = 0x14,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_1] = {
++ .name = "rx_red_prio_1",
++ .offset = 0x15,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_2] = {
++ .name = "rx_red_prio_2",
++ .offset = 0x16,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_3] = {
++ .name = "rx_red_prio_3",
++ .offset = 0x17,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_4] = {
++ .name = "rx_red_prio_4",
++ .offset = 0x18,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_5] = {
++ .name = "rx_red_prio_5",
++ .offset = 0x19,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_6] = {
++ .name = "rx_red_prio_6",
++ .offset = 0x1A,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_7] = {
++ .name = "rx_red_prio_7",
++ .offset = 0x1B,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_0] = {
++ .name = "rx_yellow_prio_0",
++ .offset = 0x1C,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_1] = {
++ .name = "rx_yellow_prio_1",
++ .offset = 0x1D,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_2] = {
++ .name = "rx_yellow_prio_2",
++ .offset = 0x1E,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_3] = {
++ .name = "rx_yellow_prio_3",
++ .offset = 0x1F,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_4] = {
++ .name = "rx_yellow_prio_4",
++ .offset = 0x20,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_5] = {
++ .name = "rx_yellow_prio_5",
++ .offset = 0x21,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_6] = {
++ .name = "rx_yellow_prio_6",
++ .offset = 0x22,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_7] = {
++ .name = "rx_yellow_prio_7",
++ .offset = 0x23,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_0] = {
++ .name = "rx_green_prio_0",
++ .offset = 0x24,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_1] = {
++ .name = "rx_green_prio_1",
++ .offset = 0x25,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_2] = {
++ .name = "rx_green_prio_2",
++ .offset = 0x26,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_3] = {
++ .name = "rx_green_prio_3",
++ .offset = 0x27,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_4] = {
++ .name = "rx_green_prio_4",
++ .offset = 0x28,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_5] = {
++ .name = "rx_green_prio_5",
++ .offset = 0x29,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_6] = {
++ .name = "rx_green_prio_6",
++ .offset = 0x2A,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_7] = {
++ .name = "rx_green_prio_7",
++ .offset = 0x2B,
++ },
++ [OCELOT_STAT_TX_OCTETS] = {
++ .name = "tx_octets",
++ .offset = 0x80,
++ },
++ [OCELOT_STAT_TX_UNICAST] = {
++ .name = "tx_unicast",
++ .offset = 0x81,
++ },
++ [OCELOT_STAT_TX_MULTICAST] = {
++ .name = "tx_multicast",
++ .offset = 0x82,
++ },
++ [OCELOT_STAT_TX_BROADCAST] = {
++ .name = "tx_broadcast",
++ .offset = 0x83,
++ },
++ [OCELOT_STAT_TX_COLLISION] = {
++ .name = "tx_collision",
++ .offset = 0x84,
++ },
++ [OCELOT_STAT_TX_DROPS] = {
++ .name = "tx_drops",
++ .offset = 0x85,
++ },
++ [OCELOT_STAT_TX_PAUSE] = {
++ .name = "tx_pause",
++ .offset = 0x86,
++ },
++ [OCELOT_STAT_TX_64] = {
++ .name = "tx_frames_below_65_octets",
++ .offset = 0x87,
++ },
++ [OCELOT_STAT_TX_65_127] = {
++ .name = "tx_frames_65_to_127_octets",
++ .offset = 0x88,
++ },
++ [OCELOT_STAT_TX_128_255] = {
++ .name = "tx_frames_128_255_octets",
++ .offset = 0x89,
++ },
++ [OCELOT_STAT_TX_256_511] = {
++ .name = "tx_frames_256_511_octets",
++ .offset = 0x8A,
++ },
++ [OCELOT_STAT_TX_512_1023] = {
++ .name = "tx_frames_512_1023_octets",
++ .offset = 0x8B,
++ },
++ [OCELOT_STAT_TX_1024_1526] = {
++ .name = "tx_frames_1024_1526_octets",
++ .offset = 0x8C,
++ },
++ [OCELOT_STAT_TX_1527_MAX] = {
++ .name = "tx_frames_over_1526_octets",
++ .offset = 0x8D,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_0] = {
++ .name = "tx_yellow_prio_0",
++ .offset = 0x8E,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_1] = {
++ .name = "tx_yellow_prio_1",
++ .offset = 0x8F,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_2] = {
++ .name = "tx_yellow_prio_2",
++ .offset = 0x90,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_3] = {
++ .name = "tx_yellow_prio_3",
++ .offset = 0x91,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_4] = {
++ .name = "tx_yellow_prio_4",
++ .offset = 0x92,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_5] = {
++ .name = "tx_yellow_prio_5",
++ .offset = 0x93,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_6] = {
++ .name = "tx_yellow_prio_6",
++ .offset = 0x94,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_7] = {
++ .name = "tx_yellow_prio_7",
++ .offset = 0x95,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_0] = {
++ .name = "tx_green_prio_0",
++ .offset = 0x96,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_1] = {
++ .name = "tx_green_prio_1",
++ .offset = 0x97,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_2] = {
++ .name = "tx_green_prio_2",
++ .offset = 0x98,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_3] = {
++ .name = "tx_green_prio_3",
++ .offset = 0x99,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_4] = {
++ .name = "tx_green_prio_4",
++ .offset = 0x9A,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_5] = {
++ .name = "tx_green_prio_5",
++ .offset = 0x9B,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_6] = {
++ .name = "tx_green_prio_6",
++ .offset = 0x9C,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_7] = {
++ .name = "tx_green_prio_7",
++ .offset = 0x9D,
++ },
++ [OCELOT_STAT_TX_AGED] = {
++ .name = "tx_aged",
++ .offset = 0x9E,
++ },
++ [OCELOT_STAT_DROP_LOCAL] = {
++ .name = "drop_local",
++ .offset = 0x100,
++ },
++ [OCELOT_STAT_DROP_TAIL] = {
++ .name = "drop_tail",
++ .offset = 0x101,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_0] = {
++ .name = "drop_yellow_prio_0",
++ .offset = 0x102,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_1] = {
++ .name = "drop_yellow_prio_1",
++ .offset = 0x103,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_2] = {
++ .name = "drop_yellow_prio_2",
++ .offset = 0x104,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_3] = {
++ .name = "drop_yellow_prio_3",
++ .offset = 0x105,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_4] = {
++ .name = "drop_yellow_prio_4",
++ .offset = 0x106,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_5] = {
++ .name = "drop_yellow_prio_5",
++ .offset = 0x107,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_6] = {
++ .name = "drop_yellow_prio_6",
++ .offset = 0x108,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_7] = {
++ .name = "drop_yellow_prio_7",
++ .offset = 0x109,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_0] = {
++ .name = "drop_green_prio_0",
++ .offset = 0x10A,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_1] = {
++ .name = "drop_green_prio_1",
++ .offset = 0x10B,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_2] = {
++ .name = "drop_green_prio_2",
++ .offset = 0x10C,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_3] = {
++ .name = "drop_green_prio_3",
++ .offset = 0x10D,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_4] = {
++ .name = "drop_green_prio_4",
++ .offset = 0x10E,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_5] = {
++ .name = "drop_green_prio_5",
++ .offset = 0x10F,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_6] = {
++ .name = "drop_green_prio_6",
++ .offset = 0x110,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_7] = {
++ .name = "drop_green_prio_7",
++ .offset = 0x111,
++ },
+ };
+
+ static const struct vcap_field vsc9959_vcap_es0_keys[] = {
+diff --git a/drivers/net/dsa/ocelot/seville_vsc9953.c b/drivers/net/dsa/ocelot/seville_vsc9953.c
+index ebe9ddbbe2b7..fe5d4642d0bc 100644
+--- a/drivers/net/dsa/ocelot/seville_vsc9953.c
++++ b/drivers/net/dsa/ocelot/seville_vsc9953.c
+@@ -545,101 +545,379 @@ static const struct reg_field vsc9953_regfields[REGFIELD_MAX] = {
+ [SYS_PAUSE_CFG_PAUSE_ENA] = REG_FIELD_ID(SYS_PAUSE_CFG, 0, 1, 11, 4),
+ };
+
+-static const struct ocelot_stat_layout vsc9953_stats_layout[] = {
+- { .offset = 0x00, .name = "rx_octets", },
+- { .offset = 0x01, .name = "rx_unicast", },
+- { .offset = 0x02, .name = "rx_multicast", },
+- { .offset = 0x03, .name = "rx_broadcast", },
+- { .offset = 0x04, .name = "rx_shorts", },
+- { .offset = 0x05, .name = "rx_fragments", },
+- { .offset = 0x06, .name = "rx_jabbers", },
+- { .offset = 0x07, .name = "rx_crc_align_errs", },
+- { .offset = 0x08, .name = "rx_sym_errs", },
+- { .offset = 0x09, .name = "rx_frames_below_65_octets", },
+- { .offset = 0x0A, .name = "rx_frames_65_to_127_octets", },
+- { .offset = 0x0B, .name = "rx_frames_128_to_255_octets", },
+- { .offset = 0x0C, .name = "rx_frames_256_to_511_octets", },
+- { .offset = 0x0D, .name = "rx_frames_512_to_1023_octets", },
+- { .offset = 0x0E, .name = "rx_frames_1024_to_1526_octets", },
+- { .offset = 0x0F, .name = "rx_frames_over_1526_octets", },
+- { .offset = 0x10, .name = "rx_pause", },
+- { .offset = 0x11, .name = "rx_control", },
+- { .offset = 0x12, .name = "rx_longs", },
+- { .offset = 0x13, .name = "rx_classified_drops", },
+- { .offset = 0x14, .name = "rx_red_prio_0", },
+- { .offset = 0x15, .name = "rx_red_prio_1", },
+- { .offset = 0x16, .name = "rx_red_prio_2", },
+- { .offset = 0x17, .name = "rx_red_prio_3", },
+- { .offset = 0x18, .name = "rx_red_prio_4", },
+- { .offset = 0x19, .name = "rx_red_prio_5", },
+- { .offset = 0x1A, .name = "rx_red_prio_6", },
+- { .offset = 0x1B, .name = "rx_red_prio_7", },
+- { .offset = 0x1C, .name = "rx_yellow_prio_0", },
+- { .offset = 0x1D, .name = "rx_yellow_prio_1", },
+- { .offset = 0x1E, .name = "rx_yellow_prio_2", },
+- { .offset = 0x1F, .name = "rx_yellow_prio_3", },
+- { .offset = 0x20, .name = "rx_yellow_prio_4", },
+- { .offset = 0x21, .name = "rx_yellow_prio_5", },
+- { .offset = 0x22, .name = "rx_yellow_prio_6", },
+- { .offset = 0x23, .name = "rx_yellow_prio_7", },
+- { .offset = 0x24, .name = "rx_green_prio_0", },
+- { .offset = 0x25, .name = "rx_green_prio_1", },
+- { .offset = 0x26, .name = "rx_green_prio_2", },
+- { .offset = 0x27, .name = "rx_green_prio_3", },
+- { .offset = 0x28, .name = "rx_green_prio_4", },
+- { .offset = 0x29, .name = "rx_green_prio_5", },
+- { .offset = 0x2A, .name = "rx_green_prio_6", },
+- { .offset = 0x2B, .name = "rx_green_prio_7", },
+- { .offset = 0x40, .name = "tx_octets", },
+- { .offset = 0x41, .name = "tx_unicast", },
+- { .offset = 0x42, .name = "tx_multicast", },
+- { .offset = 0x43, .name = "tx_broadcast", },
+- { .offset = 0x44, .name = "tx_collision", },
+- { .offset = 0x45, .name = "tx_drops", },
+- { .offset = 0x46, .name = "tx_pause", },
+- { .offset = 0x47, .name = "tx_frames_below_65_octets", },
+- { .offset = 0x48, .name = "tx_frames_65_to_127_octets", },
+- { .offset = 0x49, .name = "tx_frames_128_255_octets", },
+- { .offset = 0x4A, .name = "tx_frames_256_511_octets", },
+- { .offset = 0x4B, .name = "tx_frames_512_1023_octets", },
+- { .offset = 0x4C, .name = "tx_frames_1024_1526_octets", },
+- { .offset = 0x4D, .name = "tx_frames_over_1526_octets", },
+- { .offset = 0x4E, .name = "tx_yellow_prio_0", },
+- { .offset = 0x4F, .name = "tx_yellow_prio_1", },
+- { .offset = 0x50, .name = "tx_yellow_prio_2", },
+- { .offset = 0x51, .name = "tx_yellow_prio_3", },
+- { .offset = 0x52, .name = "tx_yellow_prio_4", },
+- { .offset = 0x53, .name = "tx_yellow_prio_5", },
+- { .offset = 0x54, .name = "tx_yellow_prio_6", },
+- { .offset = 0x55, .name = "tx_yellow_prio_7", },
+- { .offset = 0x56, .name = "tx_green_prio_0", },
+- { .offset = 0x57, .name = "tx_green_prio_1", },
+- { .offset = 0x58, .name = "tx_green_prio_2", },
+- { .offset = 0x59, .name = "tx_green_prio_3", },
+- { .offset = 0x5A, .name = "tx_green_prio_4", },
+- { .offset = 0x5B, .name = "tx_green_prio_5", },
+- { .offset = 0x5C, .name = "tx_green_prio_6", },
+- { .offset = 0x5D, .name = "tx_green_prio_7", },
+- { .offset = 0x5E, .name = "tx_aged", },
+- { .offset = 0x80, .name = "drop_local", },
+- { .offset = 0x81, .name = "drop_tail", },
+- { .offset = 0x82, .name = "drop_yellow_prio_0", },
+- { .offset = 0x83, .name = "drop_yellow_prio_1", },
+- { .offset = 0x84, .name = "drop_yellow_prio_2", },
+- { .offset = 0x85, .name = "drop_yellow_prio_3", },
+- { .offset = 0x86, .name = "drop_yellow_prio_4", },
+- { .offset = 0x87, .name = "drop_yellow_prio_5", },
+- { .offset = 0x88, .name = "drop_yellow_prio_6", },
+- { .offset = 0x89, .name = "drop_yellow_prio_7", },
+- { .offset = 0x8A, .name = "drop_green_prio_0", },
+- { .offset = 0x8B, .name = "drop_green_prio_1", },
+- { .offset = 0x8C, .name = "drop_green_prio_2", },
+- { .offset = 0x8D, .name = "drop_green_prio_3", },
+- { .offset = 0x8E, .name = "drop_green_prio_4", },
+- { .offset = 0x8F, .name = "drop_green_prio_5", },
+- { .offset = 0x90, .name = "drop_green_prio_6", },
+- { .offset = 0x91, .name = "drop_green_prio_7", },
+- OCELOT_STAT_END
++static const struct ocelot_stat_layout vsc9953_stats_layout[OCELOT_NUM_STATS] = {
++ [OCELOT_STAT_RX_OCTETS] = {
++ .name = "rx_octets",
++ .offset = 0x00,
++ },
++ [OCELOT_STAT_RX_UNICAST] = {
++ .name = "rx_unicast",
++ .offset = 0x01,
++ },
++ [OCELOT_STAT_RX_MULTICAST] = {
++ .name = "rx_multicast",
++ .offset = 0x02,
++ },
++ [OCELOT_STAT_RX_BROADCAST] = {
++ .name = "rx_broadcast",
++ .offset = 0x03,
++ },
++ [OCELOT_STAT_RX_SHORTS] = {
++ .name = "rx_shorts",
++ .offset = 0x04,
++ },
++ [OCELOT_STAT_RX_FRAGMENTS] = {
++ .name = "rx_fragments",
++ .offset = 0x05,
++ },
++ [OCELOT_STAT_RX_JABBERS] = {
++ .name = "rx_jabbers",
++ .offset = 0x06,
++ },
++ [OCELOT_STAT_RX_CRC_ALIGN_ERRS] = {
++ .name = "rx_crc_align_errs",
++ .offset = 0x07,
++ },
++ [OCELOT_STAT_RX_SYM_ERRS] = {
++ .name = "rx_sym_errs",
++ .offset = 0x08,
++ },
++ [OCELOT_STAT_RX_64] = {
++ .name = "rx_frames_below_65_octets",
++ .offset = 0x09,
++ },
++ [OCELOT_STAT_RX_65_127] = {
++ .name = "rx_frames_65_to_127_octets",
++ .offset = 0x0A,
++ },
++ [OCELOT_STAT_RX_128_255] = {
++ .name = "rx_frames_128_to_255_octets",
++ .offset = 0x0B,
++ },
++ [OCELOT_STAT_RX_256_511] = {
++ .name = "rx_frames_256_to_511_octets",
++ .offset = 0x0C,
++ },
++ [OCELOT_STAT_RX_512_1023] = {
++ .name = "rx_frames_512_to_1023_octets",
++ .offset = 0x0D,
++ },
++ [OCELOT_STAT_RX_1024_1526] = {
++ .name = "rx_frames_1024_to_1526_octets",
++ .offset = 0x0E,
++ },
++ [OCELOT_STAT_RX_1527_MAX] = {
++ .name = "rx_frames_over_1526_octets",
++ .offset = 0x0F,
++ },
++ [OCELOT_STAT_RX_PAUSE] = {
++ .name = "rx_pause",
++ .offset = 0x10,
++ },
++ [OCELOT_STAT_RX_CONTROL] = {
++ .name = "rx_control",
++ .offset = 0x11,
++ },
++ [OCELOT_STAT_RX_LONGS] = {
++ .name = "rx_longs",
++ .offset = 0x12,
++ },
++ [OCELOT_STAT_RX_CLASSIFIED_DROPS] = {
++ .name = "rx_classified_drops",
++ .offset = 0x13,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_0] = {
++ .name = "rx_red_prio_0",
++ .offset = 0x14,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_1] = {
++ .name = "rx_red_prio_1",
++ .offset = 0x15,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_2] = {
++ .name = "rx_red_prio_2",
++ .offset = 0x16,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_3] = {
++ .name = "rx_red_prio_3",
++ .offset = 0x17,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_4] = {
++ .name = "rx_red_prio_4",
++ .offset = 0x18,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_5] = {
++ .name = "rx_red_prio_5",
++ .offset = 0x19,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_6] = {
++ .name = "rx_red_prio_6",
++ .offset = 0x1A,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_7] = {
++ .name = "rx_red_prio_7",
++ .offset = 0x1B,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_0] = {
++ .name = "rx_yellow_prio_0",
++ .offset = 0x1C,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_1] = {
++ .name = "rx_yellow_prio_1",
++ .offset = 0x1D,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_2] = {
++ .name = "rx_yellow_prio_2",
++ .offset = 0x1E,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_3] = {
++ .name = "rx_yellow_prio_3",
++ .offset = 0x1F,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_4] = {
++ .name = "rx_yellow_prio_4",
++ .offset = 0x20,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_5] = {
++ .name = "rx_yellow_prio_5",
++ .offset = 0x21,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_6] = {
++ .name = "rx_yellow_prio_6",
++ .offset = 0x22,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_7] = {
++ .name = "rx_yellow_prio_7",
++ .offset = 0x23,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_0] = {
++ .name = "rx_green_prio_0",
++ .offset = 0x24,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_1] = {
++ .name = "rx_green_prio_1",
++ .offset = 0x25,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_2] = {
++ .name = "rx_green_prio_2",
++ .offset = 0x26,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_3] = {
++ .name = "rx_green_prio_3",
++ .offset = 0x27,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_4] = {
++ .name = "rx_green_prio_4",
++ .offset = 0x28,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_5] = {
++ .name = "rx_green_prio_5",
++ .offset = 0x29,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_6] = {
++ .name = "rx_green_prio_6",
++ .offset = 0x2A,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_7] = {
++ .name = "rx_green_prio_7",
++ .offset = 0x2B,
++ },
++ [OCELOT_STAT_TX_OCTETS] = {
++ .name = "tx_octets",
++ .offset = 0x40,
++ },
++ [OCELOT_STAT_TX_UNICAST] = {
++ .name = "tx_unicast",
++ .offset = 0x41,
++ },
++ [OCELOT_STAT_TX_MULTICAST] = {
++ .name = "tx_multicast",
++ .offset = 0x42,
++ },
++ [OCELOT_STAT_TX_BROADCAST] = {
++ .name = "tx_broadcast",
++ .offset = 0x43,
++ },
++ [OCELOT_STAT_TX_COLLISION] = {
++ .name = "tx_collision",
++ .offset = 0x44,
++ },
++ [OCELOT_STAT_TX_DROPS] = {
++ .name = "tx_drops",
++ .offset = 0x45,
++ },
++ [OCELOT_STAT_TX_PAUSE] = {
++ .name = "tx_pause",
++ .offset = 0x46,
++ },
++ [OCELOT_STAT_TX_64] = {
++ .name = "tx_frames_below_65_octets",
++ .offset = 0x47,
++ },
++ [OCELOT_STAT_TX_65_127] = {
++ .name = "tx_frames_65_to_127_octets",
++ .offset = 0x48,
++ },
++ [OCELOT_STAT_TX_128_255] = {
++ .name = "tx_frames_128_255_octets",
++ .offset = 0x49,
++ },
++ [OCELOT_STAT_TX_256_511] = {
++ .name = "tx_frames_256_511_octets",
++ .offset = 0x4A,
++ },
++ [OCELOT_STAT_TX_512_1023] = {
++ .name = "tx_frames_512_1023_octets",
++ .offset = 0x4B,
++ },
++ [OCELOT_STAT_TX_1024_1526] = {
++ .name = "tx_frames_1024_1526_octets",
++ .offset = 0x4C,
++ },
++ [OCELOT_STAT_TX_1527_MAX] = {
++ .name = "tx_frames_over_1526_octets",
++ .offset = 0x4D,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_0] = {
++ .name = "tx_yellow_prio_0",
++ .offset = 0x4E,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_1] = {
++ .name = "tx_yellow_prio_1",
++ .offset = 0x4F,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_2] = {
++ .name = "tx_yellow_prio_2",
++ .offset = 0x50,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_3] = {
++ .name = "tx_yellow_prio_3",
++ .offset = 0x51,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_4] = {
++ .name = "tx_yellow_prio_4",
++ .offset = 0x52,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_5] = {
++ .name = "tx_yellow_prio_5",
++ .offset = 0x53,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_6] = {
++ .name = "tx_yellow_prio_6",
++ .offset = 0x54,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_7] = {
++ .name = "tx_yellow_prio_7",
++ .offset = 0x55,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_0] = {
++ .name = "tx_green_prio_0",
++ .offset = 0x56,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_1] = {
++ .name = "tx_green_prio_1",
++ .offset = 0x57,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_2] = {
++ .name = "tx_green_prio_2",
++ .offset = 0x58,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_3] = {
++ .name = "tx_green_prio_3",
++ .offset = 0x59,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_4] = {
++ .name = "tx_green_prio_4",
++ .offset = 0x5A,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_5] = {
++ .name = "tx_green_prio_5",
++ .offset = 0x5B,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_6] = {
++ .name = "tx_green_prio_6",
++ .offset = 0x5C,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_7] = {
++ .name = "tx_green_prio_7",
++ .offset = 0x5D,
++ },
++ [OCELOT_STAT_TX_AGED] = {
++ .name = "tx_aged",
++ .offset = 0x5E,
++ },
++ [OCELOT_STAT_DROP_LOCAL] = {
++ .name = "drop_local",
++ .offset = 0x80,
++ },
++ [OCELOT_STAT_DROP_TAIL] = {
++ .name = "drop_tail",
++ .offset = 0x81,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_0] = {
++ .name = "drop_yellow_prio_0",
++ .offset = 0x82,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_1] = {
++ .name = "drop_yellow_prio_1",
++ .offset = 0x83,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_2] = {
++ .name = "drop_yellow_prio_2",
++ .offset = 0x84,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_3] = {
++ .name = "drop_yellow_prio_3",
++ .offset = 0x85,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_4] = {
++ .name = "drop_yellow_prio_4",
++ .offset = 0x86,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_5] = {
++ .name = "drop_yellow_prio_5",
++ .offset = 0x87,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_6] = {
++ .name = "drop_yellow_prio_6",
++ .offset = 0x88,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_7] = {
++ .name = "drop_yellow_prio_7",
++ .offset = 0x89,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_0] = {
++ .name = "drop_green_prio_0",
++ .offset = 0x8A,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_1] = {
++ .name = "drop_green_prio_1",
++ .offset = 0x8B,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_2] = {
++ .name = "drop_green_prio_2",
++ .offset = 0x8C,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_3] = {
++ .name = "drop_green_prio_3",
++ .offset = 0x8D,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_4] = {
++ .name = "drop_green_prio_4",
++ .offset = 0x8E,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_5] = {
++ .name = "drop_green_prio_5",
++ .offset = 0x8F,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_6] = {
++ .name = "drop_green_prio_6",
++ .offset = 0x90,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_7] = {
++ .name = "drop_green_prio_7",
++ .offset = 0x91,
++ },
+ };
+
+ static const struct vcap_field vsc9953_vcap_es0_keys[] = {
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index c67f162f8ab5..68991b021c56 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1860,16 +1860,20 @@ void ocelot_get_strings(struct ocelot *ocelot, int port, u32 sset, u8 *data)
+ if (sset != ETH_SS_STATS)
+ return;
+
+- for (i = 0; i < ocelot->num_stats; i++)
++ for (i = 0; i < OCELOT_NUM_STATS; i++) {
++ if (ocelot->stats_layout[i].name[0] == '\0')
++ continue;
++
+ memcpy(data + i * ETH_GSTRING_LEN, ocelot->stats_layout[i].name,
+ ETH_GSTRING_LEN);
++ }
+ }
+ EXPORT_SYMBOL(ocelot_get_strings);
+
+ /* Caller must hold &ocelot->stats_lock */
+ static int ocelot_port_update_stats(struct ocelot *ocelot, int port)
+ {
+- unsigned int idx = port * ocelot->num_stats;
++ unsigned int idx = port * OCELOT_NUM_STATS;
+ struct ocelot_stats_region *region;
+ int err, j;
+
+@@ -1930,9 +1934,15 @@ void ocelot_get_ethtool_stats(struct ocelot *ocelot, int port, u64 *data)
+ /* check and update now */
+ err = ocelot_port_update_stats(ocelot, port);
+
+- /* Copy all counters */
+- for (i = 0; i < ocelot->num_stats; i++)
+- *data++ = ocelot->stats[port * ocelot->num_stats + i];
++ /* Copy all supported counters */
++ for (i = 0; i < OCELOT_NUM_STATS; i++) {
++ int index = port * OCELOT_NUM_STATS + i;
++
++ if (ocelot->stats_layout[i].name[0] == '\0')
++ continue;
++
++ *data++ = ocelot->stats[index];
++ }
+
+ spin_unlock(&ocelot->stats_lock);
+
+@@ -1943,10 +1953,16 @@ EXPORT_SYMBOL(ocelot_get_ethtool_stats);
+
+ int ocelot_get_sset_count(struct ocelot *ocelot, int port, int sset)
+ {
++ int i, num_stats = 0;
++
+ if (sset != ETH_SS_STATS)
+ return -EOPNOTSUPP;
+
+- return ocelot->num_stats;
++ for (i = 0; i < OCELOT_NUM_STATS; i++)
++ if (ocelot->stats_layout[i].name[0] != '\0')
++ num_stats++;
++
++ return num_stats;
+ }
+ EXPORT_SYMBOL(ocelot_get_sset_count);
+
+@@ -1958,7 +1974,10 @@ static int ocelot_prepare_stats_regions(struct ocelot *ocelot)
+
+ INIT_LIST_HEAD(&ocelot->stats_regions);
+
+- for (i = 0; i < ocelot->num_stats; i++) {
++ for (i = 0; i < OCELOT_NUM_STATS; i++) {
++ if (ocelot->stats_layout[i].name[0] == '\0')
++ continue;
++
+ if (region && ocelot->stats_layout[i].offset == last + 1) {
+ region->count++;
+ } else {
+@@ -3340,7 +3359,6 @@ static void ocelot_detect_features(struct ocelot *ocelot)
+
+ int ocelot_init(struct ocelot *ocelot)
+ {
+- const struct ocelot_stat_layout *stat;
+ char queue_name[32];
+ int i, ret;
+ u32 port;
+@@ -3353,12 +3371,8 @@ int ocelot_init(struct ocelot *ocelot)
+ }
+ }
+
+- ocelot->num_stats = 0;
+- for_each_stat(ocelot, stat)
+- ocelot->num_stats++;
+-
+ ocelot->stats = devm_kcalloc(ocelot->dev,
+- ocelot->num_phys_ports * ocelot->num_stats,
++ ocelot->num_phys_ports * OCELOT_NUM_STATS,
+ sizeof(u64), GFP_KERNEL);
+ if (!ocelot->stats)
+ return -ENOMEM;
+diff --git a/drivers/net/ethernet/mscc/ocelot_vsc7514.c b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+index 961f803aca19..9ff910560043 100644
+--- a/drivers/net/ethernet/mscc/ocelot_vsc7514.c
++++ b/drivers/net/ethernet/mscc/ocelot_vsc7514.c
+@@ -96,101 +96,379 @@ static const struct reg_field ocelot_regfields[REGFIELD_MAX] = {
+ [SYS_PAUSE_CFG_PAUSE_ENA] = REG_FIELD_ID(SYS_PAUSE_CFG, 0, 1, 12, 4),
+ };
+
+-static const struct ocelot_stat_layout ocelot_stats_layout[] = {
+- { .name = "rx_octets", .offset = 0x00, },
+- { .name = "rx_unicast", .offset = 0x01, },
+- { .name = "rx_multicast", .offset = 0x02, },
+- { .name = "rx_broadcast", .offset = 0x03, },
+- { .name = "rx_shorts", .offset = 0x04, },
+- { .name = "rx_fragments", .offset = 0x05, },
+- { .name = "rx_jabbers", .offset = 0x06, },
+- { .name = "rx_crc_align_errs", .offset = 0x07, },
+- { .name = "rx_sym_errs", .offset = 0x08, },
+- { .name = "rx_frames_below_65_octets", .offset = 0x09, },
+- { .name = "rx_frames_65_to_127_octets", .offset = 0x0A, },
+- { .name = "rx_frames_128_to_255_octets", .offset = 0x0B, },
+- { .name = "rx_frames_256_to_511_octets", .offset = 0x0C, },
+- { .name = "rx_frames_512_to_1023_octets", .offset = 0x0D, },
+- { .name = "rx_frames_1024_to_1526_octets", .offset = 0x0E, },
+- { .name = "rx_frames_over_1526_octets", .offset = 0x0F, },
+- { .name = "rx_pause", .offset = 0x10, },
+- { .name = "rx_control", .offset = 0x11, },
+- { .name = "rx_longs", .offset = 0x12, },
+- { .name = "rx_classified_drops", .offset = 0x13, },
+- { .name = "rx_red_prio_0", .offset = 0x14, },
+- { .name = "rx_red_prio_1", .offset = 0x15, },
+- { .name = "rx_red_prio_2", .offset = 0x16, },
+- { .name = "rx_red_prio_3", .offset = 0x17, },
+- { .name = "rx_red_prio_4", .offset = 0x18, },
+- { .name = "rx_red_prio_5", .offset = 0x19, },
+- { .name = "rx_red_prio_6", .offset = 0x1A, },
+- { .name = "rx_red_prio_7", .offset = 0x1B, },
+- { .name = "rx_yellow_prio_0", .offset = 0x1C, },
+- { .name = "rx_yellow_prio_1", .offset = 0x1D, },
+- { .name = "rx_yellow_prio_2", .offset = 0x1E, },
+- { .name = "rx_yellow_prio_3", .offset = 0x1F, },
+- { .name = "rx_yellow_prio_4", .offset = 0x20, },
+- { .name = "rx_yellow_prio_5", .offset = 0x21, },
+- { .name = "rx_yellow_prio_6", .offset = 0x22, },
+- { .name = "rx_yellow_prio_7", .offset = 0x23, },
+- { .name = "rx_green_prio_0", .offset = 0x24, },
+- { .name = "rx_green_prio_1", .offset = 0x25, },
+- { .name = "rx_green_prio_2", .offset = 0x26, },
+- { .name = "rx_green_prio_3", .offset = 0x27, },
+- { .name = "rx_green_prio_4", .offset = 0x28, },
+- { .name = "rx_green_prio_5", .offset = 0x29, },
+- { .name = "rx_green_prio_6", .offset = 0x2A, },
+- { .name = "rx_green_prio_7", .offset = 0x2B, },
+- { .name = "tx_octets", .offset = 0x40, },
+- { .name = "tx_unicast", .offset = 0x41, },
+- { .name = "tx_multicast", .offset = 0x42, },
+- { .name = "tx_broadcast", .offset = 0x43, },
+- { .name = "tx_collision", .offset = 0x44, },
+- { .name = "tx_drops", .offset = 0x45, },
+- { .name = "tx_pause", .offset = 0x46, },
+- { .name = "tx_frames_below_65_octets", .offset = 0x47, },
+- { .name = "tx_frames_65_to_127_octets", .offset = 0x48, },
+- { .name = "tx_frames_128_255_octets", .offset = 0x49, },
+- { .name = "tx_frames_256_511_octets", .offset = 0x4A, },
+- { .name = "tx_frames_512_1023_octets", .offset = 0x4B, },
+- { .name = "tx_frames_1024_1526_octets", .offset = 0x4C, },
+- { .name = "tx_frames_over_1526_octets", .offset = 0x4D, },
+- { .name = "tx_yellow_prio_0", .offset = 0x4E, },
+- { .name = "tx_yellow_prio_1", .offset = 0x4F, },
+- { .name = "tx_yellow_prio_2", .offset = 0x50, },
+- { .name = "tx_yellow_prio_3", .offset = 0x51, },
+- { .name = "tx_yellow_prio_4", .offset = 0x52, },
+- { .name = "tx_yellow_prio_5", .offset = 0x53, },
+- { .name = "tx_yellow_prio_6", .offset = 0x54, },
+- { .name = "tx_yellow_prio_7", .offset = 0x55, },
+- { .name = "tx_green_prio_0", .offset = 0x56, },
+- { .name = "tx_green_prio_1", .offset = 0x57, },
+- { .name = "tx_green_prio_2", .offset = 0x58, },
+- { .name = "tx_green_prio_3", .offset = 0x59, },
+- { .name = "tx_green_prio_4", .offset = 0x5A, },
+- { .name = "tx_green_prio_5", .offset = 0x5B, },
+- { .name = "tx_green_prio_6", .offset = 0x5C, },
+- { .name = "tx_green_prio_7", .offset = 0x5D, },
+- { .name = "tx_aged", .offset = 0x5E, },
+- { .name = "drop_local", .offset = 0x80, },
+- { .name = "drop_tail", .offset = 0x81, },
+- { .name = "drop_yellow_prio_0", .offset = 0x82, },
+- { .name = "drop_yellow_prio_1", .offset = 0x83, },
+- { .name = "drop_yellow_prio_2", .offset = 0x84, },
+- { .name = "drop_yellow_prio_3", .offset = 0x85, },
+- { .name = "drop_yellow_prio_4", .offset = 0x86, },
+- { .name = "drop_yellow_prio_5", .offset = 0x87, },
+- { .name = "drop_yellow_prio_6", .offset = 0x88, },
+- { .name = "drop_yellow_prio_7", .offset = 0x89, },
+- { .name = "drop_green_prio_0", .offset = 0x8A, },
+- { .name = "drop_green_prio_1", .offset = 0x8B, },
+- { .name = "drop_green_prio_2", .offset = 0x8C, },
+- { .name = "drop_green_prio_3", .offset = 0x8D, },
+- { .name = "drop_green_prio_4", .offset = 0x8E, },
+- { .name = "drop_green_prio_5", .offset = 0x8F, },
+- { .name = "drop_green_prio_6", .offset = 0x90, },
+- { .name = "drop_green_prio_7", .offset = 0x91, },
+- OCELOT_STAT_END
++static const struct ocelot_stat_layout ocelot_stats_layout[OCELOT_NUM_STATS] = {
++ [OCELOT_STAT_RX_OCTETS] = {
++ .name = "rx_octets",
++ .offset = 0x00,
++ },
++ [OCELOT_STAT_RX_UNICAST] = {
++ .name = "rx_unicast",
++ .offset = 0x01,
++ },
++ [OCELOT_STAT_RX_MULTICAST] = {
++ .name = "rx_multicast",
++ .offset = 0x02,
++ },
++ [OCELOT_STAT_RX_BROADCAST] = {
++ .name = "rx_broadcast",
++ .offset = 0x03,
++ },
++ [OCELOT_STAT_RX_SHORTS] = {
++ .name = "rx_shorts",
++ .offset = 0x04,
++ },
++ [OCELOT_STAT_RX_FRAGMENTS] = {
++ .name = "rx_fragments",
++ .offset = 0x05,
++ },
++ [OCELOT_STAT_RX_JABBERS] = {
++ .name = "rx_jabbers",
++ .offset = 0x06,
++ },
++ [OCELOT_STAT_RX_CRC_ALIGN_ERRS] = {
++ .name = "rx_crc_align_errs",
++ .offset = 0x07,
++ },
++ [OCELOT_STAT_RX_SYM_ERRS] = {
++ .name = "rx_sym_errs",
++ .offset = 0x08,
++ },
++ [OCELOT_STAT_RX_64] = {
++ .name = "rx_frames_below_65_octets",
++ .offset = 0x09,
++ },
++ [OCELOT_STAT_RX_65_127] = {
++ .name = "rx_frames_65_to_127_octets",
++ .offset = 0x0A,
++ },
++ [OCELOT_STAT_RX_128_255] = {
++ .name = "rx_frames_128_to_255_octets",
++ .offset = 0x0B,
++ },
++ [OCELOT_STAT_RX_256_511] = {
++ .name = "rx_frames_256_to_511_octets",
++ .offset = 0x0C,
++ },
++ [OCELOT_STAT_RX_512_1023] = {
++ .name = "rx_frames_512_to_1023_octets",
++ .offset = 0x0D,
++ },
++ [OCELOT_STAT_RX_1024_1526] = {
++ .name = "rx_frames_1024_to_1526_octets",
++ .offset = 0x0E,
++ },
++ [OCELOT_STAT_RX_1527_MAX] = {
++ .name = "rx_frames_over_1526_octets",
++ .offset = 0x0F,
++ },
++ [OCELOT_STAT_RX_PAUSE] = {
++ .name = "rx_pause",
++ .offset = 0x10,
++ },
++ [OCELOT_STAT_RX_CONTROL] = {
++ .name = "rx_control",
++ .offset = 0x11,
++ },
++ [OCELOT_STAT_RX_LONGS] = {
++ .name = "rx_longs",
++ .offset = 0x12,
++ },
++ [OCELOT_STAT_RX_CLASSIFIED_DROPS] = {
++ .name = "rx_classified_drops",
++ .offset = 0x13,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_0] = {
++ .name = "rx_red_prio_0",
++ .offset = 0x14,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_1] = {
++ .name = "rx_red_prio_1",
++ .offset = 0x15,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_2] = {
++ .name = "rx_red_prio_2",
++ .offset = 0x16,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_3] = {
++ .name = "rx_red_prio_3",
++ .offset = 0x17,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_4] = {
++ .name = "rx_red_prio_4",
++ .offset = 0x18,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_5] = {
++ .name = "rx_red_prio_5",
++ .offset = 0x19,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_6] = {
++ .name = "rx_red_prio_6",
++ .offset = 0x1A,
++ },
++ [OCELOT_STAT_RX_RED_PRIO_7] = {
++ .name = "rx_red_prio_7",
++ .offset = 0x1B,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_0] = {
++ .name = "rx_yellow_prio_0",
++ .offset = 0x1C,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_1] = {
++ .name = "rx_yellow_prio_1",
++ .offset = 0x1D,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_2] = {
++ .name = "rx_yellow_prio_2",
++ .offset = 0x1E,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_3] = {
++ .name = "rx_yellow_prio_3",
++ .offset = 0x1F,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_4] = {
++ .name = "rx_yellow_prio_4",
++ .offset = 0x20,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_5] = {
++ .name = "rx_yellow_prio_5",
++ .offset = 0x21,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_6] = {
++ .name = "rx_yellow_prio_6",
++ .offset = 0x22,
++ },
++ [OCELOT_STAT_RX_YELLOW_PRIO_7] = {
++ .name = "rx_yellow_prio_7",
++ .offset = 0x23,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_0] = {
++ .name = "rx_green_prio_0",
++ .offset = 0x24,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_1] = {
++ .name = "rx_green_prio_1",
++ .offset = 0x25,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_2] = {
++ .name = "rx_green_prio_2",
++ .offset = 0x26,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_3] = {
++ .name = "rx_green_prio_3",
++ .offset = 0x27,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_4] = {
++ .name = "rx_green_prio_4",
++ .offset = 0x28,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_5] = {
++ .name = "rx_green_prio_5",
++ .offset = 0x29,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_6] = {
++ .name = "rx_green_prio_6",
++ .offset = 0x2A,
