--- /dev/null
+From 2198d07c509f1db4a1185d1f65aaada794c6ea59 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 9 Jan 2023 18:47:59 +0100
+Subject: arm64: Always load shadow stack pointer directly from the task struct
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 2198d07c509f1db4a1185d1f65aaada794c6ea59 upstream.
+
+All occurrences of the scs_load macro load the value of the shadow call
+stack pointer from the task which is current at that point. So instead
+of taking a task struct register argument in the scs_load macro to
+specify the task struct to load from, let's always reference the current
+task directly. This should make it much harder to exploit any
+instruction sequences reloading the shadow call stack pointer register
+from memory.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230109174800.3286265-2-ardb@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/include/asm/scs.h | 7 ++++---
+ arch/arm64/kernel/entry.S | 4 ++--
+ arch/arm64/kernel/head.S | 2 +-
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+--- a/arch/arm64/include/asm/scs.h
++++ b/arch/arm64/include/asm/scs.h
+@@ -9,15 +9,16 @@
+ #ifdef CONFIG_SHADOW_CALL_STACK
+ scs_sp .req x18
+
+- .macro scs_load tsk
+- ldr scs_sp, [\tsk, #TSK_TI_SCS_SP]
++ .macro scs_load_current
++ get_current_task scs_sp
++ ldr scs_sp, [scs_sp, #TSK_TI_SCS_SP]
+ .endm
+
+ .macro scs_save tsk
+ str scs_sp, [\tsk, #TSK_TI_SCS_SP]
+ .endm
+ #else
+- .macro scs_load tsk
++ .macro scs_load_current
+ .endm
+
+ .macro scs_save tsk
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -272,7 +272,7 @@ alternative_if ARM64_HAS_ADDRESS_AUTH
+ alternative_else_nop_endif
+ 1:
+
+- scs_load tsk
++ scs_load_current
+ .else
+ add x21, sp, #PT_REGS_SIZE
+ get_current_task tsk
+@@ -845,7 +845,7 @@ SYM_FUNC_START(cpu_switch_to)
+ msr sp_el0, x1
+ ptrauth_keys_install_kernel x1, x8, x9, x10
+ scs_save x0
+- scs_load x1
++ scs_load_current
+ ret
+ SYM_FUNC_END(cpu_switch_to)
+ NOKPROBE(cpu_switch_to)
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -404,7 +404,7 @@ SYM_FUNC_END(create_kernel_mapping)
+ stp xzr, xzr, [sp, #S_STACKFRAME]
+ add x29, sp, #S_STACKFRAME
+
+- scs_load \tsk
++ scs_load_current
+
+ adr_l \tmp1, __per_cpu_offset
+ ldr w\tmp2, [\tsk, #TSK_TI_CPU]
--- /dev/null
+From 59b37fe52f49955791a460752c37145f1afdcad1 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Mon, 9 Jan 2023 18:48:00 +0100
+Subject: arm64: Stash shadow stack pointer in the task struct on interrupt
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 59b37fe52f49955791a460752c37145f1afdcad1 upstream.
+
+Instead of reloading the shadow call stack pointer from the ordinary
+stack, which may be vulnerable to the kind of gadget based attacks
+shadow call stacks were designed to prevent, let's store a task's shadow
+call stack pointer in the task struct when switching to the shadow IRQ
+stack.
+
+Given that currently, the task_struct::scs_sp field is only used to
+preserve the shadow call stack pointer while a task is scheduled out or
+running in user space, reusing this field to preserve and restore it
+while running off the IRQ stack must be safe, as those occurrences are
+guaranteed to never overlap. (The stack switching logic only switches
+stacks when running from the task stack, and so the value being saved
+here always corresponds to the task mode shadow stack)
+
+While at it, fold a mov/add/mov sequence into a single add.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Acked-by: Mark Rutland <mark.rutland@arm.com>
+Link: https://lore.kernel.org/r/20230109174800.3286265-3-ardb@kernel.org
+Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm64/kernel/entry.S | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -873,19 +873,19 @@ NOKPROBE(ret_from_fork)
+ */
+ SYM_FUNC_START(call_on_irq_stack)
+ #ifdef CONFIG_SHADOW_CALL_STACK
+- stp scs_sp, xzr, [sp, #-16]!
++ get_current_task x16
++ scs_save x16
+ ldr_this_cpu scs_sp, irq_shadow_call_stack_ptr, x17
+ #endif
++
+ /* Create a frame record to save our LR and SP (implicit in FP) */
+ stp x29, x30, [sp, #-16]!
+ mov x29, sp
+
+ ldr_this_cpu x16, irq_stack_ptr, x17
+- mov x15, #IRQ_STACK_SIZE
+- add x16, x16, x15
+
+ /* Move to the new stack and call the function there */
+- mov sp, x16
++ add sp, x16, #IRQ_STACK_SIZE
+ blr x1
+
+ /*
+@@ -894,9 +894,7 @@ SYM_FUNC_START(call_on_irq_stack)
+ */
+ mov sp, x29
+ ldp x29, x30, [sp], #16
+-#ifdef CONFIG_SHADOW_CALL_STACK
+- ldp scs_sp, xzr, [sp], #16
+-#endif
++ scs_load_current
+ ret
+ SYM_FUNC_END(call_on_irq_stack)
+ NOKPROBE(call_on_irq_stack)
--- /dev/null
+From 4b19211435950a78af032c26ad64a5268e6012be Mon Sep 17 00:00:00 2001
+From: syed saba kareem <syed.sabakareem@amd.com>
+Date: Fri, 4 Nov 2022 17:39:07 +0530
+Subject: ASoC: amd: fix ACP version typo mistake
+
+From: syed saba kareem <syed.sabakareem@amd.com>
+
+commit 4b19211435950a78af032c26ad64a5268e6012be upstream.
+
+Pink Sardine is based on ACP6.3 architecture.
+This patch fixes the typo mistake acp6.2 -> acp6.3
+
+Signed-off-by: syed saba kareem <syed.sabakareem@amd.com>
+Link: https://lore.kernel.org/r/20221104121001.207992-1-Syed.SabaKareem@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/sound/acp62_chip_offset_byte.h | 444 ---------------------------------
+ include/sound/acp63_chip_offset_byte.h | 444 +++++++++++++++++++++++++++++++++
+ sound/soc/amd/Kconfig | 4
+ sound/soc/amd/ps/acp62.h | 98 -------
+ sound/soc/amd/ps/acp63.h | 98 +++++++
+ sound/soc/amd/ps/pci-ps.c | 132 ++++-----
+ sound/soc/amd/ps/ps-mach.c | 30 +-
+ sound/soc/amd/ps/ps-pdm-dma.c | 188 ++++++-------
+ 8 files changed, 719 insertions(+), 719 deletions(-)
+ rename include/sound/{acp62_chip_offset_byte.h => acp63_chip_offset_byte.h} (99%)
+ rename sound/soc/amd/ps/{acp62.h => acp63.h} (90%)
+
+--- a/include/sound/acp62_chip_offset_byte.h
++++ /dev/null
+@@ -1,444 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0+ */
+-/*
+- * AMD ACP 6.2 Register Documentation
+- *
+- * Copyright 2022 Advanced Micro Devices, Inc.
+- */
+-
+-#ifndef _acp_ip_OFFSET_HEADER
+-#define _acp_ip_OFFSET_HEADER
+-
+-/* Registers from ACP_DMA block */
+-#define ACP_DMA_CNTL_0 0x0000000
+-#define ACP_DMA_CNTL_1 0x0000004
+-#define ACP_DMA_CNTL_2 0x0000008
+-#define ACP_DMA_CNTL_3 0x000000C
+-#define ACP_DMA_CNTL_4 0x0000010
+-#define ACP_DMA_CNTL_5 0x0000014
+-#define ACP_DMA_CNTL_6 0x0000018
+-#define ACP_DMA_CNTL_7 0x000001C
+-#define ACP_DMA_DSCR_STRT_IDX_0 0x0000020
+-#define ACP_DMA_DSCR_STRT_IDX_1 0x0000024
+-#define ACP_DMA_DSCR_STRT_IDX_2 0x0000028
+-#define ACP_DMA_DSCR_STRT_IDX_3 0x000002C
+-#define ACP_DMA_DSCR_STRT_IDX_4 0x0000030
+-#define ACP_DMA_DSCR_STRT_IDX_5 0x0000034
+-#define ACP_DMA_DSCR_STRT_IDX_6 0x0000038
+-#define ACP_DMA_DSCR_STRT_IDX_7 0x000003C
+-#define ACP_DMA_DSCR_CNT_0 0x0000040
+-#define ACP_DMA_DSCR_CNT_1 0x0000044
+-#define ACP_DMA_DSCR_CNT_2 0x0000048
+-#define ACP_DMA_DSCR_CNT_3 0x000004C
+-#define ACP_DMA_DSCR_CNT_4 0x0000050
+-#define ACP_DMA_DSCR_CNT_5 0x0000054
+-#define ACP_DMA_DSCR_CNT_6 0x0000058
+-#define ACP_DMA_DSCR_CNT_7 0x000005C
+-#define ACP_DMA_PRIO_0 0x0000060
+-#define ACP_DMA_PRIO_1 0x0000064
+-#define ACP_DMA_PRIO_2 0x0000068
+-#define ACP_DMA_PRIO_3 0x000006C
+-#define ACP_DMA_PRIO_4 0x0000070
+-#define ACP_DMA_PRIO_5 0x0000074
+-#define ACP_DMA_PRIO_6 0x0000078
+-#define ACP_DMA_PRIO_7 0x000007C
+-#define ACP_DMA_CUR_DSCR_0 0x0000080
+-#define ACP_DMA_CUR_DSCR_1 0x0000084
+-#define ACP_DMA_CUR_DSCR_2 0x0000088
+-#define ACP_DMA_CUR_DSCR_3 0x000008C
+-#define ACP_DMA_CUR_DSCR_4 0x0000090
+-#define ACP_DMA_CUR_DSCR_5 0x0000094
+-#define ACP_DMA_CUR_DSCR_6 0x0000098
+-#define ACP_DMA_CUR_DSCR_7 0x000009C
+-#define ACP_DMA_CUR_TRANS_CNT_0 0x00000A0
+-#define ACP_DMA_CUR_TRANS_CNT_1 0x00000A4
+-#define ACP_DMA_CUR_TRANS_CNT_2 0x00000A8
+-#define ACP_DMA_CUR_TRANS_CNT_3 0x00000AC
+-#define ACP_DMA_CUR_TRANS_CNT_4 0x00000B0
+-#define ACP_DMA_CUR_TRANS_CNT_5 0x00000B4
+-#define ACP_DMA_CUR_TRANS_CNT_6 0x00000B8
+-#define ACP_DMA_CUR_TRANS_CNT_7 0x00000BC
+-#define ACP_DMA_ERR_STS_0 0x00000C0
+-#define ACP_DMA_ERR_STS_1 0x00000C4
+-#define ACP_DMA_ERR_STS_2 0x00000C8
+-#define ACP_DMA_ERR_STS_3 0x00000CC
+-#define ACP_DMA_ERR_STS_4 0x00000D0
+-#define ACP_DMA_ERR_STS_5 0x00000D4
+-#define ACP_DMA_ERR_STS_6 0x00000D8
+-#define ACP_DMA_ERR_STS_7 0x00000DC
+-#define ACP_DMA_DESC_BASE_ADDR 0x00000E0
+-#define ACP_DMA_DESC_MAX_NUM_DSCR 0x00000E4
+-#define ACP_DMA_CH_STS 0x00000E8
+-#define ACP_DMA_CH_GROUP 0x00000EC
+-#define ACP_DMA_CH_RST_STS 0x00000F0
+-
+-/* Registers from ACP_AXI2AXIATU block */
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_1 0x0000C00
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_1 0x0000C04
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_2 0x0000C08
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_2 0x0000C0C
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_3 0x0000C10
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_3 0x0000C14
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_4 0x0000C18
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_4 0x0000C1C
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_5 0x0000C20
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_5 0x0000C24
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_6 0x0000C28
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_6 0x0000C2C
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_7 0x0000C30
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_7 0x0000C34
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_8 0x0000C38
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_8 0x0000C3C
+-#define ACPAXI2AXI_ATU_CTRL 0x0000C40
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_9 0x0000C44
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_9 0x0000C48
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_10 0x0000C4C
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_10 0x0000C50
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_11 0x0000C54
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_11 0x0000C58
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_12 0x0000C5C
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_12 0x0000C60
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_13 0x0000C64
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_13 0x0000C68
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_14 0x0000C6C
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_14 0x0000C70
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_15 0x0000C74
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_15 0x0000C78
+-#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_16 0x0000C7C
+-#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_16 0x0000C80
+-
+-/* Registers from ACP_CLKRST block */
+-#define ACP_SOFT_RESET 0x0001000
+-#define ACP_CONTROL 0x0001004
+-#define ACP_STATUS 0x0001008
+-#define ACP_DYNAMIC_CG_MASTER_CONTROL 0x0001010
+-#define ACP_ZSC_DSP_CTRL 0x0001014
+-#define ACP_ZSC_STS 0x0001018
+-#define ACP_PGFSM_CONTROL 0x0001024
+-#define ACP_PGFSM_STATUS 0x0001028
+-#define ACP_CLKMUX_SEL 0x000102C
+-
+-/* Registers from ACP_AON block */
+-#define ACP_PME_EN 0x0001400
+-#define ACP_DEVICE_STATE 0x0001404
+-#define AZ_DEVICE_STATE 0x0001408
+-#define ACP_PIN_CONFIG 0x0001440
+-#define ACP_PAD_PULLUP_CTRL 0x0001444
+-#define ACP_PAD_PULLDOWN_CTRL 0x0001448
+-#define ACP_PAD_DRIVE_STRENGTH_CTRL 0x000144C
+-#define ACP_PAD_SCHMEN_CTRL 0x0001450
+-#define ACP_SW_PAD_KEEPER_EN 0x0001454
+-#define ACP_SW_WAKE_EN 0x0001458
+-#define ACP_I2S_WAKE_EN 0x000145C
+-#define ACP_SW1_WAKE_EN 0x0001460
+-
+-/* Registers from ACP_P1_MISC block */
+-#define ACP_EXTERNAL_INTR_ENB 0x0001A00
+-#define ACP_EXTERNAL_INTR_CNTL 0x0001A04
+-#define ACP_EXTERNAL_INTR_CNTL1 0x0001A08
+-#define ACP_EXTERNAL_INTR_STAT 0x0001A0C
+-#define ACP_EXTERNAL_INTR_STAT1 0x0001A10
+-#define ACP_ERROR_STATUS 0x0001A4C
+-#define ACP_P1_SW_I2S_ERROR_REASON 0x0001A50
+-#define ACP_P1_SW_POS_TRACK_I2S_TX_CTRL 0x0001A6C
+-#define ACP_P1_SW_I2S_TX_DMA_POS 0x0001A70
+-#define ACP_P1_SW_POS_TRACK_I2S_RX_CTRL 0x0001A74
+-#define ACP_P1_SW_I2S_RX_DMA_POS 0x0001A78
+-#define ACP_P1_DMIC_I2S_GPIO_INTR_CTRL 0x0001A7C
+-#define ACP_P1_DMIC_I2S_GPIO_INTR_STATUS 0x0001A80
+-#define ACP_SCRATCH_REG_BASE_ADDR 0x0001A84
+-#define ACP_P1_SW_POS_TRACK_BT_TX_CTRL 0x0001A88
+-#define ACP_P1_SW_BT_TX_DMA_POS 0x0001A8C
+-#define ACP_P1_SW_POS_TRACK_HS_TX_CTRL 0x0001A90
+-#define ACP_P1_SW_HS_TX_DMA_POS 0x0001A94
+-#define ACP_P1_SW_POS_TRACK_BT_RX_CTRL 0x0001A98
+-#define ACP_P1_SW_BT_RX_DMA_POS 0x0001A9C
+-#define ACP_P1_SW_POS_TRACK_HS_RX_CTRL 0x0001AA0
+-#define ACP_P1_SW_HS_RX_DMA_POS 0x0001AA4
+-
+-/* Registers from ACP_AUDIO_BUFFERS block */
+-#define ACP_I2S_RX_RINGBUFADDR 0x0002000
+-#define ACP_I2S_RX_RINGBUFSIZE 0x0002004
+-#define ACP_I2S_RX_LINKPOSITIONCNTR 0x0002008
+-#define ACP_I2S_RX_FIFOADDR 0x000200C
+-#define ACP_I2S_RX_FIFOSIZE 0x0002010
+-#define ACP_I2S_RX_DMA_SIZE 0x0002014
+-#define ACP_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0002018
+-#define ACP_I2S_RX_LINEARPOSITIONCNTR_LOW 0x000201C
+-#define ACP_I2S_RX_INTR_WATERMARK_SIZE 0x0002020
+-#define ACP_I2S_TX_RINGBUFADDR 0x0002024
+-#define ACP_I2S_TX_RINGBUFSIZE 0x0002028
+-#define ACP_I2S_TX_LINKPOSITIONCNTR 0x000202C
+-#define ACP_I2S_TX_FIFOADDR 0x0002030
+-#define ACP_I2S_TX_FIFOSIZE 0x0002034
+-#define ACP_I2S_TX_DMA_SIZE 0x0002038
+-#define ACP_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x000203C
+-#define ACP_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0002040
+-#define ACP_I2S_TX_INTR_WATERMARK_SIZE 0x0002044
+-#define ACP_BT_RX_RINGBUFADDR 0x0002048
+-#define ACP_BT_RX_RINGBUFSIZE 0x000204C
+-#define ACP_BT_RX_LINKPOSITIONCNTR 0x0002050
+-#define ACP_BT_RX_FIFOADDR 0x0002054
+-#define ACP_BT_RX_FIFOSIZE 0x0002058
+-#define ACP_BT_RX_DMA_SIZE 0x000205C
+-#define ACP_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0002060
+-#define ACP_BT_RX_LINEARPOSITIONCNTR_LOW 0x0002064
+-#define ACP_BT_RX_INTR_WATERMARK_SIZE 0x0002068
+-#define ACP_BT_TX_RINGBUFADDR 0x000206C
+-#define ACP_BT_TX_RINGBUFSIZE 0x0002070
+-#define ACP_BT_TX_LINKPOSITIONCNTR 0x0002074
+-#define ACP_BT_TX_FIFOADDR 0x0002078
+-#define ACP_BT_TX_FIFOSIZE 0x000207C
+-#define ACP_BT_TX_DMA_SIZE 0x0002080
+-#define ACP_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0002084
+-#define ACP_BT_TX_LINEARPOSITIONCNTR_LOW 0x0002088
+-#define ACP_BT_TX_INTR_WATERMARK_SIZE 0x000208C
+-#define ACP_HS_RX_RINGBUFADDR 0x0002090
+-#define ACP_HS_RX_RINGBUFSIZE 0x0002094
+-#define ACP_HS_RX_LINKPOSITIONCNTR 0x0002098
+-#define ACP_HS_RX_FIFOADDR 0x000209C
+-#define ACP_HS_RX_FIFOSIZE 0x00020A0
+-#define ACP_HS_RX_DMA_SIZE 0x00020A4
+-#define ACP_HS_RX_LINEARPOSITIONCNTR_HIGH 0x00020A8
+-#define ACP_HS_RX_LINEARPOSITIONCNTR_LOW 0x00020AC
+-#define ACP_HS_RX_INTR_WATERMARK_SIZE 0x00020B0
+-#define ACP_HS_TX_RINGBUFADDR 0x00020B4
+-#define ACP_HS_TX_RINGBUFSIZE 0x00020B8
+-#define ACP_HS_TX_LINKPOSITIONCNTR 0x00020BC
+-#define ACP_HS_TX_FIFOADDR 0x00020C0
+-#define ACP_HS_TX_FIFOSIZE 0x00020C4
+-#define ACP_HS_TX_DMA_SIZE 0x00020C8
+-#define ACP_HS_TX_LINEARPOSITIONCNTR_HIGH 0x00020CC
+-#define ACP_HS_TX_LINEARPOSITIONCNTR_LOW 0x00020D0
+-#define ACP_HS_TX_INTR_WATERMARK_SIZE 0x00020D4
+-
+-/* Registers from ACP_I2S_TDM block */
+-#define ACP_I2STDM_IER 0x0002400
+-#define ACP_I2STDM_IRER 0x0002404
+-#define ACP_I2STDM_RXFRMT 0x0002408
+-#define ACP_I2STDM_ITER 0x000240C
+-#define ACP_I2STDM_TXFRMT 0x0002410
+-#define ACP_I2STDM0_MSTRCLKGEN 0x0002414
+-#define ACP_I2STDM1_MSTRCLKGEN 0x0002418
+-#define ACP_I2STDM2_MSTRCLKGEN 0x000241C
+-#define ACP_I2STDM_REFCLKGEN 0x0002420
+-
+-/* Registers from ACP_BT_TDM block */
+-#define ACP_BTTDM_IER 0x0002800
+-#define ACP_BTTDM_IRER 0x0002804
+-#define ACP_BTTDM_RXFRMT 0x0002808
+-#define ACP_BTTDM_ITER 0x000280C
+-#define ACP_BTTDM_TXFRMT 0x0002810
+-#define ACP_HSTDM_IER 0x0002814
+-#define ACP_HSTDM_IRER 0x0002818
+-#define ACP_HSTDM_RXFRMT 0x000281C
+-#define ACP_HSTDM_ITER 0x0002820
+-#define ACP_HSTDM_TXFRMT 0x0002824
+-
+-/* Registers from ACP_WOV block */
+-#define ACP_WOV_PDM_ENABLE 0x0002C04
+-#define ACP_WOV_PDM_DMA_ENABLE 0x0002C08
+-#define ACP_WOV_RX_RINGBUFADDR 0x0002C0C
+-#define ACP_WOV_RX_RINGBUFSIZE 0x0002C10
+-#define ACP_WOV_RX_LINKPOSITIONCNTR 0x0002C14
+-#define ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH 0x0002C18
+-#define ACP_WOV_RX_LINEARPOSITIONCNTR_LOW 0x0002C1C
+-#define ACP_WOV_RX_INTR_WATERMARK_SIZE 0x0002C20
+-#define ACP_WOV_PDM_FIFO_FLUSH 0x0002C24
+-#define ACP_WOV_PDM_NO_OF_CHANNELS 0x0002C28
+-#define ACP_WOV_PDM_DECIMATION_FACTOR 0x0002C2C
+-#define ACP_WOV_PDM_VAD_CTRL 0x0002C30
+-#define ACP_WOV_WAKE 0x0002C54