++ },
++ [OCELOT_STAT_RX_GREEN_PRIO_7] = {
++ .name = "rx_green_prio_7",
++ .offset = 0x2B,
++ },
++ [OCELOT_STAT_TX_OCTETS] = {
++ .name = "tx_octets",
++ .offset = 0x40,
++ },
++ [OCELOT_STAT_TX_UNICAST] = {
++ .name = "tx_unicast",
++ .offset = 0x41,
++ },
++ [OCELOT_STAT_TX_MULTICAST] = {
++ .name = "tx_multicast",
++ .offset = 0x42,
++ },
++ [OCELOT_STAT_TX_BROADCAST] = {
++ .name = "tx_broadcast",
++ .offset = 0x43,
++ },
++ [OCELOT_STAT_TX_COLLISION] = {
++ .name = "tx_collision",
++ .offset = 0x44,
++ },
++ [OCELOT_STAT_TX_DROPS] = {
++ .name = "tx_drops",
++ .offset = 0x45,
++ },
++ [OCELOT_STAT_TX_PAUSE] = {
++ .name = "tx_pause",
++ .offset = 0x46,
++ },
++ [OCELOT_STAT_TX_64] = {
++ .name = "tx_frames_below_65_octets",
++ .offset = 0x47,
++ },
++ [OCELOT_STAT_TX_65_127] = {
++ .name = "tx_frames_65_to_127_octets",
++ .offset = 0x48,
++ },
++ [OCELOT_STAT_TX_128_255] = {
++ .name = "tx_frames_128_255_octets",
++ .offset = 0x49,
++ },
++ [OCELOT_STAT_TX_256_511] = {
++ .name = "tx_frames_256_511_octets",
++ .offset = 0x4A,
++ },
++ [OCELOT_STAT_TX_512_1023] = {
++ .name = "tx_frames_512_1023_octets",
++ .offset = 0x4B,
++ },
++ [OCELOT_STAT_TX_1024_1526] = {
++ .name = "tx_frames_1024_1526_octets",
++ .offset = 0x4C,
++ },
++ [OCELOT_STAT_TX_1527_MAX] = {
++ .name = "tx_frames_over_1526_octets",
++ .offset = 0x4D,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_0] = {
++ .name = "tx_yellow_prio_0",
++ .offset = 0x4E,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_1] = {
++ .name = "tx_yellow_prio_1",
++ .offset = 0x4F,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_2] = {
++ .name = "tx_yellow_prio_2",
++ .offset = 0x50,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_3] = {
++ .name = "tx_yellow_prio_3",
++ .offset = 0x51,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_4] = {
++ .name = "tx_yellow_prio_4",
++ .offset = 0x52,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_5] = {
++ .name = "tx_yellow_prio_5",
++ .offset = 0x53,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_6] = {
++ .name = "tx_yellow_prio_6",
++ .offset = 0x54,
++ },
++ [OCELOT_STAT_TX_YELLOW_PRIO_7] = {
++ .name = "tx_yellow_prio_7",
++ .offset = 0x55,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_0] = {
++ .name = "tx_green_prio_0",
++ .offset = 0x56,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_1] = {
++ .name = "tx_green_prio_1",
++ .offset = 0x57,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_2] = {
++ .name = "tx_green_prio_2",
++ .offset = 0x58,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_3] = {
++ .name = "tx_green_prio_3",
++ .offset = 0x59,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_4] = {
++ .name = "tx_green_prio_4",
++ .offset = 0x5A,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_5] = {
++ .name = "tx_green_prio_5",
++ .offset = 0x5B,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_6] = {
++ .name = "tx_green_prio_6",
++ .offset = 0x5C,
++ },
++ [OCELOT_STAT_TX_GREEN_PRIO_7] = {
++ .name = "tx_green_prio_7",
++ .offset = 0x5D,
++ },
++ [OCELOT_STAT_TX_AGED] = {
++ .name = "tx_aged",
++ .offset = 0x5E,
++ },
++ [OCELOT_STAT_DROP_LOCAL] = {
++ .name = "drop_local",
++ .offset = 0x80,
++ },
++ [OCELOT_STAT_DROP_TAIL] = {
++ .name = "drop_tail",
++ .offset = 0x81,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_0] = {
++ .name = "drop_yellow_prio_0",
++ .offset = 0x82,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_1] = {
++ .name = "drop_yellow_prio_1",
++ .offset = 0x83,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_2] = {
++ .name = "drop_yellow_prio_2",
++ .offset = 0x84,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_3] = {
++ .name = "drop_yellow_prio_3",
++ .offset = 0x85,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_4] = {
++ .name = "drop_yellow_prio_4",
++ .offset = 0x86,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_5] = {
++ .name = "drop_yellow_prio_5",
++ .offset = 0x87,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_6] = {
++ .name = "drop_yellow_prio_6",
++ .offset = 0x88,
++ },
++ [OCELOT_STAT_DROP_YELLOW_PRIO_7] = {
++ .name = "drop_yellow_prio_7",
++ .offset = 0x89,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_0] = {
++ .name = "drop_green_prio_0",
++ .offset = 0x8A,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_1] = {
++ .name = "drop_green_prio_1",
++ .offset = 0x8B,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_2] = {
++ .name = "drop_green_prio_2",
++ .offset = 0x8C,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_3] = {
++ .name = "drop_green_prio_3",
++ .offset = 0x8D,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_4] = {
++ .name = "drop_green_prio_4",
++ .offset = 0x8E,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_5] = {
++ .name = "drop_green_prio_5",
++ .offset = 0x8F,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_6] = {
++ .name = "drop_green_prio_6",
++ .offset = 0x90,
++ },
++ [OCELOT_STAT_DROP_GREEN_PRIO_7] = {
++ .name = "drop_green_prio_7",
++ .offset = 0x91,
++ },
+ };
+
+ static void ocelot_pll5_init(struct ocelot *ocelot)
+diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
+index 72b9474391da..2428bc64cb1d 100644
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -105,11 +105,6 @@
+ #define REG_RESERVED_ADDR 0xffffffff
+ #define REG_RESERVED(reg) REG(reg, REG_RESERVED_ADDR)
+
+-#define for_each_stat(ocelot, stat) \
+- for ((stat) = (ocelot)->stats_layout; \
+- ((stat)->name[0] != '\0'); \
+- (stat)++)
+-
+ enum ocelot_target {
+ ANA = 1,
+ QS,
+@@ -540,13 +535,108 @@ enum ocelot_ptp_pins {
+ TOD_ACC_PIN
+ };
+
++enum ocelot_stat {
++ OCELOT_STAT_RX_OCTETS,
++ OCELOT_STAT_RX_UNICAST,
++ OCELOT_STAT_RX_MULTICAST,
++ OCELOT_STAT_RX_BROADCAST,
++ OCELOT_STAT_RX_SHORTS,
++ OCELOT_STAT_RX_FRAGMENTS,
++ OCELOT_STAT_RX_JABBERS,
++ OCELOT_STAT_RX_CRC_ALIGN_ERRS,
++ OCELOT_STAT_RX_SYM_ERRS,
++ OCELOT_STAT_RX_64,
++ OCELOT_STAT_RX_65_127,
++ OCELOT_STAT_RX_128_255,
++ OCELOT_STAT_RX_256_511,
++ OCELOT_STAT_RX_512_1023,
++ OCELOT_STAT_RX_1024_1526,
++ OCELOT_STAT_RX_1527_MAX,
++ OCELOT_STAT_RX_PAUSE,
++ OCELOT_STAT_RX_CONTROL,
++ OCELOT_STAT_RX_LONGS,
++ OCELOT_STAT_RX_CLASSIFIED_DROPS,
++ OCELOT_STAT_RX_RED_PRIO_0,
++ OCELOT_STAT_RX_RED_PRIO_1,
++ OCELOT_STAT_RX_RED_PRIO_2,
++ OCELOT_STAT_RX_RED_PRIO_3,
++ OCELOT_STAT_RX_RED_PRIO_4,
++ OCELOT_STAT_RX_RED_PRIO_5,
++ OCELOT_STAT_RX_RED_PRIO_6,
++ OCELOT_STAT_RX_RED_PRIO_7,
++ OCELOT_STAT_RX_YELLOW_PRIO_0,
++ OCELOT_STAT_RX_YELLOW_PRIO_1,
++ OCELOT_STAT_RX_YELLOW_PRIO_2,
++ OCELOT_STAT_RX_YELLOW_PRIO_3,
++ OCELOT_STAT_RX_YELLOW_PRIO_4,
++ OCELOT_STAT_RX_YELLOW_PRIO_5,
++ OCELOT_STAT_RX_YELLOW_PRIO_6,
++ OCELOT_STAT_RX_YELLOW_PRIO_7,
++ OCELOT_STAT_RX_GREEN_PRIO_0,
++ OCELOT_STAT_RX_GREEN_PRIO_1,
++ OCELOT_STAT_RX_GREEN_PRIO_2,
++ OCELOT_STAT_RX_GREEN_PRIO_3,
++ OCELOT_STAT_RX_GREEN_PRIO_4,
++ OCELOT_STAT_RX_GREEN_PRIO_5,
++ OCELOT_STAT_RX_GREEN_PRIO_6,
++ OCELOT_STAT_RX_GREEN_PRIO_7,
++ OCELOT_STAT_TX_OCTETS,
++ OCELOT_STAT_TX_UNICAST,
++ OCELOT_STAT_TX_MULTICAST,
++ OCELOT_STAT_TX_BROADCAST,
++ OCELOT_STAT_TX_COLLISION,
++ OCELOT_STAT_TX_DROPS,
++ OCELOT_STAT_TX_PAUSE,
++ OCELOT_STAT_TX_64,
++ OCELOT_STAT_TX_65_127,
++ OCELOT_STAT_TX_128_255,
++ OCELOT_STAT_TX_256_511,
++ OCELOT_STAT_TX_512_1023,
++ OCELOT_STAT_TX_1024_1526,
++ OCELOT_STAT_TX_1527_MAX,
++ OCELOT_STAT_TX_YELLOW_PRIO_0,
++ OCELOT_STAT_TX_YELLOW_PRIO_1,
++ OCELOT_STAT_TX_YELLOW_PRIO_2,
++ OCELOT_STAT_TX_YELLOW_PRIO_3,
++ OCELOT_STAT_TX_YELLOW_PRIO_4,
++ OCELOT_STAT_TX_YELLOW_PRIO_5,
++ OCELOT_STAT_TX_YELLOW_PRIO_6,
++ OCELOT_STAT_TX_YELLOW_PRIO_7,
++ OCELOT_STAT_TX_GREEN_PRIO_0,
++ OCELOT_STAT_TX_GREEN_PRIO_1,
++ OCELOT_STAT_TX_GREEN_PRIO_2,
++ OCELOT_STAT_TX_GREEN_PRIO_3,
++ OCELOT_STAT_TX_GREEN_PRIO_4,
++ OCELOT_STAT_TX_GREEN_PRIO_5,
++ OCELOT_STAT_TX_GREEN_PRIO_6,
++ OCELOT_STAT_TX_GREEN_PRIO_7,
++ OCELOT_STAT_TX_AGED,
++ OCELOT_STAT_DROP_LOCAL,
++ OCELOT_STAT_DROP_TAIL,
++ OCELOT_STAT_DROP_YELLOW_PRIO_0,
++ OCELOT_STAT_DROP_YELLOW_PRIO_1,
++ OCELOT_STAT_DROP_YELLOW_PRIO_2,
++ OCELOT_STAT_DROP_YELLOW_PRIO_3,
++ OCELOT_STAT_DROP_YELLOW_PRIO_4,
++ OCELOT_STAT_DROP_YELLOW_PRIO_5,
++ OCELOT_STAT_DROP_YELLOW_PRIO_6,
++ OCELOT_STAT_DROP_YELLOW_PRIO_7,
++ OCELOT_STAT_DROP_GREEN_PRIO_0,
++ OCELOT_STAT_DROP_GREEN_PRIO_1,
++ OCELOT_STAT_DROP_GREEN_PRIO_2,
++ OCELOT_STAT_DROP_GREEN_PRIO_3,
++ OCELOT_STAT_DROP_GREEN_PRIO_4,
++ OCELOT_STAT_DROP_GREEN_PRIO_5,
++ OCELOT_STAT_DROP_GREEN_PRIO_6,
++ OCELOT_STAT_DROP_GREEN_PRIO_7,
++ OCELOT_NUM_STATS,
++};
++
+ struct ocelot_stat_layout {
+ u32 offset;
+ char name[ETH_GSTRING_LEN];
+ };
+
+-#define OCELOT_STAT_END { .name = "" }
+-
+ struct ocelot_stats_region {
+ struct list_head node;
+ u32 offset;
+@@ -709,7 +799,6 @@ struct ocelot {
+ const u32 *const *map;
+ const struct ocelot_stat_layout *stats_layout;
+ struct list_head stats_regions;
+- unsigned int num_stats;
+
+ u32 pool_size[OCELOT_SB_NUM][OCELOT_SB_POOL_NUM];
+ int packet_buffer_size;
+--
+2.35.1
+
--- /dev/null
+From 437cec7104ac4f8f5b1fe69d0923bd301b308298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Aug 2022 16:53:52 +0300
+Subject: net: mscc: ocelot: report ndo_get_stats64 from the
+ wraparound-resistant ocelot->stats
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit e780e3193e889fd8358b862f7cd18ec5a4901caf ]
+
+Rather than reading the stats64 counters directly from the 32-bit
+hardware, it's better to rely on the output produced by the periodic
+ocelot_port_update_stats().
+
+It would be even better to call ocelot_port_update_stats() right from
+ocelot_get_stats64() to make sure we report the current values rather
+than the ones from 2 seconds ago. But we need to export
+ocelot_port_update_stats() from the switch lib towards the switchdev
+driver for that, and future work will largely undo that.
+
+There are more ocelot-based drivers waiting to be introduced, an example
+of which is the SPI-controlled VSC7512. In that driver's case, it will
+be impossible to call ocelot_port_update_stats() from ndo_get_stats64
+context, since the latter is atomic, and reading the stats over SPI is
+sleepable. So the compromise taken here, which will also hold going
+forward, is to report 64-bit counters to stats64, which are not 100% up
+to date.
+
+Fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_net.c | 53 +++++++++++++-------------
+ 1 file changed, 26 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_net.c b/drivers/net/ethernet/mscc/ocelot_net.c
+index 6b9d37138844..330d30841cdc 100644
+--- a/drivers/net/ethernet/mscc/ocelot_net.c
++++ b/drivers/net/ethernet/mscc/ocelot_net.c
+@@ -725,41 +725,40 @@ static void ocelot_get_stats64(struct net_device *dev,
+ struct ocelot_port_private *priv = netdev_priv(dev);
+ struct ocelot *ocelot = priv->port.ocelot;
+ int port = priv->port.index;
++ u64 *s;
+
+ spin_lock(&ocelot->stats_lock);
+
+- /* Configure the port to read the stats from */
+- ocelot_write(ocelot, SYS_STAT_CFG_STAT_VIEW(port),
+- SYS_STAT_CFG);
++ s = &ocelot->stats[port * OCELOT_NUM_STATS];
+
+ /* Get Rx stats */
+- stats->rx_bytes = ocelot_read(ocelot, SYS_COUNT_RX_OCTETS);
+- stats->rx_packets = ocelot_read(ocelot, SYS_COUNT_RX_SHORTS) +
+- ocelot_read(ocelot, SYS_COUNT_RX_FRAGMENTS) +
+- ocelot_read(ocelot, SYS_COUNT_RX_JABBERS) +
+- ocelot_read(ocelot, SYS_COUNT_RX_LONGS) +
+- ocelot_read(ocelot, SYS_COUNT_RX_64) +
+- ocelot_read(ocelot, SYS_COUNT_RX_65_127) +
+- ocelot_read(ocelot, SYS_COUNT_RX_128_255) +
+- ocelot_read(ocelot, SYS_COUNT_RX_256_511) +
+- ocelot_read(ocelot, SYS_COUNT_RX_512_1023) +
+- ocelot_read(ocelot, SYS_COUNT_RX_1024_1526) +
+- ocelot_read(ocelot, SYS_COUNT_RX_1527_MAX);
+- stats->multicast = ocelot_read(ocelot, SYS_COUNT_RX_MULTICAST);
++ stats->rx_bytes = s[OCELOT_STAT_RX_OCTETS];
++ stats->rx_packets = s[OCELOT_STAT_RX_SHORTS] +
++ s[OCELOT_STAT_RX_FRAGMENTS] +
++ s[OCELOT_STAT_RX_JABBERS] +
++ s[OCELOT_STAT_RX_LONGS] +
++ s[OCELOT_STAT_RX_64] +
++ s[OCELOT_STAT_RX_65_127] +
++ s[OCELOT_STAT_RX_128_255] +
++ s[OCELOT_STAT_RX_256_511] +
++ s[OCELOT_STAT_RX_512_1023] +
++ s[OCELOT_STAT_RX_1024_1526] +
++ s[OCELOT_STAT_RX_1527_MAX];
++ stats->multicast = s[OCELOT_STAT_RX_MULTICAST];
+ stats->rx_dropped = dev->stats.rx_dropped;
+
+ /* Get Tx stats */
+- stats->tx_bytes = ocelot_read(ocelot, SYS_COUNT_TX_OCTETS);
+- stats->tx_packets = ocelot_read(ocelot, SYS_COUNT_TX_64) +
+- ocelot_read(ocelot, SYS_COUNT_TX_65_127) +
+- ocelot_read(ocelot, SYS_COUNT_TX_128_255) +
+- ocelot_read(ocelot, SYS_COUNT_TX_256_511) +
+- ocelot_read(ocelot, SYS_COUNT_TX_512_1023) +
+- ocelot_read(ocelot, SYS_COUNT_TX_1024_1526) +
+- ocelot_read(ocelot, SYS_COUNT_TX_1527_MAX);
+- stats->tx_dropped = ocelot_read(ocelot, SYS_COUNT_TX_DROPS) +
+- ocelot_read(ocelot, SYS_COUNT_TX_AGING);
+- stats->collisions = ocelot_read(ocelot, SYS_COUNT_TX_COLLISION);
++ stats->tx_bytes = s[OCELOT_STAT_TX_OCTETS];
++ stats->tx_packets = s[OCELOT_STAT_TX_64] +
++ s[OCELOT_STAT_TX_65_127] +
++ s[OCELOT_STAT_TX_128_255] +
++ s[OCELOT_STAT_TX_256_511] +
++ s[OCELOT_STAT_TX_512_1023] +
++ s[OCELOT_STAT_TX_1024_1526] +
++ s[OCELOT_STAT_TX_1527_MAX];
++ stats->tx_dropped = s[OCELOT_STAT_TX_DROPS] +
++ s[OCELOT_STAT_TX_AGED];
++ stats->collisions = s[OCELOT_STAT_TX_COLLISION];
+
+ spin_unlock(&ocelot->stats_lock);
+ }
+--
+2.35.1
+
--- /dev/null
+From 66184dc0617f0e2421a73f3f116274de765b2f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Aug 2022 16:53:48 +0300
+Subject: net: mscc: ocelot: turn stats_lock into a spinlock
+
+From: Vladimir Oltean <vladimir.oltean@nxp.com>
+
+[ Upstream commit 22d842e3efe56402c33b5e6e303bb71ce9bf9334 ]
+
+ocelot_get_stats64() currently runs unlocked and therefore may collide
+with ocelot_port_update_stats() which indirectly accesses the same
+counters. However, ocelot_get_stats64() runs in atomic context, and we
+cannot simply take the sleepable ocelot->stats_lock mutex. We need to
+convert it to an atomic spinlock first. Do that as a preparatory change.
+
+Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/ocelot/felix_vsc9959.c | 4 ++--
+ drivers/net/ethernet/mscc/ocelot.c | 11 +++++------
+ include/soc/mscc/ocelot.h | 2 +-
+ 3 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelot/felix_vsc9959.c
+index 61b1bf4399c4..601fae886b26 100644
+--- a/drivers/net/dsa/ocelot/felix_vsc9959.c
++++ b/drivers/net/dsa/ocelot/felix_vsc9959.c
+@@ -2177,7 +2177,7 @@ static void vsc9959_psfp_sgi_table_del(struct ocelot *ocelot,
+ static void vsc9959_psfp_counters_get(struct ocelot *ocelot, u32 index,
+ struct felix_stream_filter_counters *counters)
+ {
+- mutex_lock(&ocelot->stats_lock);
++ spin_lock(&ocelot->stats_lock);
+
+ ocelot_rmw(ocelot, SYS_STAT_CFG_STAT_VIEW(index),
+ SYS_STAT_CFG_STAT_VIEW_M,
+@@ -2194,7 +2194,7 @@ static void vsc9959_psfp_counters_get(struct ocelot *ocelot, u32 index,
+ SYS_STAT_CFG_STAT_CLEAR_SHOT(0x10),
+ SYS_STAT_CFG);
+
+- mutex_unlock(&ocelot->stats_lock);
++ spin_unlock(&ocelot->stats_lock);
+ }
+
+ static int vsc9959_psfp_filter_add(struct ocelot *ocelot, int port,
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index d4649e4ee0e7..c67f162f8ab5 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -1906,13 +1906,13 @@ static void ocelot_check_stats_work(struct work_struct *work)
+ stats_work);
+ int i, err;
+
+- mutex_lock(&ocelot->stats_lock);
++ spin_lock(&ocelot->stats_lock);
+ for (i = 0; i < ocelot->num_phys_ports; i++) {
+ err = ocelot_port_update_stats(ocelot, i);
+ if (err)
+ break;
+ }
+- mutex_unlock(&ocelot->stats_lock);
++ spin_unlock(&ocelot->stats_lock);
+
+ if (err)
+ dev_err(ocelot->dev, "Error %d updating ethtool stats\n", err);
+@@ -1925,7 +1925,7 @@ void ocelot_get_ethtool_stats(struct ocelot *ocelot, int port, u64 *data)
+ {
+ int i, err;
+
+- mutex_lock(&ocelot->stats_lock);
++ spin_lock(&ocelot->stats_lock);
+
+ /* check and update now */
+ err = ocelot_port_update_stats(ocelot, port);
+@@ -1934,7 +1934,7 @@ void ocelot_get_ethtool_stats(struct ocelot *ocelot, int port, u64 *data)
+ for (i = 0; i < ocelot->num_stats; i++)
+ *data++ = ocelot->stats[port * ocelot->num_stats + i];
+
+- mutex_unlock(&ocelot->stats_lock);
++ spin_unlock(&ocelot->stats_lock);
+
+ if (err)
+ dev_err(ocelot->dev, "Error %d updating ethtool stats\n", err);
+@@ -3363,7 +3363,7 @@ int ocelot_init(struct ocelot *ocelot)
+ if (!ocelot->stats)
+ return -ENOMEM;
+
+- mutex_init(&ocelot->stats_lock);
++ spin_lock_init(&ocelot->stats_lock);
+ mutex_init(&ocelot->ptp_lock);
+ mutex_init(&ocelot->mact_lock);
+ mutex_init(&ocelot->fwd_domain_lock);
+@@ -3511,7 +3511,6 @@ void ocelot_deinit(struct ocelot *ocelot)
+ cancel_delayed_work(&ocelot->stats_work);
+ destroy_workqueue(ocelot->stats_queue);
+ destroy_workqueue(ocelot->owq);
+- mutex_destroy(&ocelot->stats_lock);
+ }
+ EXPORT_SYMBOL(ocelot_deinit);
+
+diff --git a/include/soc/mscc/ocelot.h b/include/soc/mscc/ocelot.h
+index e7e5b06deb2d..72b9474391da 100644
+--- a/include/soc/mscc/ocelot.h
++++ b/include/soc/mscc/ocelot.h
+@@ -752,7 +752,7 @@ struct ocelot {
+ struct ocelot_psfp_list psfp;
+
+ /* Workqueue to check statistics for overflow with its lock */
+- struct mutex stats_lock;
++ spinlock_t stats_lock;
+ u64 *stats;
+ struct delayed_work stats_work;
+ struct workqueue_struct *stats_queue;
+--
+2.35.1
+
--- /dev/null
+From 77f653352f64a3fdc1ca0220ac9a2c4dc9f733ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Jul 2022 11:58:43 +0300
+Subject: nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue
+ teardown
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 533d2e8b4d5e4c89772a0adce913525fb86cbbee ]
+
+We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are
+sending/receiving for the socket from works on this workqueue.
+Also this eliminates lockdep complaints:
+--
+[ 6174.010200] workqueue: WQ_MEM_RECLAIM
+nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing
+!WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp]
+[ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628
+check_flush_dependency+0x110/0x14c
+
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/tcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
+index 0a9542599ad1..dc3b4dc8fe08 100644
+--- a/drivers/nvme/target/tcp.c
++++ b/drivers/nvme/target/tcp.c
+@@ -1839,7 +1839,8 @@ static int __init nvmet_tcp_init(void)
+ {
+ int ret;
+
+- nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq", WQ_HIGHPRI, 0);
++ nvmet_tcp_wq = alloc_workqueue("nvmet_tcp_wq",
++ WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+ if (!nvmet_tcp_wq)
+ return -ENOMEM;
+
+--
+2.35.1
+
--- /dev/null
+From c67b01176c056f8cd3c32e235ad2e3b21792e396 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Jul 2022 16:03:14 +0200
+Subject: of: overlay: Move devicetree_corrupt() check up
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit e385b0ba6a137f34953e746d70d543660c2de1a0 ]
+
+There is no point in doing several preparatory steps in
+of_overlay_fdt_apply(), only to see of_overlay_apply() return early
+because of a corrupt device tree.
+
+Move the check for a corrupt device tree from of_overlay_apply() to
+of_overlay_fdt_apply(), to check for this as early as possible.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Frank Rowand <frank.rowand@sony.com>
+Tested-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/c91ce7112eb5167ea46a43d8a980e76b920010ba.1657893306.git.geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/overlay.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
+index 4044ddcb02c6..84a8d402009c 100644
+--- a/drivers/of/overlay.c
++++ b/drivers/of/overlay.c
+@@ -903,12 +903,6 @@ static int of_overlay_apply(struct overlay_changeset *ovcs)
+ {
+ int ret = 0, ret_revert, ret_tmp;
+
+- if (devicetree_corrupt()) {
+- pr_err("devicetree state suspect, refuse to apply overlay\n");
+- ret = -EBUSY;
+- goto out;
+- }
+-
+ ret = of_resolve_phandles(ovcs->overlay_root);
+ if (ret)
+ goto out;
+@@ -983,6 +977,11 @@ int of_overlay_fdt_apply(const void *overlay_fdt, u32 overlay_fdt_size,
+
+ *ret_ovcs_id = 0;
+
++ if (devicetree_corrupt()) {
++ pr_err("devicetree state suspect, refuse to apply overlay\n");
++ return -EBUSY;
++ }
++
+ if (overlay_fdt_size < sizeof(struct fdt_header) ||
+ fdt_check_header(overlay_fdt)) {
+ pr_err("Invalid overlay_fdt header\n");
+--
+2.35.1
+
--- /dev/null
+From f6ed7d27b2ddaaf8ae28d66de19f938c694f02f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Jul 2022 19:54:08 +0900
+Subject: openrisc: io: Define iounmap argument as volatile
+
+From: Stafford Horne <shorne@gmail.com>
+
+[ Upstream commit 52e0ea900202d23843daee8f7089817e81dd3dd7 ]
+
+When OpenRISC enables PCI it allows for more drivers to be compiled
+resulting in exposing the following with -Werror.
+
+ drivers/video/fbdev/riva/fbdev.c: In function 'rivafb_probe':
+ drivers/video/fbdev/riva/fbdev.c:2062:42: error:
+ passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type
+
+ drivers/video/fbdev/nvidia/nvidia.c: In function 'nvidiafb_probe':
+ drivers/video/fbdev/nvidia/nvidia.c:1414:20: error:
+ passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type
+
+ drivers/scsi/aic7xxx/aic7xxx_osm.c: In function 'ahc_platform_free':
+ drivers/scsi/aic7xxx/aic7xxx_osm.c:1231:41: error:
+ passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type
+
+Most architectures define the iounmap argument to be volatile. To fix this
+issue we do the same for OpenRISC. This patch must go before PCI is enabled on
+OpenRISC to avoid any compile failures.
+
+Link: https://lore.kernel.org/lkml/20220729033728.GA2195022@roeck-us.net/
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/include/asm/io.h | 2 +-
+ arch/openrisc/mm/ioremap.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/include/asm/io.h b/arch/openrisc/include/asm/io.h
+index c298061c70a7..8aa3e78181e9 100644
+--- a/arch/openrisc/include/asm/io.h
++++ b/arch/openrisc/include/asm/io.h
+@@ -31,7 +31,7 @@
+ void __iomem *ioremap(phys_addr_t offset, unsigned long size);
+
+ #define iounmap iounmap
+-extern void iounmap(void __iomem *addr);
++extern void iounmap(volatile void __iomem *addr);
+
+ #include <asm-generic/io.h>
+
+diff --git a/arch/openrisc/mm/ioremap.c b/arch/openrisc/mm/ioremap.c
+index daae13a76743..8ec0dafecf25 100644
+--- a/arch/openrisc/mm/ioremap.c
++++ b/arch/openrisc/mm/ioremap.c
+@@ -77,7 +77,7 @@ void __iomem *__ref ioremap(phys_addr_t addr, unsigned long size)
+ }
+ EXPORT_SYMBOL(ioremap);
+
+-void iounmap(void __iomem *addr)
++void iounmap(volatile void __iomem *addr)
+ {
+ /* If the page is from the fixmap pool then we just clear out
+ * the fixmap mapping.
+--
+2.35.1
+
--- /dev/null
+From bb22b6b364a25aa8b80e1d73f430a8031530cdea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Jul 2022 16:31:30 +0200
+Subject: ovl: warn if trusted xattr creation fails
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit b10b85fe5149ee8b39fbbf86095b303632dde2cd ]
+
+When mounting overlayfs in an unprivileged user namespace, trusted xattr
+creation will fail. This will lead to failures in some file operations,
+e.g. in the following situation:
+
+ mkdir lower upper work merged
+ mkdir lower/directory
+ mount -toverlay -olowerdir=lower,upperdir=upper,workdir=work none merged
+ rmdir merged/directory
+ mkdir merged/directory
+
+The last mkdir will fail:
+
+ mkdir: cannot create directory 'merged/directory': Input/output error
+
+The cause for these failures is currently extremely non-obvious and hard to
+debug. Hence, warn the user and suggest using the userxattr mount option,
+if it is not already supplied and xattr creation fails during the
+self-check.
+
+Reported-by: Alois Wohlschlager <alois1@gmx-topmail.de>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/overlayfs/super.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 1ce5c9698393..4c2096130209 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -1418,11 +1418,12 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,
+ */
+ err = ovl_setxattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE, "0", 1);
+ if (err) {
++ pr_warn("failed to set xattr on upper\n");
+ ofs->noxattr = true;
+ if (ofs->config.index || ofs->config.metacopy) {
+ ofs->config.index = false;
+ ofs->config.metacopy = false;
+- pr_warn("upper fs does not support xattr, falling back to index=off,metacopy=off.\n");
++ pr_warn("...falling back to index=off,metacopy=off.\n");
+ }
+ /*
+ * xattr support is required for persistent st_ino.
+@@ -1430,8 +1431,10 @@ static int ovl_make_workdir(struct super_block *sb, struct ovl_fs *ofs,
+ */
+ if (ofs->config.xino == OVL_XINO_AUTO) {
+ ofs->config.xino = OVL_XINO_OFF;
+- pr_warn("upper fs does not support xattr, falling back to xino=off.\n");
++ pr_warn("...falling back to xino=off.\n");
+ }
++ if (err == -EPERM && !ofs->config.userxattr)
++ pr_info("try mounting with 'userxattr' option\n");
+ err = 0;
+ } else {
+ ovl_removexattr(ofs, ofs->workdir, OVL_XATTR_OPAQUE);
+--
+2.35.1
+
--- /dev/null
+From e87994fcce71622e5787340de315fbb6f9a2247d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 May 2022 15:28:27 +0200
+Subject: PCI: aardvark: Fix reporting Slot capabilities on emulated bridge
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pali Rohár <pali@kernel.org>
+
+[ Upstream commit bcdb6fd4f3e9ac1097698c8d8f56b70853b49873 ]
+
+Slot capabilities are currently not reported because emulated bridge does
+not report the PCI_EXP_FLAGS_SLOT flag.
+
+Set PCI_EXP_FLAGS_SLOT to let the kernel know that PCI_EXP_SLT* registers
+are supported.
+
+Move setting of PCI_EXP_SLTCTL register from "dynamic" pcie_conf_read
+function to static buffer as it is only statically filled the
+PCI_EXP_SLTSTA_PDS flag and dynamic read callback is not needed for this
+register.
+
+Set Presence State Bit to 1 since there is no support for unplugging the
+card and there is currently no platform able to detect presence of a card -
+in such a case the bit needs to be set to 1.
+
+Finally correctly set Physical Slot Number to 1 since there is only one
+port and zero value is reserved for ports within the same silicon as Root
+Port which is not our case for Aardvark HW.
+
+Link: https://lore.kernel.org/r/20220524132827.8837-3-kabel@kernel.org
+Signed-off-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pci-aardvark.c | 33 +++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c
+index ffec82c8a523..62db476a8651 100644
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -8,6 +8,7 @@
+ * Author: Hezi Shahmoon <hezi.shahmoon@marvell.com>
+ */
+
++#include <linux/bitfield.h>
+ #include <linux/delay.h>
+ #include <linux/gpio/consumer.h>
+ #include <linux/interrupt.h>
+@@ -857,14 +858,11 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge,
+
+
+ switch (reg) {
+- case PCI_EXP_SLTCTL:
+- *value = PCI_EXP_SLTSTA_PDS << 16;
+- return PCI_BRIDGE_EMUL_HANDLED;
+-
+ /*
+- * PCI_EXP_RTCTL and PCI_EXP_RTSTA are also supported, but do not need
+- * to be handled here, because their values are stored in emulated
+- * config space buffer, and we read them from there when needed.
++ * PCI_EXP_SLTCAP, PCI_EXP_SLTCTL, PCI_EXP_RTCTL and PCI_EXP_RTSTA are
++ * also supported, but do not need to be handled here, because their
++ * values are stored in emulated config space buffer, and we read them
++ * from there when needed.
+ */
+
+ case PCI_EXP_LNKCAP: {
+@@ -977,8 +975,25 @@ static int advk_sw_pci_bridge_init(struct advk_pcie *pcie)
+ /* Support interrupt A for MSI feature */
+ bridge->conf.intpin = PCI_INTERRUPT_INTA;
+
+- /* Aardvark HW provides PCIe Capability structure in version 2 */
+- bridge->pcie_conf.cap = cpu_to_le16(2);
++ /*
++ * Aardvark HW provides PCIe Capability structure in version 2 and
++ * indicate slot support, which is emulated.
++ */
++ bridge->pcie_conf.cap = cpu_to_le16(2 | PCI_EXP_FLAGS_SLOT);
++
++ /*
++ * Set Presence Detect State bit permanently since there is no support
++ * for unplugging the card nor detecting whether it is plugged. (If a
++ * platform exists in the future that supports it, via a GPIO for
++ * example, it should be implemented via this bit.)
++ *
++ * Set physical slot number to 1 since there is only one port and zero
++ * value is reserved for ports within the same silicon as Root Port
++ * which is not our case.
++ */
++ bridge->pcie_conf.slotcap = cpu_to_le32(FIELD_PREP(PCI_EXP_SLTCAP_PSN,
++ 1));
++ bridge->pcie_conf.slotsta = cpu_to_le16(PCI_EXP_SLTSTA_PDS);
+
+ /* Indicates supports for Completion Retry Status */
+ bridge->pcie_conf.rootcap = cpu_to_le16(PCI_EXP_RTCAP_CRSVIS);
+--
+2.35.1
+
--- /dev/null
+From 7651239ee27f17ef960516ec4948d492f67ce734 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jul 2022 20:42:10 +0800
+Subject: PCI/ACPI: Guard ARM64-specific mcfg_quirks
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+[ Upstream commit 40a6cc141b4b9580de140bcb3e893445708acc5d ]
+
+Guard ARM64-specific quirks with CONFIG_ARM64 to avoid build errors,
+since mcfg_quirks will be shared by more than one architectures.
+
+Link: https://lore.kernel.org/r/20220714124216.1489304-2-chenhuacai@loongson.cn
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/pci_mcfg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/acpi/pci_mcfg.c b/drivers/acpi/pci_mcfg.c
+index 53cab975f612..63b98eae5e75 100644
+--- a/drivers/acpi/pci_mcfg.c
++++ b/drivers/acpi/pci_mcfg.c
+@@ -41,6 +41,8 @@ struct mcfg_fixup {
+ static struct mcfg_fixup mcfg_quirks[] = {
+ /* { OEM_ID, OEM_TABLE_ID, REV, SEGMENT, BUS_RANGE, ops, cfgres }, */
+
++#ifdef CONFIG_ARM64
++
+ #define AL_ECAM(table_id, rev, seg, ops) \
+ { "AMAZON", table_id, rev, seg, MCFG_BUS_ANY, ops }
+
+@@ -169,6 +171,7 @@ static struct mcfg_fixup mcfg_quirks[] = {
+ ALTRA_ECAM_QUIRK(1, 13),
+ ALTRA_ECAM_QUIRK(1, 14),
+ ALTRA_ECAM_QUIRK(1, 15),
++#endif /* ARM64 */
+ };
+
+ static char mcfg_oem_id[ACPI_OEM_ID_SIZE];
+--
+2.35.1
+
--- /dev/null
+From 007cd12df04d5059e9af5dd8459179bd8fa644cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jun 2022 13:41:47 -0400
+Subject: PCI: Add ACS quirk for Broadcom BCM5750x NICs
+
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+
+[ Upstream commit afd306a65cedb9589564bdb23a0c368abc4215fd ]
+
+The Broadcom BCM5750x NICs may be multi-function devices. They do not
+advertise ACS capability. Peer-to-peer transactions are not possible
+between the individual functions, so it is safe to treat them as fully
+isolated.
+
+Add an ACS quirk for these devices so the functions can be in independent
+IOMMU groups and attached individually to userspace applications using
+VFIO.
+
+Link: https://lore.kernel.org/r/1654796507-28610-1-git-send-email-michael.chan@broadcom.com
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 41aeaa235132..2e68f50bc7ae 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4924,6 +4924,9 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs },
+ /* Broadcom multi-function device */
+ { PCI_VENDOR_ID_BROADCOM, 0x16D7, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1750, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1751, pci_quirk_mf_endpoint_acs },
++ { PCI_VENDOR_ID_BROADCOM, 0x1752, pci_quirk_mf_endpoint_acs },
+ { PCI_VENDOR_ID_BROADCOM, 0xD714, pci_quirk_brcm_acs },
+ /* Amazon Annapurna Labs */
+ { PCI_VENDOR_ID_AMAZON_ANNAPURNA_LABS, 0x0031, pci_quirk_al_acs },
+--
+2.35.1
+
--- /dev/null
+From 2f81365aaf3eb426d56c63f9ac383f4fe3fb46a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jun 2022 00:04:08 +0200
+Subject: phy: samsung: phy-exynos-pcie: sanitize init/power_on callbacks
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit f2812227bb07e2eaee74253f11cea1576945df31 ]
+
+The exynos-pcie driver called phy_power_on() before phy_init() for some
+historical reasons. However the generic PHY framework assumes that the
+proper sequence is to call phy_init() first, then phy_power_on(). The
+operations done by both functions should be considered as one action and as
+such they are called by the exynos-pcie driver (without doing anything
+between them). The initialization is just a sequence of register writes,
+which cannot be altered without breaking the hardware operation.
+
+To match the generic PHY framework requirement, simply move all register
+writes to the phy_init()/phy_exit() and drop power_on()/power_off()
+callbacks. This way the driver will also work with the old (incorrect)
+PHY initialization call sequence.
+
+Link: https://lore.kernel.org/r/20220628220409.26545-1-m.szyprowski@samsung.com
+Reported-by: Bjorn Helgaas <helgaas@kernel.org>
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Chanho Park <chanho61.park@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Acked-By: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/samsung/phy-exynos-pcie.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/phy/samsung/phy-exynos-pcie.c b/drivers/phy/samsung/phy-exynos-pcie.c
+index 578cfe07d07a..53c9230c2907 100644
+--- a/drivers/phy/samsung/phy-exynos-pcie.c
++++ b/drivers/phy/samsung/phy-exynos-pcie.c
+@@ -51,6 +51,13 @@ static int exynos5433_pcie_phy_init(struct phy *phy)
+ {
+ struct exynos_pcie_phy *ep = phy_get_drvdata(phy);
+
++ regmap_update_bits(ep->pmureg, EXYNOS5433_PMU_PCIE_PHY_OFFSET,
++ BIT(0), 1);
++ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_GLOBAL_RESET,
++ PCIE_APP_REQ_EXIT_L1_MODE, 0);
++ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_L1SUB_CM_CON,
++ PCIE_REFCLK_GATING_EN, 0);
++
+ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_COMMON_RESET,
+ PCIE_PHY_RESET, 1);
+ regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_MAC_RESET,
+@@ -109,20 +116,7 @@ static int exynos5433_pcie_phy_init(struct phy *phy)
+ return 0;
+ }
+
+-static int exynos5433_pcie_phy_power_on(struct phy *phy)
+-{
+- struct exynos_pcie_phy *ep = phy_get_drvdata(phy);
+-
+- regmap_update_bits(ep->pmureg, EXYNOS5433_PMU_PCIE_PHY_OFFSET,
+- BIT(0), 1);
+- regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_GLOBAL_RESET,
+- PCIE_APP_REQ_EXIT_L1_MODE, 0);
+- regmap_update_bits(ep->fsysreg, PCIE_EXYNOS5433_PHY_L1SUB_CM_CON,
+- PCIE_REFCLK_GATING_EN, 0);
+- return 0;
+-}
+-
+-static int exynos5433_pcie_phy_power_off(struct phy *phy)
++static int exynos5433_pcie_phy_exit(struct phy *phy)
+ {
+ struct exynos_pcie_phy *ep = phy_get_drvdata(phy);
+
+@@ -135,8 +129,7 @@ static int exynos5433_pcie_phy_power_off(struct phy *phy)
+
+ static const struct phy_ops exynos5433_phy_ops = {
+ .init = exynos5433_pcie_phy_init,
+- .power_on = exynos5433_pcie_phy_power_on,
+- .power_off = exynos5433_pcie_phy_power_off,
++ .exit = exynos5433_pcie_phy_exit,
+ .owner = THIS_MODULE,
+ };
+
+--
+2.35.1
+
--- /dev/null
+From d8c59ecff638cfc0be7eaea549a4a51cebf08f94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jun 2022 19:41:28 +0300
+Subject: pinctrl: intel: Check against matching data instead of ACPI companion
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c551bd81d198bf1dcd4398d5454acdc0309dbe77 ]
+
+In some cases we may get a platform device that has ACPI companion
+which is different to the pin control described in the ACPI tables.