+-#define ACP_WOV_BUFFER_STATUS 0x0002C58
+-#define ACP_WOV_MISC_CTRL 0x0002C5C
+-#define ACP_WOV_CLK_CTRL 0x0002C60
+-#define ACP_PDM_VAD_DYNAMIC_CLK_GATING_EN 0x0002C64
+-#define ACP_WOV_ERROR_STATUS_REGISTER 0x0002C68
+-#define ACP_PDM_CLKDIV 0x0002C6C
+-
+-/* Registers from ACP_P1_AUDIO_BUFFERS block */
+-#define ACP_P1_I2S_RX_RINGBUFADDR 0x0003A00
+-#define ACP_P1_I2S_RX_RINGBUFSIZE 0x0003A04
+-#define ACP_P1_I2S_RX_LINKPOSITIONCNTR 0x0003A08
+-#define ACP_P1_I2S_RX_FIFOADDR 0x0003A0C
+-#define ACP_P1_I2S_RX_FIFOSIZE 0x0003A10
+-#define ACP_P1_I2S_RX_DMA_SIZE 0x0003A14
+-#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0003A18
+-#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_LOW 0x0003A1C
+-#define ACP_P1_I2S_RX_INTR_WATERMARK_SIZE 0x0003A20
+-#define ACP_P1_I2S_TX_RINGBUFADDR 0x0003A24
+-#define ACP_P1_I2S_TX_RINGBUFSIZE 0x0003A28
+-#define ACP_P1_I2S_TX_LINKPOSITIONCNTR 0x0003A2C
+-#define ACP_P1_I2S_TX_FIFOADDR 0x0003A30
+-#define ACP_P1_I2S_TX_FIFOSIZE 0x0003A34
+-#define ACP_P1_I2S_TX_DMA_SIZE 0x0003A38
+-#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x0003A3C
+-#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0003A40
+-#define ACP_P1_I2S_TX_INTR_WATERMARK_SIZE 0x0003A44
+-#define ACP_P1_BT_RX_RINGBUFADDR 0x0003A48
+-#define ACP_P1_BT_RX_RINGBUFSIZE 0x0003A4C
+-#define ACP_P1_BT_RX_LINKPOSITIONCNTR 0x0003A50
+-#define ACP_P1_BT_RX_FIFOADDR 0x0003A54
+-#define ACP_P1_BT_RX_FIFOSIZE 0x0003A58
+-#define ACP_P1_BT_RX_DMA_SIZE 0x0003A5C
+-#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0003A60
+-#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_LOW 0x0003A64
+-#define ACP_P1_BT_RX_INTR_WATERMARK_SIZE 0x0003A68
+-#define ACP_P1_BT_TX_RINGBUFADDR 0x0003A6C
+-#define ACP_P1_BT_TX_RINGBUFSIZE 0x0003A70
+-#define ACP_P1_BT_TX_LINKPOSITIONCNTR 0x0003A74
+-#define ACP_P1_BT_TX_FIFOADDR 0x0003A78
+-#define ACP_P1_BT_TX_FIFOSIZE 0x0003A7C
+-#define ACP_P1_BT_TX_DMA_SIZE 0x0003A80
+-#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0003A84
+-#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_LOW 0x0003A88
+-#define ACP_P1_BT_TX_INTR_WATERMARK_SIZE 0x0003A8C
+-#define ACP_P1_HS_RX_RINGBUFADDR 0x0003A90
+-#define ACP_P1_HS_RX_RINGBUFSIZE 0x0003A94
+-#define ACP_P1_HS_RX_LINKPOSITIONCNTR 0x0003A98
+-#define ACP_P1_HS_RX_FIFOADDR 0x0003A9C
+-#define ACP_P1_HS_RX_FIFOSIZE 0x0003AA0
+-#define ACP_P1_HS_RX_DMA_SIZE 0x0003AA4
+-#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_HIGH 0x0003AA8
+-#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_LOW 0x0003AAC
+-#define ACP_P1_HS_RX_INTR_WATERMARK_SIZE 0x0003AB0
+-#define ACP_P1_HS_TX_RINGBUFADDR 0x0003AB4
+-#define ACP_P1_HS_TX_RINGBUFSIZE 0x0003AB8
+-#define ACP_P1_HS_TX_LINKPOSITIONCNTR 0x0003ABC
+-#define ACP_P1_HS_TX_FIFOADDR 0x0003AC0
+-#define ACP_P1_HS_TX_FIFOSIZE 0x0003AC4
+-#define ACP_P1_HS_TX_DMA_SIZE 0x0003AC8
+-#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_HIGH 0x0003ACC
+-#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_LOW 0x0003AD0
+-#define ACP_P1_HS_TX_INTR_WATERMARK_SIZE 0x0003AD4
+-
+-/* Registers from ACP_SCRATCH block */
+-#define ACP_SCRATCH_REG_0 0x0010000
+-#define ACP_SCRATCH_REG_1 0x0010004
+-#define ACP_SCRATCH_REG_2 0x0010008
+-#define ACP_SCRATCH_REG_3 0x001000C
+-#define ACP_SCRATCH_REG_4 0x0010010
+-#define ACP_SCRATCH_REG_5 0x0010014
+-#define ACP_SCRATCH_REG_6 0x0010018
+-#define ACP_SCRATCH_REG_7 0x001001C
+-#define ACP_SCRATCH_REG_8 0x0010020
+-#define ACP_SCRATCH_REG_9 0x0010024
+-#define ACP_SCRATCH_REG_10 0x0010028
+-#define ACP_SCRATCH_REG_11 0x001002C
+-#define ACP_SCRATCH_REG_12 0x0010030
+-#define ACP_SCRATCH_REG_13 0x0010034
+-#define ACP_SCRATCH_REG_14 0x0010038
+-#define ACP_SCRATCH_REG_15 0x001003C
+-#define ACP_SCRATCH_REG_16 0x0010040
+-#define ACP_SCRATCH_REG_17 0x0010044
+-#define ACP_SCRATCH_REG_18 0x0010048
+-#define ACP_SCRATCH_REG_19 0x001004C
+-#define ACP_SCRATCH_REG_20 0x0010050
+-#define ACP_SCRATCH_REG_21 0x0010054
+-#define ACP_SCRATCH_REG_22 0x0010058
+-#define ACP_SCRATCH_REG_23 0x001005C
+-#define ACP_SCRATCH_REG_24 0x0010060
+-#define ACP_SCRATCH_REG_25 0x0010064
+-#define ACP_SCRATCH_REG_26 0x0010068
+-#define ACP_SCRATCH_REG_27 0x001006C
+-#define ACP_SCRATCH_REG_28 0x0010070
+-#define ACP_SCRATCH_REG_29 0x0010074
+-#define ACP_SCRATCH_REG_30 0x0010078
+-#define ACP_SCRATCH_REG_31 0x001007C
+-#define ACP_SCRATCH_REG_32 0x0010080
+-#define ACP_SCRATCH_REG_33 0x0010084
+-#define ACP_SCRATCH_REG_34 0x0010088
+-#define ACP_SCRATCH_REG_35 0x001008C
+-#define ACP_SCRATCH_REG_36 0x0010090
+-#define ACP_SCRATCH_REG_37 0x0010094
+-#define ACP_SCRATCH_REG_38 0x0010098
+-#define ACP_SCRATCH_REG_39 0x001009C
+-#define ACP_SCRATCH_REG_40 0x00100A0
+-#define ACP_SCRATCH_REG_41 0x00100A4
+-#define ACP_SCRATCH_REG_42 0x00100A8
+-#define ACP_SCRATCH_REG_43 0x00100AC
+-#define ACP_SCRATCH_REG_44 0x00100B0
+-#define ACP_SCRATCH_REG_45 0x00100B4
+-#define ACP_SCRATCH_REG_46 0x00100B8
+-#define ACP_SCRATCH_REG_47 0x00100BC
+-#define ACP_SCRATCH_REG_48 0x00100C0
+-#define ACP_SCRATCH_REG_49 0x00100C4
+-#define ACP_SCRATCH_REG_50 0x00100C8
+-#define ACP_SCRATCH_REG_51 0x00100CC
+-#define ACP_SCRATCH_REG_52 0x00100D0
+-#define ACP_SCRATCH_REG_53 0x00100D4
+-#define ACP_SCRATCH_REG_54 0x00100D8
+-#define ACP_SCRATCH_REG_55 0x00100DC
+-#define ACP_SCRATCH_REG_56 0x00100E0
+-#define ACP_SCRATCH_REG_57 0x00100E4
+-#define ACP_SCRATCH_REG_58 0x00100E8
+-#define ACP_SCRATCH_REG_59 0x00100EC
+-#define ACP_SCRATCH_REG_60 0x00100F0
+-#define ACP_SCRATCH_REG_61 0x00100F4
+-#define ACP_SCRATCH_REG_62 0x00100F8
+-#define ACP_SCRATCH_REG_63 0x00100FC
+-#define ACP_SCRATCH_REG_64 0x0010100
+-#define ACP_SCRATCH_REG_65 0x0010104
+-#define ACP_SCRATCH_REG_66 0x0010108
+-#define ACP_SCRATCH_REG_67 0x001010C
+-#define ACP_SCRATCH_REG_68 0x0010110
+-#define ACP_SCRATCH_REG_69 0x0010114
+-#define ACP_SCRATCH_REG_70 0x0010118
+-#define ACP_SCRATCH_REG_71 0x001011C
+-#define ACP_SCRATCH_REG_72 0x0010120
+-#define ACP_SCRATCH_REG_73 0x0010124
+-#define ACP_SCRATCH_REG_74 0x0010128
+-#define ACP_SCRATCH_REG_75 0x001012C
+-#define ACP_SCRATCH_REG_76 0x0010130
+-#define ACP_SCRATCH_REG_77 0x0010134
+-#define ACP_SCRATCH_REG_78 0x0010138
+-#define ACP_SCRATCH_REG_79 0x001013C
+-#define ACP_SCRATCH_REG_80 0x0010140
+-#define ACP_SCRATCH_REG_81 0x0010144
+-#define ACP_SCRATCH_REG_82 0x0010148
+-#define ACP_SCRATCH_REG_83 0x001014C
+-#define ACP_SCRATCH_REG_84 0x0010150
+-#define ACP_SCRATCH_REG_85 0x0010154
+-#define ACP_SCRATCH_REG_86 0x0010158
+-#define ACP_SCRATCH_REG_87 0x001015C
+-#define ACP_SCRATCH_REG_88 0x0010160
+-#define ACP_SCRATCH_REG_89 0x0010164
+-#define ACP_SCRATCH_REG_90 0x0010168
+-#define ACP_SCRATCH_REG_91 0x001016C
+-#define ACP_SCRATCH_REG_92 0x0010170
+-#define ACP_SCRATCH_REG_93 0x0010174
+-#define ACP_SCRATCH_REG_94 0x0010178
+-#define ACP_SCRATCH_REG_95 0x001017C
+-#define ACP_SCRATCH_REG_96 0x0010180
+-#define ACP_SCRATCH_REG_97 0x0010184
+-#define ACP_SCRATCH_REG_98 0x0010188
+-#define ACP_SCRATCH_REG_99 0x001018C
+-#define ACP_SCRATCH_REG_100 0x0010190
+-#define ACP_SCRATCH_REG_101 0x0010194
+-#define ACP_SCRATCH_REG_102 0x0010198
+-#define ACP_SCRATCH_REG_103 0x001019C
+-#define ACP_SCRATCH_REG_104 0x00101A0
+-#define ACP_SCRATCH_REG_105 0x00101A4
+-#define ACP_SCRATCH_REG_106 0x00101A8
+-#define ACP_SCRATCH_REG_107 0x00101AC
+-#define ACP_SCRATCH_REG_108 0x00101B0
+-#define ACP_SCRATCH_REG_109 0x00101B4
+-#define ACP_SCRATCH_REG_110 0x00101B8
+-#define ACP_SCRATCH_REG_111 0x00101BC
+-#define ACP_SCRATCH_REG_112 0x00101C0
+-#define ACP_SCRATCH_REG_113 0x00101C4
+-#define ACP_SCRATCH_REG_114 0x00101C8
+-#define ACP_SCRATCH_REG_115 0x00101CC
+-#define ACP_SCRATCH_REG_116 0x00101D0
+-#define ACP_SCRATCH_REG_117 0x00101D4
+-#define ACP_SCRATCH_REG_118 0x00101D8
+-#define ACP_SCRATCH_REG_119 0x00101DC
+-#define ACP_SCRATCH_REG_120 0x00101E0
+-#define ACP_SCRATCH_REG_121 0x00101E4
+-#define ACP_SCRATCH_REG_122 0x00101E8
+-#define ACP_SCRATCH_REG_123 0x00101EC
+-#define ACP_SCRATCH_REG_124 0x00101F0
+-#define ACP_SCRATCH_REG_125 0x00101F4
+-#define ACP_SCRATCH_REG_126 0x00101F8
+-#define ACP_SCRATCH_REG_127 0x00101FC
+-#define ACP_SCRATCH_REG_128 0x0010200
+-#endif
+--- /dev/null
++++ b/include/sound/acp63_chip_offset_byte.h
+@@ -0,0 +1,444 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * AMD ACP 6.3 Register Documentation
++ *
++ * Copyright 2022 Advanced Micro Devices, Inc.