+This is primarily happens when device is instantiated by board file.
+
+In order to allow this device being enumerated, refactor
+intel_pinctrl_get_soc_data() to check the matching data instead of
+ACPI companion.
+
+Reported-by: Henning Schild <henning.schild@siemens.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Tested-by: Henning Schild <henning.schild@siemens.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-intel.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index ffc045f7bf00..fd093e36c3a8 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -1641,16 +1641,14 @@ EXPORT_SYMBOL_GPL(intel_pinctrl_probe_by_uid);
+
+ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_device *pdev)
+ {
++ const struct intel_pinctrl_soc_data * const *table;
+ const struct intel_pinctrl_soc_data *data = NULL;
+- const struct intel_pinctrl_soc_data **table;
+- struct acpi_device *adev;
+- unsigned int i;
+
+- adev = ACPI_COMPANION(&pdev->dev);
+- if (adev) {
+- const void *match = device_get_match_data(&pdev->dev);
++ table = device_get_match_data(&pdev->dev);
++ if (table) {
++ struct acpi_device *adev = ACPI_COMPANION(&pdev->dev);
++ unsigned int i;
+
+- table = (const struct intel_pinctrl_soc_data **)match;
+ for (i = 0; table[i]; i++) {
+ if (!strcmp(adev->pnp.unique_id, table[i]->uid)) {
+ data = table[i];
+@@ -1664,7 +1662,7 @@ const struct intel_pinctrl_soc_data *intel_pinctrl_get_soc_data(struct platform_
+ if (!id)
+ return ERR_PTR(-ENODEV);
+
+- table = (const struct intel_pinctrl_soc_data **)id->driver_data;
++ table = (const struct intel_pinctrl_soc_data * const *)id->driver_data;
+ data = table[pdev->id];
+ }
+
+--
+2.35.1
+
--- /dev/null
+From c63aee284d646e6f705cf2e79a5d70966cb65125 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jun 2022 08:49:49 +0000
+Subject: platform/chrome: cros_ec_proto: don't show MKBP version if
+ unsupported
+
+From: Tzung-Bi Shih <tzungbi@kernel.org>
+
+[ Upstream commit b36f0643ff14a2fb281b105418e4e73c9d7c11d0 ]
+
+It wrongly showed the following message when it doesn't support MKBP:
+"MKBP support version 4294967295".
+
+Fix it.
+
+Reviewed-by: Guenter Roeck <groeck@chromium.org>
+Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
+Link: https://lore.kernel.org/r/20220609084957.3684698-14-tzungbi@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/cros_ec_proto.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c
+index ff767dccdf0f..40dc048d18ad 100644
+--- a/drivers/platform/chrome/cros_ec_proto.c
++++ b/drivers/platform/chrome/cros_ec_proto.c
+@@ -509,13 +509,13 @@ int cros_ec_query_all(struct cros_ec_device *ec_dev)
+ ret = cros_ec_get_host_command_version_mask(ec_dev,
+ EC_CMD_GET_NEXT_EVENT,
+ &ver_mask);
+- if (ret < 0 || ver_mask == 0)
++ if (ret < 0 || ver_mask == 0) {
+ ec_dev->mkbp_event_supported = 0;
+- else
++ } else {
+ ec_dev->mkbp_event_supported = fls(ver_mask);
+
+- dev_dbg(ec_dev->dev, "MKBP support version %u\n",
+- ec_dev->mkbp_event_supported - 1);
++ dev_dbg(ec_dev->dev, "MKBP support version %u\n", ec_dev->mkbp_event_supported - 1);
++ }
+
+ /* Probe if host sleep v1 is supported for S0ix failure detection. */
+ ret = cros_ec_get_host_command_version_mask(ec_dev,
+--
+2.35.1
+
--- /dev/null
+From ffef0b505c4a499d4ed24f8a4e75d958ba931fe6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Jul 2022 16:19:30 +0200
+Subject: powerpc/32: Don't always pass -mcpu=powerpc to the compiler
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 446cda1b21d9a6b3697fe399c6a3a00ff4a285f5 ]
+
+Since commit 4bf4f42a2feb ("powerpc/kbuild: Set default generic
+machine type for 32-bit compile"), when building a 32 bits kernel
+with a bi-arch version of GCC, or when building a book3s/32 kernel,
+the option -mcpu=powerpc is passed to GCC at all time, relying on it
+being eventually overriden by a subsequent -mcpu=xxxx.
+
+But when building the same kernel with a 32 bits only version of GCC,
+that is not done, relying on gcc being built with the expected default
+CPU.
+
+This logic has two problems. First, it is a bit fragile to rely on
+whether the GCC version is bi-arch or not, because today we can have
+bi-arch versions of GCC configured with a 32 bits default. Second,
+there are some versions of GCC which don't support -mcpu=powerpc,
+for instance for e500 SPE-only versions.
+
+So, stop relying on this approximative logic and allow the user to
+decide whether he/she wants to use the toolchain's default CPU or if
+he/she wants to set one, and allow only possible CPUs based on the
+selected target.
+
+Reported-by: Pali Rohár <pali@kernel.org>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Tested-by: Pali Rohár <pali@kernel.org>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/d4df724691351531bf46d685d654689e5dfa0d74.1657549153.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 26 +-------------------------
+ arch/powerpc/platforms/Kconfig.cputype | 21 ++++++++++++++++++---
+ 2 files changed, 19 insertions(+), 28 deletions(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index a0cd70712061..d54e1fe03551 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -15,23 +15,6 @@ HAS_BIARCH := $(call cc-option-yn, -m32)
+ # Set default 32 bits cross compilers for vdso and boot wrapper
+ CROSS32_COMPILE ?=
+
+-ifeq ($(HAS_BIARCH),y)
+-ifeq ($(CROSS32_COMPILE),)
+-ifdef CONFIG_PPC32
+-# These options will be overridden by any -mcpu option that the CPU
+-# or platform code sets later on the command line, but they are needed
+-# to set a sane 32-bit cpu target for the 64-bit cross compiler which
+-# may default to the wrong ISA.
+-KBUILD_CFLAGS += -mcpu=powerpc
+-KBUILD_AFLAGS += -mcpu=powerpc
+-endif
+-endif
+-endif
+-
+-ifdef CONFIG_PPC_BOOK3S_32
+-KBUILD_CFLAGS += -mcpu=powerpc
+-endif
+-
+ # If we're on a ppc/ppc64/ppc64le machine use that defconfig, otherwise just use
+ # ppc64_defconfig because we have nothing better to go on.
+ uname := $(shell uname -m)
+@@ -183,6 +166,7 @@ endif
+ endif
+
+ CFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU))
++AFLAGS-$(CONFIG_TARGET_CPU_BOOL) += $(call cc-option,-mcpu=$(CONFIG_TARGET_CPU))
+
+ # Altivec option not allowed with e500mc64 in GCC.
+ ifdef CONFIG_ALTIVEC
+@@ -193,14 +177,6 @@ endif
+ CFLAGS-$(CONFIG_E5500_CPU) += $(E5500_CPU)
+ CFLAGS-$(CONFIG_E6500_CPU) += $(call cc-option,-mcpu=e6500,$(E5500_CPU))
+
+-ifdef CONFIG_PPC32
+-ifdef CONFIG_PPC_E500MC
+-CFLAGS-y += $(call cc-option,-mcpu=e500mc,-mcpu=powerpc)
+-else
+-CFLAGS-$(CONFIG_E500) += $(call cc-option,-mcpu=8540 -msoft-float,-mcpu=powerpc)
+-endif
+-endif
+-
+ asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1)
+
+ KBUILD_CPPFLAGS += -I $(srctree)/arch/$(ARCH) $(asinstr)
+diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype
+index 3629fd73083e..18115cabaedf 100644
+--- a/arch/powerpc/platforms/Kconfig.cputype
++++ b/arch/powerpc/platforms/Kconfig.cputype
+@@ -136,9 +136,9 @@ config GENERIC_CPU
+ select ARCH_HAS_FAST_MULTIPLIER
+ select PPC_64S_HASH_MMU
+
+-config GENERIC_CPU
++config POWERPC_CPU
+ bool "Generic 32 bits powerpc"
+- depends on PPC32 && !PPC_8xx
++ depends on PPC32 && !PPC_8xx && !PPC_85xx
+
+ config CELL_CPU
+ bool "Cell Broadband Engine"
+@@ -197,11 +197,23 @@ config G4_CPU
+ depends on PPC_BOOK3S_32
+ select ALTIVEC
+
++config E500_CPU
++ bool "e500 (8540)"
++ depends on PPC_85xx && !PPC_E500MC
++
++config E500MC_CPU
++ bool "e500mc"
++ depends on PPC_85xx && PPC_E500MC
++
++config TOOLCHAIN_DEFAULT_CPU
++ bool "Rely on the toolchain's implicit default CPU"
++ depends on PPC32
++
+ endchoice
+
+ config TARGET_CPU_BOOL
+ bool
+- default !GENERIC_CPU
++ default !GENERIC_CPU && !TOOLCHAIN_DEFAULT_CPU
+
+ config TARGET_CPU
+ string
+@@ -216,6 +228,9 @@ config TARGET_CPU
+ default "e300c2" if E300C2_CPU
+ default "e300c3" if E300C3_CPU
+ default "G4" if G4_CPU
++ default "8540" if E500_CPU
++ default "e500mc" if E500MC_CPU
++ default "powerpc" if POWERPC_CPU
+
+ config PPC_BOOK3S
+ def_bool y
+--
+2.35.1
+
--- /dev/null
+From f4e59c0a886f9fd23e90f69d4d4ce7177e2f3d58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jun 2022 12:34:09 +0200
+Subject: powerpc/32: Set an IBAT covering up to _einittext during init
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+[ Upstream commit 2a0fb3c155c97c75176e557d61f8e66c1bd9b735 ]
+
+Always set an IBAT covering up to _einittext during init because when
+CONFIG_MODULES is not selected there is no reason to have an exception
+handler for kernel instruction TLB misses.
+
+It implies DBAT and IBAT are now totaly independent, IBATs are set
+by setibat() and DBAT by setbat().
+
+This allows to revert commit 9bb162fa26ed ("powerpc/603: Fix
+boot failure with DEBUG_PAGEALLOC and KFENCE")
+
+Reported-by: Maxime Bizon <mbizon@freebox.fr>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/ce7f04a39593934d9b1ee68c69144ccd3d4da4a1.1655202804.git.christophe.leroy@csgroup.eu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/head_book3s_32.S | 4 ++--
+ arch/powerpc/mm/book3s32/mmu.c | 10 ++++------
+ 2 files changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/kernel/head_book3s_32.S b/arch/powerpc/kernel/head_book3s_32.S
+index 6c739beb938c..519b60695167 100644
+--- a/arch/powerpc/kernel/head_book3s_32.S
++++ b/arch/powerpc/kernel/head_book3s_32.S
+@@ -418,14 +418,14 @@ InstructionTLBMiss:
+ */
+ /* Get PTE (linux-style) and check access */
+ mfspr r3,SPRN_IMISS
+-#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE)
++#ifdef CONFIG_MODULES
+ lis r1, TASK_SIZE@h /* check if kernel address */
+ cmplw 0,r1,r3
+ #endif
+ mfspr r2, SPRN_SDR1
+ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC | _PAGE_USER
+ rlwinm r2, r2, 28, 0xfffff000
+-#if defined(CONFIG_MODULES) || defined(CONFIG_DEBUG_PAGEALLOC) || defined(CONFIG_KFENCE)
++#ifdef CONFIG_MODULES
+ bgt- 112f
+ lis r2, (swapper_pg_dir - PAGE_OFFSET)@ha /* if kernel address, use */
+ li r1,_PAGE_PRESENT | _PAGE_ACCESSED | _PAGE_EXEC
+diff --git a/arch/powerpc/mm/book3s32/mmu.c b/arch/powerpc/mm/book3s32/mmu.c
+index 49a737fbbd18..40029280c320 100644
+--- a/arch/powerpc/mm/book3s32/mmu.c
++++ b/arch/powerpc/mm/book3s32/mmu.c
+@@ -159,7 +159,10 @@ unsigned long __init mmu_mapin_ram(unsigned long base, unsigned long top)
+ {
+ unsigned long done;
+ unsigned long border = (unsigned long)__init_begin - PAGE_OFFSET;
++ unsigned long size;
+
++ size = roundup_pow_of_two((unsigned long)_einittext - PAGE_OFFSET);
++ setibat(0, PAGE_OFFSET, 0, size, PAGE_KERNEL_X);
+
+ if (debug_pagealloc_enabled_or_kfence() || __map_without_bats) {
+ pr_debug_once("Read-Write memory mapped without BATs\n");
+@@ -245,10 +248,9 @@ void mmu_mark_rodata_ro(void)
+ }
+
+ /*
+- * Set up one of the I/D BAT (block address translation) register pairs.
++ * Set up one of the D BAT (block address translation) register pairs.
+ * The parameters are not checked; in particular size must be a power
+ * of 2 between 128k and 256M.
+- * On 603+, only set IBAT when _PAGE_EXEC is set
+ */
+ void __init setbat(int index, unsigned long virt, phys_addr_t phys,
+ unsigned int size, pgprot_t prot)
+@@ -284,10 +286,6 @@ void __init setbat(int index, unsigned long virt, phys_addr_t phys,
+ /* G bit must be zero in IBATs */
+ flags &= ~_PAGE_EXEC;
+ }
+- if (flags & _PAGE_EXEC)
+- bat[0] = bat[1];
+- else
+- bat[0].batu = bat[0].batl = 0;
+
+ bat_addrs[index].start = virt;
+ bat_addrs[index].limit = virt + ((bl + 1) << 17) - 1;
+--
+2.35.1
+
--- /dev/null
+From 3d921c71675b891e4726db58b2b1256dc4f49c4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jul 2022 09:57:47 +0800
+Subject: powerpc/64: Init jump labels before parse_early_param()
+
+From: Zhouyi Zhou <zhouzhouyi@gmail.com>
+
+[ Upstream commit ca829e05d3d4f728810cc5e4b468d9ebc7745eb3 ]
+
+On 64-bit, calling jump_label_init() in setup_feature_keys() is too
+late because static keys may be used in subroutines of
+parse_early_param() which is again subroutine of early_init_devtree().
+
+For example booting with "threadirqs":
+
+ static_key_enable_cpuslocked(): static key '0xc000000002953260' used before call to jump_label_init()
+ WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:166 static_key_enable_cpuslocked+0xfc/0x120
+ ...
+ NIP static_key_enable_cpuslocked+0xfc/0x120
+ LR static_key_enable_cpuslocked+0xf8/0x120
+ Call Trace:
+ static_key_enable_cpuslocked+0xf8/0x120 (unreliable)
+ static_key_enable+0x30/0x50
+ setup_forced_irqthreads+0x28/0x40
+ do_early_param+0xa0/0x108
+ parse_args+0x290/0x4e0
+ parse_early_options+0x48/0x5c
+ parse_early_param+0x58/0x84
+ early_init_devtree+0xd4/0x518
+ early_setup+0xb4/0x214
+
+So call jump_label_init() just before parse_early_param() in
+early_init_devtree().
+
+Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Zhouyi Zhou <zhouzhouyi@gmail.com>
+[mpe: Add call trace to change log and minor wording edits.]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220726015747.11754-1-zhouzhouyi@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index feae8509b59c..b64c3f06c069 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -751,6 +751,13 @@ void __init early_init_devtree(void *params)
+ early_init_dt_scan_root();
+ early_init_dt_scan_memory_ppc();
+
++ /*
++ * As generic code authors expect to be able to use static keys
++ * in early_param() handlers, we initialize the static keys just
++ * before parsing early params (it's fine to call jump_label_init()
++ * more than once).
++ */
++ jump_label_init();
+ parse_early_param();
+
+ /* make sure we've parsed cmdline for mem= before this */
+--
+2.35.1
+
--- /dev/null
+From 89b6310d05a6d55badaacf306a928798b0add106 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Jul 2022 18:08:00 +1000
+Subject: powerpc/ioda/iommu/debugfs: Generate unique debugfs entries
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit d73b46c3c1449bf27f793b9d9ee86ed70c7a7163 ]
+
+The iommu_table::it_index is a LIOBN which is not initialized on PowerNV
+as it is not used except IOMMU debugfs where it is used for a node name.
+
+This initializes it_index witn a unique number to avoid warnings and
+have a node for every iommu_table.
+
+This should not cause any behavioral change without CONFIG_IOMMU_DEBUGFS.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220714080800.3712998-1-aik@ozlabs.ru
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/pci-ioda.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index c8cf2728031a..9de9b2fb163d 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -1609,6 +1609,7 @@ static void pnv_pci_ioda1_setup_dma_pe(struct pnv_phb *phb,
+ tbl->it_ops = &pnv_ioda1_iommu_ops;
+ pe->table_group.tce32_start = tbl->it_offset << tbl->it_page_shift;
+ pe->table_group.tce32_size = tbl->it_size << tbl->it_page_shift;
++ tbl->it_index = (phb->hose->global_number << 16) | pe->pe_number;
+ if (!iommu_init_table(tbl, phb->hose->node, 0, 0))
+ panic("Failed to initialize iommu table");
+
+@@ -1779,6 +1780,7 @@ static long pnv_pci_ioda2_setup_default_config(struct pnv_ioda_pe *pe)
+ res_end = min(window_size, SZ_4G) >> tbl->it_page_shift;
+ }
+
++ tbl->it_index = (pe->phb->hose->global_number << 16) | pe->pe_number;
+ if (iommu_init_table(tbl, pe->phb->hose->node, res_start, res_end))
+ rc = pnv_pci_ioda2_set_window(&pe->table_group, 0, tbl);
+ else
+--
+2.35.1
+
--- /dev/null
+From 1a5e0b1b1a00a79dab77a3903ebfa8434b7939c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jul 2022 17:47:29 +0200
+Subject: powerpc/pseries/mobility: set NMI watchdog factor during an LPM
+
+From: Laurent Dufour <ldufour@linux.ibm.com>
+
+[ Upstream commit 118b1366930c8c833b8b36abef657f40d4e26610 ]
+
+During an LPM, while the memory transfer is in progress on the arrival
+side, some latencies are generated when accessing not yet transferred
+pages on the arrival side. Thus, the NMI watchdog may be triggered too
+frequently, which increases the risk to hit an NMI interrupt in a bad
+place in the kernel, leading to a kernel panic.
+
+Disabling the Hard Lockup Watchdog until the memory transfer could be a
+too strong work around, some users would want this timeout to be
+eventually triggered if the system is hanging even during an LPM.
+
+Introduce a new sysctl variable nmi_watchdog_factor. It allows to apply
+a factor to the NMI watchdog timeout during an LPM. Just before the CPUs
+are stopped for the switchover sequence, the NMI watchdog timer is set
+to watchdog_thresh + factor%
+
+A value of 0 has no effect. The default value is 200, meaning that the
+NMI watchdog is set to 30s during LPM (based on a 10s watchdog_thresh
+value). Once the memory transfer is achieved, the factor is reset to 0.
+
+Setting this value to a high number is like disabling the NMI watchdog
+during an LPM.
+
+Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220713154729.80789-5-ldufour@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/admin-guide/sysctl/kernel.rst | 12 ++++++
+ arch/powerpc/platforms/pseries/mobility.c | 43 +++++++++++++++++++++
+ 2 files changed, 55 insertions(+)
+
+diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst
+index ddccd1077462..9b7fa1baf225 100644
+--- a/Documentation/admin-guide/sysctl/kernel.rst
++++ b/Documentation/admin-guide/sysctl/kernel.rst
+@@ -592,6 +592,18 @@ to the guest kernel command line (see
+ Documentation/admin-guide/kernel-parameters.rst).
+
+
++nmi_wd_lpm_factor (PPC only)
++============================
++
++Factor to apply to the NMI watchdog timeout (only when ``nmi_watchdog`` is
++set to 1). This factor represents the percentage added to
++``watchdog_thresh`` when calculating the NMI watchdog timeout during an
++LPM. The soft lockup timeout is not impacted.
++
++A value of 0 means no change. The default value is 200 meaning the NMI
++watchdog is set to 30s (based on ``watchdog_thresh`` equal to 10).
++
++
+ numa_balancing
+ ==============
+
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 78f3f74c7056..cbe0989239bf 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -48,6 +48,39 @@ struct update_props_workarea {
+ #define MIGRATION_SCOPE (1)
+ #define PRRN_SCOPE -2
+
++#ifdef CONFIG_PPC_WATCHDOG
++static unsigned int nmi_wd_lpm_factor = 200;
++
++#ifdef CONFIG_SYSCTL
++static struct ctl_table nmi_wd_lpm_factor_ctl_table[] = {
++ {
++ .procname = "nmi_wd_lpm_factor",
++ .data = &nmi_wd_lpm_factor,
++ .maxlen = sizeof(int),
++ .mode = 0644,
++ .proc_handler = proc_douintvec_minmax,
++ },
++ {}
++};
++static struct ctl_table nmi_wd_lpm_factor_sysctl_root[] = {
++ {
++ .procname = "kernel",
++ .mode = 0555,
++ .child = nmi_wd_lpm_factor_ctl_table,
++ },
++ {}
++};
++
++static int __init register_nmi_wd_lpm_factor_sysctl(void)
++{
++ register_sysctl_table(nmi_wd_lpm_factor_sysctl_root);
++
++ return 0;
++}
++device_initcall(register_nmi_wd_lpm_factor_sysctl);
++#endif /* CONFIG_SYSCTL */
++#endif /* CONFIG_PPC_WATCHDOG */
++
+ static int mobility_rtas_call(int token, char *buf, s32 scope)
+ {
+ int rc;
+@@ -665,19 +698,29 @@ static int pseries_suspend(u64 handle)
+ static int pseries_migrate_partition(u64 handle)
+ {
+ int ret;
++ unsigned int factor = 0;
+
++#ifdef CONFIG_PPC_WATCHDOG
++ factor = nmi_wd_lpm_factor;
++#endif
+ ret = wait_for_vasi_session_suspending(handle);
+ if (ret)
+ return ret;
+
+ vas_migration_handler(VAS_SUSPEND);
+
++ if (factor)
++ watchdog_nmi_set_timeout_pct(factor);
++
+ ret = pseries_suspend(handle);
+ if (ret == 0)
+ post_mobility_fixup();
+ else
+ pseries_cancel_migration(handle, ret);
+
++ if (factor)
++ watchdog_nmi_set_timeout_pct(0);
++
+ vas_migration_handler(VAS_RESUME);
+
+ return ret;
+--
+2.35.1
+
--- /dev/null
+From 3d6f38ac6923f55cc7407f72cccc0a4e4a3e30b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jul 2022 17:47:28 +0200
+Subject: powerpc/watchdog: introduce a NMI watchdog's factor
+
+From: Laurent Dufour <ldufour@linux.ibm.com>
+
+[ Upstream commit f5e74e836097d1004077390717d4bd95d4a2c27a ]
+
+Introduce a factor which would apply to the NMI watchdog timeout.
+
+This factor is a percentage added to the watchdog_tresh value. The value is
+set under the watchdog_mutex protection and lockup_detector_reconfigure()
+is called to recompute wd_panic_timeout_tb.
+
+Once the factor is set, it remains until it is set back to 0, which means
+no impact.
+
+Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220713154729.80789-4-ldufour@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/nmi.h | 2 ++
+ arch/powerpc/kernel/watchdog.c | 21 ++++++++++++++++++++-
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/nmi.h b/arch/powerpc/include/asm/nmi.h
+index ea0e487f87b1..c3c7adef74de 100644
+--- a/arch/powerpc/include/asm/nmi.h
++++ b/arch/powerpc/include/asm/nmi.h
+@@ -5,8 +5,10 @@
+ #ifdef CONFIG_PPC_WATCHDOG
+ extern void arch_touch_nmi_watchdog(void);
+ long soft_nmi_interrupt(struct pt_regs *regs);
++void watchdog_nmi_set_timeout_pct(u64 pct);
+ #else
+ static inline void arch_touch_nmi_watchdog(void) {}
++static inline void watchdog_nmi_set_timeout_pct(u64 pct) {}
+ #endif
+
+ #ifdef CONFIG_NMI_IPI
+diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
+index 7d28b9553654..5d903e63f932 100644
+--- a/arch/powerpc/kernel/watchdog.c
++++ b/arch/powerpc/kernel/watchdog.c
+@@ -91,6 +91,10 @@ static cpumask_t wd_smp_cpus_pending;
+ static cpumask_t wd_smp_cpus_stuck;
+ static u64 wd_smp_last_reset_tb;
+
++#ifdef CONFIG_PPC_PSERIES
++static u64 wd_timeout_pct;
++#endif
++
+ /*
+ * Try to take the exclusive watchdog action / NMI IPI / printing lock.
+ * wd_smp_lock must be held. If this fails, we should return and wait
+@@ -527,7 +531,13 @@ static int stop_watchdog_on_cpu(unsigned int cpu)
+
+ static void watchdog_calc_timeouts(void)
+ {
+- wd_panic_timeout_tb = watchdog_thresh * ppc_tb_freq;
++ u64 threshold = watchdog_thresh;
++
++#ifdef CONFIG_PPC_PSERIES
++ threshold += (READ_ONCE(wd_timeout_pct) * threshold) / 100;
++#endif
++
++ wd_panic_timeout_tb = threshold * ppc_tb_freq;
+
+ /* Have the SMP detector trigger a bit later */
+ wd_smp_panic_timeout_tb = wd_panic_timeout_tb * 3 / 2;
+@@ -570,3 +580,12 @@ int __init watchdog_nmi_probe(void)
+ }
+ return 0;
+ }
++
++#ifdef CONFIG_PPC_PSERIES
++void watchdog_nmi_set_timeout_pct(u64 pct)
++{
++ pr_info("Set the NMI watchdog timeout factor to %llu%%\n", pct);
++ WRITE_ONCE(wd_timeout_pct, pct);
++ lockup_detector_reconfigure();
++}
++#endif
+--
+2.35.1
+
--- /dev/null
+From e9ec2e35fa6f3bf4d016069cbc2f9b9cffd8ccb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jun 2022 14:04:25 -0500
+Subject: RDMA/rxe: Limit the number of calls to each tasklet
+
+From: Bob Pearson <rpearsonhpe@gmail.com>
+
+[ Upstream commit eff6d998ca297cb0b2e53b032a56cf8e04dd8b17 ]
+
+Limit the maximum number of calls to each tasklet from rxe_do_task()
+before yielding the cpu. When the limit is reached reschedule the tasklet
+and exit the calling loop. This patch prevents one tasklet from consuming
+100% of a cpu core and causing a deadlock or soft lockup.
+
+Link: https://lore.kernel.org/r/20220630190425.2251-9-rpearsonhpe@gmail.com
+Signed-off-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_param.h | 6 ++++++
+ drivers/infiniband/sw/rxe/rxe_task.c | 16 ++++++++++++----
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_param.h b/drivers/infiniband/sw/rxe/rxe_param.h
+index 568a7cbd13d4..86c7a8bf3cbb 100644
+--- a/drivers/infiniband/sw/rxe/rxe_param.h
++++ b/drivers/infiniband/sw/rxe/rxe_param.h
+@@ -105,6 +105,12 @@ enum rxe_device_param {
+ RXE_INFLIGHT_SKBS_PER_QP_HIGH = 64,
+ RXE_INFLIGHT_SKBS_PER_QP_LOW = 16,
+
++ /* Max number of interations of each tasklet
++ * before yielding the cpu to let other
++ * work make progress
++ */
++ RXE_MAX_ITERATIONS = 1024,
++
+ /* Delay before calling arbiter timer */
+ RXE_NSEC_ARB_TIMER_DELAY = 200,
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_task.c b/drivers/infiniband/sw/rxe/rxe_task.c
+index 0c4db5bb17d7..2248cf33d776 100644
+--- a/drivers/infiniband/sw/rxe/rxe_task.c
++++ b/drivers/infiniband/sw/rxe/rxe_task.c
+@@ -8,7 +8,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/hardirq.h>
+
+-#include "rxe_task.h"
++#include "rxe.h"
+
+ int __rxe_do_task(struct rxe_task *task)
+
+@@ -33,6 +33,7 @@ void rxe_do_task(struct tasklet_struct *t)
+ int cont;
+ int ret;
+ struct rxe_task *task = from_tasklet(task, t, tasklet);
++ unsigned int iterations = RXE_MAX_ITERATIONS;
+
+ spin_lock_bh(&task->state_lock);
+ switch (task->state) {
+@@ -61,13 +62,20 @@ void rxe_do_task(struct tasklet_struct *t)
+ spin_lock_bh(&task->state_lock);
+ switch (task->state) {
+ case TASK_STATE_BUSY:
+- if (ret)
++ if (ret) {
+ task->state = TASK_STATE_START;
+- else
++ } else if (iterations--) {
+ cont = 1;
++ } else {
++ /* reschedule the tasklet and exit
++ * the loop to give up the cpu
++ */
++ tasklet_schedule(&task->tasklet);
++ task->state = TASK_STATE_START;
++ }
+ break;
+
+- /* soneone tried to run the task since the last time we called
++ /* someone tried to run the task since the last time we called
+ * func, so we will call one more time regardless of the
+ * return value
+ */
+--
+2.35.1
+
--- /dev/null
+From b1cd217ed16f9c08d58bf36b702e336f1707b38e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Jul 2022 03:16:26 +0000
+Subject: Revert "RDMA/rxe: Create duplicate mapping tables for FMRs"
+
+From: Li Zhijian <lizhijian@fujitsu.com>
+
+[ Upstream commit 1e75550648da1fa1cd1969e7597355de8fe8caf6 ]
+
+Below 2 commits will be reverted:
+ commit 8ff5f5d9d8cf ("RDMA/rxe: Prevent double freeing rxe_map_set()")
+ commit 647bf13ce944 ("RDMA/rxe: Create duplicate mapping tables for FMRs")
+
+The community has a few bug reports which pointed this commit at last.
+Some proposals are raised up in the meantime but all of them have no
+follow-up operation.
+
+The previous commit led the map_set of FMR to be not available any more if
+the MR is registered again after invalidating. Although the mentioned
+patch try to fix a potential race in building/accessing the same table
+for fast memory regions, it broke rtrs etc ULPs. Since the latter could
+be worse, revert this patch.
+
+With previous commit, it's observed that a same MR in rnbd server will
+trigger below code path:
+ -> rxe_mr_init_fast()
+ |-> alloc map_set() # map_set is uninitialized
+ |...-> rxe_map_mr_sg() # build the map_set
+ |-> rxe_mr_set_page()
+ |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE that means
+ # we can access host memory(such rxe_mr_copy)
+ |...-> rxe_invalidate_mr() # mr->state change to FREE from VALID
+ |...-> rxe_reg_fast_mr() # mr->state change to VALID from FREE,
+ # but map_set was not built again
+ |...-> rxe_mr_copy() # kernel crash due to access wild addresses
+ # that lookup from the map_set
+
+The backtraces are not always identical.
+[1st]----------
+ RIP: 0010:lookup_iova+0x66/0xa0 [rdma_rxe]
+ Code: 00 00 00 48 d3 ee 89 32 c3 4c 8b 18 49 8b 3b 48 8b 47 08 48 39 c6 72 38 48 29 c6 45 31 d2 b8 01 00 00 00 48 63 c8 48 c1 e1 04 <48> 8b 4c 0f 08 48 39 f1 77 21 83 c0 01 48 29 ce 3d 00 01 00 00 75
+ RSP: 0018:ffffb7ff80063bf0 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: ffff9b9949d86800 RCX: 0000000000000000
+ RDX: ffffb7ff80063c00 RSI: 0000000049f6b378 RDI: 002818da00000004
+ RBP: 0000000000000120 R08: ffffb7ff80063c08 R09: ffffb7ff80063c04
+ R10: 0000000000000002 R11: ffff9b9916f7eef8 R12: ffff9b99488a0038
+ R13: ffff9b99488a0038 R14: ffff9b9914fb346a R15: ffff9b990ab27000
+ FS: 0000000000000000(0000) GS:ffff9b997dc00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007efc33a98ed0 CR3: 0000000014f32004 CR4: 00000000001706f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <TASK>
+ rxe_mr_copy.part.0+0x6f/0x140 [rdma_rxe]
+ rxe_responder+0x12ee/0x1b60 [rdma_rxe]
+ ? rxe_icrc_check+0x7e/0x100 [rdma_rxe]
+ ? rxe_rcv+0x1d0/0x780 [rdma_rxe]
+ ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe]
+ rxe_do_task+0x67/0xb0 [rdma_rxe]
+ rxe_xmit_packet+0xc7/0x210 [rdma_rxe]
+ rxe_requester+0x680/0xee0 [rdma_rxe]
+ ? update_load_avg+0x5f/0x690
+ ? update_load_avg+0x5f/0x690
+ ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client]
+
+[2nd]----------
+ RIP: 0010:rxe_mr_copy.part.0+0xa8/0x140 [rdma_rxe]
+ Code: 00 00 49 c1 e7 04 48 8b 00 4c 8d 2c d0 48 8b 44 24 10 4d 03 7d 00 85 ed 7f 10 eb 6c 89 54 24 0c 49 83 c7 10 31 c0 85 ed 7e 5e <49> 8b 3f 8b 14 24 4c 89 f6 48 01 c7 85 d2 74 06 48 89 fe 4c 89 f7
+ RSP: 0018:ffffae3580063bf8 EFLAGS: 00010202
+ RAX: 0000000000018978 RBX: ffff9d7ef7a03600 RCX: 0000000000000008
+ RDX: 000000000000007c RSI: 000000000000007c RDI: ffff9d7ef7a03600
+ RBP: 0000000000000120 R08: ffffae3580063c08 R09: ffffae3580063c04
+ R10: ffff9d7efece0038 R11: ffff9d7ec4b1db00 R12: ffff9d7efece0038
+ R13: ffff9d7ef4098260 R14: ffff9d7f11e23c6a R15: 4c79500065708144
+ FS: 0000000000000000(0000) GS:ffff9d7f3dc00000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007fce47276c60 CR3: 0000000003f66004 CR4: 00000000001706f0
+ DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <TASK>
+ rxe_responder+0x12ee/0x1b60 [rdma_rxe]
+ ? rxe_icrc_check+0x7e/0x100 [rdma_rxe]
+ ? rxe_rcv+0x1d0/0x780 [rdma_rxe]
+ ? rxe_icrc_hdr.isra.0+0xf6/0x160 [rdma_rxe]
+ rxe_do_task+0x67/0xb0 [rdma_rxe]
+ rxe_xmit_packet+0xc7/0x210 [rdma_rxe]
+ rxe_requester+0x680/0xee0 [rdma_rxe]
+ ? update_load_avg+0x5f/0x690
+ ? update_load_avg+0x5f/0x690
+ ? rtrs_clt_recv_done+0x1b/0x30 [rtrs_client]
+ rxe_do_task+0x67/0xb0 [rdma_rxe]
+ tasklet_action_common.constprop.0+0x92/0xc0
+ __do_softirq+0xe1/0x2d8
+ run_ksoftirqd+0x21/0x30
+ smpboot_thread_fn+0x183/0x220
+ ? sort_range+0x20/0x20
+ kthread+0xe2/0x110
+ ? kthread_complete_and_exit+0x20/0x20
+ ret_from_fork+0x22/0x30
+
+Link: https://lore.kernel.org/r/1658805386-2-1-git-send-email-lizhijian@fujitsu.com
+Link: https://lore.kernel.org/all/20220210073655.42281-1-guoqing.jiang@linux.dev/T/
+Link: https://www.spinics.net/lists/linux-rdma/msg110836.html
+Link: https://lore.kernel.org/lkml/94a5ea93-b8bb-3a01-9497-e2021f29598a@linux.dev/t/
+Tested-by: Md Haris Iqbal <haris.iqbal@ionos.com>
+Reviewed-by: Bob Pearson <rpearsonhpe@gmail.com>
+Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_loc.h | 1 -
+ drivers/infiniband/sw/rxe/rxe_mr.c | 199 +++++++++-----------------
+ drivers/infiniband/sw/rxe/rxe_mw.c | 6 +-
+ drivers/infiniband/sw/rxe/rxe_verbs.c | 39 +++--
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 21 ++-
+ 5 files changed, 104 insertions(+), 162 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_loc.h b/drivers/infiniband/sw/rxe/rxe_loc.h
+index 37484a559d20..d86253c6d6b5 100644
+--- a/drivers/infiniband/sw/rxe/rxe_loc.h
++++ b/drivers/infiniband/sw/rxe/rxe_loc.h
+@@ -79,7 +79,6 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length);
+ int advance_dma_data(struct rxe_dma_info *dma, unsigned int length);
+ int rxe_invalidate_mr(struct rxe_qp *qp, u32 key);
+ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe);
+-int rxe_mr_set_page(struct ib_mr *ibmr, u64 addr);
+ int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata);
+ void rxe_mr_cleanup(struct rxe_pool_elem *elem);
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
+index 3add52129006..c28b18d59a06 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mr.c
++++ b/drivers/infiniband/sw/rxe/rxe_mr.c
+@@ -24,7 +24,7 @@ u8 rxe_get_next_key(u32 last_key)
+
+ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
+ {
+- struct rxe_map_set *set = mr->cur_map_set;
++
+
+ switch (mr->type) {
+ case IB_MR_TYPE_DMA:
+@@ -32,8 +32,8 @@ int mr_check_range(struct rxe_mr *mr, u64 iova, size_t length)
+
+ case IB_MR_TYPE_USER:
+ case IB_MR_TYPE_MEM_REG:
+- if (iova < set->iova || length > set->length ||
+- iova > set->iova + set->length - length)
++ if (iova < mr->iova || length > mr->length ||
++ iova > mr->iova + mr->length - length)
+ return -EFAULT;
+ return 0;
+
+@@ -65,89 +65,41 @@ static void rxe_mr_init(int access, struct rxe_mr *mr)
+ mr->map_shift = ilog2(RXE_BUF_PER_MAP);
+ }
+
+-static void rxe_mr_free_map_set(int num_map, struct rxe_map_set *set)
+-{
+- int i;
+-
+- for (i = 0; i < num_map; i++)
+- kfree(set->map[i]);
+-
+- kfree(set->map);
+- kfree(set);
+-}
+-
+-static int rxe_mr_alloc_map_set(int num_map, struct rxe_map_set **setp)
++static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf)
+ {
+ int i;
+- struct rxe_map_set *set;
++ int num_map;
++ struct rxe_map **map = mr->map;
+
+- set = kmalloc(sizeof(*set), GFP_KERNEL);
+- if (!set)
+- goto err_out;
++ num_map = (num_buf + RXE_BUF_PER_MAP - 1) / RXE_BUF_PER_MAP;
+
+- set->map = kmalloc_array(num_map, sizeof(struct rxe_map *), GFP_KERNEL);
+- if (!set->map)
+- goto err_free_set;
++ mr->map = kmalloc_array(num_map, sizeof(*map), GFP_KERNEL);
++ if (!mr->map)
++ goto err1;
+
+ for (i = 0; i < num_map; i++) {
+- set->map[i] = kmalloc(sizeof(struct rxe_map), GFP_KERNEL);
+- if (!set->map[i])
+- goto err_free_map;
++ mr->map[i] = kmalloc(sizeof(**map), GFP_KERNEL);
++ if (!mr->map[i])
++ goto err2;
+ }
+
+- *setp = set;
+-
+- return 0;
+-
+-err_free_map:
+- for (i--; i >= 0; i--)
+- kfree(set->map[i]);
+-
+- kfree(set->map);
+-err_free_set:
+- kfree(set);
+-err_out:
+- return -ENOMEM;
+-}
+-
+-/**
+- * rxe_mr_alloc() - Allocate memory map array(s) for MR
+- * @mr: Memory region
+- * @num_buf: Number of buffer descriptors to support
+- * @both: If non zero allocate both mr->map and mr->next_map
+- * else just allocate mr->map. Used for fast MRs
+- *
+- * Return: 0 on success else an error
+- */
+-static int rxe_mr_alloc(struct rxe_mr *mr, int num_buf, int both)
+-{
+- int ret;
+- int num_map;
+-
+ BUILD_BUG_ON(!is_power_of_2(RXE_BUF_PER_MAP));
+- num_map = (num_buf + RXE_BUF_PER_MAP - 1) / RXE_BUF_PER_MAP;
+
+ mr->map_shift = ilog2(RXE_BUF_PER_MAP);
+ mr->map_mask = RXE_BUF_PER_MAP - 1;
++
+ mr->num_buf = num_buf;
+- mr->max_buf = num_map * RXE_BUF_PER_MAP;
+ mr->num_map = num_map;
+-
+- ret = rxe_mr_alloc_map_set(num_map, &mr->cur_map_set);
+- if (ret)
+- return -ENOMEM;
+-
+- if (both) {
+- ret = rxe_mr_alloc_map_set(num_map, &mr->next_map_set);
+- if (ret)
+- goto err_free;
+- }
++ mr->max_buf = num_map * RXE_BUF_PER_MAP;
+
+ return 0;
+
+-err_free:
+- rxe_mr_free_map_set(mr->num_map, mr->cur_map_set);
+- mr->cur_map_set = NULL;
++err2:
++ for (i--; i >= 0; i--)
++ kfree(mr->map[i]);
++
++ kfree(mr->map);
++err1:
+ return -ENOMEM;
+ }
+
+@@ -164,7 +116,6 @@ void rxe_mr_init_dma(struct rxe_pd *pd, int access, struct rxe_mr *mr)
+ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+ int access, struct rxe_mr *mr)
+ {
+- struct rxe_map_set *set;
+ struct rxe_map **map;
+ struct rxe_phys_buf *buf = NULL;
+ struct ib_umem *umem;
+@@ -172,6 +123,7 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+ int num_buf;
+ void *vaddr;
+ int err;
++ int i;
+
+ umem = ib_umem_get(pd->ibpd.device, start, length, access);
+ if (IS_ERR(umem)) {
+@@ -185,20 +137,18 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+
+ rxe_mr_init(access, mr);
+
+- err = rxe_mr_alloc(mr, num_buf, 0);
++ err = rxe_mr_alloc(mr, num_buf);
+ if (err) {
+ pr_warn("%s: Unable to allocate memory for map\n",
+ __func__);
+ goto err_release_umem;
+ }
+
+- set = mr->cur_map_set;
+- set->page_shift = PAGE_SHIFT;
+- set->page_mask = PAGE_SIZE - 1;
+-
+- num_buf = 0;
+- map = set->map;
++ mr->page_shift = PAGE_SHIFT;
++ mr->page_mask = PAGE_SIZE - 1;
+
++ num_buf = 0;
++ map = mr->map;
+ if (length > 0) {
+ buf = map[0]->buf;
+
+@@ -214,29 +164,33 @@ int rxe_mr_init_user(struct rxe_pd *pd, u64 start, u64 length, u64 iova,
+ pr_warn("%s: Unable to get virtual address\n",
+ __func__);
+ err = -ENOMEM;
+- goto err_release_umem;
++ goto err_cleanup_map;
+ }
+
+ buf->addr = (uintptr_t)vaddr;
+ buf->size = PAGE_SIZE;
+ num_buf++;
+ buf++;
++
+ }
+ }
+
+ mr->ibmr.pd = &pd->ibpd;
+ mr->umem = umem;
+ mr->access = access;
++ mr->length = length;
++ mr->iova = iova;
++ mr->va = start;
++ mr->offset = ib_umem_offset(umem);
+ mr->state = RXE_MR_STATE_VALID;
+ mr->type = IB_MR_TYPE_USER;
+
+- set->length = length;
+- set->iova = iova;
+- set->va = start;
+- set->offset = ib_umem_offset(umem);
+-
+ return 0;
+
++err_cleanup_map:
++ for (i = 0; i < mr->num_map; i++)
++ kfree(mr->map[i]);
++ kfree(mr->map);
+ err_release_umem:
+ ib_umem_release(umem);
+ err_out:
+@@ -250,7 +204,7 @@ int rxe_mr_init_fast(struct rxe_pd *pd, int max_pages, struct rxe_mr *mr)
+ /* always allow remote access for FMRs */
+ rxe_mr_init(IB_ACCESS_REMOTE, mr);
+
+- err = rxe_mr_alloc(mr, max_pages, 1);
++ err = rxe_mr_alloc(mr, max_pages);
+ if (err)
+ goto err1;
+
+@@ -268,24 +222,21 @@ int rxe_mr_init_fast(struct rxe_pd *pd, int max_pages, struct rxe_mr *mr)
+ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out,
+ size_t *offset_out)
+ {
+- struct rxe_map_set *set = mr->cur_map_set;
+- size_t offset = iova - set->iova + set->offset;
++ size_t offset = iova - mr->iova + mr->offset;
+ int map_index;
+ int buf_index;
+ u64 length;
+- struct rxe_map *map;
+
+- if (likely(set->page_shift)) {
+- *offset_out = offset & set->page_mask;
+- offset >>= set->page_shift;
++ if (likely(mr->page_shift)) {
++ *offset_out = offset & mr->page_mask;
++ offset >>= mr->page_shift;
+ *n_out = offset & mr->map_mask;
+ *m_out = offset >> mr->map_shift;
+ } else {
+ map_index = 0;
+ buf_index = 0;
+
+- map = set->map[map_index];
+- length = map->buf[buf_index].size;
++ length = mr->map[map_index]->buf[buf_index].size;
+
+ while (offset >= length) {
+ offset -= length;
+@@ -295,8 +246,7 @@ static void lookup_iova(struct rxe_mr *mr, u64 iova, int *m_out, int *n_out,
+ map_index++;
+ buf_index = 0;
+ }
+- map = set->map[map_index];
+- length = map->buf[buf_index].size;
++ length = mr->map[map_index]->buf[buf_index].size;
+ }
+
+ *m_out = map_index;
+@@ -317,7 +267,7 @@ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length)
+ goto out;
+ }
+
+- if (!mr->cur_map_set) {
++ if (!mr->map) {
+ addr = (void *)(uintptr_t)iova;
+ goto out;
+ }
+@@ -330,13 +280,13 @@ void *iova_to_vaddr(struct rxe_mr *mr, u64 iova, int length)
+
+ lookup_iova(mr, iova, &m, &n, &offset);
+
+- if (offset + length > mr->cur_map_set->map[m]->buf[n].size) {
++ if (offset + length > mr->map[m]->buf[n].size) {
+ pr_warn("crosses page boundary\n");
+ addr = NULL;
+ goto out;
+ }
+
+- addr = (void *)(uintptr_t)mr->cur_map_set->map[m]->buf[n].addr + offset;
++ addr = (void *)(uintptr_t)mr->map[m]->buf[n].addr + offset;
+
+ out:
+ return addr;
+@@ -372,7 +322,7 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length,
+ return 0;
+ }
+
+- WARN_ON_ONCE(!mr->cur_map_set);
++ WARN_ON_ONCE(!mr->map);
+
+ err = mr_check_range(mr, iova, length);
+ if (err) {
+@@ -382,7 +332,7 @@ int rxe_mr_copy(struct rxe_mr *mr, u64 iova, void *addr, int length,
+
+ lookup_iova(mr, iova, &m, &i, &offset);
+
+- map = mr->cur_map_set->map + m;
++ map = mr->map + m;
+ buf = map[0]->buf + i;
+
+ while (length > 0) {
+@@ -628,9 +578,8 @@ int rxe_invalidate_mr(struct rxe_qp *qp, u32 key)
+ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+ {
+ struct rxe_mr *mr = to_rmr(wqe->wr.wr.reg.mr);
+- u32 key = wqe->wr.wr.reg.key & 0xff;
++ u32 key = wqe->wr.wr.reg.key;
+ u32 access = wqe->wr.wr.reg.access;
+- struct rxe_map_set *set;
+
+ /* user can only register MR in free state */
+ if (unlikely(mr->state != RXE_MR_STATE_FREE)) {
+@@ -646,36 +595,19 @@ int rxe_reg_fast_mr(struct rxe_qp *qp, struct rxe_send_wqe *wqe)
+ return -EINVAL;
+ }
+
++ /* user is only allowed to change key portion of l/rkey */
++ if (unlikely((mr->lkey & ~0xff) != (key & ~0xff))) {
++ pr_warn("%s: key = 0x%x has wrong index mr->lkey = 0x%x\n",
++ __func__, key, mr->lkey);
++ return -EINVAL;
++ }
++
+ mr->access = access;
+- mr->lkey = (mr->lkey & ~0xff) | key;
+- mr->rkey = (access & IB_ACCESS_REMOTE) ? mr->lkey : 0;
++ mr->lkey = key;
++ mr->rkey = (access & IB_ACCESS_REMOTE) ? key : 0;
++ mr->iova = wqe->wr.wr.reg.mr->iova;
+ mr->state = RXE_MR_STATE_VALID;
+
+- set = mr->cur_map_set;
+- mr->cur_map_set = mr->next_map_set;
+- mr->cur_map_set->iova = wqe->wr.wr.reg.mr->iova;
+- mr->next_map_set = set;
+-
+- return 0;
+-}
+-
+-int rxe_mr_set_page(struct ib_mr *ibmr, u64 addr)
+-{
+- struct rxe_mr *mr = to_rmr(ibmr);
+- struct rxe_map_set *set = mr->next_map_set;
+- struct rxe_map *map;
+- struct rxe_phys_buf *buf;
+-
+- if (unlikely(set->nbuf == mr->num_buf))
+- return -ENOMEM;
+-
+- map = set->map[set->nbuf / RXE_BUF_PER_MAP];
+- buf = &map->buf[set->nbuf % RXE_BUF_PER_MAP];
+-
+- buf->addr = addr;
+- buf->size = ibmr->page_size;
+- set->nbuf++;
+-
+ return 0;
+ }
+
+@@ -695,14 +627,15 @@ int rxe_dereg_mr(struct ib_mr *ibmr, struct ib_udata *udata)
+ void rxe_mr_cleanup(struct rxe_pool_elem *elem)
+ {
+ struct rxe_mr *mr = container_of(elem, typeof(*mr), elem);
++ int i;
+
+ rxe_put(mr_pd(mr));
+-
+ ib_umem_release(mr->umem);
+
+- if (mr->cur_map_set)
+- rxe_mr_free_map_set(mr->num_map, mr->cur_map_set);
++ if (mr->map) {
++ for (i = 0; i < mr->num_map; i++)
++ kfree(mr->map[i]);
+
+- if (mr->next_map_set)
+- rxe_mr_free_map_set(mr->num_map, mr->next_map_set);
++ kfree(mr->map);
++ }
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
+index 824739008d5b..6c24bc4318e8 100644
+--- a/drivers/infiniband/sw/rxe/rxe_mw.c
++++ b/drivers/infiniband/sw/rxe/rxe_mw.c
+@@ -112,15 +112,15 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+
+ /* C10-75 */
+ if (mw->access & IB_ZERO_BASED) {
+- if (unlikely(wqe->wr.wr.mw.length > mr->cur_map_set->length)) {
++ if (unlikely(wqe->wr.wr.mw.length > mr->length)) {
+ pr_err_once(
+ "attempt to bind a ZB MW outside of the MR\n");
+ return -EINVAL;
+ }
+ } else {
+- if (unlikely((wqe->wr.wr.mw.addr < mr->cur_map_set->iova) ||
++ if (unlikely((wqe->wr.wr.mw.addr < mr->iova) ||
+ ((wqe->wr.wr.mw.addr + wqe->wr.wr.mw.length) >
+- (mr->cur_map_set->iova + mr->cur_map_set->length)))) {
++ (mr->iova + mr->length)))) {
+ pr_err_once(
+ "attempt to bind a VA MW outside of the MR\n");
+ return -EINVAL;
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
+index 9d995854a174..d2b4e68402d4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
+@@ -967,26 +967,41 @@ static struct ib_mr *rxe_alloc_mr(struct ib_pd *ibpd, enum ib_mr_type mr_type,
+ return ERR_PTR(err);
+ }
+
+-/* build next_map_set from scatterlist
+- * The IB_WR_REG_MR WR will swap map_sets
+- */
++static int rxe_set_page(struct ib_mr *ibmr, u64 addr)
++{
++ struct rxe_mr *mr = to_rmr(ibmr);
++ struct rxe_map *map;
++ struct rxe_phys_buf *buf;
++
++ if (unlikely(mr->nbuf == mr->num_buf))
++ return -ENOMEM;
++
++ map = mr->map[mr->nbuf / RXE_BUF_PER_MAP];
++ buf = &map->buf[mr->nbuf % RXE_BUF_PER_MAP];
++
++ buf->addr = addr;
++ buf->size = ibmr->page_size;
++ mr->nbuf++;
++
++ return 0;
++}
++
+ static int rxe_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg,
+ int sg_nents, unsigned int *sg_offset)
+ {
+ struct rxe_mr *mr = to_rmr(ibmr);
+- struct rxe_map_set *set = mr->next_map_set;
+ int n;
+
+- set->nbuf = 0;
++ mr->nbuf = 0;
+
+- n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_mr_set_page);
++ n = ib_sg_to_pages(ibmr, sg, sg_nents, sg_offset, rxe_set_page);
+
+- set->va = ibmr->iova;
+- set->iova = ibmr->iova;
+- set->length = ibmr->length;
+- set->page_shift = ilog2(ibmr->page_size);
+- set->page_mask = ibmr->page_size - 1;
+- set->offset = set->iova & set->page_mask;
++ mr->va = ibmr->iova;
++ mr->iova = ibmr->iova;
++ mr->length = ibmr->length;
++ mr->page_shift = ilog2(ibmr->page_size);
++ mr->page_mask = ibmr->page_size - 1;
++ mr->offset = mr->iova & mr->page_mask;
+
+ return n;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 9bdf33346511..3d524238e5c4 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -289,17 +289,6 @@ struct rxe_map {
+ struct rxe_phys_buf buf[RXE_BUF_PER_MAP];
+ };
+
+-struct rxe_map_set {
+- struct rxe_map **map;
+- u64 va;
+- u64 iova;
+- size_t length;
+- u32 offset;
+- u32 nbuf;
+- int page_shift;
+- int page_mask;
+-};
+-
+ static inline int rkey_is_mw(u32 rkey)
+ {
+ u32 index = rkey >> 8;
+@@ -317,20 +306,26 @@ struct rxe_mr {
+ u32 rkey;
+ enum rxe_mr_state state;
+ enum ib_mr_type type;
++ u64 va;
++ u64 iova;
++ size_t length;
++ u32 offset;
+ int access;
+
++ int page_shift;
++ int page_mask;
+ int map_shift;
+ int map_mask;
+
+ u32 num_buf;
++ u32 nbuf;
+
+ u32 max_buf;
+ u32 num_map;
+
+ atomic_t num_mw;
+
+- struct rxe_map_set *cur_map_set;
+- struct rxe_map_set *next_map_set;
++ struct rxe_map **map;
+ };
+
+ enum rxe_mw_state {
+--
+2.35.1
+
--- /dev/null
+From d847e4279a89042b82956333338ab5e499a18010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jun 2022 16:23:08 +0800
+Subject: RISC-V: Add fast call path of crash_kexec()
+
+From: Xianting Tian <xianting.tian@linux.alibaba.com>
+
+[ Upstream commit 3f1901110a89b0e2e13adb2ac8d1a7102879ea98 ]
+
+Currently, almost all archs (x86, arm64, mips...) support fast call
+of crash_kexec() when "regs && kexec_should_crash()" is true. But
+RISC-V not, it can only enter crash system via panic(). However panic()
+doesn't pass the regs of the real accident scene to crash_kexec(),
+it caused we can't get accurate backtrace via gdb,
+ $ riscv64-linux-gnu-gdb vmlinux vmcore
+ Reading symbols from vmlinux...
+ [New LWP 95]
+ #0 console_unlock () at kernel/printk/printk.c:2557
+ 2557 if (do_cond_resched)
+ (gdb) bt
+ #0 console_unlock () at kernel/printk/printk.c:2557
+ #1 0x0000000000000000 in ?? ()
+
+With the patch we can get the accurate backtrace,
+ $ riscv64-linux-gnu-gdb vmlinux vmcore
+ Reading symbols from vmlinux...
+ [New LWP 95]
+ #0 0xffffffe00063a4e0 in test_thread (data=<optimized out>) at drivers/test_crash.c:81
+ 81 *(int *)p = 0xdead;
+ (gdb)
+ (gdb) bt
+ #0 0xffffffe00064d5c0 in test_thread (data=<optimized out>) at drivers/test_crash.c:81
+ #1 0x0000000000000000 in ?? ()
+
+Test code to produce NULL address dereference in test_crash.c,
+ void *p = NULL;
+ *(int *)p = 0xdead;
+
+Reviewed-by: Guo Ren <guoren@kernel.org>
+Tested-by: Xianting Tian <xianting.tian@linux.alibaba.com>
+Signed-off-by: Xianting Tian <xianting.tian@linux.alibaba.com>
+Link: https://lore.kernel.org/r/20220606082308.2883458-1-xianting.tian@linux.alibaba.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/traps.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
+index b40426509244..39d0f8bba4b4 100644
+--- a/arch/riscv/kernel/traps.c
++++ b/arch/riscv/kernel/traps.c
+@@ -16,6 +16,7 @@
+ #include <linux/mm.h>
+ #include <linux/module.h>
+ #include <linux/irq.h>
++#include <linux/kexec.h>
+
+ #include <asm/asm-prototypes.h>
+ #include <asm/bug.h>
+@@ -44,6 +45,9 @@ void die(struct pt_regs *regs, const char *str)
+
+ ret = notify_die(DIE_OOPS, str, regs, 0, regs->cause, SIGSEGV);
+
++ if (regs && kexec_should_crash(current))
++ crash_kexec(regs);
++
+ bust_spinlocks(0);
+ add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
+ spin_unlock_irq(&die_lock);
+--
+2.35.1
+
--- /dev/null
+From 07a757b5156c56daa0464fb46eff1bc582a02da9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jul 2022 20:04:36 +0100
+Subject: riscv: dts: canaan: Add k210 topology information
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+[ Upstream commit d9d193dea8666bbf69fc21c5bdcdabaa34a466e3 ]
+
+The k210 has no cpu-map node, so tools like hwloc cannot correctly
+parse the topology. Add the node using the existing node labels.
+
+Reported-by: Brice Goglin <Brice.Goglin@inria.fr>
+Link: https://github.com/open-mpi/hwloc/issues/536
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
+Link: https://lore.kernel.org/r/20220705190435.1790466-6-mail@conchuod.ie
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/canaan/k210.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/riscv/boot/dts/canaan/k210.dtsi b/arch/riscv/boot/dts/canaan/k210.dtsi
+index 44d338514761..ec944d1537dc 100644
+--- a/arch/riscv/boot/dts/canaan/k210.dtsi
++++ b/arch/riscv/boot/dts/canaan/k210.dtsi
+@@ -65,6 +65,18 @@
+ compatible = "riscv,cpu-intc";
+ };
+ };
++
++ cpu-map {
++ cluster0 {
++ core0 {
++ cpu = <&cpu0>;
++ };
++
++ core1 {
++ cpu = <&cpu1>;
++ };
++ };
++ };
+ };
+
+ sram: memory@80000000 {
+--
+2.35.1
+
--- /dev/null
+From 58273c019874f786105c5cb914c2cf6d702f3408 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jul 2022 20:04:33 +0100
+Subject: riscv: dts: sifive: Add fu540 topology information
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+[ Upstream commit af8f260abc608c06e4466a282b53f1e2dc09f042 ]
+
+The fu540 has no cpu-map node, so tools like hwloc cannot correctly
+parse the topology. Add the node using the existing node labels.
+
+Reported-by: Brice Goglin <Brice.Goglin@inria.fr>
+Link: https://github.com/open-mpi/hwloc/issues/536
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20220705190435.1790466-3-mail@conchuod.ie
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 24 ++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+index e3172d0ffac4..24bba83bec77 100644
+--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
++++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
+@@ -133,6 +133,30 @@
+ interrupt-controller;
+ };
+ };
++
++ cpu-map {
++ cluster0 {
++ core0 {
++ cpu = <&cpu0>;
++ };
++
++ core1 {
++ cpu = <&cpu1>;
++ };
++
++ core2 {
++ cpu = <&cpu2>;
++ };
++
++ core3 {
++ cpu = <&cpu3>;
++ };
++
++ core4 {
++ cpu = <&cpu4>;
++ };
++ };
++ };
+ };
+ soc {
+ #address-cells = <2>;
+--
+2.35.1
+
--- /dev/null
+From 8ddefa7540c98f8937bae935b1616028e8484844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Jul 2022 20:04:34 +0100
+Subject: riscv: dts: sifive: Add fu740 topology information
+
+From: Conor Dooley <conor.dooley@microchip.com>
+
+[ Upstream commit bf6cd1c01c959a31002dfa6784c0d8caffed4cf1 ]
+
+The fu740 has no cpu-map node, so tools like hwloc cannot correctly
+parse the topology. Add the node using the existing node labels.
+
+Reported-by: Brice Goglin <Brice.Goglin@inria.fr>
+Link: https://github.com/open-mpi/hwloc/issues/536
+Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20220705190435.1790466-4-mail@conchuod.ie
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 24 ++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
+index 7b77c13496d8..43bed6c0a84f 100644
+--- a/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
++++ b/arch/riscv/boot/dts/sifive/fu740-c000.dtsi
+@@ -134,6 +134,30 @@
+ interrupt-controller;
+ };
+ };
++
++ cpu-map {
++ cluster0 {
++ core0 {
++ cpu = <&cpu0>;
++ };
++
++ core1 {
++ cpu = <&cpu1>;
++ };
++
++ core2 {
++ cpu = <&cpu2>;
++ };
++
++ core3 {
++ cpu = <&cpu3>;
++ };
++
++ core4 {
++ cpu = <&cpu4>;
++ };
++ };
++ };
+ };
+ soc {
+ #address-cells = <2>;
+--
+2.35.1
+
--- /dev/null
+From e7f16a387a2cecc92614fa4cecf85ed8c6021c2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 May 2022 15:56:52 +0800
+Subject: riscv: mmap with PROT_WRITE but no PROT_READ is invalid
+
+From: Celeste Liu <coelacanthus@outlook.com>
+
+[ Upstream commit 2139619bcad7ac44cc8f6f749089120594056613 ]
+
+As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3, write
+but not read is "Reserved for future use.". For now, they are not valid.
+In the current code, -wx is marked as invalid, but -w- is not marked
+as invalid.
+This patch refines that judgment.
+
+Reported-by: xctan <xc-tan@outlook.com>
+Co-developed-by: dram <dramforever@live.com>
+Signed-off-by: dram <dramforever@live.com>
+Co-developed-by: Ruizhe Pan <c141028@gmail.com>
+Signed-off-by: Ruizhe Pan <c141028@gmail.com>
+Signed-off-by: Celeste Liu <coelacanthus@outlook.com>
+Link: https://lore.kernel.org/r/PH7PR14MB559464DBDD310E755F5B21E8CEDC9@PH7PR14MB5594.namprd14.prod.outlook.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/sys_riscv.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
+index 9c0194f176fc..571556bb9261 100644
+--- a/arch/riscv/kernel/sys_riscv.c
++++ b/arch/riscv/kernel/sys_riscv.c
+@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
+ if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
+ return -EINVAL;
+
+- if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
+- if (unlikely(!(prot & PROT_READ)))
+- return -EINVAL;
++ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
++ return -EINVAL;
+
+ return ksys_mmap_pgoff(addr, len, prot, flags, fd,
+ offset >> (PAGE_SHIFT - page_shift_offset));
+--
+2.35.1
+
--- /dev/null
+From 6f1e028b9437bcd78a763dd04b0bd59876fdbe9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jun 2022 17:27:33 -0500
+Subject: scsi: iscsi: Fix HW conn removal use after free
+
+From: Mike Christie <michael.christie@oracle.com>
+
+[ Upstream commit c577ab7ba5f3bf9062db8a58b6e89d4fe370447e ]
+
+If qla4xxx doesn't remove the connection before the session, the iSCSI
+class tries to remove the connection for it. We were doing a
+iscsi_put_conn() in the iter function which is not needed and will result
+in a use after free because iscsi_remove_conn() will free the connection.
+
+Link: https://lore.kernel.org/r/20220616222738.5722-2-michael.christie@oracle.com
+Tested-by: Nilesh Javali <njavali@marvell.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Reviewed-by: Nilesh Javali <njavali@marvell.com>
+Signed-off-by: Mike Christie <michael.christie@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/scsi_transport_iscsi.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 2a38cd2d24ef..02899e8849dd 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2143,8 +2143,6 @@ static int iscsi_iter_destroy_conn_fn(struct device *dev, void *data)
+ return 0;
+
+ iscsi_remove_conn(iscsi_dev_to_conn(dev));
+- iscsi_put_conn(iscsi_dev_to_conn(dev));
+-
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From b98cdb5d1a7158cb2581f86bfc9b93000ef45c8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 14:14:18 -0700
+Subject: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 2f67dc7970bce3529edce93a0a14234d88b3fcd5 ]
+
+There is no corresponding free routine if lpfc_sli4_issue_wqe fails to
+issue the CMF WQE in lpfc_issue_cmf_sync_wqe.
+
+If ret_val is non-zero, then free the iocbq request structure.
+
+Link: https://lore.kernel.org/r/20220701211425.2708-6-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 80ac3a051c19..e2127e85ff32 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -2003,10 +2003,12 @@ lpfc_issue_cmf_sync_wqe(struct lpfc_hba *phba, u32 ms, u64 total)
+
+ sync_buf->cmd_flag |= LPFC_IO_CMF;
+ ret_val = lpfc_sli4_issue_wqe(phba, &phba->sli4_hba.hdwq[0], sync_buf);
+- if (ret_val)
++ if (ret_val) {
+ lpfc_printf_log(phba, KERN_INFO, LOG_CGN_MGMT,
+ "6214 Cannot issue CMF_SYNC_WQE: x%x\n",
+ ret_val);
++ __lpfc_sli_release_iocbq(phba, sync_buf);
++ }
+ out_unlock:
+ spin_unlock_irqrestore(&phba->hbalock, iflags);
+ return ret_val;
+--
+2.35.1
+
--- /dev/null
+From 52ba92f3a3e55cf3d2716a6e0d84672e062a08bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 14:14:15 -0700
+Subject: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed
+ user input
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit f8191d40aa612981ce897e66cda6a88db8df17bb ]
+
+Malformed user input to debugfs results in buffer overflow crashes. Adapt
+input string lengths to fit within internal buffers, leaving space for NULL
+terminators.
+
+Link: https://lore.kernel.org/r/20220701211425.2708-3-jsmart2021@gmail.com
+Co-developed-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: Justin Tee <justin.tee@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
+index 7b24c932e812..25deacc92b02 100644
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -2607,8 +2607,8 @@ lpfc_debugfs_multixripools_write(struct file *file, const char __user *buf,
+ struct lpfc_sli4_hdw_queue *qp;
+ struct lpfc_multixri_pool *multixri_pool;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -2688,8 +2688,8 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
+ if (!phba->targetport)
+ return -ENXIO;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -2826,8 +2826,8 @@ lpfc_debugfs_ioktime_write(struct file *file, const char __user *buf,
+ char mybuf[64];
+ char *pbuf;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
+ char mybuf[64];
+ char *pbuf;
+
+- if (nbytes > 63)
+- nbytes = 63;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+@@ -3060,8 +3060,8 @@ lpfc_debugfs_hdwqstat_write(struct file *file, const char __user *buf,
+ char *pbuf;
+ int i;
+
+- if (nbytes > 64)
+- nbytes = 64;
++ if (nbytes > sizeof(mybuf) - 1)
++ nbytes = sizeof(mybuf) - 1;
+
+ memset(mybuf, 0, sizeof(mybuf));
+
+--
+2.35.1
+
--- /dev/null
+From 1a94aaef5cdfa168fa0a74ee642f4176f06dfffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jun 2022 20:05:19 +0900
+Subject: scsi: ufs: core: Add UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 6554400d6f66b9494a0c0f07712ab0a9d307eb01 ]
+
+Add UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS for host controllers which do not
+support 64-bit addressing.
+
+Link: https://lore.kernel.org/r/20220603110524.1997825-3-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 2 ++
+ include/ufs/ufshcd.h | 6 ++++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 8d91be0fd1a4..141fff01a662 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -2227,6 +2227,8 @@ static inline int ufshcd_hba_capabilities(struct ufs_hba *hba)
+ int err;
+
+ hba->capabilities = ufshcd_readl(hba, REG_CONTROLLER_CAPABILITIES);
++ if (hba->quirks & UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS)
++ hba->capabilities &= ~MASK_64_ADDRESSING_SUPPORT;
+
+ /* nutrs and nutmrs are 0 based values */
+ hba->nutrs = (hba->capabilities & MASK_TRANSFER_REQUESTS_SLOTS) + 1;
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index a92271421718..795c8951341d 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -577,6 +577,12 @@ enum ufshcd_quirks {
+ * support physical host configuration.
+ */
+ UFSHCD_QUIRK_SKIP_PH_CONFIGURATION = 1 << 16,
++
++ /*
++ * This quirk needs to be enabled if the host controller has
++ * 64-bit addressing supported capability but it doesn't work.
++ */
++ UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS = 1 << 17,
+ };
+
+ enum ufshcd_caps {
+--
+2.35.1
+
--- /dev/null
+From 00f78f9ed5198049534ee8c2ad0de74015861cd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jun 2022 20:05:20 +0900
+Subject: scsi: ufs: core: Add UFSHCD_QUIRK_HIBERN_FASTAUTO
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 2f11bbc2c7f37e3a6151ac548b1c0679cc90ea83 ]
+
+Add UFSHCD_QUIRK_HIBERN_FASTAUTO quirk for host controllers which supports
+auto-hibernate the capability but only FASTAUTO mode.
+
+Link: https://lore.kernel.org/r/20220603110524.1997825-4-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/core/ufshcd.c | 9 +++++++--
+ include/ufs/ufshcd.h | 6 ++++++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
+index 141fff01a662..a51ca56a0ebe 100644
+--- a/drivers/ufs/core/ufshcd.c
++++ b/drivers/ufs/core/ufshcd.c
+@@ -4292,8 +4292,13 @@ static int ufshcd_get_max_pwr_mode(struct ufs_hba *hba)
+ if (hba->max_pwr_info.is_valid)
+ return 0;
+
+- pwr_info->pwr_tx = FAST_MODE;
+- pwr_info->pwr_rx = FAST_MODE;
++ if (hba->quirks & UFSHCD_QUIRK_HIBERN_FASTAUTO) {
++ pwr_info->pwr_tx = FASTAUTO_MODE;
++ pwr_info->pwr_rx = FASTAUTO_MODE;
++ } else {
++ pwr_info->pwr_tx = FAST_MODE;
++ pwr_info->pwr_rx = FAST_MODE;
++ }
+ pwr_info->hs_rate = PA_HS_MODE_B;
+
+ /* Get the connected lane count */
+diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
+index 795c8951341d..991aea081ec7 100644
+--- a/include/ufs/ufshcd.h
++++ b/include/ufs/ufshcd.h
+@@ -583,6 +583,12 @@ enum ufshcd_quirks {
+ * 64-bit addressing supported capability but it doesn't work.
+ */
+ UFSHCD_QUIRK_BROKEN_64BIT_ADDRESS = 1 << 17,
++
++ /*
++ * This quirk needs to be enabled if the host controller has
++ * auto-hibernate capability but it's FASTAUTO only.
++ */
++ UFSHCD_QUIRK_HIBERN_FASTAUTO = 1 << 18,
+ };
+
+ enum ufshcd_caps {
+--
+2.35.1
+
--- /dev/null
+From a866442d55cdc7dd169c9b4fa37d21b91fb4e093 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Jul 2022 11:02:55 +0900
+Subject: scsi: ufs: ufs-exynos: Change ufs phy control sequence
+
+From: Chanho Park <chanho61.park@samsung.com>
+
+[ Upstream commit 3d73b200f9893d8f5ba5d105e8b69c8d16744fa2 ]
+
+Since commit 1599069a62c6 ("phy: core: Warn when phy_power_on is called
+before phy_init"), the following warning has been reported:
+
+ phy_power_on was called before phy_init
+
+To address this, we need to remove phy_power_on from exynos_ufs_phy_init()
+and move it after phy_init. phy_power_off and phy_exit are also necessary
+in exynos_ufs_remove().
+
+Link: https://lore.kernel.org/r/20220706020255.151177-4-chanho61.park@samsung.com
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Chanho Park <chanho61.park@samsung.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-exynos.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c
+index a81d8cbd542f..25995667c832 100644
+--- a/drivers/ufs/host/ufs-exynos.c
++++ b/drivers/ufs/host/ufs-exynos.c
+@@ -910,9 +910,13 @@ static int exynos_ufs_phy_init(struct exynos_ufs *ufs)
+ if (ret) {
+ dev_err(hba->dev, "%s: phy init failed, ret = %d\n",
+ __func__, ret);
+- goto out_exit_phy;
++ return ret;
+ }
+
++ ret = phy_power_on(generic_phy);
++ if (ret)
++ goto out_exit_phy;
++
+ return 0;
+
+ out_exit_phy:
+@@ -1174,10 +1178,6 @@ static int exynos_ufs_init(struct ufs_hba *hba)
+ goto out;
+ }
+
+- ret = phy_power_on(ufs->phy);
+- if (ret)
+- goto phy_off;
+-
+ exynos_ufs_priv_init(hba, ufs);
+
+ if (ufs->drv_data->drv_init) {
+@@ -1195,8 +1195,6 @@ static int exynos_ufs_init(struct ufs_hba *hba)
+ exynos_ufs_config_smu(ufs);
+ return 0;
+
+-phy_off:
+- phy_power_off(ufs->phy);
+ out:
+ hba->priv = NULL;
+ return ret;
+@@ -1514,9 +1512,14 @@ static int exynos_ufs_probe(struct platform_device *pdev)
+ static int exynos_ufs_remove(struct platform_device *pdev)
+ {
+ struct ufs_hba *hba = platform_get_drvdata(pdev);
++ struct exynos_ufs *ufs = ufshcd_get_variant(hba);
+
+ pm_runtime_get_sync(&(pdev)->dev);
+ ufshcd_remove(hba);
++
++ phy_power_off(ufs->phy);
++ phy_exit(ufs->phy);
++
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 7457ab3e8bd4388bc2f54fe41202c98a97f71621 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jun 2022 13:37:18 +0800
+Subject: scsi: ufs: ufs-mediatek: Fix the timing of configuring device
+ regulators
+
+From: Po-Wen Kao <powen.kao@mediatek.com>
+
+[ Upstream commit 3fd23b8dfb54d9b74eba6dfdd3225db3ac116785 ]
+
+Currently the LPM configurations of device regulators may not work since
+VCC is not disabled yet while ufs_mtk_vreg_set_lpm() is executed.
+
+Fix this by changing the timing of invoking ufs_mtk_vreg_set_lpm().
+
+Link: https://lore.kernel.org/r/20220616053725.5681-5-stanley.chu@mediatek.com
+Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Po-Wen Kao <powen.kao@mediatek.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ufs/host/ufs-mediatek.c | 58 ++++++++++++++++++++++++++++++---
+ 1 file changed, 53 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
+index beabc3ccd30b..8b9daa281cc4 100644
+--- a/drivers/ufs/host/ufs-mediatek.c
++++ b/drivers/ufs/host/ufs-mediatek.c
+@@ -1026,7 +1026,6 @@ static int ufs_mtk_suspend(struct ufs_hba *hba, enum ufs_pm_op pm_op,
+ * ufshcd_suspend() re-enabling regulators while vreg is still
+ * in low-power mode.
+ */
+- ufs_mtk_vreg_set_lpm(hba, true);
+ err = ufs_mtk_mphy_power_on(hba, false);
+ if (err)
+ goto fail;
+@@ -1050,12 +1049,13 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ {
+ int err;
+
++ if (hba->ufshcd_state != UFSHCD_STATE_OPERATIONAL)
++ ufs_mtk_vreg_set_lpm(hba, false);
++
+ err = ufs_mtk_mphy_power_on(hba, true);
+ if (err)
+ goto fail;
+
+- ufs_mtk_vreg_set_lpm(hba, false);
+-
+ if (ufshcd_is_link_hibern8(hba)) {
+ err = ufs_mtk_link_set_hpm(hba);
+ if (err)
+@@ -1220,9 +1220,57 @@ static int ufs_mtk_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++int ufs_mtk_system_suspend(struct device *dev)
++{
++ struct ufs_hba *hba = dev_get_drvdata(dev);
++ int ret;
++
++ ret = ufshcd_system_suspend(dev);
++ if (ret)
++ return ret;
++
++ ufs_mtk_vreg_set_lpm(hba, true);
++
++ return 0;
++}
++
++int ufs_mtk_system_resume(struct device *dev)
++{
++ struct ufs_hba *hba = dev_get_drvdata(dev);
++
++ ufs_mtk_vreg_set_lpm(hba, false);
++
++ return ufshcd_system_resume(dev);
++}
++
++int ufs_mtk_runtime_suspend(struct device *dev)
++{
++ struct ufs_hba *hba = dev_get_drvdata(dev);
++ int ret = 0;
++
++ ret = ufshcd_runtime_suspend(dev);
++ if (ret)
++ return ret;
++
++ ufs_mtk_vreg_set_lpm(hba, true);
++
++ return 0;
++}
++
++int ufs_mtk_runtime_resume(struct device *dev)
++{
++ struct ufs_hba *hba = dev_get_drvdata(dev);
++
++ ufs_mtk_vreg_set_lpm(hba, false);
++
++ return ufshcd_runtime_resume(dev);
++}
++
+ static const struct dev_pm_ops ufs_mtk_pm_ops = {
+- SET_SYSTEM_SLEEP_PM_OPS(ufshcd_system_suspend, ufshcd_system_resume)
+- SET_RUNTIME_PM_OPS(ufshcd_runtime_suspend, ufshcd_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(ufs_mtk_system_suspend,
++ ufs_mtk_system_resume)
++ SET_RUNTIME_PM_OPS(ufs_mtk_runtime_suspend,
++ ufs_mtk_runtime_resume, NULL)
+ .prepare = ufshcd_suspend_prepare,
+ .complete = ufshcd_resume_complete,
+ };
+--
+2.35.1
+
--- /dev/null
+From 0af199520c2580f5e828362cb5831e34458dea56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 16:17:07 -0400
+Subject: selftests/kprobe: Do not test for GRP/ without event failures
+
+From: Steven Rostedt (Google) <rostedt@goodmis.org>
+
+[ Upstream commit f5eab65ff2b76449286d18efc7fee3e0b72f7d9b ]
+
+A new feature is added where kprobes (and other probes) do not need to
+explicitly state the event name when creating a probe. The event name will
+come from what is being attached.
+
+That is:
+
+ # echo 'p:foo/ vfs_read' > kprobe_events
+
+Will no longer error, but instead create an event:
+
+ # cat kprobe_events
+ p:foo/p_vfs_read_0 vfs_read
+
+This should not be tested as an error case anymore. Remove it from the
+selftest as now this feature "breaks" the selftest as it no longer fails
+as expected.