++ */
++
++#ifndef _acp_ip_OFFSET_HEADER
++#define _acp_ip_OFFSET_HEADER
++
++/* Registers from ACP_DMA block */
++#define ACP_DMA_CNTL_0 0x0000000
++#define ACP_DMA_CNTL_1 0x0000004
++#define ACP_DMA_CNTL_2 0x0000008
++#define ACP_DMA_CNTL_3 0x000000C
++#define ACP_DMA_CNTL_4 0x0000010
++#define ACP_DMA_CNTL_5 0x0000014
++#define ACP_DMA_CNTL_6 0x0000018
++#define ACP_DMA_CNTL_7 0x000001C
++#define ACP_DMA_DSCR_STRT_IDX_0 0x0000020
++#define ACP_DMA_DSCR_STRT_IDX_1 0x0000024
++#define ACP_DMA_DSCR_STRT_IDX_2 0x0000028
++#define ACP_DMA_DSCR_STRT_IDX_3 0x000002C
++#define ACP_DMA_DSCR_STRT_IDX_4 0x0000030
++#define ACP_DMA_DSCR_STRT_IDX_5 0x0000034
++#define ACP_DMA_DSCR_STRT_IDX_6 0x0000038
++#define ACP_DMA_DSCR_STRT_IDX_7 0x000003C
++#define ACP_DMA_DSCR_CNT_0 0x0000040
++#define ACP_DMA_DSCR_CNT_1 0x0000044
++#define ACP_DMA_DSCR_CNT_2 0x0000048
++#define ACP_DMA_DSCR_CNT_3 0x000004C
++#define ACP_DMA_DSCR_CNT_4 0x0000050
++#define ACP_DMA_DSCR_CNT_5 0x0000054
++#define ACP_DMA_DSCR_CNT_6 0x0000058
++#define ACP_DMA_DSCR_CNT_7 0x000005C
++#define ACP_DMA_PRIO_0 0x0000060
++#define ACP_DMA_PRIO_1 0x0000064
++#define ACP_DMA_PRIO_2 0x0000068
++#define ACP_DMA_PRIO_3 0x000006C
++#define ACP_DMA_PRIO_4 0x0000070
++#define ACP_DMA_PRIO_5 0x0000074
++#define ACP_DMA_PRIO_6 0x0000078
++#define ACP_DMA_PRIO_7 0x000007C
++#define ACP_DMA_CUR_DSCR_0 0x0000080
++#define ACP_DMA_CUR_DSCR_1 0x0000084
++#define ACP_DMA_CUR_DSCR_2 0x0000088
++#define ACP_DMA_CUR_DSCR_3 0x000008C
++#define ACP_DMA_CUR_DSCR_4 0x0000090
++#define ACP_DMA_CUR_DSCR_5 0x0000094
++#define ACP_DMA_CUR_DSCR_6 0x0000098
++#define ACP_DMA_CUR_DSCR_7 0x000009C
++#define ACP_DMA_CUR_TRANS_CNT_0 0x00000A0
++#define ACP_DMA_CUR_TRANS_CNT_1 0x00000A4
++#define ACP_DMA_CUR_TRANS_CNT_2 0x00000A8
++#define ACP_DMA_CUR_TRANS_CNT_3 0x00000AC
++#define ACP_DMA_CUR_TRANS_CNT_4 0x00000B0
++#define ACP_DMA_CUR_TRANS_CNT_5 0x00000B4
++#define ACP_DMA_CUR_TRANS_CNT_6 0x00000B8
++#define ACP_DMA_CUR_TRANS_CNT_7 0x00000BC
++#define ACP_DMA_ERR_STS_0 0x00000C0
++#define ACP_DMA_ERR_STS_1 0x00000C4
++#define ACP_DMA_ERR_STS_2 0x00000C8
++#define ACP_DMA_ERR_STS_3 0x00000CC
++#define ACP_DMA_ERR_STS_4 0x00000D0
++#define ACP_DMA_ERR_STS_5 0x00000D4
++#define ACP_DMA_ERR_STS_6 0x00000D8
++#define ACP_DMA_ERR_STS_7 0x00000DC
++#define ACP_DMA_DESC_BASE_ADDR 0x00000E0
++#define ACP_DMA_DESC_MAX_NUM_DSCR 0x00000E4
++#define ACP_DMA_CH_STS 0x00000E8
++#define ACP_DMA_CH_GROUP 0x00000EC
++#define ACP_DMA_CH_RST_STS 0x00000F0
++
++/* Registers from ACP_AXI2AXIATU block */
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_1 0x0000C00
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_1 0x0000C04
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_2 0x0000C08
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_2 0x0000C0C
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_3 0x0000C10
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_3 0x0000C14
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_4 0x0000C18
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_4 0x0000C1C
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_5 0x0000C20
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_5 0x0000C24
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_6 0x0000C28
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_6 0x0000C2C
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_7 0x0000C30
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_7 0x0000C34
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_8 0x0000C38
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_8 0x0000C3C
++#define ACPAXI2AXI_ATU_CTRL 0x0000C40
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_9 0x0000C44
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_9 0x0000C48
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_10 0x0000C4C
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_10 0x0000C50
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_11 0x0000C54
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_11 0x0000C58
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_12 0x0000C5C
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_12 0x0000C60
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_13 0x0000C64
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_13 0x0000C68
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_14 0x0000C6C
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_14 0x0000C70
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_15 0x0000C74
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_15 0x0000C78
++#define ACPAXI2AXI_ATU_PAGE_SIZE_GRP_16 0x0000C7C
++#define ACPAXI2AXI_ATU_BASE_ADDR_GRP_16 0x0000C80
++
++/* Registers from ACP_CLKRST block */
++#define ACP_SOFT_RESET 0x0001000
++#define ACP_CONTROL 0x0001004
++#define ACP_STATUS 0x0001008
++#define ACP_DYNAMIC_CG_MASTER_CONTROL 0x0001010
++#define ACP_ZSC_DSP_CTRL 0x0001014
++#define ACP_ZSC_STS 0x0001018
++#define ACP_PGFSM_CONTROL 0x0001024
++#define ACP_PGFSM_STATUS 0x0001028
++#define ACP_CLKMUX_SEL 0x000102C
++
++/* Registers from ACP_AON block */
++#define ACP_PME_EN 0x0001400
++#define ACP_DEVICE_STATE 0x0001404
++#define AZ_DEVICE_STATE 0x0001408
++#define ACP_PIN_CONFIG 0x0001440
++#define ACP_PAD_PULLUP_CTRL 0x0001444
++#define ACP_PAD_PULLDOWN_CTRL 0x0001448
++#define ACP_PAD_DRIVE_STRENGTH_CTRL 0x000144C
++#define ACP_PAD_SCHMEN_CTRL 0x0001450
++#define ACP_SW_PAD_KEEPER_EN 0x0001454
++#define ACP_SW_WAKE_EN 0x0001458
++#define ACP_I2S_WAKE_EN 0x000145C
++#define ACP_SW1_WAKE_EN 0x0001460
++
++/* Registers from ACP_P1_MISC block */
++#define ACP_EXTERNAL_INTR_ENB 0x0001A00
++#define ACP_EXTERNAL_INTR_CNTL 0x0001A04
++#define ACP_EXTERNAL_INTR_CNTL1 0x0001A08
++#define ACP_EXTERNAL_INTR_STAT 0x0001A0C
++#define ACP_EXTERNAL_INTR_STAT1 0x0001A10
++#define ACP_ERROR_STATUS 0x0001A4C
++#define ACP_P1_SW_I2S_ERROR_REASON 0x0001A50
++#define ACP_P1_SW_POS_TRACK_I2S_TX_CTRL 0x0001A6C
++#define ACP_P1_SW_I2S_TX_DMA_POS 0x0001A70
++#define ACP_P1_SW_POS_TRACK_I2S_RX_CTRL 0x0001A74
++#define ACP_P1_SW_I2S_RX_DMA_POS 0x0001A78
++#define ACP_P1_DMIC_I2S_GPIO_INTR_CTRL 0x0001A7C
++#define ACP_P1_DMIC_I2S_GPIO_INTR_STATUS 0x0001A80
++#define ACP_SCRATCH_REG_BASE_ADDR 0x0001A84
++#define ACP_P1_SW_POS_TRACK_BT_TX_CTRL 0x0001A88
++#define ACP_P1_SW_BT_TX_DMA_POS 0x0001A8C
++#define ACP_P1_SW_POS_TRACK_HS_TX_CTRL 0x0001A90
++#define ACP_P1_SW_HS_TX_DMA_POS 0x0001A94
++#define ACP_P1_SW_POS_TRACK_BT_RX_CTRL 0x0001A98
++#define ACP_P1_SW_BT_RX_DMA_POS 0x0001A9C