+
+Link: https://lore.kernel.org/all/1656296348-16111-1-git-send-email-quic_linyyuan@quicinc.com/
+Link: https://lkml.kernel.org/r/20220712161707.6dc08a14@gandalf.local.home
+
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
+index fa928b431555..7c02509c71d0 100644
+--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc
+@@ -21,7 +21,6 @@ check_error 'p:^/bar vfs_read' # NO_GROUP_NAME
+ check_error 'p:^12345678901234567890123456789012345678901234567890123456789012345/bar vfs_read' # GROUP_TOO_LONG
+
+ check_error 'p:^foo.1/bar vfs_read' # BAD_GROUP_NAME
+-check_error 'p:foo/^ vfs_read' # NO_EVENT_NAME
+ check_error 'p:foo/^12345678901234567890123456789012345678901234567890123456789012345 vfs_read' # EVENT_TOO_LONG
+ check_error 'p:foo/^bar.1 vfs_read' # BAD_EVENT_NAME
+
+--
+2.35.1
+
igb-add-lock-to-avoid-data-race.patch
kbuild-fix-the-modules-order-between-drivers-and-libs.patch
gcc-plugins-undefine-latent_entropy_plugin-when-plugin-disabled-for-a-file.patch
+drm-imx-dcss-get-rid-of-hpd-warning-message.patch
+drm-meson-fix-refcount-bugs-in-meson_vpu_has_availab.patch
+drm-i915-ttm-don-t-leak-the-ccs-state.patch
+drm-amdgpu-avoid-another-list-of-reset-devices.patch
+drm-bridge-lvds-codec-fix-error-checking-of-drm_of_l.patch
+drm-sun4i-dsi-prevent-underflow-when-computing-packe.patch
+drm-amdgpu-fix-use-after-free-on-amdgpu_bo_list-mute.patch
+kvm-arm64-treat-pmcr_el1.lc-as-res1-on-asymmetric-sy.patch
+kvm-arm64-reject-32bit-user-pstate-on-asymmetric-sys.patch
+ice-fix-clearing-of-promisc-mode-with-bridge-over-bo.patch
+net-mscc-ocelot-turn-stats_lock-into-a-spinlock.patch
+net-mscc-ocelot-fix-race-between-ndo_get_stats64-and.patch
+net-mscc-ocelot-make-struct-ocelot_stat_layout-array.patch
+net-mscc-ocelot-report-ndo_get_stats64-from-the-wrap.patch
+x86-ibt-objtool-add-ibt_noseal.patch
+x86-kvm-fix-missing-endbr-bug-for-fastop-functions.patch
+thunderbolt-change-downstream-router-s-tmu-rate-in-b.patch
+hid-multitouch-new-device-class-fix-lenovo-x12-track.patch
+pci-add-acs-quirk-for-broadcom-bcm5750x-nics.patch
+platform-chrome-cros_ec_proto-don-t-show-mkbp-versio.patch
+staging-r8188eu-add-error-handling-of-rtw_read8.patch
+staging-r8188eu-add-error-handling-of-rtw_read16.patch
+staging-r8188eu-add-error-handling-of-rtw_read32.patch
+usb-cdns3-fix-use-after-free-at-workaround-2.patch
+usb-gadget-uvc-calculate-the-number-of-request-depen.patch
+usb-gadget-uvc-call-uvc-uvcg_warn-on-completed-statu.patch
+pci-aardvark-fix-reporting-slot-capabilities-on-emul.patch
+scsi-ufs-core-add-ufshcd_quirk_broken_64bit_address.patch
+scsi-ufs-core-add-ufshcd_quirk_hibern_fastauto.patch
+irqchip-tegra-fix-overflow-implicit-truncation-warni.patch
+drm-meson-fix-overflow-implicit-truncation-warnings.patch
+clk-ti-stop-using-legacy-clkctrl-names-for-omap4-and.patch
+scsi-ufs-ufs-mediatek-fix-the-timing-of-configuring-.patch
+usb-typec-mux-add-config-guards-for-functions.patch
+usb-host-ohci-ppc-of-fix-refcount-leak-bug.patch
+usb-renesas-fix-refcount-leak-bug.patch
+scsi-iscsi-fix-hw-conn-removal-use-after-free.patch
+usb-dwc2-gadget-remove-d-pull-up-while-no-vbus-with-.patch
+vboxguest-do-not-use-devm-for-irq.patch
+clk-qcom-ipq8074-dont-disable-gcc_sleep_clk_src.patch
+uacce-handle-parent-device-removal-or-parent-driver-.patch
+zram-do-not-lookup-algorithm-in-backends-table.patch
+clk-qcom-clk-alpha-pll-fix-clk_trion_pll_configure-d.patch
+scsi-lpfc-prevent-buffer-overflow-crashes-in-debugfs.patch
+scsi-lpfc-fix-possible-memory-leak-when-failing-to-i.patch
+gadgetfs-ep_io-wait-until-irq-finishes.patch
+coresight-etm4x-avoid-build-failure-with-unrolled-lo.patch
+habanalabs-add-terminating-null-to-attrs-arrays.patch
+habanalabs-gaudi-invoke-device-reset-from-one-code-b.patch
+habanalabs-gaudi-fix-shift-out-of-bounds.patch
+habanalabs-gaudi-mask-constant-value-before-cast.patch
+mmc-tmio-avoid-glitches-when-resetting.patch
+scsi-ufs-ufs-exynos-change-ufs-phy-control-sequence.patch
+pinctrl-intel-check-against-matching-data-instead-of.patch
+cxl-fix-a-memory-leak-in-an-error-handling-path.patch
+pci-acpi-guard-arm64-specific-mcfg_quirks.patch
+um-add-noreboot-command-line-option-for-panic_timeou.patch
+of-overlay-move-devicetree_corrupt-check-up.patch
+dmaengine-dw-axi-dmac-do-not-print-null-lli-during-e.patch
+dmaengine-dw-axi-dmac-ignore-interrupt-if-no-descrip.patch
+mmc-renesas_sdhi-newer-socs-don-t-need-manual-tap-co.patch
+acpi-pptt-leave-the-table-mapped-for-the-runtime-usa.patch
+rdma-rxe-limit-the-number-of-calls-to-each-tasklet.patch
+csky-kprobe-reclaim-insn_slot-on-kprobe-unregistrati.patch
+selftests-kprobe-do-not-test-for-grp-without-event-f.patch
+dmaengine-tegra-add-terminate-for-tegra234.patch
+dmaengine-sprd-cleanup-in-.remove-after-pm_runtime_g.patch
+revert-rdma-rxe-create-duplicate-mapping-tables-for-.patch
+openrisc-io-define-iounmap-argument-as-volatile.patch
+phy-samsung-phy-exynos-pcie-sanitize-init-power_on-c.patch
+md-notify-sysfs-sync_completed-in-md_reap_sync_threa.patch
+md-raid5-make-logic-blocking-check-consistent-with-l.patch
+nvmet-tcp-fix-lockdep-complaint-on-nvmet_tcp_wq-flus.patch
+drivers-md-fix-a-potential-use-after-free-bug.patch
+ext4-avoid-remove-directory-when-directory-is-corrup.patch
+ext4-block-range-must-be-validated-before-use-in-ext.patch
+ext4-avoid-resizing-to-a-partial-cluster-size.patch
+lib-list_debug.c-detect-uninitialized-lists.patch
+swiotlb-panic-if-nslabs-is-too-small.patch
+tty-serial-fix-refcount-leak-bug-in-ucc_uart.c.patch
+kvm-ppc-book3s-hv-fix-rm_exit-entry-in-debugfs-timin.patch
+vfio-clear-the-caps-buf-to-null-after-free.patch
+mips-cavium-octeon-fix-missing-of_node_put-in-octeon.patch
+iommu-io-pgtable-arm-v7s-add-a-quirk-to-allow-pgtabl.patch
+asoc-intel-avs-set-max-dma-segment-size.patch
+alsa-hda-fix-page-fault-in-snd_hda_codec_shutdown.patch
+modules-ensure-natural-alignment-for-.altinstruction.patch
+asoc-sof-intel-cnl-do-not-process-ipc-reply-before-f.patch
+asoc-sof-intel-hda-ipc-do-not-process-ipc-reply-befo.patch
+asoc-sof-sof-client-probes-only-load-the-driver-if-i.patch
+asoc-rsnd-care-default-case-on-rsnd_ssiu_busif_err_i.patch
+riscv-dts-sifive-add-fu540-topology-information.patch
+riscv-dts-sifive-add-fu740-topology-information.patch
+riscv-dts-canaan-add-k210-topology-information.patch
+asoc-nau8821-don-t-unconditionally-free-interrupt.patch
+riscv-mmap-with-prot_write-but-no-prot_read-is-inval.patch
+risc-v-add-fast-call-path-of-crash_kexec.patch
+alsa-hda-realtek-enable-speaker-and-mute-leds-for-hp.patch
+asoc-sof-intel-hda-add-sanity-check-on-ssp-index-rep.patch
+asoc-intel-sof_es8336-fix-gpio-quirks-set-via-module.patch
+asoc-intel-sof_es8336-ignore-gpioint-when-looking-fo.patch
+asoc-intel-sof_nau8825-move-quirk-check-to-the-front.patch
+watchdog-export-lockup_detector_reconfigure.patch
+powerpc-watchdog-introduce-a-nmi-watchdog-s-factor.patch
+powerpc-pseries-mobility-set-nmi-watchdog-factor-dur.patch
+powerpc-32-set-an-ibat-covering-up-to-_einittext-dur.patch
+powerpc-32-don-t-always-pass-mcpu-powerpc-to-the-com.patch
+asoc-codecs-va-macro-use-fsgen-as-clock.patch
+ovl-warn-if-trusted-xattr-creation-fails.patch
+powerpc-ioda-iommu-debugfs-generate-unique-debugfs-e.patch
+alsa-core-add-async-signal-helpers.patch
+alsa-timer-use-deferred-fasync-helper.patch
+alsa-pcm-use-deferred-fasync-helper.patch
+alsa-control-use-deferred-fasync-helper.patch
+f2fs-fix-to-avoid-use-f2fs_bug_on-in-f2fs_new_node_p.patch
+f2fs-fix-to-do-sanity-check-on-segment-type-in-build.patch
+smb3-check-xattr-value-length-earlier.patch
+powerpc-64-init-jump-labels-before-parse_early_param.patch
+venus-pm_helpers-fix-warning-in-opp-during-probe.patch
+video-fbdev-i740fb-check-the-argument-of-i740_calc_v.patch
+mips-tlbex-explicitly-compare-_page_no_exec-against-.patch
+f2fs-revive-f2fs_ioc_abort_volatile_write.patch
+f2fs-fix-null-ptr-deref-in-f2fs_get_dnode_of_data.patch
--- /dev/null
+From bae2a11961ba3f56b064e262bb5db4bc77a9274a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Jul 2022 11:43:44 -0500
+Subject: smb3: check xattr value length earlier
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 5fa2cffba0b82336a2244d941322eb1627ff787b ]
+
+Coverity complains about assigning a pointer based on
+value length before checking that value length goes
+beyond the end of the SMB. Although this is even more
+unlikely as value length is a single byte, and the
+pointer is not dereferenced until laterm, it is clearer
+to check the lengths first.
+
+Addresses-Coverity: 1467704 ("Speculative execution data leak")
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 8802995b2d3d..aa4c1d403708 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -1145,9 +1145,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ size_t name_len, value_len, user_name_len;
+
+ while (src_size > 0) {
+- name = &src->ea_data[0];
+ name_len = (size_t)src->ea_name_length;
+- value = &src->ea_data[src->ea_name_length + 1];
+ value_len = (size_t)le16_to_cpu(src->ea_value_length);
+
+ if (name_len == 0)
+@@ -1159,6 +1157,9 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size,
+ goto out;
+ }
+
++ name = &src->ea_data[0];
++ value = &src->ea_data[src->ea_name_length + 1];
++
+ if (ea_name) {
+ if (ea_name_len == name_len &&
+ memcmp(ea_name, name, name_len) == 0) {
+--
+2.35.1
+
--- /dev/null
+From a247e885cfc58984d79840b22c4d2c8f60a53d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jun 2022 22:26:12 +0300
+Subject: staging: r8188eu: add error handling of rtw_read16
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit fed9e604eeb6150847d9757f6b056c12912d468b ]
+
+rtw_read16() reads data from device via USB API which may fail. In case
+of any failure previous code returned stack data to callers, which is
+wrong.
+
+Fix it by changing rtw_read16() prototype and prevent caller from
+touching random stack data
+
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: https://lore.kernel.org/r/06b45afda048d0aeddeed983c2318680fe6265f5.1654629778.git.paskripkin@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/r8188eu/hal/rtl8188e_hal_init.c | 29 +++++++++++++++----
+ drivers/staging/r8188eu/hal/rtl8188e_phycfg.c | 8 +++--
+ drivers/staging/r8188eu/hal/usb_halinit.c | 27 ++++++++++++++---
+ drivers/staging/r8188eu/hal/usb_ops_linux.c | 13 ++++++---
+ drivers/staging/r8188eu/include/rtw_io.h | 2 +-
+ drivers/staging/r8188eu/os_dep/ioctl_linux.c | 9 ++++--
+ drivers/staging/r8188eu/os_dep/os_intfs.c | 6 +++-
+ 7 files changed, 73 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+index e67ecbd1ba79..8215ed8b506d 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+@@ -200,7 +200,8 @@ efuse_phymap_to_logical(u8 *phymap, u16 _offset, u16 _size_byte, u8 *pbuf)
+ kfree(eFuseWord);
+ }
+
+-static void efuse_read_phymap_from_txpktbuf(
++/* FIXME: add error handling in callers */
++static int efuse_read_phymap_from_txpktbuf(
+ struct adapter *adapter,
+ int bcnhead, /* beacon head, where FW store len(2-byte) and efuse physical map. */
+ u8 *content, /* buffer to store efuse physical map */
+@@ -219,7 +220,7 @@ static void efuse_read_phymap_from_txpktbuf(
+ if (bcnhead < 0) { /* if not valid */
+ res = rtw_read8(adapter, REG_TDECTRL + 1, ®);
+ if (res)
+- return;
++ return res;
+
+ bcnhead = reg;
+ }
+@@ -249,11 +250,15 @@ static void efuse_read_phymap_from_txpktbuf(
+ hi32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_H));
+
+ if (i == 0) {
++ u16 reg;
++
+ /* Although lenc is only used in a debug statement,
+ * do not remove it as the rtw_read16() call consumes
+ * 2 bytes from the EEPROM source.
+ */
+- rtw_read16(adapter, REG_PKTBUF_DBG_DATA_L);
++ res = rtw_read16(adapter, REG_PKTBUF_DBG_DATA_L, ®);
++ if (res)
++ return res;
+
+ len = le32_to_cpu(lo32) & 0x0000ffff;
+
+@@ -280,6 +285,8 @@ static void efuse_read_phymap_from_txpktbuf(
+ }
+ rtw_write8(adapter, REG_PKT_BUFF_ACCESS_CTRL, DISABLE_TRXPKT_BUF_ACCESS);
+ *size = count;
++
++ return 0;
+ }
+
+ static s32 iol_read_efuse(struct adapter *padapter, u8 txpktbuf_bndy, u16 offset, u16 size_byte, u8 *logical_map)
+@@ -355,25 +362,35 @@ int rtl8188e_IOL_exec_cmds_sync(struct adapter *adapter, struct xmit_frame *xmit
+ void rtl8188e_EfusePowerSwitch(struct adapter *pAdapter, u8 PwrState)
+ {
+ u16 tmpV16;
++ int res;
+
+ if (PwrState) {
+ rtw_write8(pAdapter, REG_EFUSE_ACCESS, EFUSE_ACCESS_ON);
+
+ /* 1.2V Power: From VDDON with Power Cut(0x0000h[15]), defualt valid */
+- tmpV16 = rtw_read16(pAdapter, REG_SYS_ISO_CTRL);
++ res = rtw_read16(pAdapter, REG_SYS_ISO_CTRL, &tmpV16);
++ if (res)
++ return;
++
+ if (!(tmpV16 & PWC_EV12V)) {
+ tmpV16 |= PWC_EV12V;
+ rtw_write16(pAdapter, REG_SYS_ISO_CTRL, tmpV16);
+ }
+ /* Reset: 0x0000h[28], default valid */
+- tmpV16 = rtw_read16(pAdapter, REG_SYS_FUNC_EN);
++ res = rtw_read16(pAdapter, REG_SYS_FUNC_EN, &tmpV16);
++ if (res)
++ return;
++
+ if (!(tmpV16 & FEN_ELDR)) {
+ tmpV16 |= FEN_ELDR;
+ rtw_write16(pAdapter, REG_SYS_FUNC_EN, tmpV16);
+ }
+
+ /* Clock: Gated(0x0008h[5]) 8M(0x0008h[1]) clock from ANA, default valid */
+- tmpV16 = rtw_read16(pAdapter, REG_SYS_CLKR);
++ res = rtw_read16(pAdapter, REG_SYS_CLKR, &tmpV16);
++ if (res)
++ return;
++
+ if ((!(tmpV16 & LOADER_CLK_EN)) || (!(tmpV16 & ANA8M))) {
+ tmpV16 |= (LOADER_CLK_EN | ANA8M);
+ rtw_write16(pAdapter, REG_SYS_CLKR, tmpV16);
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
+index 985339a974fc..298c3d9bc7be 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
+@@ -484,13 +484,17 @@ PHY_BBConfig8188E(
+ {
+ int rtStatus = _SUCCESS;
+ struct hal_data_8188e *pHalData = &Adapter->haldata;
+- u32 RegVal;
++ u16 RegVal;
+ u8 CrystalCap;
++ int res;
+
+ phy_InitBBRFRegisterDefinition(Adapter);
+
+ /* Enable BB and RF */
+- RegVal = rtw_read16(Adapter, REG_SYS_FUNC_EN);
++ res = rtw_read16(Adapter, REG_SYS_FUNC_EN, &RegVal);
++ if (res)
++ return _FAIL;
++
+ rtw_write16(Adapter, REG_SYS_FUNC_EN, (u16)(RegVal | BIT(13) | BIT(0) | BIT(1)));
+
+ /* 20090923 Joseph: Advised by Steven and Jenyu. Power sequence before init RF. */
+diff --git a/drivers/staging/r8188eu/hal/usb_halinit.c b/drivers/staging/r8188eu/hal/usb_halinit.c
+index 01422d548748..e7b51b427e8f 100644
+--- a/drivers/staging/r8188eu/hal/usb_halinit.c
++++ b/drivers/staging/r8188eu/hal/usb_halinit.c
+@@ -52,6 +52,8 @@ void rtl8188eu_interface_configure(struct adapter *adapt)
+ u32 rtl8188eu_InitPowerOn(struct adapter *adapt)
+ {
+ u16 value16;
++ int res;
++
+ /* HW Power on sequence */
+ struct hal_data_8188e *haldata = &adapt->haldata;
+ if (haldata->bMacPwrCtrlOn)
+@@ -65,7 +67,10 @@ u32 rtl8188eu_InitPowerOn(struct adapter *adapt)
+ rtw_write16(adapt, REG_CR, 0x00); /* suggseted by zhouzhou, by page, 20111230 */
+
+ /* Enable MAC DMA/WMAC/SCHEDULE/SEC block */
+- value16 = rtw_read16(adapt, REG_CR);
++ res = rtw_read16(adapt, REG_CR, &value16);
++ if (res)
++ return _FAIL;
++
+ value16 |= (HCI_TXDMA_EN | HCI_RXDMA_EN | TXDMA_EN | RXDMA_EN
+ | PROTOCOL_EN | SCHEDULE_EN | ENSEC | CALTMR_EN);
+ /* for SDIO - Set CR bit10 to enable 32k calibration. Suggested by SD1 Gimmy. Added by tynli. 2011.08.31. */
+@@ -166,7 +171,14 @@ static void _InitNormalChipRegPriority(struct adapter *Adapter, u16 beQ,
+ u16 bkQ, u16 viQ, u16 voQ, u16 mgtQ,
+ u16 hiQ)
+ {
+- u16 value16 = (rtw_read16(Adapter, REG_TRXDMA_CTRL) & 0x7);
++ u16 value16;
++ int res;
++
++ res = rtw_read16(Adapter, REG_TRXDMA_CTRL, &value16);
++ if (res)
++ return;
++
++ value16 &= 0x7;
+
+ value16 |= _TXDMA_BEQ_MAP(beQ) | _TXDMA_BKQ_MAP(bkQ) |
+ _TXDMA_VIQ_MAP(viQ) | _TXDMA_VOQ_MAP(voQ) |
+@@ -640,7 +652,10 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter)
+ /* Hw bug which Hw initials RxFF boundary size to a value which is larger than the real Rx buffer size in 88E. */
+ /* */
+ /* Enable MACTXEN/MACRXEN block */
+- value16 = rtw_read16(Adapter, REG_CR);
++ res = rtw_read16(Adapter, REG_CR, &value16);
++ if (res)
++ return _FAIL;
++
+ value16 |= (MACTXEN | MACRXEN);
+ rtw_write8(Adapter, REG_CR, value16);
+
+@@ -713,7 +728,11 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter)
+ rtw_write16(Adapter, REG_TX_RPT_TIME, 0x3DF0);
+
+ /* enable tx DMA to drop the redundate data of packet */
+- rtw_write16(Adapter, REG_TXDMA_OFFSET_CHK, (rtw_read16(Adapter, REG_TXDMA_OFFSET_CHK) | DROP_DATA_EN));
++ res = rtw_read16(Adapter, REG_TXDMA_OFFSET_CHK, &value16);
++ if (res)
++ return _FAIL;
++
++ rtw_write16(Adapter, REG_TXDMA_OFFSET_CHK, (value16 | DROP_DATA_EN));
+
+ /* 2010/08/26 MH Merge from 8192CE. */
+ if (pwrctrlpriv->rf_pwrstate == rf_on) {
+diff --git a/drivers/staging/r8188eu/hal/usb_ops_linux.c b/drivers/staging/r8188eu/hal/usb_ops_linux.c
+index f399a7fd8b97..7d62f1f3d26e 100644
+--- a/drivers/staging/r8188eu/hal/usb_ops_linux.c
++++ b/drivers/staging/r8188eu/hal/usb_ops_linux.c
+@@ -103,16 +103,21 @@ int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data)
+ return usb_read(intf, value, data, 1);
+ }
+
+-u16 rtw_read16(struct adapter *adapter, u32 addr)
++int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data)
+ {
+ struct io_priv *io_priv = &adapter->iopriv;
+ struct intf_hdl *intf = &io_priv->intf;
+ u16 value = addr & 0xffff;
+- __le16 data;
++ __le16 le_data;
++ int res;
+
+- usb_read(intf, value, &data, 2);
++ res = usb_read(intf, value, &le_data, 2);
++ if (res)
++ return res;
+
+- return le16_to_cpu(data);
++ *data = le16_to_cpu(le_data);
++
++ return 0;
+ }
+
+ u32 rtw_read32(struct adapter *adapter, u32 addr)
+diff --git a/drivers/staging/r8188eu/include/rtw_io.h b/drivers/staging/r8188eu/include/rtw_io.h
+index 1198d3850a6d..ce3369e33d66 100644
+--- a/drivers/staging/r8188eu/include/rtw_io.h
++++ b/drivers/staging/r8188eu/include/rtw_io.h
+@@ -221,7 +221,7 @@ void _rtw_attrib_read(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+ void _rtw_attrib_write(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+ int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data);
+-u16 rtw_read16(struct adapter *adapter, u32 addr);
++int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data);
+ u32 rtw_read32(struct adapter *adapter, u32 addr);
+ void _rtw_read_mem(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+ u32 rtw_read_port(struct adapter *adapter, u8 *pmem);
+diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+index 19a60d47f7c0..7ec363089ae0 100644
+--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+@@ -3349,6 +3349,7 @@ static int rtw_dbg_port(struct net_device *dev,
+
+ /* FIXME: is this read necessary? */
+ res = rtw_read8(padapter, reg, &val8);
++ (void)res;
+ }
+ break;
+
+@@ -3357,8 +3358,8 @@ static int rtw_dbg_port(struct net_device *dev,
+ u16 reg = arg;
+ u16 start_value = 200;
+ u32 write_num = extra_arg;
+-
+- int i;
++ u16 val16;
++ int i, res;
+ struct xmit_frame *xmit_frame;
+
+ xmit_frame = rtw_IOL_accquire_xmit_frame(padapter);
+@@ -3372,7 +3373,9 @@ static int rtw_dbg_port(struct net_device *dev,
+ if (rtl8188e_IOL_exec_cmds_sync(padapter, xmit_frame, 5000, 0) != _SUCCESS)
+ ret = -EPERM;
+
+- rtw_read16(padapter, reg);
++ /* FIXME: is this read necessary? */
++ res = rtw_read16(padapter, reg, &val16);
++ (void)res;
+ }
+ break;
+ case 0x08: /* continuous write dword test */
+diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c
+index 891c85b088ca..d9325ef6ac28 100644
+--- a/drivers/staging/r8188eu/os_dep/os_intfs.c
++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c
+@@ -740,12 +740,16 @@ static void rtw_fifo_cleanup(struct adapter *adapter)
+ {
+ struct pwrctrl_priv *pwrpriv = &adapter->pwrctrlpriv;
+ u8 trycnt = 100;
++ int res;
+
+ /* pause tx */
+ rtw_write8(adapter, REG_TXPAUSE, 0xff);
+
+ /* keep sn */
+- adapter->xmitpriv.nqos_ssn = rtw_read16(adapter, REG_NQOS_SEQ);
++ /* FIXME: return an error to caller */
++ res = rtw_read16(adapter, REG_NQOS_SEQ, &adapter->xmitpriv.nqos_ssn);
++ if (res)
++ return;
+
+ if (!pwrpriv->bkeepfwalive) {
+ /* RX DMA stop */
+--
+2.35.1
+
--- /dev/null
+From b3e9571a60df2f1a3f2b5c14b8a2917a88e8a8d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jun 2022 22:26:21 +0300
+Subject: staging: r8188eu: add error handling of rtw_read32
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit b9c5e272062708680d47df433bfbfe5299ad1a63 ]
+
+rtw_read32() reads data from device via USB API which may fail. In case
+of any failure previous code returned stack data to callers, which is
+wrong.
+
+Fix it by changing rtw_read32() prototype and prevent caller from
+touching random stack data
+
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: https://lore.kernel.org/r/583c3d21c46066275e4fc8da5ba4fd0e3679335b.1654629778.git.paskripkin@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/core/rtw_cmd.c | 15 +++++-
+ drivers/staging/r8188eu/core/rtw_efuse.c | 20 ++++---
+ drivers/staging/r8188eu/core/rtw_fw.c | 16 ++++--
+ drivers/staging/r8188eu/core/rtw_mlme_ext.c | 14 ++++-
+ drivers/staging/r8188eu/core/rtw_pwrctrl.c | 9 +++-
+ .../r8188eu/hal/Hal8188ERateAdaptive.c | 21 ++++++--
+ drivers/staging/r8188eu/hal/HalPhyRf_8188e.c | 3 +-
+ .../staging/r8188eu/hal/rtl8188e_hal_init.c | 40 +++++++++-----
+ drivers/staging/r8188eu/hal/rtl8188e_phycfg.c | 12 ++++-
+ drivers/staging/r8188eu/hal/usb_halinit.c | 53 ++++++++++++++++---
+ drivers/staging/r8188eu/hal/usb_ops_linux.c | 13 +++--
+ drivers/staging/r8188eu/include/rtw_io.h | 2 +-
+ drivers/staging/r8188eu/os_dep/ioctl_linux.c | 27 ++++++++--
+ drivers/staging/r8188eu/os_dep/os_intfs.c | 13 ++++-
+ 14 files changed, 202 insertions(+), 56 deletions(-)
+
+diff --git a/drivers/staging/r8188eu/core/rtw_cmd.c b/drivers/staging/r8188eu/core/rtw_cmd.c
+index 06523d91939a..5b6a891b5d67 100644
+--- a/drivers/staging/r8188eu/core/rtw_cmd.c
++++ b/drivers/staging/r8188eu/core/rtw_cmd.c
+@@ -898,8 +898,12 @@ static void traffic_status_watchdog(struct adapter *padapter)
+ static void rtl8188e_sreset_xmit_status_check(struct adapter *padapter)
+ {
+ u32 txdma_status;
++ int res;
++
++ res = rtw_read32(padapter, REG_TXDMA_STATUS, &txdma_status);
++ if (res)
++ return;
+
+- txdma_status = rtw_read32(padapter, REG_TXDMA_STATUS);
+ if (txdma_status != 0x00)
+ rtw_write32(padapter, REG_TXDMA_STATUS, txdma_status);
+ /* total xmit irp = 4 */
+@@ -1177,7 +1181,14 @@ u8 rtw_ps_cmd(struct adapter *padapter)
+
+ static bool rtw_is_hi_queue_empty(struct adapter *adapter)
+ {
+- return (rtw_read32(adapter, REG_HGQ_INFORMATION) & 0x0000ff00) == 0;
++ int res;
++ u32 reg;
++
++ res = rtw_read32(adapter, REG_HGQ_INFORMATION, ®);
++ if (res)
++ return false;
++
++ return (reg & 0x0000ff00) == 0;
+ }
+
+ static void rtw_chk_hi_queue_hdl(struct adapter *padapter)
+diff --git a/drivers/staging/r8188eu/core/rtw_efuse.c b/drivers/staging/r8188eu/core/rtw_efuse.c
+index a2691c7f96f6..8005ed8d3a20 100644
+--- a/drivers/staging/r8188eu/core/rtw_efuse.c
++++ b/drivers/staging/r8188eu/core/rtw_efuse.c
+@@ -46,11 +46,17 @@ ReadEFuseByte(
+ rtw_write8(Adapter, EFUSE_CTRL + 3, (readbyte & 0x7f));
+
+ /* Check bit 32 read-ready */
+- retry = 0;
+- value32 = rtw_read32(Adapter, EFUSE_CTRL);
+- while (!(((value32 >> 24) & 0xff) & 0x80) && (retry < 10000)) {
+- value32 = rtw_read32(Adapter, EFUSE_CTRL);
+- retry++;
++ res = rtw_read32(Adapter, EFUSE_CTRL, &value32);
++ if (res)
++ return;
++
++ for (retry = 0; retry < 10000; retry++) {
++ res = rtw_read32(Adapter, EFUSE_CTRL, &value32);
++ if (res)
++ continue;
++
++ if (((value32 >> 24) & 0xff) & 0x80)
++ break;
+ }
+
+ /* 20100205 Joseph: Add delay suggested by SD1 Victor. */
+@@ -58,7 +64,9 @@ ReadEFuseByte(
+ /* Designer says that there shall be some delay after ready bit is set, or the */
+ /* result will always stay on last data we read. */
+ udelay(50);
+- value32 = rtw_read32(Adapter, EFUSE_CTRL);
++ res = rtw_read32(Adapter, EFUSE_CTRL, &value32);
++ if (res)
++ return;
+
+ *pbuf = (u8)(value32 & 0xff);
+
+diff --git a/drivers/staging/r8188eu/core/rtw_fw.c b/drivers/staging/r8188eu/core/rtw_fw.c
+index 7cf8525595c6..04f25e0b3bca 100644
+--- a/drivers/staging/r8188eu/core/rtw_fw.c
++++ b/drivers/staging/r8188eu/core/rtw_fw.c
+@@ -194,10 +194,14 @@ static int fw_free_to_go(struct adapter *padapter)
+ {
+ u32 counter = 0;
+ u32 value32;
++ int res;
+
+ /* polling CheckSum report */
+ do {
+- value32 = rtw_read32(padapter, REG_MCUFWDL);
++ res = rtw_read32(padapter, REG_MCUFWDL, &value32);
++ if (res)
++ continue;
++
+ if (value32 & FWDL_CHKSUM_RPT)
+ break;
+ } while (counter++ < POLLING_READY_TIMEOUT_COUNT);
+@@ -205,7 +209,10 @@ static int fw_free_to_go(struct adapter *padapter)
+ if (counter >= POLLING_READY_TIMEOUT_COUNT)
+ return _FAIL;
+
+- value32 = rtw_read32(padapter, REG_MCUFWDL);
++ res = rtw_read32(padapter, REG_MCUFWDL, &value32);
++ if (res)
++ return _FAIL;
++
+ value32 |= MCUFWDL_RDY;
+ value32 &= ~WINTINI_RDY;
+ rtw_write32(padapter, REG_MCUFWDL, value32);
+@@ -215,9 +222,10 @@ static int fw_free_to_go(struct adapter *padapter)
+ /* polling for FW ready */
+ counter = 0;
+ do {
+- value32 = rtw_read32(padapter, REG_MCUFWDL);
+- if (value32 & WINTINI_RDY)
++ res = rtw_read32(padapter, REG_MCUFWDL, &value32);
++ if (!res && value32 & WINTINI_RDY)
+ return _SUCCESS;
++
+ udelay(5);
+ } while (counter++ < POLLING_READY_TIMEOUT_COUNT);
+
+diff --git a/drivers/staging/r8188eu/core/rtw_mlme_ext.c b/drivers/staging/r8188eu/core/rtw_mlme_ext.c
+index fdb5a8cb9d69..88a4953d31d8 100644
+--- a/drivers/staging/r8188eu/core/rtw_mlme_ext.c
++++ b/drivers/staging/r8188eu/core/rtw_mlme_ext.c
+@@ -6017,6 +6017,7 @@ static void mlme_join(struct adapter *adapter, int type)
+ {
+ struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+ u8 retry_limit = 0x30, reg;
++ u32 reg32;
+ int res;
+
+ switch (type) {
+@@ -6025,8 +6026,12 @@ static void mlme_join(struct adapter *adapter, int type)
+ /* enable to rx data frame, accept all data frame */
+ rtw_write16(adapter, REG_RXFLTMAP2, 0xFFFF);
+
++ res = rtw_read32(adapter, REG_RCR, ®32);
++ if (res)
++ return;
++
+ rtw_write32(adapter, REG_RCR,
+- rtw_read32(adapter, REG_RCR) | RCR_CBSSID_DATA | RCR_CBSSID_BCN);
++ reg32 | RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+
+ if (check_fwstate(mlmepriv, WIFI_STATION_STATE)) {
+ retry_limit = 48;
+@@ -6839,9 +6844,14 @@ static u8 chk_ap_is_alive(struct sta_info *psta)
+
+ static int rtl8188e_sreset_linked_status_check(struct adapter *padapter)
+ {
+- u32 rx_dma_status = rtw_read32(padapter, REG_RXDMA_STATUS);
++ u32 rx_dma_status;
++ int res;
+ u8 reg;
+
++ res = rtw_read32(padapter, REG_RXDMA_STATUS, &rx_dma_status);
++ if (res)
++ return res;
++
+ if (rx_dma_status != 0x00)
+ rtw_write32(padapter, REG_RXDMA_STATUS, rx_dma_status);
+
+diff --git a/drivers/staging/r8188eu/core/rtw_pwrctrl.c b/drivers/staging/r8188eu/core/rtw_pwrctrl.c
+index 7b816b824947..45e85b593665 100644
+--- a/drivers/staging/r8188eu/core/rtw_pwrctrl.c
++++ b/drivers/staging/r8188eu/core/rtw_pwrctrl.c
+@@ -229,6 +229,9 @@ void rtw_set_ps_mode(struct adapter *padapter, u8 ps_mode, u8 smart_ps, u8 bcn_a
+
+ static bool lps_rf_on(struct adapter *adapter)
+ {
++ int res;
++ u32 reg;
++
+ /* When we halt NIC, we should check if FW LPS is leave. */
+ if (adapter->pwrctrlpriv.rf_pwrstate == rf_off) {
+ /* If it is in HW/SW Radio OFF or IPS state, we do not check Fw LPS Leave, */
+@@ -236,7 +239,11 @@ static bool lps_rf_on(struct adapter *adapter)
+ return true;
+ }
+
+- if (rtw_read32(adapter, REG_RCR) & 0x00070000)
++ res = rtw_read32(adapter, REG_RCR, ®);
++ if (res)
++ return false;
++
++ if (reg & 0x00070000)
+ return false;
+
+ return true;
+diff --git a/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c b/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c
+index 57e8f5573846..3cefdf90d6e0 100644
+--- a/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c
++++ b/drivers/staging/r8188eu/hal/Hal8188ERateAdaptive.c
+@@ -279,6 +279,7 @@ static int odm_ARFBRefresh_8188E(struct odm_dm_struct *dm_odm, struct odm_ra_inf
+ { /* Wilson 2011/10/26 */
+ u32 MaskFromReg;
+ s8 i;
++ int res;
+
+ switch (pRaInfo->RateID) {
+ case RATR_INX_WIRELESS_NGB:
+@@ -303,19 +304,31 @@ static int odm_ARFBRefresh_8188E(struct odm_dm_struct *dm_odm, struct odm_ra_inf
+ pRaInfo->RAUseRate = (pRaInfo->RateMask) & 0x0000000d;
+ break;
+ case 12:
+- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR0);
++ res = rtw_read32(dm_odm->Adapter, REG_ARFR0, &MaskFromReg);
++ if (res)
++ return res;
++
+ pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg;
+ break;
+ case 13:
+- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR1);
++ res = rtw_read32(dm_odm->Adapter, REG_ARFR1, &MaskFromReg);
++ if (res)
++ return res;
++
+ pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg;
+ break;
+ case 14:
+- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR2);
++ res = rtw_read32(dm_odm->Adapter, REG_ARFR2, &MaskFromReg);
++ if (res)
++ return res;
++
+ pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg;
+ break;
+ case 15:
+- MaskFromReg = rtw_read32(dm_odm->Adapter, REG_ARFR3);
++ res = rtw_read32(dm_odm->Adapter, REG_ARFR3, &MaskFromReg);
++ if (res)
++ return res;
++
+ pRaInfo->RAUseRate = (pRaInfo->RateMask) & MaskFromReg;
+ break;
+ default:
+diff --git a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c
+index a5b7980dfcee..525deab10820 100644
+--- a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c
++++ b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c
+@@ -483,7 +483,8 @@ static void _PHY_SaveMACRegisters(
+ MACBackup[i] = reg;
+ }
+
+- MACBackup[i] = rtw_read32(adapt, MACReg[i]);
++ res = rtw_read32(adapt, MACReg[i], MACBackup + i);
++ (void)res;
+ }
+
+ static void reload_adda_reg(struct adapter *adapt, u32 *ADDAReg, u32 *ADDABackup, u32 RegiesterNum)
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+index 8215ed8b506d..5549e7be334a 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+@@ -216,6 +216,7 @@ static int efuse_read_phymap_from_txpktbuf(
+ u16 limit = *size;
+ u8 reg;
+ u8 *pos = content;
++ u32 reg32;
+
+ if (bcnhead < 0) { /* if not valid */
+ res = rtw_read8(adapter, REG_TDECTRL + 1, ®);
+@@ -246,8 +247,17 @@ static int efuse_read_phymap_from_txpktbuf(
+ } while (time_before(jiffies, timeout));
+
+ /* data from EEPROM needs to be in LE */
+- lo32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_L));
+- hi32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_H));
++ res = rtw_read32(adapter, REG_PKTBUF_DBG_DATA_L, ®32);
++ if (res)
++ return res;
++
++ lo32 = cpu_to_le32(reg32);
++
++ res = rtw_read32(adapter, REG_PKTBUF_DBG_DATA_H, ®32);
++ if (res)
++ return res;
++
++ hi32 = cpu_to_le32(reg32);
+
+ if (i == 0) {
+ u16 reg;
+@@ -548,8 +558,12 @@ void rtl8188e_read_chip_version(struct adapter *padapter)
+ u32 value32;
+ struct HAL_VERSION ChipVersion;
+ struct hal_data_8188e *pHalData = &padapter->haldata;
++ int res;
++
++ res = rtw_read32(padapter, REG_SYS_CFG, &value32);
++ if (res)
++ return;
+
+- value32 = rtw_read32(padapter, REG_SYS_CFG);
+ ChipVersion.ChipType = ((value32 & RTL_ID) ? TEST_CHIP : NORMAL_CHIP);
+
+ ChipVersion.VendorType = ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : CHIP_VENDOR_TSMC);
+@@ -596,26 +610,24 @@ void hal_notch_filter_8188e(struct adapter *adapter, bool enable)
+ /* */
+ static s32 _LLTWrite(struct adapter *padapter, u32 address, u32 data)
+ {
+- s32 status = _SUCCESS;
+- s32 count = 0;
++ s32 count;
+ u32 value = _LLT_INIT_ADDR(address) | _LLT_INIT_DATA(data) | _LLT_OP(_LLT_WRITE_ACCESS);
+ u16 LLTReg = REG_LLT_INIT;
++ int res;
+
+ rtw_write32(padapter, LLTReg, value);
+
+ /* polling */
+- do {
+- value = rtw_read32(padapter, LLTReg);
+- if (_LLT_NO_ACTIVE == _LLT_OP_VALUE(value))
+- break;
++ for (count = 0; count <= POLLING_LLT_THRESHOLD; count++) {
++ res = rtw_read32(padapter, LLTReg, &value);
++ if (res)
++ continue;
+
+- if (count > POLLING_LLT_THRESHOLD) {
+- status = _FAIL;
++ if (_LLT_NO_ACTIVE == _LLT_OP_VALUE(value))
+ break;
+- }
+- } while (count++);
++ }
+
+- return status;
++ return count > POLLING_LLT_THRESHOLD ? _FAIL : _SUCCESS;
+ }
+
+ s32 InitLLTTable(struct adapter *padapter, u8 txpktbuf_bndy)
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
+index 298c3d9bc7be..dea6d915a1f4 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
+@@ -56,8 +56,12 @@ rtl8188e_PHY_QueryBBReg(
+ )
+ {
+ u32 ReturnValue = 0, OriginalValue, BitShift;
++ int res;
++
++ res = rtw_read32(Adapter, RegAddr, &OriginalValue);
++ if (res)
++ return 0;
+
+- OriginalValue = rtw_read32(Adapter, RegAddr);
+ BitShift = phy_CalculateBitShift(BitMask);
+ ReturnValue = (OriginalValue & BitMask) >> BitShift;
+ return ReturnValue;
+@@ -84,9 +88,13 @@ rtl8188e_PHY_QueryBBReg(
+ void rtl8188e_PHY_SetBBReg(struct adapter *Adapter, u32 RegAddr, u32 BitMask, u32 Data)
+ {
+ u32 OriginalValue, BitShift;
++ int res;
+
+ if (BitMask != bMaskDWord) { /* if not "double word" write */
+- OriginalValue = rtw_read32(Adapter, RegAddr);
++ res = rtw_read32(Adapter, RegAddr, &OriginalValue);
++ if (res)
++ return;
++
+ BitShift = phy_CalculateBitShift(BitMask);
+ Data = ((OriginalValue & (~BitMask)) | (Data << BitShift));
+ }
+diff --git a/drivers/staging/r8188eu/hal/usb_halinit.c b/drivers/staging/r8188eu/hal/usb_halinit.c
+index e7b51b427e8f..0afde5038b3f 100644
+--- a/drivers/staging/r8188eu/hal/usb_halinit.c
++++ b/drivers/staging/r8188eu/hal/usb_halinit.c
+@@ -297,8 +297,12 @@ static void _InitQueuePriority(struct adapter *Adapter)
+ static void _InitNetworkType(struct adapter *Adapter)
+ {
+ u32 value32;
++ int res;
++
++ res = rtw_read32(Adapter, REG_CR, &value32);
++ if (res)
++ return;
+
+- value32 = rtw_read32(Adapter, REG_CR);
+ /* TODO: use the other function to set network type */
+ value32 = (value32 & ~MASK_NETTYPE) | _NETTYPE(NT_LINK_AP);
+
+@@ -338,9 +342,13 @@ static void _InitAdaptiveCtrl(struct adapter *Adapter)
+ {
+ u16 value16;
+ u32 value32;
++ int res;
+
+ /* Response Rate Set */
+- value32 = rtw_read32(Adapter, REG_RRSR);
++ res = rtw_read32(Adapter, REG_RRSR, &value32);
++ if (res)
++ return;
++
+ value32 &= ~RATE_BITMAP_ALL;
+ value32 |= RATE_RRSR_CCK_ONLY_1M;
+ rtw_write32(Adapter, REG_RRSR, value32);
+@@ -409,11 +417,15 @@ static void _InitRetryFunction(struct adapter *Adapter)
+ static void usb_AggSettingTxUpdate(struct adapter *Adapter)
+ {
+ u32 value32;
++ int res;
+
+ if (Adapter->registrypriv.wifi_spec)
+ return;
+
+- value32 = rtw_read32(Adapter, REG_TDECTRL);
++ res = rtw_read32(Adapter, REG_TDECTRL, &value32);
++ if (res)
++ return;
++
+ value32 = value32 & ~(BLK_DESC_NUM_MASK << BLK_DESC_NUM_SHIFT);
+ value32 |= ((USB_TXAGG_DESC_NUM & BLK_DESC_NUM_MASK) << BLK_DESC_NUM_SHIFT);
+
+@@ -521,11 +533,17 @@ static void _BBTurnOnBlock(struct adapter *Adapter)
+ static void _InitAntenna_Selection(struct adapter *Adapter)
+ {
+ struct hal_data_8188e *haldata = &Adapter->haldata;
++ int res;
++ u32 reg;
+
+ if (haldata->AntDivCfg == 0)
+ return;
+
+- rtw_write32(Adapter, REG_LEDCFG0, rtw_read32(Adapter, REG_LEDCFG0) | BIT(23));
++ res = rtw_read32(Adapter, REG_LEDCFG0, ®);
++ if (res)
++ return;
++
++ rtw_write32(Adapter, REG_LEDCFG0, reg | BIT(23));
+ rtl8188e_PHY_SetBBReg(Adapter, rFPGA0_XAB_RFParameter, BIT(13), 0x01);
+
+ if (rtl8188e_PHY_QueryBBReg(Adapter, rFPGA0_XA_RFInterfaceOE, 0x300) == Antenna_A)
+@@ -555,6 +573,7 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter)
+ struct hal_data_8188e *haldata = &Adapter->haldata;
+ struct pwrctrl_priv *pwrctrlpriv = &Adapter->pwrctrlpriv;
+ struct registry_priv *pregistrypriv = &Adapter->registrypriv;
++ u32 reg;
+
+ if (Adapter->pwrctrlpriv.bkeepfwalive) {
+ if (haldata->odmpriv.RFCalibrateInfo.bIQKInitialized) {
+@@ -752,7 +771,11 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter)
+ rtw_write8(Adapter, REG_USB_HRPWM, 0);
+
+ /* ack for xmit mgmt frames. */
+- rtw_write32(Adapter, REG_FWHW_TXQ_CTRL, rtw_read32(Adapter, REG_FWHW_TXQ_CTRL) | BIT(12));
++ res = rtw_read32(Adapter, REG_FWHW_TXQ_CTRL, ®);
++ if (res)
++ return _FAIL;
++
++ rtw_write32(Adapter, REG_FWHW_TXQ_CTRL, reg | BIT(12));
+
+ exit:
+ return status;
+@@ -1121,7 +1144,12 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+ case HW_VAR_MLME_SITESURVEY:
+ if (*((u8 *)val)) { /* under sitesurvey */
+ /* config RCR to receive different BSSID & not to receive data frame */
+- u32 v = rtw_read32(Adapter, REG_RCR);
++ u32 v;
++
++ res = rtw_read32(Adapter, REG_RCR, &v);
++ if (res)
++ return;
++
+ v &= ~(RCR_CBSSID_BCN);
+ rtw_write32(Adapter, REG_RCR, v);
+ /* reject all data frame */
+@@ -1136,6 +1164,7 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+ } else { /* sitesurvey done */
+ struct mlme_ext_priv *pmlmeext = &Adapter->mlmeextpriv;
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
++ u32 reg32;
+
+ if ((is_client_associated_to_ap(Adapter)) ||
+ ((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE)) {
+@@ -1157,7 +1186,12 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+
+ rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(4)));
+ }
+- rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR) | RCR_CBSSID_BCN);
++
++ res = rtw_read32(Adapter, REG_RCR, ®32);
++ if (res)
++ return;
++
++ rtw_write32(Adapter, REG_RCR, reg32 | RCR_CBSSID_BCN);
+ }
+ break;
+ case HW_VAR_SLOT_TIME:
+@@ -1326,7 +1360,10 @@ void SetBeaconRelatedRegisters8188EUsb(struct adapter *adapt)
+
+ rtw_write8(adapt, REG_SLOT, 0x09);
+
+- value32 = rtw_read32(adapt, REG_TCR);
++ res = rtw_read32(adapt, REG_TCR, &value32);
++ if (res)
++ return;
++
+ value32 &= ~TSFRST;
+ rtw_write32(adapt, REG_TCR, value32);
+
+diff --git a/drivers/staging/r8188eu/hal/usb_ops_linux.c b/drivers/staging/r8188eu/hal/usb_ops_linux.c
+index 7d62f1f3d26e..c1a4d023f627 100644
+--- a/drivers/staging/r8188eu/hal/usb_ops_linux.c
++++ b/drivers/staging/r8188eu/hal/usb_ops_linux.c
+@@ -120,16 +120,21 @@ int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data)
+ return 0;
+ }
+
+-u32 rtw_read32(struct adapter *adapter, u32 addr)
++int __must_check rtw_read32(struct adapter *adapter, u32 addr, u32 *data)
+ {
+ struct io_priv *io_priv = &adapter->iopriv;
+ struct intf_hdl *intf = &io_priv->intf;
+ u16 value = addr & 0xffff;
+- __le32 data;
++ __le32 le_data;
++ int res;
+
+- usb_read(intf, value, &data, 4);
++ res = usb_read(intf, value, &le_data, 4);
++ if (res)
++ return res;
+
+- return le32_to_cpu(data);
++ *data = le32_to_cpu(le_data);
++
++ return 0;
+ }
+
+ int rtw_write8(struct adapter *adapter, u32 addr, u8 val)
+diff --git a/drivers/staging/r8188eu/include/rtw_io.h b/drivers/staging/r8188eu/include/rtw_io.h
+index ce3369e33d66..1c6097367a67 100644
+--- a/drivers/staging/r8188eu/include/rtw_io.h
++++ b/drivers/staging/r8188eu/include/rtw_io.h
+@@ -222,7 +222,7 @@ void _rtw_attrib_write(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+ int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data);
+ int __must_check rtw_read16(struct adapter *adapter, u32 addr, u16 *data);
+-u32 rtw_read32(struct adapter *adapter, u32 addr);
++int __must_check rtw_read32(struct adapter *adapter, u32 addr, u32 *data);
+ void _rtw_read_mem(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+ u32 rtw_read_port(struct adapter *adapter, u8 *pmem);
+ void rtw_read_port_cancel(struct adapter *adapter);
+diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+index 7ec363089ae0..f486870965ac 100644
+--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+@@ -3126,18 +3126,29 @@ static int rtw_rereg_nd_name(struct net_device *dev,
+ static void mac_reg_dump(struct adapter *padapter)
+ {
+ int i, j = 1;
++ u32 reg;
++ int res;
++
+ pr_info("\n ======= MAC REG =======\n");
+ for (i = 0x0; i < 0x300; i += 4) {
+ if (j % 4 == 1)
+ pr_info("0x%02x", i);
+- pr_info(" 0x%08x ", rtw_read32(padapter, i));
++
++ res = rtw_read32(padapter, i, ®);
++ if (!res)
++ pr_info(" 0x%08x ", reg);
++
+ if ((j++) % 4 == 0)
+ pr_info("\n");
+ }
+ for (i = 0x400; i < 0x800; i += 4) {
+ if (j % 4 == 1)
+ pr_info("0x%02x", i);
+- pr_info(" 0x%08x ", rtw_read32(padapter, i));
++
++ res = rtw_read32(padapter, i, ®);
++ if (!res)
++ pr_info(" 0x%08x ", reg);
++
+ if ((j++) % 4 == 0)
+ pr_info("\n");
+ }
+@@ -3145,13 +3156,18 @@ static void mac_reg_dump(struct adapter *padapter)
+
+ static void bb_reg_dump(struct adapter *padapter)
+ {
+- int i, j = 1;
++ int i, j = 1, res;
++ u32 reg;
++
+ pr_info("\n ======= BB REG =======\n");
+ for (i = 0x800; i < 0x1000; i += 4) {
+ if (j % 4 == 1)
+ pr_info("0x%02x", i);
+
+- pr_info(" 0x%08x ", rtw_read32(padapter, i));
++ res = rtw_read32(padapter, i, ®);
++ if (!res)
++ pr_info(" 0x%08x ", reg);
++
+ if ((j++) % 4 == 0)
+ pr_info("\n");
+ }
+@@ -3398,7 +3414,8 @@ static int rtw_dbg_port(struct net_device *dev,
+ if (rtl8188e_IOL_exec_cmds_sync(padapter, xmit_frame, 5000, 0) != _SUCCESS)
+ ret = -EPERM;
+
+- rtw_read32(padapter, reg);
++ /* FIXME: is this read necessary? */
++ ret = rtw_read32(padapter, reg, &write_num);
+ }
+ break;
+ }
+diff --git a/drivers/staging/r8188eu/os_dep/os_intfs.c b/drivers/staging/r8188eu/os_dep/os_intfs.c
+index d9325ef6ac28..cac9553666e6 100644
+--- a/drivers/staging/r8188eu/os_dep/os_intfs.c
++++ b/drivers/staging/r8188eu/os_dep/os_intfs.c
+@@ -741,6 +741,7 @@ static void rtw_fifo_cleanup(struct adapter *adapter)
+ struct pwrctrl_priv *pwrpriv = &adapter->pwrctrlpriv;
+ u8 trycnt = 100;
+ int res;
++ u32 reg;
+
+ /* pause tx */
+ rtw_write8(adapter, REG_TXPAUSE, 0xff);
+@@ -753,10 +754,18 @@ static void rtw_fifo_cleanup(struct adapter *adapter)
+
+ if (!pwrpriv->bkeepfwalive) {
+ /* RX DMA stop */
++ res = rtw_read32(adapter, REG_RXPKT_NUM, ®);
++ if (res)
++ return;
++
+ rtw_write32(adapter, REG_RXPKT_NUM,
+- (rtw_read32(adapter, REG_RXPKT_NUM) | RW_RELEASE_EN));
++ (reg | RW_RELEASE_EN));
+ do {
+- if (!(rtw_read32(adapter, REG_RXPKT_NUM) & RXDMA_IDLE))
++ res = rtw_read32(adapter, REG_RXPKT_NUM, ®);
++ if (res)
++ continue;
++
++ if (!(reg & RXDMA_IDLE))
+ break;
+ } while (trycnt--);
+
+--
+2.35.1
+
--- /dev/null
+From 16e08b15ef6190d943bba257bdfc228b053b5713 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jun 2022 22:26:05 +0300
+Subject: staging: r8188eu: add error handling of rtw_read8
+
+From: Pavel Skripkin <paskripkin@gmail.com>
+
+[ Upstream commit 857fe9e5efc09833fe1110e99d8baba954a86abb ]
+
+rtw_read8() reads data from device via USB API which may fail. In case
+of any failure previous code returned stack data to callers, which is
+wrong.
+
+Fix it by changing rtw_read8() prototype and prevent caller from
+touching random stack data
+
+Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
+Link: https://lore.kernel.org/r/c8f8ef4f14db3ba2478a87d5be6eb768a093dfaf.1654629778.git.paskripkin@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/r8188eu/core/rtw_efuse.c | 13 +-
+ drivers/staging/r8188eu/core/rtw_fw.c | 56 ++++--
+ drivers/staging/r8188eu/core/rtw_led.c | 16 +-
+ drivers/staging/r8188eu/core/rtw_mlme_ext.c | 48 ++++-
+ drivers/staging/r8188eu/core/rtw_wlan_util.c | 20 +-
+ drivers/staging/r8188eu/hal/HalPhyRf_8188e.c | 18 +-
+ drivers/staging/r8188eu/hal/HalPwrSeqCmd.c | 9 +-
+ drivers/staging/r8188eu/hal/hal_com.c | 27 ++-
+ drivers/staging/r8188eu/hal/rtl8188e_cmd.c | 37 +++-
+ drivers/staging/r8188eu/hal/rtl8188e_dm.c | 6 +-
+ .../staging/r8188eu/hal/rtl8188e_hal_init.c | 69 +++++--
+ drivers/staging/r8188eu/hal/rtl8188e_phycfg.c | 10 +-
+ drivers/staging/r8188eu/hal/usb_halinit.c | 171 +++++++++++++++---
+ drivers/staging/r8188eu/hal/usb_ops_linux.c | 7 +-
+ drivers/staging/r8188eu/include/rtw_io.h | 2 +-
+ drivers/staging/r8188eu/os_dep/ioctl_linux.c | 11 +-
+ 16 files changed, 418 insertions(+), 102 deletions(-)
+
+diff --git a/drivers/staging/r8188eu/core/rtw_efuse.c b/drivers/staging/r8188eu/core/rtw_efuse.c
+index 0e0e60638880..a2691c7f96f6 100644
+--- a/drivers/staging/r8188eu/core/rtw_efuse.c
++++ b/drivers/staging/r8188eu/core/rtw_efuse.c
+@@ -28,14 +28,21 @@ ReadEFuseByte(
+ u32 value32;
+ u8 readbyte;
+ u16 retry;
++ int res;
+
+ /* Write Address */
+ rtw_write8(Adapter, EFUSE_CTRL + 1, (_offset & 0xff));
+- readbyte = rtw_read8(Adapter, EFUSE_CTRL + 2);
++ res = rtw_read8(Adapter, EFUSE_CTRL + 2, &readbyte);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, EFUSE_CTRL + 2, ((_offset >> 8) & 0x03) | (readbyte & 0xfc));
+
+ /* Write bit 32 0 */
+- readbyte = rtw_read8(Adapter, EFUSE_CTRL + 3);
++ res = rtw_read8(Adapter, EFUSE_CTRL + 3, &readbyte);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, EFUSE_CTRL + 3, (readbyte & 0x7f));
+
+ /* Check bit 32 read-ready */
+@@ -54,6 +61,8 @@ ReadEFuseByte(
+ value32 = rtw_read32(Adapter, EFUSE_CTRL);
+
+ *pbuf = (u8)(value32 & 0xff);
++
++ /* FIXME: return an error to caller */
+ }
+
+ /*-----------------------------------------------------------------------------
+diff --git a/drivers/staging/r8188eu/core/rtw_fw.c b/drivers/staging/r8188eu/core/rtw_fw.c
+index 0451e5177644..7cf8525595c6 100644
+--- a/drivers/staging/r8188eu/core/rtw_fw.c
++++ b/drivers/staging/r8188eu/core/rtw_fw.c
+@@ -44,18 +44,28 @@ static_assert(sizeof(struct rt_firmware_hdr) == 32);
+ static void fw_download_enable(struct adapter *padapter, bool enable)
+ {
+ u8 tmp;
++ int res;
+
+ if (enable) {
+ /* MCU firmware download enable. */
+- tmp = rtw_read8(padapter, REG_MCUFWDL);
++ res = rtw_read8(padapter, REG_MCUFWDL, &tmp);
++ if (res)
++ return;
++
+ rtw_write8(padapter, REG_MCUFWDL, tmp | 0x01);
+
+ /* 8051 reset */
+- tmp = rtw_read8(padapter, REG_MCUFWDL + 2);
++ res = rtw_read8(padapter, REG_MCUFWDL + 2, &tmp);
++ if (res)
++ return;
++
+ rtw_write8(padapter, REG_MCUFWDL + 2, tmp & 0xf7);
+ } else {
+ /* MCU firmware download disable. */
+- tmp = rtw_read8(padapter, REG_MCUFWDL);
++ res = rtw_read8(padapter, REG_MCUFWDL, &tmp);
++ if (res)
++ return;
++
+ rtw_write8(padapter, REG_MCUFWDL, tmp & 0xfe);
+
+ /* Reserved for fw extension. */
+@@ -125,8 +135,13 @@ static int page_write(struct adapter *padapter, u32 page, u8 *buffer, u32 size)
+ {
+ u8 value8;
+ u8 u8Page = (u8)(page & 0x07);
++ int res;
++
++ res = rtw_read8(padapter, REG_MCUFWDL + 2, &value8);
++ if (res)
++ return _FAIL;
+
+- value8 = (rtw_read8(padapter, REG_MCUFWDL + 2) & 0xF8) | u8Page;
++ value8 = (value8 & 0xF8) | u8Page;
+ rtw_write8(padapter, REG_MCUFWDL + 2, value8);
+
+ return block_write(padapter, buffer, size);
+@@ -165,8 +180,12 @@ static int write_fw(struct adapter *padapter, u8 *buffer, u32 size)
+ void rtw_reset_8051(struct adapter *padapter)
+ {
+ u8 val8;
++ int res;
++
++ res = rtw_read8(padapter, REG_SYS_FUNC_EN + 1, &val8);
++ if (res)
++ return;
+
+- val8 = rtw_read8(padapter, REG_SYS_FUNC_EN + 1);
+ rtw_write8(padapter, REG_SYS_FUNC_EN + 1, val8 & (~BIT(2)));
+ rtw_write8(padapter, REG_SYS_FUNC_EN + 1, val8 | (BIT(2)));
+ }
+@@ -239,7 +258,7 @@ static int load_firmware(struct rt_firmware *rtfw, struct device *device)
+ int rtl8188e_firmware_download(struct adapter *padapter)
+ {
+ int ret = _SUCCESS;
+- u8 write_fw_retry = 0;
++ u8 reg;
+ unsigned long fwdl_timeout;
+ struct dvobj_priv *dvobj = adapter_to_dvobj(padapter);
+ struct device *device = dvobj_to_dev(dvobj);
+@@ -269,23 +288,34 @@ int rtl8188e_firmware_download(struct adapter *padapter)
+
+ /* Suggested by Filen. If 8051 is running in RAM code, driver should inform Fw to reset by itself, */
+ /* or it will cause download Fw fail. 2010.02.01. by tynli. */
+- if (rtw_read8(padapter, REG_MCUFWDL) & RAM_DL_SEL) { /* 8051 RAM code */
++ ret = rtw_read8(padapter, REG_MCUFWDL, ®);
++ if (ret) {
++ ret = _FAIL;
++ goto exit;
++ }
++
++ if (reg & RAM_DL_SEL) { /* 8051 RAM code */
+ rtw_write8(padapter, REG_MCUFWDL, 0x00);
+ rtw_reset_8051(padapter);
+ }
+
+ fw_download_enable(padapter, true);
+ fwdl_timeout = jiffies + msecs_to_jiffies(500);
+- while (1) {
++ do {
+ /* reset the FWDL chksum */
+- rtw_write8(padapter, REG_MCUFWDL, rtw_read8(padapter, REG_MCUFWDL) | FWDL_CHKSUM_RPT);
++ ret = rtw_read8(padapter, REG_MCUFWDL, ®);
++ if (ret) {
++ ret = _FAIL;
++ continue;
++ }
+
+- ret = write_fw(padapter, fw_data, fw_size);
++ rtw_write8(padapter, REG_MCUFWDL, reg | FWDL_CHKSUM_RPT);
+
+- if (ret == _SUCCESS ||
+- (time_after(jiffies, fwdl_timeout) && write_fw_retry++ >= 3))
++ ret = write_fw(padapter, fw_data, fw_size);
++ if (ret == _SUCCESS)
+ break;
+- }
++ } while (!time_after(jiffies, fwdl_timeout));
++
+ fw_download_enable(padapter, false);
+ if (ret != _SUCCESS)
+ goto exit;
+diff --git a/drivers/staging/r8188eu/core/rtw_led.c b/drivers/staging/r8188eu/core/rtw_led.c
+index 2f3000428af7..25989acf5259 100644
+--- a/drivers/staging/r8188eu/core/rtw_led.c
++++ b/drivers/staging/r8188eu/core/rtw_led.c
+@@ -35,11 +35,15 @@ static void ResetLedStatus(struct LED_871x *pLed)
+ static void SwLedOn(struct adapter *padapter, struct LED_871x *pLed)
+ {
+ u8 LedCfg;
++ int res;
+
+ if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
+ return;
+
+- LedCfg = rtw_read8(padapter, REG_LEDCFG2);
++ res = rtw_read8(padapter, REG_LEDCFG2, &LedCfg);
++ if (res)
++ return;
++
+ rtw_write8(padapter, REG_LEDCFG2, (LedCfg & 0xf0) | BIT(5) | BIT(6)); /* SW control led0 on. */
+ pLed->bLedOn = true;
+ }
+@@ -47,15 +51,21 @@ static void SwLedOn(struct adapter *padapter, struct LED_871x *pLed)
+ static void SwLedOff(struct adapter *padapter, struct LED_871x *pLed)
+ {
+ u8 LedCfg;
++ int res;
+
+ if (padapter->bSurpriseRemoved || padapter->bDriverStopped)
+ goto exit;
+
+- LedCfg = rtw_read8(padapter, REG_LEDCFG2);/* 0x4E */
++ res = rtw_read8(padapter, REG_LEDCFG2, &LedCfg);/* 0x4E */
++ if (res)
++ goto exit;
+
+ LedCfg &= 0x90; /* Set to software control. */
+ rtw_write8(padapter, REG_LEDCFG2, (LedCfg | BIT(3)));
+- LedCfg = rtw_read8(padapter, REG_MAC_PINMUX_CFG);
++ res = rtw_read8(padapter, REG_MAC_PINMUX_CFG, &LedCfg);
++ if (res)
++ goto exit;
++
+ LedCfg &= 0xFE;
+ rtw_write8(padapter, REG_MAC_PINMUX_CFG, LedCfg);
+ exit:
+diff --git a/drivers/staging/r8188eu/core/rtw_mlme_ext.c b/drivers/staging/r8188eu/core/rtw_mlme_ext.c
+index faf23fc950c5..fdb5a8cb9d69 100644
+--- a/drivers/staging/r8188eu/core/rtw_mlme_ext.c
++++ b/drivers/staging/r8188eu/core/rtw_mlme_ext.c
+@@ -5667,14 +5667,28 @@ unsigned int send_beacon(struct adapter *padapter)
+
+ bool get_beacon_valid_bit(struct adapter *adapter)
+ {
++ int res;
++ u8 reg;
++
++ res = rtw_read8(adapter, REG_TDECTRL + 2, ®);
++ if (res)
++ return false;
++
+ /* BIT(16) of REG_TDECTRL = BIT(0) of REG_TDECTRL+2 */
+- return BIT(0) & rtw_read8(adapter, REG_TDECTRL + 2);
++ return BIT(0) & reg;
+ }
+
+ void clear_beacon_valid_bit(struct adapter *adapter)
+ {
++ int res;
++ u8 reg;
++
++ res = rtw_read8(adapter, REG_TDECTRL + 2, ®);
++ if (res)
++ return;
++
+ /* BIT(16) of REG_TDECTRL = BIT(0) of REG_TDECTRL+2, write 1 to clear, Clear by sw */
+- rtw_write8(adapter, REG_TDECTRL + 2, rtw_read8(adapter, REG_TDECTRL + 2) | BIT(0));
++ rtw_write8(adapter, REG_TDECTRL + 2, reg | BIT(0));
+ }
+
+ /****************************************************************************
+@@ -6002,7 +6016,8 @@ static void rtw_set_bssid(struct adapter *adapter, u8 *bssid)
+ static void mlme_join(struct adapter *adapter, int type)
+ {
+ struct mlme_priv *mlmepriv = &adapter->mlmepriv;
+- u8 retry_limit = 0x30;
++ u8 retry_limit = 0x30, reg;
++ int res;
+
+ switch (type) {
+ case 0:
+@@ -6027,7 +6042,11 @@ static void mlme_join(struct adapter *adapter, int type)
+ case 2:
+ /* sta add event call back */
+ /* enable update TSF */
+- rtw_write8(adapter, REG_BCN_CTRL, rtw_read8(adapter, REG_BCN_CTRL) & (~BIT(4)));
++ res = rtw_read8(adapter, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(adapter, REG_BCN_CTRL, reg & (~BIT(4)));
+
+ if (check_fwstate(mlmepriv, WIFI_ADHOC_STATE | WIFI_ADHOC_MASTER_STATE))
+ retry_limit = 0x7;
+@@ -6748,6 +6767,9 @@ void mlmeext_sta_add_event_callback(struct adapter *padapter, struct sta_info *p
+
+ static void mlme_disconnect(struct adapter *adapter)
+ {
++ int res;
++ u8 reg;
++
+ /* Set RCR to not to receive data frame when NO LINK state */
+ /* reject all data frames */
+ rtw_write16(adapter, REG_RXFLTMAP2, 0x00);
+@@ -6756,7 +6778,12 @@ static void mlme_disconnect(struct adapter *adapter)
+ rtw_write8(adapter, REG_DUAL_TSF_RST, (BIT(0) | BIT(1)));
+
+ /* disable update TSF */
+- rtw_write8(adapter, REG_BCN_CTRL, rtw_read8(adapter, REG_BCN_CTRL) | BIT(4));
++
++ res = rtw_read8(adapter, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(adapter, REG_BCN_CTRL, reg | BIT(4));
+ }
+
+ void mlmeext_sta_del_event_callback(struct adapter *padapter)
+@@ -6810,14 +6837,15 @@ static u8 chk_ap_is_alive(struct sta_info *psta)
+ return ret;
+ }
+
+-static void rtl8188e_sreset_linked_status_check(struct adapter *padapter)
++static int rtl8188e_sreset_linked_status_check(struct adapter *padapter)
+ {
+ u32 rx_dma_status = rtw_read32(padapter, REG_RXDMA_STATUS);
++ u8 reg;
+
+ if (rx_dma_status != 0x00)
+ rtw_write32(padapter, REG_RXDMA_STATUS, rx_dma_status);
+
+- rtw_read8(padapter, REG_FMETHR);
++ return rtw_read8(padapter, REG_FMETHR, ®);
+ }
+
+ void linked_status_chk(struct adapter *padapter)
+@@ -7219,6 +7247,7 @@ u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+ struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)(&pmlmeinfo->network);
+ u8 val8;
++ int res;
+
+ if (is_client_associated_to_ap(padapter))
+ issue_deauth_ex(padapter, pnetwork->MacAddress, WLAN_REASON_DEAUTH_LEAVING, param->deauth_timeout_ms / 100, 100);
+@@ -7231,7 +7260,10 @@ u8 disconnect_hdl(struct adapter *padapter, unsigned char *pbuf)
+
+ if (((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE)) {
+ /* Stop BCN */
+- val8 = rtw_read8(padapter, REG_BCN_CTRL);
++ res = rtw_read8(padapter, REG_BCN_CTRL, &val8);
++ if (res)
++ return H2C_DROPPED;
++
+ rtw_write8(padapter, REG_BCN_CTRL, val8 & (~(EN_BCN_FUNCTION | EN_TXBCN_RPT)));
+ }
+
+diff --git a/drivers/staging/r8188eu/core/rtw_wlan_util.c b/drivers/staging/r8188eu/core/rtw_wlan_util.c
+index 392a65783f32..9bd059b86d0c 100644
+--- a/drivers/staging/r8188eu/core/rtw_wlan_util.c
++++ b/drivers/staging/r8188eu/core/rtw_wlan_util.c
+@@ -279,8 +279,13 @@ void Restore_DM_Func_Flag(struct adapter *padapter)
+ void Set_MSR(struct adapter *padapter, u8 type)
+ {
+ u8 val8;
++ int res;
+
+- val8 = rtw_read8(padapter, MSR) & 0x0c;
++ res = rtw_read8(padapter, MSR, &val8);
++ if (res)
++ return;
++
++ val8 &= 0x0c;
+ val8 |= type;
+ rtw_write8(padapter, MSR, val8);
+ }
+@@ -505,7 +510,11 @@ int WMM_param_handler(struct adapter *padapter, struct ndis_802_11_var_ie *pIE)
+
+ static void set_acm_ctrl(struct adapter *adapter, u8 acm_mask)
+ {
+- u8 acmctrl = rtw_read8(adapter, REG_ACMHWCTRL);
++ u8 acmctrl;
++ int res = rtw_read8(adapter, REG_ACMHWCTRL, &acmctrl);
++
++ if (res)
++ return;
+
+ if (acm_mask > 1)
+ acmctrl = acmctrl | 0x1;
+@@ -765,6 +774,7 @@ void HT_info_handler(struct adapter *padapter, struct ndis_802_11_var_ie *pIE)
+ static void set_min_ampdu_spacing(struct adapter *adapter, u8 spacing)
+ {
+ u8 sec_spacing;
++ int res;
+
+ if (spacing <= 7) {
+ switch (adapter->securitypriv.dot11PrivacyAlgrthm) {
+@@ -786,8 +796,12 @@ static void set_min_ampdu_spacing(struct adapter *adapter, u8 spacing)
+ if (spacing < sec_spacing)
+ spacing = sec_spacing;
+
++ res = rtw_read8(adapter, REG_AMPDU_MIN_SPACE, &sec_spacing);
++ if (res)
++ return;
++
+ rtw_write8(adapter, REG_AMPDU_MIN_SPACE,
+- (rtw_read8(adapter, REG_AMPDU_MIN_SPACE) & 0xf8) | spacing);
++ (sec_spacing & 0xf8) | spacing);
+ }
+ }
+
+diff --git a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c
+index b944c8071a3b..a5b7980dfcee 100644
+--- a/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c
++++ b/drivers/staging/r8188eu/hal/HalPhyRf_8188e.c
+@@ -463,6 +463,7 @@ void _PHY_SaveADDARegisters(struct adapter *adapt, u32 *ADDAReg, u32 *ADDABackup
+ }
+ }
+
++/* FIXME: return an error to caller */
+ static void _PHY_SaveMACRegisters(
+ struct adapter *adapt,
+ u32 *MACReg,
+@@ -470,9 +471,17 @@ static void _PHY_SaveMACRegisters(
+ )
+ {
+ u32 i;
++ int res;
+
+- for (i = 0; i < (IQK_MAC_REG_NUM - 1); i++)
+- MACBackup[i] = rtw_read8(adapt, MACReg[i]);
++ for (i = 0; i < (IQK_MAC_REG_NUM - 1); i++) {
++ u8 reg;
++
++ res = rtw_read8(adapt, MACReg[i], ®);
++ if (res)
++ return;
++
++ MACBackup[i] = reg;
++ }
+
+ MACBackup[i] = rtw_read32(adapt, MACReg[i]);
+ }
+@@ -739,9 +748,12 @@ static void phy_LCCalibrate_8188E(struct adapter *adapt)
+ {
+ u8 tmpreg;
+ u32 RF_Amode = 0, LC_Cal;
++ int res;
+
+ /* Check continuous TX and Packet TX */
+- tmpreg = rtw_read8(adapt, 0xd03);
++ res = rtw_read8(adapt, 0xd03, &tmpreg);
++ if (res)
++ return;
+
+ if ((tmpreg & 0x70) != 0) /* Deal with contisuous TX case */
+ rtw_write8(adapt, 0xd03, tmpreg & 0x8F); /* disable all continuous TX */
+diff --git a/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c b/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c
+index 150ea380c39e..4a4563b900b3 100644
+--- a/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c
++++ b/drivers/staging/r8188eu/hal/HalPwrSeqCmd.c
+@@ -12,6 +12,7 @@ u8 HalPwrSeqCmdParsing(struct adapter *padapter, struct wl_pwr_cfg pwrseqcmd[])
+ u32 offset = 0;
+ u32 poll_count = 0; /* polling autoload done. */
+ u32 max_poll_count = 5000;
++ int res;
+
+ do {
+ pwrcfgcmd = pwrseqcmd[aryidx];
+@@ -21,7 +22,9 @@ u8 HalPwrSeqCmdParsing(struct adapter *padapter, struct wl_pwr_cfg pwrseqcmd[])
+ offset = GET_PWR_CFG_OFFSET(pwrcfgcmd);
+
+ /* Read the value from system register */
+- value = rtw_read8(padapter, offset);
++ res = rtw_read8(padapter, offset, &value);
++ if (res)
++ return false;
+
+ value &= ~(GET_PWR_CFG_MASK(pwrcfgcmd));
+ value |= (GET_PWR_CFG_VALUE(pwrcfgcmd) & GET_PWR_CFG_MASK(pwrcfgcmd));
+@@ -33,7 +36,9 @@ u8 HalPwrSeqCmdParsing(struct adapter *padapter, struct wl_pwr_cfg pwrseqcmd[])
+ poll_bit = false;
+ offset = GET_PWR_CFG_OFFSET(pwrcfgcmd);
+ do {
+- value = rtw_read8(padapter, offset);
++ res = rtw_read8(padapter, offset, &value);
++ if (res)
++ return false;
+
+ value &= GET_PWR_CFG_MASK(pwrcfgcmd);
+ if (value == (GET_PWR_CFG_VALUE(pwrcfgcmd) & GET_PWR_CFG_MASK(pwrcfgcmd)))
+diff --git a/drivers/staging/r8188eu/hal/hal_com.c b/drivers/staging/r8188eu/hal/hal_com.c
+index 910cc07f656c..e9a32dd84a8e 100644
+--- a/drivers/staging/r8188eu/hal/hal_com.c
++++ b/drivers/staging/r8188eu/hal/hal_com.c
+@@ -303,7 +303,9 @@ s32 c2h_evt_read(struct adapter *adapter, u8 *buf)
+ if (!buf)
+ goto exit;
+
+- trigger = rtw_read8(adapter, REG_C2HEVT_CLEAR);
++ ret = rtw_read8(adapter, REG_C2HEVT_CLEAR, &trigger);
++ if (ret)
++ return _FAIL;
+
+ if (trigger == C2H_EVT_HOST_CLOSE)
+ goto exit; /* Not ready */
+@@ -314,13 +316,26 @@ s32 c2h_evt_read(struct adapter *adapter, u8 *buf)
+
+ memset(c2h_evt, 0, 16);
+
+- *buf = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL);
+- *(buf + 1) = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + 1);
++ ret = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL, buf);
++ if (ret) {
++ ret = _FAIL;
++ goto clear_evt;
++ }
+
++ ret = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL + 1, buf + 1);
++ if (ret) {
++ ret = _FAIL;
++ goto clear_evt;
++ }
+ /* Read the content */
+- for (i = 0; i < c2h_evt->plen; i++)
+- c2h_evt->payload[i] = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL +
+- sizeof(*c2h_evt) + i);
++ for (i = 0; i < c2h_evt->plen; i++) {
++ ret = rtw_read8(adapter, REG_C2HEVT_MSG_NORMAL +
++ sizeof(*c2h_evt) + i, c2h_evt->payload + i);
++ if (ret) {
++ ret = _FAIL;
++ goto clear_evt;
++ }
++ }
+
+ ret = _SUCCESS;
+
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_cmd.c b/drivers/staging/r8188eu/hal/rtl8188e_cmd.c
+index 475650dc7301..b01ee1695fee 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_cmd.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_cmd.c
+@@ -18,13 +18,18 @@
+
+ static u8 _is_fw_read_cmd_down(struct adapter *adapt, u8 msgbox_num)
+ {
+- u8 read_down = false;
++ u8 read_down = false, reg;
+ int retry_cnts = 100;
++ int res;
+
+ u8 valid;
+
+ do {
+- valid = rtw_read8(adapt, REG_HMETFR) & BIT(msgbox_num);
++ res = rtw_read8(adapt, REG_HMETFR, ®);
++ if (res)
++ continue;
++
++ valid = reg & BIT(msgbox_num);
+ if (0 == valid)
+ read_down = true;
+ } while ((!read_down) && (retry_cnts--));
+@@ -533,6 +538,8 @@ void rtl8188e_set_FwJoinBssReport_cmd(struct adapter *adapt, u8 mstatus)
+ bool bcn_valid = false;
+ u8 DLBcnCount = 0;
+ u32 poll = 0;
++ u8 reg;
++ int res;
+
+ if (mstatus == 1) {
+ /* We should set AID, correct TSF, HW seq enable before set JoinBssReport to Fw in 88/92C. */
+@@ -547,8 +554,17 @@ void rtl8188e_set_FwJoinBssReport_cmd(struct adapter *adapt, u8 mstatus)
+ /* Disable Hw protection for a time which revserd for Hw sending beacon. */
+ /* Fix download reserved page packet fail that access collision with the protection time. */
+ /* 2010.05.11. Added by tynli. */
+- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) & (~BIT(3)));
+- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) | BIT(4));
++ res = rtw_read8(adapt, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(adapt, REG_BCN_CTRL, reg & (~BIT(3)));
++
++ res = rtw_read8(adapt, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(adapt, REG_BCN_CTRL, reg | BIT(4));
+
+ if (haldata->RegFwHwTxQCtrl & BIT(6))
+ bSendBeacon = true;
+@@ -581,8 +597,17 @@ void rtl8188e_set_FwJoinBssReport_cmd(struct adapter *adapt, u8 mstatus)
+ /* */
+
+ /* Enable Bcn */
+- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) | BIT(3));
+- rtw_write8(adapt, REG_BCN_CTRL, rtw_read8(adapt, REG_BCN_CTRL) & (~BIT(4)));
++ res = rtw_read8(adapt, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(adapt, REG_BCN_CTRL, reg | BIT(3));
++
++ res = rtw_read8(adapt, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(adapt, REG_BCN_CTRL, reg & (~BIT(4)));
+
+ /* To make sure that if there exists an adapter which would like to send beacon. */
+ /* If exists, the origianl value of 0x422[6] will be 1, we should check this to */
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_dm.c b/drivers/staging/r8188eu/hal/rtl8188e_dm.c
+index 6d28e3dc0d26..0399872c4546 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_dm.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_dm.c
+@@ -12,8 +12,12 @@
+ static void dm_InitGPIOSetting(struct adapter *Adapter)
+ {
+ u8 tmp1byte;
++ int res;
++
++ res = rtw_read8(Adapter, REG_GPIO_MUXCFG, &tmp1byte);
++ if (res)
++ return;
+
+- tmp1byte = rtw_read8(Adapter, REG_GPIO_MUXCFG);
+ tmp1byte &= (GPIOSEL_GPIO | ~GPIOSEL_ENBT);
+
+ rtw_write8(Adapter, REG_GPIO_MUXCFG, tmp1byte);
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+index e17375a74f17..e67ecbd1ba79 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_hal_init.c
+@@ -13,10 +13,14 @@
+ static void iol_mode_enable(struct adapter *padapter, u8 enable)
+ {
+ u8 reg_0xf0 = 0;
++ int res;
+
+ if (enable) {
+ /* Enable initial offload */
+- reg_0xf0 = rtw_read8(padapter, REG_SYS_CFG);
++ res = rtw_read8(padapter, REG_SYS_CFG, ®_0xf0);
++ if (res)
++ return;
++
+ rtw_write8(padapter, REG_SYS_CFG, reg_0xf0 | SW_OFFLOAD_EN);
+
+ if (!padapter->bFWReady)
+@@ -24,7 +28,10 @@ static void iol_mode_enable(struct adapter *padapter, u8 enable)
+
+ } else {
+ /* disable initial offload */
+- reg_0xf0 = rtw_read8(padapter, REG_SYS_CFG);
++ res = rtw_read8(padapter, REG_SYS_CFG, ®_0xf0);
++ if (res)
++ return;
++
+ rtw_write8(padapter, REG_SYS_CFG, reg_0xf0 & ~SW_OFFLOAD_EN);
+ }
+ }
+@@ -34,17 +41,31 @@ static s32 iol_execute(struct adapter *padapter, u8 control)
+ s32 status = _FAIL;
+ u8 reg_0x88 = 0;
+ unsigned long timeout;
++ int res;
+
+ control = control & 0x0f;
+- reg_0x88 = rtw_read8(padapter, REG_HMEBOX_E0);
++ res = rtw_read8(padapter, REG_HMEBOX_E0, ®_0x88);
++ if (res)
++ return _FAIL;
++
+ rtw_write8(padapter, REG_HMEBOX_E0, reg_0x88 | control);
+
+ timeout = jiffies + msecs_to_jiffies(1000);
+- while ((reg_0x88 = rtw_read8(padapter, REG_HMEBOX_E0)) & control &&
+- time_before(jiffies, timeout))
+- ;
+
+- reg_0x88 = rtw_read8(padapter, REG_HMEBOX_E0);
++ do {
++ res = rtw_read8(padapter, REG_HMEBOX_E0, ®_0x88);
++ if (res)
++ continue;
++
++ if (!(reg_0x88 & control))
++ break;
++
++ } while (time_before(jiffies, timeout));
++
++ res = rtw_read8(padapter, REG_HMEBOX_E0, ®_0x88);
++ if (res)
++ return _FAIL;
++
+ status = (reg_0x88 & control) ? _FAIL : _SUCCESS;
+ if (reg_0x88 & control << 4)
+ status = _FAIL;
+@@ -190,13 +211,18 @@ static void efuse_read_phymap_from_txpktbuf(
+ u16 dbg_addr = 0;
+ __le32 lo32 = 0, hi32 = 0;