++#define ACP_P1_SW_POS_TRACK_HS_RX_CTRL 0x0001AA0
++#define ACP_P1_SW_HS_RX_DMA_POS 0x0001AA4
++
++/* Registers from ACP_AUDIO_BUFFERS block */
++#define ACP_I2S_RX_RINGBUFADDR 0x0002000
++#define ACP_I2S_RX_RINGBUFSIZE 0x0002004
++#define ACP_I2S_RX_LINKPOSITIONCNTR 0x0002008
++#define ACP_I2S_RX_FIFOADDR 0x000200C
++#define ACP_I2S_RX_FIFOSIZE 0x0002010
++#define ACP_I2S_RX_DMA_SIZE 0x0002014
++#define ACP_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0002018
++#define ACP_I2S_RX_LINEARPOSITIONCNTR_LOW 0x000201C
++#define ACP_I2S_RX_INTR_WATERMARK_SIZE 0x0002020
++#define ACP_I2S_TX_RINGBUFADDR 0x0002024
++#define ACP_I2S_TX_RINGBUFSIZE 0x0002028
++#define ACP_I2S_TX_LINKPOSITIONCNTR 0x000202C
++#define ACP_I2S_TX_FIFOADDR 0x0002030
++#define ACP_I2S_TX_FIFOSIZE 0x0002034
++#define ACP_I2S_TX_DMA_SIZE 0x0002038
++#define ACP_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x000203C
++#define ACP_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0002040
++#define ACP_I2S_TX_INTR_WATERMARK_SIZE 0x0002044
++#define ACP_BT_RX_RINGBUFADDR 0x0002048
++#define ACP_BT_RX_RINGBUFSIZE 0x000204C
++#define ACP_BT_RX_LINKPOSITIONCNTR 0x0002050
++#define ACP_BT_RX_FIFOADDR 0x0002054
++#define ACP_BT_RX_FIFOSIZE 0x0002058
++#define ACP_BT_RX_DMA_SIZE 0x000205C
++#define ACP_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0002060
++#define ACP_BT_RX_LINEARPOSITIONCNTR_LOW 0x0002064
++#define ACP_BT_RX_INTR_WATERMARK_SIZE 0x0002068
++#define ACP_BT_TX_RINGBUFADDR 0x000206C
++#define ACP_BT_TX_RINGBUFSIZE 0x0002070
++#define ACP_BT_TX_LINKPOSITIONCNTR 0x0002074
++#define ACP_BT_TX_FIFOADDR 0x0002078
++#define ACP_BT_TX_FIFOSIZE 0x000207C
++#define ACP_BT_TX_DMA_SIZE 0x0002080
++#define ACP_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0002084
++#define ACP_BT_TX_LINEARPOSITIONCNTR_LOW 0x0002088
++#define ACP_BT_TX_INTR_WATERMARK_SIZE 0x000208C
++#define ACP_HS_RX_RINGBUFADDR 0x0002090
++#define ACP_HS_RX_RINGBUFSIZE 0x0002094
++#define ACP_HS_RX_LINKPOSITIONCNTR 0x0002098
++#define ACP_HS_RX_FIFOADDR 0x000209C
++#define ACP_HS_RX_FIFOSIZE 0x00020A0
++#define ACP_HS_RX_DMA_SIZE 0x00020A4
++#define ACP_HS_RX_LINEARPOSITIONCNTR_HIGH 0x00020A8
++#define ACP_HS_RX_LINEARPOSITIONCNTR_LOW 0x00020AC
++#define ACP_HS_RX_INTR_WATERMARK_SIZE 0x00020B0
++#define ACP_HS_TX_RINGBUFADDR 0x00020B4
++#define ACP_HS_TX_RINGBUFSIZE 0x00020B8
++#define ACP_HS_TX_LINKPOSITIONCNTR 0x00020BC
++#define ACP_HS_TX_FIFOADDR 0x00020C0
++#define ACP_HS_TX_FIFOSIZE 0x00020C4
++#define ACP_HS_TX_DMA_SIZE 0x00020C8
++#define ACP_HS_TX_LINEARPOSITIONCNTR_HIGH 0x00020CC
++#define ACP_HS_TX_LINEARPOSITIONCNTR_LOW 0x00020D0
++#define ACP_HS_TX_INTR_WATERMARK_SIZE 0x00020D4
++
++/* Registers from ACP_I2S_TDM block */
++#define ACP_I2STDM_IER 0x0002400
++#define ACP_I2STDM_IRER 0x0002404
++#define ACP_I2STDM_RXFRMT 0x0002408
++#define ACP_I2STDM_ITER 0x000240C
++#define ACP_I2STDM_TXFRMT 0x0002410
++#define ACP_I2STDM0_MSTRCLKGEN 0x0002414
++#define ACP_I2STDM1_MSTRCLKGEN 0x0002418
++#define ACP_I2STDM2_MSTRCLKGEN 0x000241C
++#define ACP_I2STDM_REFCLKGEN 0x0002420
++
++/* Registers from ACP_BT_TDM block */
++#define ACP_BTTDM_IER 0x0002800
++#define ACP_BTTDM_IRER 0x0002804
++#define ACP_BTTDM_RXFRMT 0x0002808
++#define ACP_BTTDM_ITER 0x000280C
++#define ACP_BTTDM_TXFRMT 0x0002810
++#define ACP_HSTDM_IER 0x0002814
++#define ACP_HSTDM_IRER 0x0002818
++#define ACP_HSTDM_RXFRMT 0x000281C
++#define ACP_HSTDM_ITER 0x0002820
++#define ACP_HSTDM_TXFRMT 0x0002824
++
++/* Registers from ACP_WOV block */
++#define ACP_WOV_PDM_ENABLE 0x0002C04
++#define ACP_WOV_PDM_DMA_ENABLE 0x0002C08
++#define ACP_WOV_RX_RINGBUFADDR 0x0002C0C
++#define ACP_WOV_RX_RINGBUFSIZE 0x0002C10
++#define ACP_WOV_RX_LINKPOSITIONCNTR 0x0002C14
++#define ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH 0x0002C18
++#define ACP_WOV_RX_LINEARPOSITIONCNTR_LOW 0x0002C1C
++#define ACP_WOV_RX_INTR_WATERMARK_SIZE 0x0002C20
++#define ACP_WOV_PDM_FIFO_FLUSH 0x0002C24
++#define ACP_WOV_PDM_NO_OF_CHANNELS 0x0002C28
++#define ACP_WOV_PDM_DECIMATION_FACTOR 0x0002C2C
++#define ACP_WOV_PDM_VAD_CTRL 0x0002C30
++#define ACP_WOV_WAKE 0x0002C54
++#define ACP_WOV_BUFFER_STATUS 0x0002C58
++#define ACP_WOV_MISC_CTRL 0x0002C5C
++#define ACP_WOV_CLK_CTRL 0x0002C60
++#define ACP_PDM_VAD_DYNAMIC_CLK_GATING_EN 0x0002C64
++#define ACP_WOV_ERROR_STATUS_REGISTER 0x0002C68
++#define ACP_PDM_CLKDIV 0x0002C6C
++
++/* Registers from ACP_P1_AUDIO_BUFFERS block */
++#define ACP_P1_I2S_RX_RINGBUFADDR 0x0003A00
++#define ACP_P1_I2S_RX_RINGBUFSIZE 0x0003A04
++#define ACP_P1_I2S_RX_LINKPOSITIONCNTR 0x0003A08
++#define ACP_P1_I2S_RX_FIFOADDR 0x0003A0C
++#define ACP_P1_I2S_RX_FIFOSIZE 0x0003A10
++#define ACP_P1_I2S_RX_DMA_SIZE 0x0003A14
++#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_HIGH 0x0003A18
++#define ACP_P1_I2S_RX_LINEARPOSITIONCNTR_LOW 0x0003A1C
++#define ACP_P1_I2S_RX_INTR_WATERMARK_SIZE 0x0003A20
++#define ACP_P1_I2S_TX_RINGBUFADDR 0x0003A24
++#define ACP_P1_I2S_TX_RINGBUFSIZE 0x0003A28
++#define ACP_P1_I2S_TX_LINKPOSITIONCNTR 0x0003A2C
++#define ACP_P1_I2S_TX_FIFOADDR 0x0003A30
++#define ACP_P1_I2S_TX_FIFOSIZE 0x0003A34
++#define ACP_P1_I2S_TX_DMA_SIZE 0x0003A38
++#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_HIGH 0x0003A3C
++#define ACP_P1_I2S_TX_LINEARPOSITIONCNTR_LOW 0x0003A40
++#define ACP_P1_I2S_TX_INTR_WATERMARK_SIZE 0x0003A44
++#define ACP_P1_BT_RX_RINGBUFADDR 0x0003A48
++#define ACP_P1_BT_RX_RINGBUFSIZE 0x0003A4C
++#define ACP_P1_BT_RX_LINKPOSITIONCNTR 0x0003A50
++#define ACP_P1_BT_RX_FIFOADDR 0x0003A54
++#define ACP_P1_BT_RX_FIFOSIZE 0x0003A58
++#define ACP_P1_BT_RX_DMA_SIZE 0x0003A5C
++#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_HIGH 0x0003A60
++#define ACP_P1_BT_RX_LINEARPOSITIONCNTR_LOW 0x0003A64
++#define ACP_P1_BT_RX_INTR_WATERMARK_SIZE 0x0003A68
++#define ACP_P1_BT_TX_RINGBUFADDR 0x0003A6C
++#define ACP_P1_BT_TX_RINGBUFSIZE 0x0003A70
++#define ACP_P1_BT_TX_LINKPOSITIONCNTR 0x0003A74
++#define ACP_P1_BT_TX_FIFOADDR 0x0003A78
++#define ACP_P1_BT_TX_FIFOSIZE 0x0003A7C
++#define ACP_P1_BT_TX_DMA_SIZE 0x0003A80
++#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_HIGH 0x0003A84
++#define ACP_P1_BT_TX_LINEARPOSITIONCNTR_LOW 0x0003A88
++#define ACP_P1_BT_TX_INTR_WATERMARK_SIZE 0x0003A8C
++#define ACP_P1_HS_RX_RINGBUFADDR 0x0003A90
++#define ACP_P1_HS_RX_RINGBUFSIZE 0x0003A94
++#define ACP_P1_HS_RX_LINKPOSITIONCNTR 0x0003A98
++#define ACP_P1_HS_RX_FIFOADDR 0x0003A9C
++#define ACP_P1_HS_RX_FIFOSIZE 0x0003AA0
++#define ACP_P1_HS_RX_DMA_SIZE 0x0003AA4