+ u16 len = 0, count = 0;
+- int i = 0;
++ int i = 0, res;
+ u16 limit = *size;
+-
++ u8 reg;
+ u8 *pos = content;
+
+- if (bcnhead < 0) /* if not valid */
+- bcnhead = rtw_read8(adapter, REG_TDECTRL + 1);
++ if (bcnhead < 0) { /* if not valid */
++ res = rtw_read8(adapter, REG_TDECTRL + 1, ®);
++ if (res)
++ return;
++
++ bcnhead = reg;
++ }
+
+ rtw_write8(adapter, REG_PKT_BUFF_ACCESS_CTRL, TXPKT_BUF_SELECT);
+
+@@ -207,8 +233,16 @@ static void efuse_read_phymap_from_txpktbuf(
+
+ rtw_write8(adapter, REG_TXPKTBUF_DBG, 0);
+ timeout = jiffies + msecs_to_jiffies(1000);
+- while (!rtw_read8(adapter, REG_TXPKTBUF_DBG) && time_before(jiffies, timeout))
++ do {
++ res = rtw_read8(adapter, REG_TXPKTBUF_DBG, ®);
++ if (res)
++ continue;
++
++ if (reg)
++ break;
++
+ rtw_usleep_os(100);
++ } while (time_before(jiffies, timeout));
+
+ /* data from EEPROM needs to be in LE */
+ lo32 = cpu_to_le32(rtw_read32(adapter, REG_PKTBUF_DBG_DATA_L));
+@@ -525,10 +559,17 @@ void rtl8188e_SetHalODMVar(struct adapter *Adapter, void *pValue1, bool bSet)
+
+ void hal_notch_filter_8188e(struct adapter *adapter, bool enable)
+ {
++ int res;
++ u8 reg;
++
++ res = rtw_read8(adapter, rOFDM0_RxDSP + 1, ®);
++ if (res)
++ return;
++
+ if (enable)
+- rtw_write8(adapter, rOFDM0_RxDSP + 1, rtw_read8(adapter, rOFDM0_RxDSP + 1) | BIT(1));
++ rtw_write8(adapter, rOFDM0_RxDSP + 1, reg | BIT(1));
+ else
+- rtw_write8(adapter, rOFDM0_RxDSP + 1, rtw_read8(adapter, rOFDM0_RxDSP + 1) & ~BIT(1));
++ rtw_write8(adapter, rOFDM0_RxDSP + 1, reg & ~BIT(1));
+ }
+
+ /* */
+diff --git a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
+index 4864dafd887b..985339a974fc 100644
+--- a/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
++++ b/drivers/staging/r8188eu/hal/rtl8188e_phycfg.c
+@@ -594,6 +594,7 @@ _PHY_SetBWMode92C(
+ struct hal_data_8188e *pHalData = &Adapter->haldata;
+ u8 regBwOpMode;
+ u8 regRRSR_RSC;
++ int res;
+
+ if (Adapter->bDriverStopped)
+ return;
+@@ -602,8 +603,13 @@ _PHY_SetBWMode92C(
+ /* 3<1>Set MAC register */
+ /* 3 */
+
+- regBwOpMode = rtw_read8(Adapter, REG_BWOPMODE);
+- regRRSR_RSC = rtw_read8(Adapter, REG_RRSR + 2);
++ res = rtw_read8(Adapter, REG_BWOPMODE, ®BwOpMode);
++ if (res)
++ return;
++
++ res = rtw_read8(Adapter, REG_RRSR + 2, ®RRSR_RSC);
++ if (res)
++ return;
+
+ switch (pHalData->CurrentChannelBW) {
+ case HT_CHANNEL_WIDTH_20:
+diff --git a/drivers/staging/r8188eu/hal/usb_halinit.c b/drivers/staging/r8188eu/hal/usb_halinit.c
+index a217272a07f8..01422d548748 100644
+--- a/drivers/staging/r8188eu/hal/usb_halinit.c
++++ b/drivers/staging/r8188eu/hal/usb_halinit.c
+@@ -81,6 +81,7 @@ static void _InitInterrupt(struct adapter *Adapter)
+ {
+ u32 imr, imr_ex;
+ u8 usb_opt;
++ int res;
+
+ /* HISR write one to clear */
+ rtw_write32(Adapter, REG_HISR_88E, 0xFFFFFFFF);
+@@ -94,7 +95,9 @@ static void _InitInterrupt(struct adapter *Adapter)
+ /* REG_USB_SPECIAL_OPTION - BIT(4) */
+ /* 0; Use interrupt endpoint to upload interrupt pkt */
+ /* 1; Use bulk endpoint to upload interrupt pkt, */
+- usb_opt = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION);
++ res = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION, &usb_opt);
++ if (res)
++ return;
+
+ if (adapter_to_dvobj(Adapter)->pusbdev->speed == USB_SPEED_HIGH)
+ usb_opt = usb_opt | (INT_BULK_SEL);
+@@ -363,8 +366,12 @@ static void _InitEDCA(struct adapter *Adapter)
+ static void _InitRetryFunction(struct adapter *Adapter)
+ {
+ u8 value8;
++ int res;
++
++ res = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL, &value8);
++ if (res)
++ return;
+
+- value8 = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL);
+ value8 |= EN_AMPDU_RTY_NEW;
+ rtw_write8(Adapter, REG_FWHW_TXQ_CTRL, value8);
+
+@@ -423,9 +430,15 @@ usb_AggSettingRxUpdate(
+ {
+ u8 valueDMA;
+ u8 valueUSB;
++ int res;
+
+- valueDMA = rtw_read8(Adapter, REG_TRXDMA_CTRL);
+- valueUSB = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION);
++ res = rtw_read8(Adapter, REG_TRXDMA_CTRL, &valueDMA);
++ if (res)
++ return;
++
++ res = rtw_read8(Adapter, REG_USB_SPECIAL_OPTION, &valueUSB);
++ if (res)
++ return;
+
+ valueDMA |= RXDMA_AGG_EN;
+ valueUSB &= ~USB_AGG_EN;
+@@ -446,9 +459,11 @@ static void InitUsbAggregationSetting(struct adapter *Adapter)
+ usb_AggSettingRxUpdate(Adapter);
+ }
+
+-static void _InitBeaconParameters(struct adapter *Adapter)
++/* FIXME: add error handling in callers */
++static int _InitBeaconParameters(struct adapter *Adapter)
+ {
+ struct hal_data_8188e *haldata = &Adapter->haldata;
++ int res;
+
+ rtw_write16(Adapter, REG_BCN_CTRL, 0x1010);
+
+@@ -461,9 +476,19 @@ static void _InitBeaconParameters(struct adapter *Adapter)
+ /* beacause test chip does not contension before sending beacon. by tynli. 2009.11.03 */
+ rtw_write16(Adapter, REG_BCNTCFG, 0x660F);
+
+- haldata->RegFwHwTxQCtrl = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL + 2);
+- haldata->RegReg542 = rtw_read8(Adapter, REG_TBTT_PROHIBIT + 2);
+- haldata->RegCR_1 = rtw_read8(Adapter, REG_CR + 1);
++ res = rtw_read8(Adapter, REG_FWHW_TXQ_CTRL + 2, &haldata->RegFwHwTxQCtrl);
++ if (res)
++ return res;
++
++ res = rtw_read8(Adapter, REG_TBTT_PROHIBIT + 2, &haldata->RegReg542);
++ if (res)
++ return res;
++
++ res = rtw_read8(Adapter, REG_CR + 1, &haldata->RegCR_1);
++ if (res)
++ return res;
++
++ return 0;
+ }
+
+ static void _BeaconFunctionEnable(struct adapter *Adapter,
+@@ -514,6 +539,7 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter)
+ u16 value16;
+ u8 txpktbuf_bndy;
+ u32 status = _SUCCESS;
++ int res;
+ struct hal_data_8188e *haldata = &Adapter->haldata;
+ struct pwrctrl_priv *pwrctrlpriv = &Adapter->pwrctrlpriv;
+ struct registry_priv *pregistrypriv = &Adapter->registrypriv;
+@@ -620,7 +646,10 @@ u32 rtl8188eu_hal_init(struct adapter *Adapter)
+
+ /* Enable TX Report */
+ /* Enable Tx Report Timer */
+- value8 = rtw_read8(Adapter, REG_TX_RPT_CTRL);
++ res = rtw_read8(Adapter, REG_TX_RPT_CTRL, &value8);
++ if (res)
++ return _FAIL;
++
+ rtw_write8(Adapter, REG_TX_RPT_CTRL, (value8 | BIT(1) | BIT(0)));
+ /* Set MAX RPT MACID */
+ rtw_write8(Adapter, REG_TX_RPT_CTRL + 1, 2);/* FOR sta mode ,0: bc/mc ,1:AP */
+@@ -714,9 +743,13 @@ static void CardDisableRTL8188EU(struct adapter *Adapter)
+ {
+ u8 val8;
+ struct hal_data_8188e *haldata = &Adapter->haldata;
++ int res;
+
+ /* Stop Tx Report Timer. 0x4EC[Bit1]=b'0 */
+- val8 = rtw_read8(Adapter, REG_TX_RPT_CTRL);
++ res = rtw_read8(Adapter, REG_TX_RPT_CTRL, &val8);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, REG_TX_RPT_CTRL, val8 & (~BIT(1)));
+
+ /* stop rx */
+@@ -727,10 +760,16 @@ static void CardDisableRTL8188EU(struct adapter *Adapter)
+
+ /* 2. 0x1F[7:0] = 0 turn off RF */
+
+- val8 = rtw_read8(Adapter, REG_MCUFWDL);
++ res = rtw_read8(Adapter, REG_MCUFWDL, &val8);
++ if (res)
++ return;
++
+ if ((val8 & RAM_DL_SEL) && Adapter->bFWReady) { /* 8051 RAM code */
+ /* Reset MCU 0x2[10]=0. */
+- val8 = rtw_read8(Adapter, REG_SYS_FUNC_EN + 1);
++ res = rtw_read8(Adapter, REG_SYS_FUNC_EN + 1, &val8);
++ if (res)
++ return;
++
+ val8 &= ~BIT(2); /* 0x2[10], FEN_CPUEN */
+ rtw_write8(Adapter, REG_SYS_FUNC_EN + 1, val8);
+ }
+@@ -740,26 +779,45 @@ static void CardDisableRTL8188EU(struct adapter *Adapter)
+
+ /* YJ,add,111212 */
+ /* Disable 32k */
+- val8 = rtw_read8(Adapter, REG_32K_CTRL);
++ res = rtw_read8(Adapter, REG_32K_CTRL, &val8);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, REG_32K_CTRL, val8 & (~BIT(0)));
+
+ /* Card disable power action flow */
+ HalPwrSeqCmdParsing(Adapter, Rtl8188E_NIC_DISABLE_FLOW);
+
+ /* Reset MCU IO Wrapper */
+- val8 = rtw_read8(Adapter, REG_RSV_CTRL + 1);
++ res = rtw_read8(Adapter, REG_RSV_CTRL + 1, &val8);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, REG_RSV_CTRL + 1, (val8 & (~BIT(3))));
+- val8 = rtw_read8(Adapter, REG_RSV_CTRL + 1);
++
++ res = rtw_read8(Adapter, REG_RSV_CTRL + 1, &val8);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, REG_RSV_CTRL + 1, val8 | BIT(3));
+
+ /* YJ,test add, 111207. For Power Consumption. */
+- val8 = rtw_read8(Adapter, GPIO_IN);
++ res = rtw_read8(Adapter, GPIO_IN, &val8);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, GPIO_OUT, val8);
+ rtw_write8(Adapter, GPIO_IO_SEL, 0xFF);/* Reg0x46 */
+
+- val8 = rtw_read8(Adapter, REG_GPIO_IO_SEL);
++ res = rtw_read8(Adapter, REG_GPIO_IO_SEL, &val8);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, REG_GPIO_IO_SEL, (val8 << 4));
+- val8 = rtw_read8(Adapter, REG_GPIO_IO_SEL + 1);
++ res = rtw_read8(Adapter, REG_GPIO_IO_SEL + 1, &val8);
++ if (res)
++ return;
++
+ rtw_write8(Adapter, REG_GPIO_IO_SEL + 1, val8 | 0x0F);/* Reg0x43 */
+ rtw_write32(Adapter, REG_BB_PAD_CTRL, 0x00080808);/* set LNA ,TRSW,EX_PA Pin to output mode */
+ haldata->bMacPwrCtrlOn = false;
+@@ -830,9 +888,13 @@ void ReadAdapterInfo8188EU(struct adapter *Adapter)
+ struct eeprom_priv *eeprom = &Adapter->eeprompriv;
+ struct led_priv *ledpriv = &Adapter->ledpriv;
+ u8 eeValue;
++ int res;
+
+ /* check system boot selection */
+- eeValue = rtw_read8(Adapter, REG_9346CR);
++ res = rtw_read8(Adapter, REG_9346CR, &eeValue);
++ if (res)
++ return;
++
+ eeprom->EepromOrEfuse = (eeValue & BOOT_FROM_EEPROM);
+ eeprom->bautoload_fail_flag = !(eeValue & EEPROM_EN);
+
+@@ -887,12 +949,21 @@ static void hw_var_set_opmode(struct adapter *Adapter, u8 *val)
+ {
+ u8 val8;
+ u8 mode = *((u8 *)val);
++ int res;
+
+ /* disable Port0 TSF update */
+- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) | BIT(4));
++ res = rtw_read8(Adapter, REG_BCN_CTRL, &val8);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_BCN_CTRL, val8 | BIT(4));
+
+ /* set net_type */
+- val8 = rtw_read8(Adapter, MSR) & 0x0c;
++ res = rtw_read8(Adapter, MSR, &val8);
++ if (res)
++ return;
++
++ val8 &= 0x0c;
+ val8 |= mode;
+ rtw_write8(Adapter, MSR, val8);
+
+@@ -927,14 +998,22 @@ static void hw_var_set_opmode(struct adapter *Adapter, u8 *val)
+ rtw_write8(Adapter, REG_DUAL_TSF_RST, BIT(0));
+
+ /* BIT(3) - If set 0, hw will clr bcnq when tx becon ok/fail or port 0 */
+- rtw_write8(Adapter, REG_MBID_NUM, rtw_read8(Adapter, REG_MBID_NUM) | BIT(3) | BIT(4));
++ res = rtw_read8(Adapter, REG_MBID_NUM, &val8);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_MBID_NUM, val8 | BIT(3) | BIT(4));
+
+ /* enable BCN0 Function for if1 */
+ /* don't enable update TSF0 for if1 (due to TSF update when beacon/probe rsp are received) */
+ rtw_write8(Adapter, REG_BCN_CTRL, (DIS_TSF_UDT0_NORMAL_CHIP | EN_BCN_FUNCTION | BIT(1)));
+
+ /* dis BCN1 ATIM WND if if2 is station */
+- rtw_write8(Adapter, REG_BCN_CTRL_1, rtw_read8(Adapter, REG_BCN_CTRL_1) | BIT(0));
++ res = rtw_read8(Adapter, REG_BCN_CTRL_1, &val8);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_BCN_CTRL_1, val8 | BIT(0));
+ }
+ }
+
+@@ -943,6 +1022,8 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+ struct hal_data_8188e *haldata = &Adapter->haldata;
+ struct dm_priv *pdmpriv = &haldata->dmpriv;
+ struct odm_dm_struct *podmpriv = &haldata->odmpriv;
++ u8 reg;
++ int res;
+
+ switch (variable) {
+ case HW_VAR_SET_OPMODE:
+@@ -970,7 +1051,11 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+ /* Set RRSR rate table. */
+ rtw_write8(Adapter, REG_RRSR, BrateCfg & 0xff);
+ rtw_write8(Adapter, REG_RRSR + 1, (BrateCfg >> 8) & 0xff);
+- rtw_write8(Adapter, REG_RRSR + 2, rtw_read8(Adapter, REG_RRSR + 2) & 0xf0);
++ res = rtw_read8(Adapter, REG_RRSR + 2, ®);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_RRSR + 2, reg & 0xf0);
+
+ /* Set RTS initial rate */
+ while (BrateCfg > 0x1) {
+@@ -994,13 +1079,21 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+ StopTxBeacon(Adapter);
+
+ /* disable related TSF function */
+- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) & (~BIT(3)));
++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(3)));
+
+ rtw_write32(Adapter, REG_TSFTR, tsf);
+ rtw_write32(Adapter, REG_TSFTR + 4, tsf >> 32);
+
+ /* enable related TSF function */
+- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) | BIT(3));
++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_BCN_CTRL, reg | BIT(3));
+
+ if (((pmlmeinfo->state & 0x03) == WIFI_FW_ADHOC_STATE) || ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE))
+ ResumeTxBeacon(Adapter);
+@@ -1016,7 +1109,11 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+ rtw_write16(Adapter, REG_RXFLTMAP2, 0x00);
+
+ /* disable update TSF */
+- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) | BIT(4));
++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_BCN_CTRL, reg | BIT(4));
+ } else { /* sitesurvey done */
+ struct mlme_ext_priv *pmlmeext = &Adapter->mlmeextpriv;
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+@@ -1027,11 +1124,19 @@ void SetHwReg8188EU(struct adapter *Adapter, u8 variable, u8 *val)
+ rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF);
+
+ /* enable update TSF */
+- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) & (~BIT(4)));
++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(4)));
+ } else if ((pmlmeinfo->state & 0x03) == WIFI_FW_AP_STATE) {
+ rtw_write16(Adapter, REG_RXFLTMAP2, 0xFFFF);
+ /* enable update TSF */
+- rtw_write8(Adapter, REG_BCN_CTRL, rtw_read8(Adapter, REG_BCN_CTRL) & (~BIT(4)));
++ res = rtw_read8(Adapter, REG_BCN_CTRL, ®);
++ if (res)
++ return;
++
++ rtw_write8(Adapter, REG_BCN_CTRL, reg & (~BIT(4)));
+ }
+ rtw_write32(Adapter, REG_RCR, rtw_read32(Adapter, REG_RCR) | RCR_CBSSID_BCN);
+ }
+@@ -1190,6 +1295,8 @@ void SetBeaconRelatedRegisters8188EUsb(struct adapter *adapt)
+ struct mlme_ext_priv *pmlmeext = &adapt->mlmeextpriv;
+ struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;
+ u32 bcn_ctrl_reg = REG_BCN_CTRL;
++ int res;
++ u8 reg;
+ /* reset TSF, enable update TSF, correcting TSF On Beacon */
+
+ /* BCN interval */
+@@ -1215,7 +1322,11 @@ void SetBeaconRelatedRegisters8188EUsb(struct adapter *adapt)
+
+ ResumeTxBeacon(adapt);
+
+- rtw_write8(adapt, bcn_ctrl_reg, rtw_read8(adapt, bcn_ctrl_reg) | BIT(1));
++ res = rtw_read8(adapt, bcn_ctrl_reg, ®);
++ if (res)
++ return;
++
++ rtw_write8(adapt, bcn_ctrl_reg, reg | BIT(1));
+ }
+
+ void rtl8188eu_init_default_value(struct adapter *adapt)
+diff --git a/drivers/staging/r8188eu/hal/usb_ops_linux.c b/drivers/staging/r8188eu/hal/usb_ops_linux.c
+index d5e674542a78..f399a7fd8b97 100644
+--- a/drivers/staging/r8188eu/hal/usb_ops_linux.c
++++ b/drivers/staging/r8188eu/hal/usb_ops_linux.c
+@@ -94,16 +94,13 @@ static int usb_write(struct intf_hdl *intf, u16 value, void *data, u8 size)
+ return status;
+ }
+
+-u8 rtw_read8(struct adapter *adapter, u32 addr)
++int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data)
+ {
+ struct io_priv *io_priv = &adapter->iopriv;
+ struct intf_hdl *intf = &io_priv->intf;
+ u16 value = addr & 0xffff;
+- u8 data;
+
+- usb_read(intf, value, &data, 1);
+-
+- return data;
++ return usb_read(intf, value, data, 1);
+ }
+
+ u16 rtw_read16(struct adapter *adapter, u32 addr)
+diff --git a/drivers/staging/r8188eu/include/rtw_io.h b/drivers/staging/r8188eu/include/rtw_io.h
+index 6910e2b430e2..1198d3850a6d 100644
+--- a/drivers/staging/r8188eu/include/rtw_io.h
++++ b/drivers/staging/r8188eu/include/rtw_io.h
+@@ -220,7 +220,7 @@ void unregister_intf_hdl(struct intf_hdl *pintfhdl);
+ void _rtw_attrib_read(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+ void _rtw_attrib_write(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+
+-u8 rtw_read8(struct adapter *adapter, u32 addr);
++int __must_check rtw_read8(struct adapter *adapter, u32 addr, u8 *data);
+ u16 rtw_read16(struct adapter *adapter, u32 addr);
+ u32 rtw_read32(struct adapter *adapter, u32 addr);
+ void _rtw_read_mem(struct adapter *adapter, u32 addr, u32 cnt, u8 *pmem);
+diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+index 8dd280e2739a..19a60d47f7c0 100644
+--- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c
+@@ -3178,6 +3178,7 @@ static void rtw_set_dynamic_functions(struct adapter *adapter, u8 dm_func)
+ {
+ struct hal_data_8188e *haldata = &adapter->haldata;
+ struct odm_dm_struct *odmpriv = &haldata->odmpriv;
++ int res;
+
+ switch (dm_func) {
+ case 0:
+@@ -3193,7 +3194,9 @@ static void rtw_set_dynamic_functions(struct adapter *adapter, u8 dm_func)
+ if (!(odmpriv->SupportAbility & DYNAMIC_BB_DIG)) {
+ struct rtw_dig *digtable = &odmpriv->DM_DigTable;
+
+- digtable->CurIGValue = rtw_read8(adapter, 0xc50);
++ res = rtw_read8(adapter, 0xc50, &digtable->CurIGValue);
++ (void)res;
++ /* FIXME: return an error to caller */
+ }
+ odmpriv->SupportAbility = DYNAMIC_ALL_FUNC_ENABLE;
+ break;
+@@ -3329,8 +3332,9 @@ static int rtw_dbg_port(struct net_device *dev,
+ u16 reg = arg;
+ u16 start_value = 0;
+ u32 write_num = extra_arg;
+- int i;
++ int i, res;
+ struct xmit_frame *xmit_frame;
++ u8 val8;
+
+ xmit_frame = rtw_IOL_accquire_xmit_frame(padapter);
+ if (!xmit_frame) {
+@@ -3343,7 +3347,8 @@ static int rtw_dbg_port(struct net_device *dev,
+ if (rtl8188e_IOL_exec_cmds_sync(padapter, xmit_frame, 5000, 0) != _SUCCESS)
+ ret = -EPERM;
+
+- rtw_read8(padapter, reg);
++ /* FIXME: is this read necessary? */
++ res = rtw_read8(padapter, reg, &val8);
+ }
+ break;
+
+--
+2.35.1
+
--- /dev/null
+From 01161d81b226bd77445ec23ea604114ae29daa4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jun 2022 01:25:14 -0700
+Subject: swiotlb: panic if nslabs is too small
+
+From: Dongli Zhang <dongli.zhang@oracle.com>
+
+[ Upstream commit 0bf28fc40d89b1a3e00d1b79473bad4e9ca20ad1 ]
+
+Panic on purpose if nslabs is too small, in order to sync with the remap
+retry logic.
+
+In addition, print the number of bytes for tlb alloc failure.
+
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/swiotlb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
+index 5830dce6081b..f5304e2f6a35 100644
+--- a/kernel/dma/swiotlb.c
++++ b/kernel/dma/swiotlb.c
+@@ -242,6 +242,9 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
+ if (swiotlb_force_disable)
+ return;
+
++ if (nslabs < IO_TLB_MIN_SLABS)
++ panic("%s: nslabs = %lu too small\n", __func__, nslabs);
++
+ /*
+ * By default allocate the bounce buffer memory from low memory, but
+ * allow to pick a location everywhere for hypervisors with guest
+@@ -254,7 +257,8 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags,
+ else
+ tlb = memblock_alloc_low(bytes, PAGE_SIZE);
+ if (!tlb) {
+- pr_warn("%s: failed to allocate tlb structure\n", __func__);
++ pr_warn("%s: Failed to allocate %zu bytes tlb structure\n",
++ __func__, bytes);
+ return;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From d43bfc9e58a9fbfed27888dac4c59a1db53b906d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 May 2022 13:59:19 +0300
+Subject: thunderbolt: Change downstream router's TMU rate in both TMU
+ uni/bidir mode
+
+From: Gil Fine <gil.fine@intel.com>
+
+[ Upstream commit 5fd6b9a5cbe63fea4c490fee8af34144a139a266 ]
+
+In case of uni-directional time sync, TMU handshake is
+initiated by upstream router. In case of bi-directional
+time sync, TMU handshake is initiated by downstream router.
+In order to handle correctly the case of uni-directional mode,
+we avoid changing the upstream router's rate to off,
+because it might have another downstream router plugged that is set to
+uni-directional mode (and we don't want to change its mode).
+Instead, we always change downstream router's rate.
+
+Signed-off-by: Gil Fine <gil.fine@intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/tmu.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/thunderbolt/tmu.c b/drivers/thunderbolt/tmu.c
+index e4a07a26f693..93ba1d00335b 100644
+--- a/drivers/thunderbolt/tmu.c
++++ b/drivers/thunderbolt/tmu.c
+@@ -359,13 +359,14 @@ int tb_switch_tmu_disable(struct tb_switch *sw)
+ * In case of uni-directional time sync, TMU handshake is
+ * initiated by upstream router. In case of bi-directional
+ * time sync, TMU handshake is initiated by downstream router.
+- * Therefore, we change the rate to off in the respective
+- * router.
++ * We change downstream router's rate to off for both uni/bidir
++ * cases although it is needed only for the bi-directional mode.
++ * We avoid changing upstream router's mode since it might
++ * have another downstream router plugged, that is set to
++ * uni-directional mode and we don't want to change it's TMU
++ * mode.
+ */
+- if (unidirectional)
+- tb_switch_tmu_rate_write(parent, TB_SWITCH_TMU_RATE_OFF);
+- else
+- tb_switch_tmu_rate_write(sw, TB_SWITCH_TMU_RATE_OFF);
++ tb_switch_tmu_rate_write(sw, TB_SWITCH_TMU_RATE_OFF);
+
+ tb_port_tmu_time_sync_disable(up);
+ ret = tb_port_tmu_time_sync_disable(down);
+--
+2.35.1
+
--- /dev/null
+From 39425297fb95155f0923e2fd1b08d2603cd9bc95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jun 2022 14:08:50 +0800
+Subject: tty: serial: Fix refcount leak bug in ucc_uart.c
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit d24d7bb2cd947676f9b71fb944d045e09b8b282f ]
+
+In soc_info(), of_find_node_by_type() will return a node pointer
+with refcount incremented. We should use of_node_put() when it is
+not used anymore.
+
+Acked-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20220618060850.4058525-1-windhl@126.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/ucc_uart.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/ucc_uart.c b/drivers/tty/serial/ucc_uart.c
+index 6000853973c1..3cc9ef08455c 100644
+--- a/drivers/tty/serial/ucc_uart.c
++++ b/drivers/tty/serial/ucc_uart.c
+@@ -1137,6 +1137,8 @@ static unsigned int soc_info(unsigned int *rev_h, unsigned int *rev_l)
+ /* No compatible property, so try the name. */
+ soc_string = np->name;
+
++ of_node_put(np);
++
+ /* Extract the SOC number from the "PowerPC," string */
+ if ((sscanf(soc_string, "PowerPC,%u", &soc) != 1) || !soc)
+ return 0;
+--
+2.35.1
+
--- /dev/null
+From 7b0ea5bcd19ce9935a3539c8344410a2893b25e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Jul 2022 11:48:43 +0800
+Subject: uacce: Handle parent device removal or parent driver module rmmod
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 80fc671bcc0173836e9032b0c698ea74c13b9d7c ]
+
+The uacce driver must deal with a possible removal of the parent device
+or parent driver module rmmod at any time.
+
+Although uacce_remove(), called on device removal and on driver unbind,
+prevents future use of the uacce fops by removing the cdev, fops that
+were called before that point may still be running.
+
+Serialize uacce_fops_open() and uacce_remove() with uacce->mutex.
+Serialize other fops against uacce_remove() with q->mutex.
+Since we need to protect uacce_fops_poll() which gets called on the fast
+path, replace uacce->queues_lock with q->mutex to improve scalability.
+The other fops are only used during setup.
+
+uacce_queue_is_valid(), checked under q->mutex or uacce->mutex, denotes
+whether uacce_remove() has disabled all queues. If that is the case,
+don't go any further since the parent device is being removed and
+uacce->ops should not be called anymore.
+
+Reported-by: Yang Shen <shenyang39@huawei.com>
+Signed-off-by: Zhangfei Gao <zhangfei.gao@linaro.org>
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Link: https://lore.kernel.org/r/20220701034843.7502-1-zhangfei.gao@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/uacce/uacce.c | 133 ++++++++++++++++++++++++-------------
+ include/linux/uacce.h | 6 +-
+ 2 files changed, 91 insertions(+), 48 deletions(-)
+
+diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c
+index 281c54003edc..b70a013139c7 100644
+--- a/drivers/misc/uacce/uacce.c
++++ b/drivers/misc/uacce/uacce.c
+@@ -9,43 +9,38 @@
+
+ static struct class *uacce_class;
+ static dev_t uacce_devt;
+-static DEFINE_MUTEX(uacce_mutex);
+ static DEFINE_XARRAY_ALLOC(uacce_xa);
+
+-static int uacce_start_queue(struct uacce_queue *q)
++/*
++ * If the parent driver or the device disappears, the queue state is invalid and
++ * ops are not usable anymore.
++ */
++static bool uacce_queue_is_valid(struct uacce_queue *q)
+ {
+- int ret = 0;
++ return q->state == UACCE_Q_INIT || q->state == UACCE_Q_STARTED;
++}
+
+- mutex_lock(&uacce_mutex);
++static int uacce_start_queue(struct uacce_queue *q)
++{
++ int ret;
+
+- if (q->state != UACCE_Q_INIT) {
+- ret = -EINVAL;
+- goto out_with_lock;
+- }
++ if (q->state != UACCE_Q_INIT)
++ return -EINVAL;
+
+ if (q->uacce->ops->start_queue) {
+ ret = q->uacce->ops->start_queue(q);
+ if (ret < 0)
+- goto out_with_lock;
++ return ret;
+ }
+
+ q->state = UACCE_Q_STARTED;
+-
+-out_with_lock:
+- mutex_unlock(&uacce_mutex);
+-
+- return ret;
++ return 0;
+ }
+
+ static int uacce_put_queue(struct uacce_queue *q)
+ {
+ struct uacce_device *uacce = q->uacce;
+
+- mutex_lock(&uacce_mutex);
+-
+- if (q->state == UACCE_Q_ZOMBIE)
+- goto out;
+-
+ if ((q->state == UACCE_Q_STARTED) && uacce->ops->stop_queue)
+ uacce->ops->stop_queue(q);
+
+@@ -54,8 +49,6 @@ static int uacce_put_queue(struct uacce_queue *q)
+ uacce->ops->put_queue(q);
+
+ q->state = UACCE_Q_ZOMBIE;
+-out:
+- mutex_unlock(&uacce_mutex);
+
+ return 0;
+ }
+@@ -65,20 +58,36 @@ static long uacce_fops_unl_ioctl(struct file *filep,
+ {
+ struct uacce_queue *q = filep->private_data;
+ struct uacce_device *uacce = q->uacce;
++ long ret = -ENXIO;
++
++ /*
++ * uacce->ops->ioctl() may take the mmap_lock when copying arg to/from
++ * user. Avoid a circular lock dependency with uacce_fops_mmap(), which
++ * gets called with mmap_lock held, by taking uacce->mutex instead of
++ * q->mutex. Doing this in uacce_fops_mmap() is not possible because
++ * uacce_fops_open() calls iommu_sva_bind_device(), which takes
++ * mmap_lock, while holding uacce->mutex.
++ */
++ mutex_lock(&uacce->mutex);
++ if (!uacce_queue_is_valid(q))
++ goto out_unlock;
+
+ switch (cmd) {
+ case UACCE_CMD_START_Q:
+- return uacce_start_queue(q);
+-
++ ret = uacce_start_queue(q);
++ break;
+ case UACCE_CMD_PUT_Q:
+- return uacce_put_queue(q);
+-
++ ret = uacce_put_queue(q);
++ break;
+ default:
+- if (!uacce->ops->ioctl)
+- return -EINVAL;
+-
+- return uacce->ops->ioctl(q, cmd, arg);
++ if (uacce->ops->ioctl)
++ ret = uacce->ops->ioctl(q, cmd, arg);
++ else
++ ret = -EINVAL;
+ }
++out_unlock:
++ mutex_unlock(&uacce->mutex);
++ return ret;
+ }
+
+ #ifdef CONFIG_COMPAT
+@@ -136,6 +145,13 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)
+ if (!q)
+ return -ENOMEM;
+
++ mutex_lock(&uacce->mutex);
++
++ if (!uacce->parent) {
++ ret = -EINVAL;
++ goto out_with_mem;
++ }
++
+ ret = uacce_bind_queue(uacce, q);
+ if (ret)
+ goto out_with_mem;
+@@ -152,10 +168,9 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)
+ filep->private_data = q;
+ uacce->inode = inode;
+ q->state = UACCE_Q_INIT;
+-
+- mutex_lock(&uacce->queues_lock);
++ mutex_init(&q->mutex);
+ list_add(&q->list, &uacce->queues);
+- mutex_unlock(&uacce->queues_lock);
++ mutex_unlock(&uacce->mutex);
+
+ return 0;
+
+@@ -163,18 +178,20 @@ static int uacce_fops_open(struct inode *inode, struct file *filep)
+ uacce_unbind_queue(q);
+ out_with_mem:
+ kfree(q);
++ mutex_unlock(&uacce->mutex);
+ return ret;
+ }
+
+ static int uacce_fops_release(struct inode *inode, struct file *filep)
+ {
+ struct uacce_queue *q = filep->private_data;
++ struct uacce_device *uacce = q->uacce;
+
+- mutex_lock(&q->uacce->queues_lock);
+- list_del(&q->list);
+- mutex_unlock(&q->uacce->queues_lock);
++ mutex_lock(&uacce->mutex);
+ uacce_put_queue(q);
+ uacce_unbind_queue(q);
++ list_del(&q->list);
++ mutex_unlock(&uacce->mutex);
+ kfree(q);
+
+ return 0;
+@@ -217,10 +234,9 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma)
+ vma->vm_private_data = q;
+ qfr->type = type;
+
+- mutex_lock(&uacce_mutex);
+-
+- if (q->state != UACCE_Q_INIT && q->state != UACCE_Q_STARTED) {
+- ret = -EINVAL;
++ mutex_lock(&q->mutex);
++ if (!uacce_queue_is_valid(q)) {
++ ret = -ENXIO;
+ goto out_with_lock;
+ }
+
+@@ -248,12 +264,12 @@ static int uacce_fops_mmap(struct file *filep, struct vm_area_struct *vma)
+ }
+
+ q->qfrs[type] = qfr;
+- mutex_unlock(&uacce_mutex);
++ mutex_unlock(&q->mutex);
+
+ return ret;
+
+ out_with_lock:
+- mutex_unlock(&uacce_mutex);
++ mutex_unlock(&q->mutex);
+ kfree(qfr);
+ return ret;
+ }
+@@ -262,12 +278,20 @@ static __poll_t uacce_fops_poll(struct file *file, poll_table *wait)
+ {
+ struct uacce_queue *q = file->private_data;
+ struct uacce_device *uacce = q->uacce;
++ __poll_t ret = 0;
++
++ mutex_lock(&q->mutex);
++ if (!uacce_queue_is_valid(q))
++ goto out_unlock;
+
+ poll_wait(file, &q->wait, wait);
++
+ if (uacce->ops->is_q_updated && uacce->ops->is_q_updated(q))
+- return EPOLLIN | EPOLLRDNORM;
++ ret = EPOLLIN | EPOLLRDNORM;
+
+- return 0;
++out_unlock:
++ mutex_unlock(&q->mutex);
++ return ret;
+ }
+
+ static const struct file_operations uacce_fops = {
+@@ -450,7 +474,7 @@ struct uacce_device *uacce_alloc(struct device *parent,
+ goto err_with_uacce;
+
+ INIT_LIST_HEAD(&uacce->queues);
+- mutex_init(&uacce->queues_lock);
++ mutex_init(&uacce->mutex);
+ device_initialize(&uacce->dev);
+ uacce->dev.devt = MKDEV(MAJOR(uacce_devt), uacce->dev_id);
+ uacce->dev.class = uacce_class;
+@@ -507,13 +531,23 @@ void uacce_remove(struct uacce_device *uacce)
+ if (uacce->inode)
+ unmap_mapping_range(uacce->inode->i_mapping, 0, 0, 1);
+
++ /*
++ * uacce_fops_open() may be running concurrently, even after we remove
++ * the cdev. Holding uacce->mutex ensures that open() does not obtain a
++ * removed uacce device.
++ */
++ mutex_lock(&uacce->mutex);
+ /* ensure no open queue remains */
+- mutex_lock(&uacce->queues_lock);
+ list_for_each_entry_safe(q, next_q, &uacce->queues, list) {
++ /*
++ * Taking q->mutex ensures that fops do not use the defunct
++ * uacce->ops after the queue is disabled.
++ */
++ mutex_lock(&q->mutex);
+ uacce_put_queue(q);
++ mutex_unlock(&q->mutex);
+ uacce_unbind_queue(q);
+ }
+- mutex_unlock(&uacce->queues_lock);
+
+ /* disable sva now since no opened queues */
+ uacce_disable_sva(uacce);
+@@ -521,6 +555,13 @@ void uacce_remove(struct uacce_device *uacce)
+ if (uacce->cdev)
+ cdev_device_del(uacce->cdev, &uacce->dev);
+ xa_erase(&uacce_xa, uacce->dev_id);
++ /*
++ * uacce exists as long as there are open fds, but ops will be freed
++ * now. Ensure that bugs cause NULL deref rather than use-after-free.
++ */
++ uacce->ops = NULL;
++ uacce->parent = NULL;
++ mutex_unlock(&uacce->mutex);
+ put_device(&uacce->dev);
+ }
+ EXPORT_SYMBOL_GPL(uacce_remove);
+diff --git a/include/linux/uacce.h b/include/linux/uacce.h
+index 48e319f40275..9ce88c28b0a8 100644
+--- a/include/linux/uacce.h
++++ b/include/linux/uacce.h
+@@ -70,6 +70,7 @@ enum uacce_q_state {
+ * @wait: wait queue head
+ * @list: index into uacce queues list
+ * @qfrs: pointer of qfr regions
++ * @mutex: protects queue state
+ * @state: queue state machine
+ * @pasid: pasid associated to the mm
+ * @handle: iommu_sva handle returned by iommu_sva_bind_device()
+@@ -80,6 +81,7 @@ struct uacce_queue {
+ wait_queue_head_t wait;
+ struct list_head list;
+ struct uacce_qfile_region *qfrs[UACCE_MAX_REGION];
++ struct mutex mutex;
+ enum uacce_q_state state;
+ u32 pasid;
+ struct iommu_sva *handle;
+@@ -97,9 +99,9 @@ struct uacce_queue {
+ * @dev_id: id of the uacce device
+ * @cdev: cdev of the uacce
+ * @dev: dev of the uacce
++ * @mutex: protects uacce operation
+ * @priv: private pointer of the uacce
+ * @queues: list of queues
+- * @queues_lock: lock for queues list
+ * @inode: core vfs
+ */
+ struct uacce_device {
+@@ -113,9 +115,9 @@ struct uacce_device {
+ u32 dev_id;
+ struct cdev *cdev;
+ struct device dev;
++ struct mutex mutex;
+ void *priv;
+ struct list_head queues;
+- struct mutex queues_lock;
+ struct inode *inode;
+ };
+
+--
+2.35.1
+
--- /dev/null
+From 97f98578216f72d9450f09284f70404b09d8c88d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jul 2022 13:56:17 +0200
+Subject: um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+[ Upstream commit dda520d07b95072a0b63f6c52a8eb566d08ea897 ]
+
+QEMU has a -no-reboot option, which halts instead of reboots when the
+guest asks to reboot. This is invaluable when used with
+CONFIG_PANIC_TIMEOUT=-1 (and panic_on_warn), because it allows panics
+and warnings to be caught immediately in CI. Implement this in UML too,
+by way of a basic setup param.