++#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_HIGH 0x0003AA8
++#define ACP_P1_HS_RX_LINEARPOSITIONCNTR_LOW 0x0003AAC
++#define ACP_P1_HS_RX_INTR_WATERMARK_SIZE 0x0003AB0
++#define ACP_P1_HS_TX_RINGBUFADDR 0x0003AB4
++#define ACP_P1_HS_TX_RINGBUFSIZE 0x0003AB8
++#define ACP_P1_HS_TX_LINKPOSITIONCNTR 0x0003ABC
++#define ACP_P1_HS_TX_FIFOADDR 0x0003AC0
++#define ACP_P1_HS_TX_FIFOSIZE 0x0003AC4
++#define ACP_P1_HS_TX_DMA_SIZE 0x0003AC8
++#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_HIGH 0x0003ACC
++#define ACP_P1_HS_TX_LINEARPOSITIONCNTR_LOW 0x0003AD0
++#define ACP_P1_HS_TX_INTR_WATERMARK_SIZE 0x0003AD4
++
++/* Registers from ACP_SCRATCH block */
++#define ACP_SCRATCH_REG_0 0x0010000
++#define ACP_SCRATCH_REG_1 0x0010004
++#define ACP_SCRATCH_REG_2 0x0010008
++#define ACP_SCRATCH_REG_3 0x001000C
++#define ACP_SCRATCH_REG_4 0x0010010
++#define ACP_SCRATCH_REG_5 0x0010014
++#define ACP_SCRATCH_REG_6 0x0010018
++#define ACP_SCRATCH_REG_7 0x001001C
++#define ACP_SCRATCH_REG_8 0x0010020
++#define ACP_SCRATCH_REG_9 0x0010024
++#define ACP_SCRATCH_REG_10 0x0010028
++#define ACP_SCRATCH_REG_11 0x001002C
++#define ACP_SCRATCH_REG_12 0x0010030
++#define ACP_SCRATCH_REG_13 0x0010034
++#define ACP_SCRATCH_REG_14 0x0010038
++#define ACP_SCRATCH_REG_15 0x001003C
++#define ACP_SCRATCH_REG_16 0x0010040
++#define ACP_SCRATCH_REG_17 0x0010044
++#define ACP_SCRATCH_REG_18 0x0010048
++#define ACP_SCRATCH_REG_19 0x001004C
++#define ACP_SCRATCH_REG_20 0x0010050
++#define ACP_SCRATCH_REG_21 0x0010054
++#define ACP_SCRATCH_REG_22 0x0010058
++#define ACP_SCRATCH_REG_23 0x001005C
++#define ACP_SCRATCH_REG_24 0x0010060
++#define ACP_SCRATCH_REG_25 0x0010064
++#define ACP_SCRATCH_REG_26 0x0010068
++#define ACP_SCRATCH_REG_27 0x001006C
++#define ACP_SCRATCH_REG_28 0x0010070
++#define ACP_SCRATCH_REG_29 0x0010074
++#define ACP_SCRATCH_REG_30 0x0010078
++#define ACP_SCRATCH_REG_31 0x001007C
++#define ACP_SCRATCH_REG_32 0x0010080
++#define ACP_SCRATCH_REG_33 0x0010084
++#define ACP_SCRATCH_REG_34 0x0010088
++#define ACP_SCRATCH_REG_35 0x001008C
++#define ACP_SCRATCH_REG_36 0x0010090
++#define ACP_SCRATCH_REG_37 0x0010094
++#define ACP_SCRATCH_REG_38 0x0010098
++#define ACP_SCRATCH_REG_39 0x001009C
++#define ACP_SCRATCH_REG_40 0x00100A0
++#define ACP_SCRATCH_REG_41 0x00100A4
++#define ACP_SCRATCH_REG_42 0x00100A8
++#define ACP_SCRATCH_REG_43 0x00100AC
++#define ACP_SCRATCH_REG_44 0x00100B0
++#define ACP_SCRATCH_REG_45 0x00100B4
++#define ACP_SCRATCH_REG_46 0x00100B8
++#define ACP_SCRATCH_REG_47 0x00100BC
++#define ACP_SCRATCH_REG_48 0x00100C0
++#define ACP_SCRATCH_REG_49 0x00100C4
++#define ACP_SCRATCH_REG_50 0x00100C8
++#define ACP_SCRATCH_REG_51 0x00100CC
++#define ACP_SCRATCH_REG_52 0x00100D0
++#define ACP_SCRATCH_REG_53 0x00100D4
++#define ACP_SCRATCH_REG_54 0x00100D8
++#define ACP_SCRATCH_REG_55 0x00100DC
++#define ACP_SCRATCH_REG_56 0x00100E0
++#define ACP_SCRATCH_REG_57 0x00100E4
++#define ACP_SCRATCH_REG_58 0x00100E8
++#define ACP_SCRATCH_REG_59 0x00100EC
++#define ACP_SCRATCH_REG_60 0x00100F0
++#define ACP_SCRATCH_REG_61 0x00100F4
++#define ACP_SCRATCH_REG_62 0x00100F8
++#define ACP_SCRATCH_REG_63 0x00100FC
++#define ACP_SCRATCH_REG_64 0x0010100
++#define ACP_SCRATCH_REG_65 0x0010104
++#define ACP_SCRATCH_REG_66 0x0010108
++#define ACP_SCRATCH_REG_67 0x001010C
++#define ACP_SCRATCH_REG_68 0x0010110
++#define ACP_SCRATCH_REG_69 0x0010114
++#define ACP_SCRATCH_REG_70 0x0010118
++#define ACP_SCRATCH_REG_71 0x001011C
++#define ACP_SCRATCH_REG_72 0x0010120
++#define ACP_SCRATCH_REG_73 0x0010124
++#define ACP_SCRATCH_REG_74 0x0010128
++#define ACP_SCRATCH_REG_75 0x001012C
++#define ACP_SCRATCH_REG_76 0x0010130
++#define ACP_SCRATCH_REG_77 0x0010134
++#define ACP_SCRATCH_REG_78 0x0010138
++#define ACP_SCRATCH_REG_79 0x001013C
++#define ACP_SCRATCH_REG_80 0x0010140
++#define ACP_SCRATCH_REG_81 0x0010144
++#define ACP_SCRATCH_REG_82 0x0010148
++#define ACP_SCRATCH_REG_83 0x001014C
++#define ACP_SCRATCH_REG_84 0x0010150
++#define ACP_SCRATCH_REG_85 0x0010154
++#define ACP_SCRATCH_REG_86 0x0010158
++#define ACP_SCRATCH_REG_87 0x001015C
++#define ACP_SCRATCH_REG_88 0x0010160
++#define ACP_SCRATCH_REG_89 0x0010164
++#define ACP_SCRATCH_REG_90 0x0010168
++#define ACP_SCRATCH_REG_91 0x001016C
++#define ACP_SCRATCH_REG_92 0x0010170
++#define ACP_SCRATCH_REG_93 0x0010174
++#define ACP_SCRATCH_REG_94 0x0010178
++#define ACP_SCRATCH_REG_95 0x001017C
++#define ACP_SCRATCH_REG_96 0x0010180
++#define ACP_SCRATCH_REG_97 0x0010184
++#define ACP_SCRATCH_REG_98 0x0010188
++#define ACP_SCRATCH_REG_99 0x001018C
++#define ACP_SCRATCH_REG_100 0x0010190
++#define ACP_SCRATCH_REG_101 0x0010194
++#define ACP_SCRATCH_REG_102 0x0010198
++#define ACP_SCRATCH_REG_103 0x001019C
++#define ACP_SCRATCH_REG_104 0x00101A0
++#define ACP_SCRATCH_REG_105 0x00101A4
++#define ACP_SCRATCH_REG_106 0x00101A8
++#define ACP_SCRATCH_REG_107 0x00101AC
++#define ACP_SCRATCH_REG_108 0x00101B0
++#define ACP_SCRATCH_REG_109 0x00101B4
++#define ACP_SCRATCH_REG_110 0x00101B8
++#define ACP_SCRATCH_REG_111 0x00101BC
++#define ACP_SCRATCH_REG_112 0x00101C0
++#define ACP_SCRATCH_REG_113 0x00101C4
++#define ACP_SCRATCH_REG_114 0x00101C8
++#define ACP_SCRATCH_REG_115 0x00101CC
++#define ACP_SCRATCH_REG_116 0x00101D0
++#define ACP_SCRATCH_REG_117 0x00101D4
++#define ACP_SCRATCH_REG_118 0x00101D8
++#define ACP_SCRATCH_REG_119 0x00101DC
++#define ACP_SCRATCH_REG_120 0x00101E0
++#define ACP_SCRATCH_REG_121 0x00101E4
++#define ACP_SCRATCH_REG_122 0x00101E8
++#define ACP_SCRATCH_REG_123 0x00101EC
++#define ACP_SCRATCH_REG_124 0x00101F0
++#define ACP_SCRATCH_REG_125 0x00101F4
++#define ACP_SCRATCH_REG_126 0x00101F8
++#define ACP_SCRATCH_REG_127 0x00101FC
++#define ACP_SCRATCH_REG_128 0x0010200
++#endif
+--- a/sound/soc/amd/Kconfig
++++ b/sound/soc/amd/Kconfig
+@@ -129,10 +129,10 @@ config SND_SOC_AMD_RPL_ACP6x
+ If unsure select "N".
+
+ config SND_SOC_AMD_PS
+- tristate "AMD Audio Coprocessor-v6.2 Pink Sardine support"
++ tristate "AMD Audio Coprocessor-v6.3 Pink Sardine support"
+ depends on X86 && PCI && ACPI
+ help
+- This option enables Audio Coprocessor i.e ACP v6.2 support on
++ This option enables Audio Coprocessor i.e ACP v6.3 support on
+ AMD Pink sardine platform. By enabling this flag build will be
+ triggered for ACP PCI driver, ACP PDM DMA driver.
+ Say m if you have such a device.
+--- a/sound/soc/amd/ps/acp62.h
++++ /dev/null
+@@ -1,98 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0+ */
+-/*
+- * AMD ALSA SoC PDM Driver
+- *
+- * Copyright (C) 2022 Advanced Micro Devices, Inc. All rights reserved.