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/os-Linux/skas/process.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
+index c316c993a949..b24db6017ded 100644
+--- a/arch/um/os-Linux/skas/process.c
++++ b/arch/um/os-Linux/skas/process.c
+@@ -5,6 +5,7 @@
+ */
+
+ #include <stdlib.h>
++#include <stdbool.h>
+ #include <unistd.h>
+ #include <sched.h>
+ #include <errno.h>
+@@ -707,10 +708,24 @@ void halt_skas(void)
+ UML_LONGJMP(&initial_jmpbuf, INIT_JMP_HALT);
+ }
+
++static bool noreboot;
++
++static int __init noreboot_cmd_param(char *str, int *add)
++{
++ noreboot = true;
++ return 0;
++}
++
++__uml_setup("noreboot", noreboot_cmd_param,
++"noreboot\n"
++" Rather than rebooting, exit always, akin to QEMU's -no-reboot option.\n"
++" This is useful if you're using CONFIG_PANIC_TIMEOUT in order to catch\n"
++" crashes in CI\n");
++
+ void reboot_skas(void)
+ {
+ block_signals_trace();
+- UML_LONGJMP(&initial_jmpbuf, INIT_JMP_REBOOT);
++ UML_LONGJMP(&initial_jmpbuf, noreboot ? INIT_JMP_HALT : INIT_JMP_REBOOT);
+ }
+
+ void __switch_mm(struct mm_id *mm_idp)
+--
+2.35.1
+
--- /dev/null
+From f4c38d80474d65b9c22a01ca408b3bb9a7411674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jun 2022 14:04:30 -0500
+Subject: usb: cdns3 fix use-after-free at workaround 2
+
+From: Frank Li <Frank.Li@nxp.com>
+
+[ Upstream commit 7d602f30149a117eea260208b1661bc404c21dfd ]
+
+BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac
+
+cdns3_wa2_remove_old_request()
+{
+ ...
+ kfree(priv_req->request.buf);
+ cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
+ list_del_init(&priv_req->list);
+ ^^^ use after free
+ ...
+}
+
+cdns3_gadget_ep_free_request() free the space pointed by priv_req,
+but priv_req is used in the following list_del_init().
+
+This patch move list_del_init() before cdns3_gadget_ep_free_request().
+
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Faqiang Zhu <faqiang.zhu@nxp.com>
+Link: https://lore.kernel.org/r/20220608190430.2814358-1-Frank.Li@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/cdns3-gadget.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
+index 87cfa91a758d..d21b69997e75 100644
+--- a/drivers/usb/cdns3/cdns3-gadget.c
++++ b/drivers/usb/cdns3/cdns3-gadget.c
+@@ -625,9 +625,9 @@ static void cdns3_wa2_remove_old_request(struct cdns3_endpoint *priv_ep)
+ trace_cdns3_wa2(priv_ep, "removes eldest request");
+
+ kfree(priv_req->request.buf);
++ list_del_init(&priv_req->list);
+ cdns3_gadget_ep_free_request(&priv_ep->endpoint,
+ &priv_req->request);
+- list_del_init(&priv_req->list);
+ --priv_ep->wa2_counter;
+
+ if (!chain)
+--
+2.35.1
+
--- /dev/null
+From b718ed862c96e079337af7886b21d54f72d9fcbc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jun 2022 18:07:17 +0200
+Subject: usb: dwc2: gadget: remove D+ pull-up while no vbus with
+ usb-role-switch
+
+From: Amelie Delaunay <amelie.delaunay@foss.st.com>
+
+[ Upstream commit db638c6500abaffb8f7770b2a69c40d003d54ae1 ]
+
+When using usb-role-switch, D+ pull-up is set as soon as DTCL_SFTDISCON is
+cleared, whatever the vbus valid signal state is. The pull-up should not
+be set when vbus isn't present (this is determined by the drd controller).
+
+This patch ensures that B-Session (so Peripheral role + vbus valid signal)
+is valid before clearing the DCTL_SFTDISCON bit when role switch is used.
+Keep original behavior when usb-role-switch isn't used.
+
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
+Link: https://lore.kernel.org/r/20220622160717.314580-1-fabrice.gasnier@foss.st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index fe2a58c75861..8b15742d9e8a 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3594,7 +3594,8 @@ void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg)
+ void dwc2_hsotg_core_connect(struct dwc2_hsotg *hsotg)
+ {
+ /* remove the soft-disconnect and let's go */
+- dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON);
++ if (!hsotg->role_sw || (dwc2_readl(hsotg, GOTGCTL) & GOTGCTL_BSESVLD))
++ dwc2_clear_bit(hsotg, DCTL, DCTL_SFTDISCON);
+ }
+
+ /**
+--
+2.35.1
+
--- /dev/null
+From 266578a0c370c45a8f990c996925be042d3dadc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 May 2022 00:38:46 +0200
+Subject: usb: gadget: uvc: calculate the number of request depending on
+ framesize
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+[ Upstream commit 87d76b5f1d8eeb49efa16e2018e188864cbb9401 ]
+
+The current limitation of possible number of requests being handled is
+dependent on the gadget speed. It makes more sense to depend on the
+typical frame size when calculating the number of requests. This patch
+is changing this and is using the previous limits as boundaries for
+reasonable minimum and maximum number of requests.
+
+For a 1080p jpeg encoded video stream with a maximum imagesize of
+e.g. 800kB with a maxburst of 8 and an multiplier of 1 the resulting
+number of requests is calculated to 49.
+
+ 800768 1
+nreqs = ------ * -------------- ~= 49
+ 2 (1024 * 8 * 1)
+
+Tested-by: Dan Vacura <w36195@motorola.com>
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Link: https://lore.kernel.org/r/20220529223848.105914-2-m.grzeschik@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_queue.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_queue.c b/drivers/usb/gadget/function/uvc_queue.c
+index 951934aa4454..ec500ee499ee 100644
+--- a/drivers/usb/gadget/function/uvc_queue.c
++++ b/drivers/usb/gadget/function/uvc_queue.c
+@@ -44,7 +44,8 @@ static int uvc_queue_setup(struct vb2_queue *vq,
+ {
+ struct uvc_video_queue *queue = vb2_get_drv_priv(vq);
+ struct uvc_video *video = container_of(queue, struct uvc_video, queue);
+- struct usb_composite_dev *cdev = video->uvc->func.config->cdev;
++ unsigned int req_size;
++ unsigned int nreq;
+
+ if (*nbuffers > UVC_MAX_VIDEO_BUFFERS)
+ *nbuffers = UVC_MAX_VIDEO_BUFFERS;
+@@ -53,10 +54,16 @@ static int uvc_queue_setup(struct vb2_queue *vq,
+
+ sizes[0] = video->imagesize;
+
+- if (cdev->gadget->speed < USB_SPEED_SUPER)
+- video->uvc_num_requests = 4;
+- else
+- video->uvc_num_requests = 64;
++ req_size = video->ep->maxpacket
++ * max_t(unsigned int, video->ep->maxburst, 1)
++ * (video->ep->mult);
++
++ /* We divide by two, to increase the chance to run
++ * into fewer requests for smaller framesizes.
++ */
++ nreq = DIV_ROUND_UP(DIV_ROUND_UP(sizes[0], 2), req_size);
++ nreq = clamp(nreq, 4U, 64U);
++ video->uvc_num_requests = nreq;
+
+ return 0;
+ }
+--
+2.35.1
+
--- /dev/null
+From dba1f28d1110dc373240fa3b5a10bbbe83743f3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 May 2022 00:38:48 +0200
+Subject: usb: gadget: uvc: call uvc uvcg_warn on completed status instead of
+ uvcg_info
+
+From: Michael Grzeschik <m.grzeschik@pengutronix.de>
+
+[ Upstream commit a725d0f6dfc5d3739d6499f30ec865305ba3544d ]
+
+Likewise to the uvcvideo hostside driver, this patch is changing the
+usb_request message of an non zero completion handler call from dev_info
+to dev_warn.
+
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
+Link: https://lore.kernel.org/r/20220529223848.105914-4-m.grzeschik@pengutronix.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/uvc_video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
+index ce421d9cc241..c00ce0e91f5d 100644
+--- a/drivers/usb/gadget/function/uvc_video.c
++++ b/drivers/usb/gadget/function/uvc_video.c
+@@ -261,7 +261,7 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
+ break;
+
+ default:
+- uvcg_info(&video->uvc->func,
++ uvcg_warn(&video->uvc->func,
+ "VS request completed with status %d.\n",
+ req->status);
+ uvcg_queue_cancel(queue, 0);
+--
+2.35.1
+
--- /dev/null
+From d5bf0b8fb165c7fbd8e50ecf1e8eb985a735fa79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jun 2022 11:46:37 +0800
+Subject: usb: host: ohci-ppc-of: Fix refcount leak bug
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 40a959d7042bb7711e404ad2318b30e9f92c6b9b ]
+
+In ohci_hcd_ppc_of_probe(), of_find_compatible_node() will return
+a node pointer with refcount incremented. We should use of_node_put()
+when it is not used anymore.
+
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20220617034637.4003115-1-windhl@126.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ohci-ppc-of.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/host/ohci-ppc-of.c b/drivers/usb/host/ohci-ppc-of.c
+index 1960b8dfdba5..591f675cc930 100644
+--- a/drivers/usb/host/ohci-ppc-of.c
++++ b/drivers/usb/host/ohci-ppc-of.c
+@@ -166,6 +166,7 @@ static int ohci_hcd_ppc_of_probe(struct platform_device *op)
+ release_mem_region(res.start, 0x4);
+ } else
+ pr_debug("%s: cannot get ehci offset from fdt\n", __FILE__);
++ of_node_put(np);
+ }
+
+ irq_dispose_mapping(irq);
+--
+2.35.1
+
--- /dev/null
+From 6b7d5e220cb7a6cc69d9fce47dcbc8d3b027bfb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jun 2022 10:32:05 +0800
+Subject: usb: renesas: Fix refcount leak bug
+
+From: Liang He <windhl@126.com>
+
+[ Upstream commit 9d6d5303c39b8bc182475b22f45504106a07f086 ]
+
+In usbhs_rza1_hardware_init(), of_find_node_by_name() will return
+a node pointer with refcount incremented. We should use of_node_put()
+when it is not used anymore.
+
+Signed-off-by: Liang He <windhl@126.com>
+Link: https://lore.kernel.org/r/20220618023205.4056548-1-windhl@126.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/renesas_usbhs/rza.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/renesas_usbhs/rza.c b/drivers/usb/renesas_usbhs/rza.c
+index 24de64edb674..2d77edefb4b3 100644
+--- a/drivers/usb/renesas_usbhs/rza.c
++++ b/drivers/usb/renesas_usbhs/rza.c
+@@ -23,6 +23,10 @@ static int usbhs_rza1_hardware_init(struct platform_device *pdev)
+ extal_clk = of_find_node_by_name(NULL, "extal");
+ of_property_read_u32(usb_x1_clk, "clock-frequency", &freq_usb);
+ of_property_read_u32(extal_clk, "clock-frequency", &freq_extal);
++
++ of_node_put(usb_x1_clk);
++ of_node_put(extal_clk);
++
+ if (freq_usb == 0) {
+ if (freq_extal == 12000000) {
+ /* Select 12MHz XTAL */
+--
+2.35.1
+
--- /dev/null
+From b03172383ff695573e422d4e0436d6f96b7bd612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jun 2022 17:20:18 +0000
+Subject: usb: typec: mux: Add CONFIG guards for functions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Prashant Malani <pmalani@chromium.org>
+
+[ Upstream commit a37599ebfb656c2af4ca119de556eba29b6926d6 ]
+
+There are some drivers that can use the Type C mux API, but don't have
+to. Introduce CONFIG guards for the mux functions so that drivers can
+include the header file and not run into compilation errors on systems
+which don't have CONFIG_TYPEC enabled. When CONFIG_TYPEC is not enabled,
+the Type C mux functions will be stub versions of the original calls.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Reviewed-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Tested-by: Nícolas F. R. A. Prado <nfraprado@collabora.com>
+Signed-off-by: Prashant Malani <pmalani@chromium.org>
+Link: https://lore.kernel.org/r/20220615172129.1314056-3-pmalani@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/usb/typec_mux.h | 44 ++++++++++++++++++++++++++++++-----
+ 1 file changed, 38 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/usb/typec_mux.h b/include/linux/usb/typec_mux.h
+index ee57781dcf28..9292f0e07846 100644
+--- a/include/linux/usb/typec_mux.h
++++ b/include/linux/usb/typec_mux.h
+@@ -58,17 +58,13 @@ struct typec_mux_desc {
+ void *drvdata;
+ };
+
++#if IS_ENABLED(CONFIG_TYPEC)
++
+ struct typec_mux *fwnode_typec_mux_get(struct fwnode_handle *fwnode,
+ const struct typec_altmode_desc *desc);
+ void typec_mux_put(struct typec_mux *mux);
+ int typec_mux_set(struct typec_mux *mux, struct typec_mux_state *state);
+
+-static inline struct typec_mux *
+-typec_mux_get(struct device *dev, const struct typec_altmode_desc *desc)
+-{
+- return fwnode_typec_mux_get(dev_fwnode(dev), desc);
+-}
+-
+ struct typec_mux_dev *
+ typec_mux_register(struct device *parent, const struct typec_mux_desc *desc);
+ void typec_mux_unregister(struct typec_mux_dev *mux);
+@@ -76,4 +72,40 @@ void typec_mux_unregister(struct typec_mux_dev *mux);
+ void typec_mux_set_drvdata(struct typec_mux_dev *mux, void *data);
+ void *typec_mux_get_drvdata(struct typec_mux_dev *mux);
+
++#else
++
++static inline struct typec_mux *fwnode_typec_mux_get(struct fwnode_handle *fwnode,
++ const struct typec_altmode_desc *desc)
++{
++ return NULL;
++}
++
++static inline void typec_mux_put(struct typec_mux *mux) {}
++
++static inline int typec_mux_set(struct typec_mux *mux, struct typec_mux_state *state)
++{
++ return 0;
++}
++
++static inline struct typec_mux_dev *
++typec_mux_register(struct device *parent, const struct typec_mux_desc *desc)
++{
++ return ERR_PTR(-EOPNOTSUPP);
++}
++static inline void typec_mux_unregister(struct typec_mux_dev *mux) {}
++
++static inline void typec_mux_set_drvdata(struct typec_mux_dev *mux, void *data) {}
++static inline void *typec_mux_get_drvdata(struct typec_mux_dev *mux)
++{
++ return ERR_PTR(-EOPNOTSUPP);
++}
++
++#endif /* CONFIG_TYPEC */
++
++static inline struct typec_mux *
++typec_mux_get(struct device *dev, const struct typec_altmode_desc *desc)
++{
++ return fwnode_typec_mux_get(dev_fwnode(dev), desc);
++}
++
+ #endif /* __USB_TYPEC_MUX */
+--
+2.35.1
+
--- /dev/null
+From 859fae705424926826f815b038d95d09e99893f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jun 2022 14:37:44 +0100
+Subject: vboxguest: Do not use devm for irq
+
+From: Pascal Terjan <pterjan@google.com>
+
+[ Upstream commit 6169525b76764acb81918aa387ac168fb9a55575 ]
+
+When relying on devm it doesn't get freed early enough which causes the
+following warning when unloading the module:
+
+[249348.837181] remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'vboxguest'
+[249348.837219] WARNING: CPU: 0 PID: 6708 at fs/proc/generic.c:715 remove_proc_entry+0x119/0x140
+
+[249348.837379] Call Trace:
+[249348.837385] unregister_irq_proc+0xbd/0xe0
+[249348.837392] free_desc+0x23/0x60
+[249348.837396] irq_free_descs+0x4a/0x70
+[249348.837401] irq_domain_free_irqs+0x160/0x1a0
+[249348.837452] mp_unmap_irq+0x5c/0x60
+[249348.837458] acpi_unregister_gsi_ioapic+0x29/0x40
+[249348.837463] acpi_unregister_gsi+0x17/0x30
+[249348.837467] acpi_pci_irq_disable+0xbf/0xe0
+[249348.837473] pcibios_disable_device+0x20/0x30
+[249348.837478] pci_disable_device+0xef/0x120
+[249348.837482] vbg_pci_remove+0x6c/0x70 [vboxguest]
+
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Pascal Terjan <pterjan@google.com>
+Link: https://lore.kernel.org/r/20220612133744.4030602-1-pterjan@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virt/vboxguest/vboxguest_linux.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/virt/vboxguest/vboxguest_linux.c b/drivers/virt/vboxguest/vboxguest_linux.c
+index 73eb34849eab..4ccfd30c2a30 100644
+--- a/drivers/virt/vboxguest/vboxguest_linux.c
++++ b/drivers/virt/vboxguest/vboxguest_linux.c
+@@ -356,8 +356,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ goto err_vbg_core_exit;
+ }
+
+- ret = devm_request_irq(dev, pci->irq, vbg_core_isr, IRQF_SHARED,
+- DEVICE_NAME, gdev);
++ ret = request_irq(pci->irq, vbg_core_isr, IRQF_SHARED, DEVICE_NAME,
++ gdev);
+ if (ret) {
+ vbg_err("vboxguest: Error requesting irq: %d\n", ret);
+ goto err_vbg_core_exit;
+@@ -367,7 +367,7 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ if (ret) {
+ vbg_err("vboxguest: Error misc_register %s failed: %d\n",
+ DEVICE_NAME, ret);
+- goto err_vbg_core_exit;
++ goto err_free_irq;
+ }
+
+ ret = misc_register(&gdev->misc_device_user);
+@@ -403,6 +403,8 @@ static int vbg_pci_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ misc_deregister(&gdev->misc_device_user);
+ err_unregister_misc_device:
+ misc_deregister(&gdev->misc_device);
++err_free_irq:
++ free_irq(pci->irq, gdev);
+ err_vbg_core_exit:
+ vbg_core_exit(gdev);
+ err_disable_pcidev:
+@@ -419,6 +421,7 @@ static void vbg_pci_remove(struct pci_dev *pci)
+ vbg_gdev = NULL;
+ mutex_unlock(&vbg_gdev_mutex);
+
++ free_irq(pci->irq, gdev);
+ device_remove_file(gdev->dev, &dev_attr_host_features);
+ device_remove_file(gdev->dev, &dev_attr_host_version);
+ misc_deregister(&gdev->misc_device_user);
+--
+2.35.1
+
--- /dev/null
+From 9463b89cc8720e1bdecc14c1fd3d5a8d5c840bd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Aug 2022 18:16:41 +0300
+Subject: venus: pm_helpers: Fix warning in OPP during probe
+
+From: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+
+[ Upstream commit 1d95af02f23031c2e1cca7607c514b86ce85bc6e ]
+
+Fix the following WARN triggered during Venus driver probe on
+5.19.0-rc8-next-20220728:
+
+ WARNING: CPU: 7 PID: 339 at drivers/opp/core.c:2471 dev_pm_opp_set_config+0x49c/0x610
+ Modules linked in: qcom_spmi_adc5 rtc_pm8xxx qcom_spmi_adc_tm5 leds_qcom_lpg led_class_multicolor
+ qcom_pon qcom_vadc_common venus_core(+) qcom_spmi_temp_alarm v4l2_mem2mem videobuf2_v4l2 msm(+)
+ videobuf2_common crct10dif_ce spi_geni_qcom snd_soc_sm8250 i2c_qcom_geni gpu_sched
+ snd_soc_qcom_common videodev qcom_q6v5_pas soundwire_qcom drm_dp_aux_bus qcom_stats
+ drm_display_helper qcom_pil_info soundwire_bus snd_soc_lpass_va_macro mc qcom_q6v5
+ phy_qcom_snps_femto_v2 qcom_rng snd_soc_lpass_macro_common snd_soc_lpass_wsa_macro
+ lpass_gfm_sm8250 slimbus qcom_sysmon qcom_common qcom_glink_smem qmi_helpers
+ qcom_wdt mdt_loader socinfo icc_osm_l3 display_connector
+ drm_kms_helper qnoc_sm8250 drm fuse ip_tables x_tables ipv6
+ CPU: 7 PID: 339 Comm: systemd-udevd Not tainted 5.19.0-rc8-next-20220728 #4
+ Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
+ pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
+ pc : dev_pm_opp_set_config+0x49c/0x610
+ lr : dev_pm_opp_set_config+0x58/0x610
+ sp : ffff8000093c3710
+ x29: ffff8000093c3710 x28: ffffbca3959d82b8 x27: ffff8000093c3d00
+ x26: ffffbca3959d8e08 x25: ffff4396cac98118 x24: ffff4396c0e24810
+ x23: ffff4396c4272c40 x22: ffff4396c0e24810 x21: ffff8000093c3810
+ x20: ffff4396cac36800 x19: ffff4396cac96800 x18: 0000000000000000
+ x17: 0000000000000003 x16: ffffbca3f4edf198 x15: 0000001cba64a858
+ x14: 0000000000000180 x13: 000000000000017e x12: 0000000000000000
+ x11: 0000000000000002 x10: 0000000000000a60 x9 : ffff8000093c35c0
+ x8 : ffff4396c4273700 x7 : ffff43983efca6c0 x6 : ffff43983efca640
+ x5 : 00000000410fd0d0 x4 : ffff4396c4272c40 x3 : ffffbca3f5d1e008
+ x2 : 0000000000000000 x1 : ffff4396c2421600 x0 : ffff4396cac96860
+ Call trace:
+ dev_pm_opp_set_config+0x49c/0x610
+ devm_pm_opp_set_config+0x18/0x70
+ vcodec_domains_get+0xb8/0x1638 [venus_core]
+ core_get_v4+0x1d8/0x218 [venus_core]
+ venus_probe+0xf4/0x468 [venus_core]
+ platform_probe+0x68/0xd8
+ really_probe+0xbc/0x2a8
+ __driver_probe_device+0x78/0xe0
+ driver_probe_device+0x3c/0xf0
+ __driver_attach+0x70/0x120
+ bus_for_each_dev+0x70/0xc0
+ driver_attach+0x24/0x30
+ bus_add_driver+0x150/0x200
+ driver_register+0x64/0x120
+ __platform_driver_register+0x28/0x38
+ qcom_venus_driver_init+0x24/0x1000 [venus_core]
+ do_one_initcall+0x54/0x1c8
+ do_init_module+0x44/0x1d0
+ load_module+0x16c8/0x1aa0
+ __do_sys_finit_module+0xbc/0x110
+ __arm64_sys_finit_module+0x20/0x30
+ invoke_syscall+0x44/0x108
+ el0_svc_common.constprop.0+0xcc/0xf0
+ do_el0_svc+0x2c/0xb8
+ el0_svc+0x2c/0x88
+ el0t_64_sync_handler+0xb8/0xc0
+ el0t_64_sync+0x18c/0x190
+ qcom-venus: probe of aa00000.video-codec failed with error -16
+
+The fix is re-ordering the code related to OPP core. The OPP core
+expects all configuration options to be provided before the OPP
+table is added.
+
+Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
+Suggested-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/qcom/venus/pm_helpers.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/qcom/venus/pm_helpers.c b/drivers/media/platform/qcom/venus/pm_helpers.c
+index cb48c5ff3dee..c93d2906e4c7 100644
+--- a/drivers/media/platform/qcom/venus/pm_helpers.c
++++ b/drivers/media/platform/qcom/venus/pm_helpers.c
+@@ -875,7 +875,7 @@ static int vcodec_domains_get(struct venus_core *core)
+ }
+
+ skip_pmdomains:
+- if (!core->has_opp_table)
++ if (!core->res->opp_pmdomain)
+ return 0;
+
+ /* Attach the power domain for setting performance state */
+@@ -1007,6 +1007,10 @@ static int core_get_v4(struct venus_core *core)
+ if (ret)
+ return ret;
+
++ ret = vcodec_domains_get(core);
++ if (ret)
++ return ret;
++
+ if (core->res->opp_pmdomain) {
+ ret = devm_pm_opp_of_add_table(dev);
+ if (!ret) {
+@@ -1017,10 +1021,6 @@ static int core_get_v4(struct venus_core *core)
+ }
+ }
+
+- ret = vcodec_domains_get(core);
+- if (ret)
+- return ret;
+-
+ return 0;
+ }
+
+--
+2.35.1
+
--- /dev/null
+From e100f4697ce840ac50be1e86335f3c3764c29897 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jun 2022 10:29:48 +0800
+Subject: vfio: Clear the caps->buf to NULL after free
+
+From: Schspa Shi <schspa@gmail.com>
+
+[ Upstream commit 6641085e8d7b3f061911517f79a2a15a0a21b97b ]
+
+On buffer resize failure, vfio_info_cap_add() will free the buffer,
+report zero for the size, and return -ENOMEM. As additional
+hardening, also clear the buffer pointer to prevent any chance of a
+double free.
+
+Signed-off-by: Schspa Shi <schspa@gmail.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Link: https://lore.kernel.org/r/20220629022948.55608-1-schspa@gmail.com
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
+index 18fc0916587e..277cd1152dd8 100644
+--- a/drivers/vfio/vfio.c
++++ b/drivers/vfio/vfio.c
+@@ -1814,6 +1814,7 @@ struct vfio_info_cap_header *vfio_info_cap_add(struct vfio_info_cap *caps,
+ buf = krealloc(caps->buf, caps->size + size, GFP_KERNEL);
+ if (!buf) {
+ kfree(caps->buf);
++ caps->buf = NULL;
+ caps->size = 0;
+ return ERR_PTR(-ENOMEM);
+ }
+--
+2.35.1
+
--- /dev/null
+From 1cf6bd5915ba28662dfc9c6760f3b21952f237c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Aug 2022 17:24:19 +0800
+Subject: video: fbdev: i740fb: Check the argument of i740_calc_vclk()
+
+From: Zheyu Ma <zheyuma97@gmail.com>
+
+[ Upstream commit 40bf722f8064f50200b8c4f8946cd625b441dda9 ]
+
+Since the user can control the arguments of the ioctl() from the user
+space, under special arguments that may result in a divide-by-zero bug.
+
+If the user provides an improper 'pixclock' value that makes the argumet
+of i740_calc_vclk() less than 'I740_RFREQ_FIX', it will cause a
+divide-by-zero bug in:
+ drivers/video/fbdev/i740fb.c:353 p_best = min(15, ilog2(I740_MAX_VCO_FREQ / (freq / I740_RFREQ_FIX)));
+
+The following log can reveal it:
+
+divide error: 0000 [#1] PREEMPT SMP KASAN PTI
+RIP: 0010:i740_calc_vclk drivers/video/fbdev/i740fb.c:353 [inline]
+RIP: 0010:i740fb_decode_var drivers/video/fbdev/i740fb.c:646 [inline]
+RIP: 0010:i740fb_set_par+0x163f/0x3b70 drivers/video/fbdev/i740fb.c:742
+Call Trace:
+ fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034
+ do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110
+ fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
+
+Fix this by checking the argument of i740_calc_vclk() first.
+
+Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/i740fb.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/i740fb.c b/drivers/video/fbdev/i740fb.c
+index 09dd85553d4f..7f09a0daaaa2 100644
+--- a/drivers/video/fbdev/i740fb.c
++++ b/drivers/video/fbdev/i740fb.c
+@@ -400,7 +400,7 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
+ u32 xres, right, hslen, left, xtotal;
+ u32 yres, lower, vslen, upper, ytotal;
+ u32 vxres, xoffset, vyres, yoffset;
+- u32 bpp, base, dacspeed24, mem;
++ u32 bpp, base, dacspeed24, mem, freq;
+ u8 r7;
+ int i;
+
+@@ -643,7 +643,12 @@ static int i740fb_decode_var(const struct fb_var_screeninfo *var,
+ par->atc[VGA_ATC_OVERSCAN] = 0;
+
+ /* Calculate VCLK that most closely matches the requested dot clock */
+- i740_calc_vclk((((u32)1e9) / var->pixclock) * (u32)(1e3), par);
++ freq = (((u32)1e9) / var->pixclock) * (u32)(1e3);
++ if (freq < I740_RFREQ_FIX) {
++ fb_dbg(info, "invalid pixclock\n");
++ freq = I740_RFREQ_FIX;
++ }
++ i740_calc_vclk(freq, par);
+
+ /* Since we program the clocks ourselves, always use VCLK2. */
+ par->misc |= 0x0C;
+--
+2.35.1
+
--- /dev/null
+From dcecbc3bda5713ad9b65318974658777153f8f6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Jul 2022 17:47:27 +0200
+Subject: watchdog: export lockup_detector_reconfigure
+
+From: Laurent Dufour <ldufour@linux.ibm.com>
+
+[ Upstream commit 7c56a8733d0a2a4be2438a7512566e5ce552fccf ]
+
+In some circumstances it may be interesting to reconfigure the watchdog
+from inside the kernel.
+
+On PowerPC, this may helpful before and after a LPAR migration (LPM) is
+initiated, because it implies some latencies, watchdog, and especially NMI
+watchdog is expected to be triggered during this operation. Reconfiguring
+the watchdog with a factor, would prevent it to happen too frequently
+during LPM.
+
+Rename lockup_detector_reconfigure() as __lockup_detector_reconfigure() and
+create a new function lockup_detector_reconfigure() calling
+__lockup_detector_reconfigure() under the protection of watchdog_mutex.
+
+Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
+[mpe: Squash in build fix from Laurent, reported by Sachin]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220713154729.80789-3-ldufour@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/nmi.h | 2 ++
+ kernel/watchdog.c | 21 ++++++++++++++++-----
+ 2 files changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/include/linux/nmi.h b/include/linux/nmi.h
+index 750c7f395ca9..f700ff2df074 100644
+--- a/include/linux/nmi.h
++++ b/include/linux/nmi.h
+@@ -122,6 +122,8 @@ int watchdog_nmi_probe(void);
+ int watchdog_nmi_enable(unsigned int cpu);
+ void watchdog_nmi_disable(unsigned int cpu);
+
++void lockup_detector_reconfigure(void);
++
+ /**
+ * touch_nmi_watchdog - restart NMI watchdog timeout.
+ *
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index ecb0e8346e65..8e61f21e7e33 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -537,7 +537,7 @@ int lockup_detector_offline_cpu(unsigned int cpu)
+ return 0;
+ }
+
+-static void lockup_detector_reconfigure(void)
++static void __lockup_detector_reconfigure(void)
+ {
+ cpus_read_lock();
+ watchdog_nmi_stop();
+@@ -557,6 +557,13 @@ static void lockup_detector_reconfigure(void)
+ __lockup_detector_cleanup();
+ }
+
++void lockup_detector_reconfigure(void)
++{
++ mutex_lock(&watchdog_mutex);
++ __lockup_detector_reconfigure();
++ mutex_unlock(&watchdog_mutex);
++}
++
+ /*
+ * Create the watchdog infrastructure and configure the detector(s).
+ */
+@@ -573,13 +580,13 @@ static __init void lockup_detector_setup(void)
+ return;
+
+ mutex_lock(&watchdog_mutex);
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ softlockup_initialized = true;
+ mutex_unlock(&watchdog_mutex);
+ }
+
+ #else /* CONFIG_SOFTLOCKUP_DETECTOR */
+-static void lockup_detector_reconfigure(void)
++static void __lockup_detector_reconfigure(void)
+ {
+ cpus_read_lock();
+ watchdog_nmi_stop();
+@@ -587,9 +594,13 @@ static void lockup_detector_reconfigure(void)
+ watchdog_nmi_start();
+ cpus_read_unlock();
+ }
++void lockup_detector_reconfigure(void)
++{
++ __lockup_detector_reconfigure();
++}
+ static inline void lockup_detector_setup(void)
+ {
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ }
+ #endif /* !CONFIG_SOFTLOCKUP_DETECTOR */
+
+@@ -629,7 +640,7 @@ static void proc_watchdog_update(void)
+ {
+ /* Remove impossible cpus to keep sysctl output clean. */
+ cpumask_and(&watchdog_cpumask, &watchdog_cpumask, cpu_possible_mask);
+- lockup_detector_reconfigure();
++ __lockup_detector_reconfigure();
+ }
+
+ /*
+--
+2.35.1
+
--- /dev/null
+From 225e4d98eba6d90a66ba8c649605922c4da87706 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Aug 2022 14:39:27 -0700
+Subject: x86/ibt, objtool: Add IBT_NOSEAL()
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit e27e5bea956ce4d3eb15112de5fa5a3b77c2f488 ]
+
+Add a macro which prevents a function from getting sealed if there are
+no compile-time references to it.
+
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Message-Id: <20220818213927.e44fmxkoq4yj6ybn@treble>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/ibt.h | 11 +++++++++++
+ tools/objtool/check.c | 3 ++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/ibt.h b/arch/x86/include/asm/ibt.h
+index 689880eca9ba..9b08082a5d9f 100644
+--- a/arch/x86/include/asm/ibt.h
++++ b/arch/x86/include/asm/ibt.h
+@@ -31,6 +31,16 @@
+
+ #define __noendbr __attribute__((nocf_check))
+
++/*
++ * Create a dummy function pointer reference to prevent objtool from marking
++ * the function as needing to be "sealed" (i.e. ENDBR converted to NOP by
++ * apply_ibt_endbr()).
++ */
++#define IBT_NOSEAL(fname) \
++ ".pushsection .discard.ibt_endbr_noseal\n\t" \
++ _ASM_PTR fname "\n\t" \
++ ".popsection\n\t"
++
+ static inline __attribute_const__ u32 gen_endbr(void)
+ {
+ u32 endbr;
+@@ -84,6 +94,7 @@ extern __noendbr void ibt_restore(u64 save);
+ #ifndef __ASSEMBLY__
+
+ #define ASM_ENDBR
++#define IBT_NOSEAL(name)
+
+ #define __noendbr
+
+diff --git a/tools/objtool/check.c b/tools/objtool/check.c
+index b341f8a8c7c5..31c719f99f66 100644
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -4096,7 +4096,8 @@ static int validate_ibt(struct objtool_file *file)
+ * These sections can reference text addresses, but not with
+ * the intent to indirect branch to them.
+ */
+- if (!strncmp(sec->name, ".discard", 8) ||
++ if ((!strncmp(sec->name, ".discard", 8) &&
++ strcmp(sec->name, ".discard.ibt_endbr_noseal")) ||
+ !strncmp(sec->name, ".debug", 6) ||
+ !strcmp(sec->name, ".altinstructions") ||
+ !strcmp(sec->name, ".ibt_endbr_seal") ||
+--
+2.35.1
+
--- /dev/null
+From a2683c8af14e5610023181ca4c50de88e0fc87c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Aug 2022 08:53:43 -0700
+Subject: x86/kvm: Fix "missing ENDBR" BUG for fastop functions
+
+From: Josh Poimboeuf <jpoimboe@kernel.org>
+
+[ Upstream commit 3d9606b0e0f3aed4dfb61d0853ebf432fead7bba ]
+
+The following BUG was reported:
+
+ traps: Missing ENDBR: andw_ax_dx+0x0/0x10 [kvm]
+ ------------[ cut here ]------------
+ kernel BUG at arch/x86/kernel/traps.c:253!
+ invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
+ <TASK>
+ asm_exc_control_protection+0x2b/0x30
+ RIP: 0010:andw_ax_dx+0x0/0x10 [kvm]
+ Code: c3 cc cc cc cc 0f 1f 44 00 00 66 0f 1f 00 48 19 d0 c3 cc cc cc
+ cc 0f 1f 40 00 f3 0f 1e fa 20 d0 c3 cc cc cc cc 0f 1f 44 00 00
+ <66> 0f 1f 00 66 21 d0 c3 cc cc cc cc 0f 1f 40 00 66 0f 1f 00 21
+ d0
+
+ ? andb_al_dl+0x10/0x10 [kvm]
+ ? fastop+0x5d/0xa0 [kvm]
+ x86_emulate_insn+0x822/0x1060 [kvm]
+ x86_emulate_instruction+0x46f/0x750 [kvm]
+ complete_emulated_mmio+0x216/0x2c0 [kvm]
+ kvm_arch_vcpu_ioctl_run+0x604/0x650 [kvm]
+ kvm_vcpu_ioctl+0x2f4/0x6b0 [kvm]
+ ? wake_up_q+0xa0/0xa0
+
+The BUG occurred because the ENDBR in the andw_ax_dx() fastop function
+had been incorrectly "sealed" (converted to a NOP) by apply_ibt_endbr().
+
+Objtool marked it to be sealed because KVM has no compile-time
+references to the function. Instead KVM calculates its address at
+runtime.
+
+Prevent objtool from annotating fastop functions as sealable by creating
+throwaway dummy compile-time references to the functions.
+
+Fixes: 6649fa876da4 ("x86/ibt,kvm: Add ENDBR to fastops")
+Reported-by: Pengfei Xu <pengfei.xu@intel.com>
+Debugged-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
+Message-Id: <0d4116f90e9d0c1b754bb90c585e6f0415a1c508.1660837839.git.jpoimboe@kernel.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/emulate.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index aa907cec0918..09fa8a94807b 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -316,7 +316,8 @@ static int fastop(struct x86_emulate_ctxt *ctxt, fastop_t fop);
+ ".align " __stringify(FASTOP_SIZE) " \n\t" \
+ ".type " name ", @function \n\t" \
+ name ":\n\t" \
+- ASM_ENDBR
++ ASM_ENDBR \
++ IBT_NOSEAL(name)
+
+ #define FOP_FUNC(name) \
+ __FOP_FUNC(#name)
+--
+2.35.1
+
--- /dev/null
+From 15f899a1e319e18d9737c9163f17554a8cab0949 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jun 2022 11:35:01 +0900
+Subject: zram: do not lookup algorithm in backends table
+
+From: Sergey Senozhatsky <senozhatsky@chromium.org>
+
+[ Upstream commit dc89997264de565999a1cb55db3f295d3a8e457b ]
+
+Always use crypto_has_comp() so that crypto can lookup module, call
+usermodhelper to load the modules, wait for usermodhelper to finish and so
+on. Otherwise crypto will do all of these steps under CPU hot-plug lock
+and this looks like too much stuff to handle under the CPU hot-plug lock.
+Besides this can end up in a deadlock when usermodhelper triggers a code
+path that attempts to lock the CPU hot-plug lock, that zram already holds.
+
+An example of such deadlock:
+
+- path A. zram grabs CPU hot-plug lock, execs /sbin/modprobe from crypto
+ and waits for modprobe to finish
+
+disksize_store
+ zcomp_create
+ __cpuhp_state_add_instance
+ __cpuhp_state_add_instance_cpuslocked
+ zcomp_cpu_up_prepare
+ crypto_alloc_base
+ crypto_alg_mod_lookup
+ call_usermodehelper_exec
+ wait_for_completion_killable
+ do_wait_for_common
+ schedule
+
+- path B. async work kthread that brings in scsi device. It wants to
+ register CPUHP states at some point, and it needs the CPU hot-plug
+ lock for that, which is owned by zram.
+
+async_run_entry_fn
+ scsi_probe_and_add_lun
+ scsi_mq_alloc_queue
+ blk_mq_init_queue
+ blk_mq_init_allocated_queue
+ blk_mq_realloc_hw_ctxs
+ __cpuhp_state_add_instance
+ __cpuhp_state_add_instance_cpuslocked
+ mutex_lock
+ schedule
+
+- path C. modprobe sleeps, waiting for all aync works to finish.
+
+load_module
+ do_init_module
+ async_synchronize_full
+ async_synchronize_cookie_domain
+ schedule
+
+[senozhatsky@chromium.org: add comment]
+ Link: https://lkml.kernel.org/r/20220624060606.1014474-1-senozhatsky@chromium.org
+Link: https://lkml.kernel.org/r/20220622023501.517125-1-senozhatsky@chromium.org
+Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Nitin Gupta <ngupta@vflare.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zcomp.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/block/zram/zcomp.c b/drivers/block/zram/zcomp.c
+index 052aa3f65514..0916de952e09 100644
+--- a/drivers/block/zram/zcomp.c
++++ b/drivers/block/zram/zcomp.c
+@@ -63,12 +63,6 @@ static int zcomp_strm_init(struct zcomp_strm *zstrm, struct zcomp *comp)
+
+ bool zcomp_available_algorithm(const char *comp)
+ {
+- int i;
+-
+- i = sysfs_match_string(backends, comp);
+- if (i >= 0)
+- return true;
+-
+ /*
+ * Crypto does not ignore a trailing new line symbol,
+ * so make sure you don't supply a string containing
+@@ -217,6 +211,11 @@ struct zcomp *zcomp_create(const char *compress)
+ struct zcomp *comp;
+ int error;
+
++ /*
++ * Crypto API will execute /sbin/modprobe if the compression module
++ * is not loaded yet. We must do it here, otherwise we are about to
++ * call /sbin/modprobe under CPU hot-plug lock.
++ */
+ if (!zcomp_available_algorithm(compress))
+ return ERR_PTR(-EINVAL);
+
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