+- */
+-
+-#include <sound/acp62_chip_offset_byte.h>
+-
+-#define ACP_DEVICE_ID 0x15E2
+-#define ACP6x_REG_START 0x1240000
+-#define ACP6x_REG_END 0x1250200
+-#define ACP6x_DEVS 3
+-#define ACP6x_PDM_MODE 1
+-
+-#define ACP_SOFT_RESET_SOFTRESET_AUDDONE_MASK 0x00010001
+-#define ACP_PGFSM_CNTL_POWER_ON_MASK 1
+-#define ACP_PGFSM_CNTL_POWER_OFF_MASK 0
+-#define ACP_PGFSM_STATUS_MASK 3
+-#define ACP_POWERED_ON 0
+-#define ACP_POWER_ON_IN_PROGRESS 1
+-#define ACP_POWERED_OFF 2
+-#define ACP_POWER_OFF_IN_PROGRESS 3
+-
+-#define ACP_ERROR_MASK 0x20000000
+-#define ACP_EXT_INTR_STAT_CLEAR_MASK 0xFFFFFFFF
+-#define PDM_DMA_STAT 0x10
+-
+-#define PDM_DMA_INTR_MASK 0x10000
+-#define ACP_ERROR_STAT 29
+-#define PDM_DECIMATION_FACTOR 2
+-#define ACP_PDM_CLK_FREQ_MASK 7
+-#define ACP_WOV_MISC_CTRL_MASK 0x10
+-#define ACP_PDM_ENABLE 1
+-#define ACP_PDM_DISABLE 0
+-#define ACP_PDM_DMA_EN_STATUS 2
+-#define TWO_CH 2
+-#define DELAY_US 5
+-#define ACP_COUNTER 20000
+-
+-#define ACP_SRAM_PTE_OFFSET 0x03800000
+-#define PAGE_SIZE_4K_ENABLE 2
+-#define PDM_PTE_OFFSET 0
+-#define PDM_MEM_WINDOW_START 0x4000000
+-
+-#define CAPTURE_MIN_NUM_PERIODS 4
+-#define CAPTURE_MAX_NUM_PERIODS 4
+-#define CAPTURE_MAX_PERIOD_SIZE 8192
+-#define CAPTURE_MIN_PERIOD_SIZE 4096
+-
+-#define MAX_BUFFER (CAPTURE_MAX_PERIOD_SIZE * CAPTURE_MAX_NUM_PERIODS)
+-#define MIN_BUFFER MAX_BUFFER
+-
+-/* time in ms for runtime suspend delay */
+-#define ACP_SUSPEND_DELAY_MS 2000
+-
+-enum acp_config {
+- ACP_CONFIG_0 = 0,
+- ACP_CONFIG_1,
+- ACP_CONFIG_2,
+- ACP_CONFIG_3,
+- ACP_CONFIG_4,
+- ACP_CONFIG_5,
+- ACP_CONFIG_6,
+- ACP_CONFIG_7,
+- ACP_CONFIG_8,
+- ACP_CONFIG_9,
+- ACP_CONFIG_10,
+- ACP_CONFIG_11,
+- ACP_CONFIG_12,
+- ACP_CONFIG_13,
+- ACP_CONFIG_14,
+- ACP_CONFIG_15,
+-};
+-
+-struct pdm_stream_instance {
+- u16 num_pages;
+- u16 channels;
+- dma_addr_t dma_addr;
+- u64 bytescount;
+- void __iomem *acp62_base;
+-};
+-
+-struct pdm_dev_data {
+- u32 pdm_irq;
+- void __iomem *acp62_base;
+- struct snd_pcm_substream *capture_stream;
+-};
+-
+-static inline u32 acp62_readl(void __iomem *base_addr)
+-{
+- return readl(base_addr);
+-}
+-
+-static inline void acp62_writel(u32 val, void __iomem *base_addr)
+-{
+- writel(val, base_addr);
+-}
+--- /dev/null
++++ b/sound/soc/amd/ps/acp63.h
+@@ -0,0 +1,98 @@
++/* SPDX-License-Identifier: GPL-2.0+ */
++/*
++ * AMD ALSA SoC PDM Driver
++ *
++ * Copyright (C) 2022 Advanced Micro Devices, Inc. All rights reserved.
++ */
++
++#include <sound/acp63_chip_offset_byte.h>
++
++#define ACP_DEVICE_ID 0x15E2
++#define ACP6x_REG_START 0x1240000
++#define ACP6x_REG_END 0x1250200
++#define ACP6x_DEVS 3
++#define ACP6x_PDM_MODE 1
++
++#define ACP_SOFT_RESET_SOFTRESET_AUDDONE_MASK 0x00010001
++#define ACP_PGFSM_CNTL_POWER_ON_MASK 1
++#define ACP_PGFSM_CNTL_POWER_OFF_MASK 0
++#define ACP_PGFSM_STATUS_MASK 3
++#define ACP_POWERED_ON 0
++#define ACP_POWER_ON_IN_PROGRESS 1
++#define ACP_POWERED_OFF 2
++#define ACP_POWER_OFF_IN_PROGRESS 3
++
++#define ACP_ERROR_MASK 0x20000000
++#define ACP_EXT_INTR_STAT_CLEAR_MASK 0xFFFFFFFF
++#define PDM_DMA_STAT 0x10
++
++#define PDM_DMA_INTR_MASK 0x10000
++#define ACP_ERROR_STAT 29
++#define PDM_DECIMATION_FACTOR 2
++#define ACP_PDM_CLK_FREQ_MASK 7
++#define ACP_WOV_MISC_CTRL_MASK 0x10
++#define ACP_PDM_ENABLE 1
++#define ACP_PDM_DISABLE 0
++#define ACP_PDM_DMA_EN_STATUS 2
++#define TWO_CH 2
++#define DELAY_US 5
++#define ACP_COUNTER 20000
++
++#define ACP_SRAM_PTE_OFFSET 0x03800000
++#define PAGE_SIZE_4K_ENABLE 2
++#define PDM_PTE_OFFSET 0
++#define PDM_MEM_WINDOW_START 0x4000000
++
++#define CAPTURE_MIN_NUM_PERIODS 4
++#define CAPTURE_MAX_NUM_PERIODS 4
++#define CAPTURE_MAX_PERIOD_SIZE 8192
++#define CAPTURE_MIN_PERIOD_SIZE 4096
++
++#define MAX_BUFFER (CAPTURE_MAX_PERIOD_SIZE * CAPTURE_MAX_NUM_PERIODS)
++#define MIN_BUFFER MAX_BUFFER
++
++/* time in ms for runtime suspend delay */
++#define ACP_SUSPEND_DELAY_MS 2000
++
++enum acp_config {
++ ACP_CONFIG_0 = 0,
++ ACP_CONFIG_1,
++ ACP_CONFIG_2,
++ ACP_CONFIG_3,
++ ACP_CONFIG_4,
++ ACP_CONFIG_5,
++ ACP_CONFIG_6,
++ ACP_CONFIG_7,
++ ACP_CONFIG_8,
++ ACP_CONFIG_9,
++ ACP_CONFIG_10,
++ ACP_CONFIG_11,
++ ACP_CONFIG_12,
++ ACP_CONFIG_13,
++ ACP_CONFIG_14,
++ ACP_CONFIG_15,
++};
++
++struct pdm_stream_instance {
++ u16 num_pages;
++ u16 channels;
++ dma_addr_t dma_addr;
++ u64 bytescount;
++ void __iomem *acp63_base;
++};
++
++struct pdm_dev_data {
++ u32 pdm_irq;
++ void __iomem *acp63_base;
++ struct snd_pcm_substream *capture_stream;
++};
++
++static inline u32 acp63_readl(void __iomem *base_addr)
++{
++ return readl(base_addr);
++}
++
++static inline void acp63_writel(u32 val, void __iomem *base_addr)
++{
++ writel(val, base_addr);
++}
+--- a/sound/soc/amd/ps/pci-ps.c
++++ b/sound/soc/amd/ps/pci-ps.c
+@@ -15,30 +15,30 @@
+ #include <sound/pcm_params.h>
+ #include <linux/pm_runtime.h>
+
+-#include "acp62.h"
++#include "acp63.h"
+
+-struct acp62_dev_data {
+- void __iomem *acp62_base;
++struct acp63_dev_data {
++ void __iomem *acp63_base;
+ struct resource *res;
+- bool acp62_audio_mode;
++ bool acp63_audio_mode;
+ struct platform_device *pdev[ACP6x_DEVS];
+ };
+
+-static int acp62_power_on(void __iomem *acp_base)
++static int acp63_power_on(void __iomem *acp_base)
+ {
+ u32 val;
+ int timeout;
+
+- val = acp62_readl(acp_base + ACP_PGFSM_STATUS);
++ val = acp63_readl(acp_base + ACP_PGFSM_STATUS);
+
+ if (!val)
+ return val;
+
+ if ((val & ACP_PGFSM_STATUS_MASK) != ACP_POWER_ON_IN_PROGRESS)
+- acp62_writel(ACP_PGFSM_CNTL_POWER_ON_MASK, acp_base + ACP_PGFSM_CONTROL);
++ acp63_writel(ACP_PGFSM_CNTL_POWER_ON_MASK, acp_base + ACP_PGFSM_CONTROL);
+ timeout = 0;
+ while (++timeout < 500) {
+- val = acp62_readl(acp_base + ACP_PGFSM_STATUS);
++ val = acp63_readl(acp_base + ACP_PGFSM_STATUS);
+ if (!val)
+ return 0;
+ udelay(1);
+@@ -46,23 +46,23 @@ static int acp62_power_on(void __iomem *
+ return -ETIMEDOUT;
+ }
+
+-static int acp62_reset(void __iomem *acp_base)
++static int acp63_reset(void __iomem *acp_base)
+ {
+ u32 val;
+ int timeout;
+
+- acp62_writel(1, acp_base + ACP_SOFT_RESET);
++ acp63_writel(1, acp_base + ACP_SOFT_RESET);
+ timeout = 0;
+ while (++timeout < 500) {
+- val = acp62_readl(acp_base + ACP_SOFT_RESET);
++ val = acp63_readl(acp_base + ACP_SOFT_RESET);
+ if (val & ACP_SOFT_RESET_SOFTRESET_AUDDONE_MASK)
+ break;
+ cpu_relax();
+ }
+- acp62_writel(0, acp_base + ACP_SOFT_RESET);
++ acp63_writel(0, acp_base + ACP_SOFT_RESET);
+ timeout = 0;
+ while (++timeout < 500) {
+- val = acp62_readl(acp_base + ACP_SOFT_RESET);
++ val = acp63_readl(acp_base + ACP_SOFT_RESET);
+ if (!val)
+ return 0;
+ cpu_relax();
+@@ -70,57 +70,57 @@ static int acp62_reset(void __iomem *acp
+ return -ETIMEDOUT;
+ }
+
+-static void acp62_enable_interrupts(void __iomem *acp_base)
++static void acp63_enable_interrupts(void __iomem *acp_base)
+ {
+- acp62_writel(1, acp_base + ACP_EXTERNAL_INTR_ENB);
++ acp63_writel(1, acp_base + ACP_EXTERNAL_INTR_ENB);
+ }
+
+-static void acp62_disable_interrupts(void __iomem *acp_base)
++static void acp63_disable_interrupts(void __iomem *acp_base)
+ {
+- acp62_writel(ACP_EXT_INTR_STAT_CLEAR_MASK, acp_base +
++ acp63_writel(ACP_EXT_INTR_STAT_CLEAR_MASK, acp_base +
+ ACP_EXTERNAL_INTR_STAT);
+- acp62_writel(0, acp_base + ACP_EXTERNAL_INTR_CNTL);
+- acp62_writel(0, acp_base + ACP_EXTERNAL_INTR_ENB);
++ acp63_writel(0, acp_base + ACP_EXTERNAL_INTR_CNTL);
++ acp63_writel(0, acp_base + ACP_EXTERNAL_INTR_ENB);
+ }
+
+-static int acp62_init(void __iomem *acp_base, struct device *dev)
++static int acp63_init(void __iomem *acp_base, struct device *dev)
+ {
+ int ret;
+
+- ret = acp62_power_on(acp_base);
++ ret = acp63_power_on(acp_base);
+ if (ret) {
+ dev_err(dev, "ACP power on failed\n");
+ return ret;
+ }
+- acp62_writel(0x01, acp_base + ACP_CONTROL);
+- ret = acp62_reset(acp_base);
++ acp63_writel(0x01, acp_base + ACP_CONTROL);
++ ret = acp63_reset(acp_base);
+ if (ret) {
+ dev_err(dev, "ACP reset failed\n");
+ return ret;
+ }
+- acp62_writel(0x03, acp_base + ACP_CLKMUX_SEL);
+- acp62_enable_interrupts(acp_base);
++ acp63_writel(0x03, acp_base + ACP_CLKMUX_SEL);
++ acp63_enable_interrupts(acp_base);
+ return 0;
+ }
+
+-static int acp62_deinit(void __iomem *acp_base, struct device *dev)
++static int acp63_deinit(void __iomem *acp_base, struct device *dev)
+ {
+ int ret;
+
+- acp62_disable_interrupts(acp_base);
+- ret = acp62_reset(acp_base);
++ acp63_disable_interrupts(acp_base);
++ ret = acp63_reset(acp_base);
+ if (ret) {
+ dev_err(dev, "ACP reset failed\n");
+ return ret;
+ }
+- acp62_writel(0, acp_base + ACP_CLKMUX_SEL);
+- acp62_writel(0, acp_base + ACP_CONTROL);
++ acp63_writel(0, acp_base + ACP_CLKMUX_SEL);
++ acp63_writel(0, acp_base + ACP_CONTROL);
+ return 0;
+ }
+
+-static irqreturn_t acp62_irq_handler(int irq, void *dev_id)
++static irqreturn_t acp63_irq_handler(int irq, void *dev_id)
+ {
+- struct acp62_dev_data *adata;
++ struct acp63_dev_data *adata;
+ struct pdm_dev_data *ps_pdm_data;
+ u32 val;
+
+@@ -128,10 +128,10 @@ static irqreturn_t acp62_irq_handler(int
+ if (!adata)
+ return IRQ_NONE;
+
+- val = acp62_readl(adata->acp62_base + ACP_EXTERNAL_INTR_STAT);
++ val = acp63_readl(adata->acp63_base + ACP_EXTERNAL_INTR_STAT);
+ if (val & BIT(PDM_DMA_STAT)) {
+ ps_pdm_data = dev_get_drvdata(&adata->pdev[0]->dev);
+- acp62_writel(BIT(PDM_DMA_STAT), adata->acp62_base + ACP_EXTERNAL_INTR_STAT);
++ acp63_writel(BIT(PDM_DMA_STAT), adata->acp63_base + ACP_EXTERNAL_INTR_STAT);
+ if (ps_pdm_data->capture_stream)
+ snd_pcm_period_elapsed(ps_pdm_data->capture_stream);
+ return IRQ_HANDLED;
+@@ -139,10 +139,10 @@ static irqreturn_t acp62_irq_handler(int
+ return IRQ_NONE;
+ }
+
+-static int snd_acp62_probe(struct pci_dev *pci,
++static int snd_acp63_probe(struct pci_dev *pci,
+ const struct pci_device_id *pci_id)
+ {
+- struct acp62_dev_data *adata;
++ struct acp63_dev_data *adata;
+ struct platform_device_info pdevinfo[ACP6x_DEVS];
+ int index, ret;
+ int val = 0x00;
+@@ -157,7 +157,7 @@ static int snd_acp62_probe(struct pci_de
+ case 0x63:
+ break;
+ default:
+- dev_dbg(&pci->dev, "acp62 pci device not found\n");
++ dev_dbg(&pci->dev, "acp63 pci device not found\n");
+ return -ENODEV;
+ }
+ if (pci_enable_device(pci)) {
+@@ -170,7 +170,7 @@ static int snd_acp62_probe(struct pci_de
+ dev_err(&pci->dev, "pci_request_regions failed\n");
+ goto disable_pci;
+ }
+- adata = devm_kzalloc(&pci->dev, sizeof(struct acp62_dev_data),
++ adata = devm_kzalloc(&pci->dev, sizeof(struct acp63_dev_data),
+ GFP_KERNEL);
+ if (!adata) {
+ ret = -ENOMEM;
+@@ -178,18 +178,18 @@ static int snd_acp62_probe(struct pci_de
+ }
+
+ addr = pci_resource_start(pci, 0);
+- adata->acp62_base = devm_ioremap(&pci->dev, addr,
++ adata->acp63_base = devm_ioremap(&pci->dev, addr,
+ pci_resource_len(pci, 0));
+- if (!adata->acp62_base) {
++ if (!adata->acp63_base) {
+ ret = -ENOMEM;
+ goto release_regions;
+ }
+ pci_set_master(pci);
+ pci_set_drvdata(pci, adata);
+- ret = acp62_init(adata->acp62_base, &pci->dev);
++ ret = acp63_init(adata->acp63_base, &pci->dev);
+ if (ret)
+ goto release_regions;
+- val = acp62_readl(adata->acp62_base + ACP_PIN_CONFIG);
++ val = acp63_readl(adata->acp63_base + ACP_PIN_CONFIG);
+ switch (val) {
+ case ACP_CONFIG_0:
+ case ACP_CONFIG_1:
+@@ -220,7 +220,7 @@ static int snd_acp62_probe(struct pci_de
+ adata->res->flags = IORESOURCE_MEM;
+ adata->res->start = addr;
+ adata->res->end = addr + (ACP6x_REG_END - ACP6x_REG_START);
+- adata->acp62_audio_mode = ACP6x_PDM_MODE;
++ adata->acp63_audio_mode = ACP6x_PDM_MODE;
+
+ memset(&pdevinfo, 0, sizeof(pdevinfo));
+ pdevinfo[0].name = "acp_ps_pdm_dma";
+@@ -248,7 +248,7 @@ static int snd_acp62_probe(struct pci_de
+ ret = PTR_ERR(adata->pdev[index]);
+ goto unregister_devs;
+ }
+- ret = devm_request_irq(&pci->dev, pci->irq, acp62_irq_handler,
++ ret = devm_request_irq(&pci->dev, pci->irq, acp63_irq_handler,
+ irqflags, "ACP_PCI_IRQ", adata);
+ if (ret) {
+ dev_err(&pci->dev, "ACP PCI IRQ request failed\n");
+@@ -267,7 +267,7 @@ unregister_devs:
+ for (--index; index >= 0; index--)
+ platform_device_unregister(adata->pdev[index]);
+ de_init:
+- if (acp62_deinit(adata->acp62_base, &pci->dev))
++ if (acp63_deinit(adata->acp63_base, &pci->dev))
+ dev_err(&pci->dev, "ACP de-init failed\n");
+ release_regions:
+ pci_release_regions(pci);
+@@ -277,46 +277,46 @@ disable_pci:
+ return ret;
+ }
+
+-static int __maybe_unused snd_acp62_suspend(struct device *dev)
++static int __maybe_unused snd_acp63_suspend(struct device *dev)
+ {
+- struct acp62_dev_data *adata;
++ struct acp63_dev_data *adata;
+ int ret;
+
+ adata = dev_get_drvdata(dev);
+- ret = acp62_deinit(adata->acp62_base, dev);
++ ret = acp63_deinit(adata->acp63_base, dev);
+ if (ret)
+ dev_err(dev, "ACP de-init failed\n");
+ return ret;
+ }
+
+-static int __maybe_unused snd_acp62_resume(struct device *dev)
++static int __maybe_unused snd_acp63_resume(struct device *dev)
+ {
+- struct acp62_dev_data *adata;
++ struct acp63_dev_data *adata;
+ int ret;
+
+ adata = dev_get_drvdata(dev);
+- ret = acp62_init(adata->acp62_base, dev);
++ ret = acp63_init(adata->acp63_base, dev);
+ if (ret)
+ dev_err(dev, "ACP init failed\n");
+ return ret;
+ }
+
+-static const struct dev_pm_ops acp62_pm_ops = {
+- SET_RUNTIME_PM_OPS(snd_acp62_suspend, snd_acp62_resume, NULL)
+- SET_SYSTEM_SLEEP_PM_OPS(snd_acp62_suspend, snd_acp62_resume)
++static const struct dev_pm_ops acp63_pm_ops = {
++ SET_RUNTIME_PM_OPS(snd_acp63_suspend, snd_acp63_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(snd_acp63_suspend, snd_acp63_resume)
+ };
+
+-static void snd_acp62_remove(struct pci_dev *pci)
++static void snd_acp63_remove(struct pci_dev *pci)
+ {
+- struct acp62_dev_data *adata;
++ struct acp63_dev_data *adata;
+ int ret, index;
+
+ adata = pci_get_drvdata(pci);
+- if (adata->acp62_audio_mode == ACP6x_PDM_MODE) {
++ if (adata->acp63_audio_mode == ACP6x_PDM_MODE) {
+ for (index = 0; index < ACP6x_DEVS; index++)
+ platform_device_unregister(adata->pdev[index]);
+ }
+- ret = acp62_deinit(adata->acp62_base, &pci->dev);
++ ret = acp63_deinit(adata->acp63_base, &pci->dev);
+ if (ret)
+ dev_err(&pci->dev, "ACP de-init failed\n");
+ pm_runtime_forbid(&pci->dev);
+@@ -325,25 +325,25 @@ static void snd_acp62_remove(struct pci_
+ pci_disable_device(pci);
+ }
+
+-static const struct pci_device_id snd_acp62_ids[] = {
++static const struct pci_device_id snd_acp63_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_AMD, ACP_DEVICE_ID),
+ .class = PCI_CLASS_MULTIMEDIA_OTHER << 8,
+ .class_mask = 0xffffff },
+ { 0, },
+ };
+-MODULE_DEVICE_TABLE(pci, snd_acp62_ids);
++MODULE_DEVICE_TABLE(pci, snd_acp63_ids);
+
+-static struct pci_driver ps_acp62_driver = {
++static struct pci_driver ps_acp63_driver = {
+ .name = KBUILD_MODNAME,
+- .id_table = snd_acp62_ids,
+- .probe = snd_acp62_probe,
+- .remove = snd_acp62_remove,
++ .id_table = snd_acp63_ids,
++ .probe = snd_acp63_probe,
++ .remove = snd_acp63_remove,
+ .driver = {
+- .pm = &acp62_pm_ops,
++ .pm = &acp63_pm_ops,
+ }
+ };
+
+-module_pci_driver(ps_acp62_driver);
++module_pci_driver(ps_acp63_driver);
+
+ MODULE_AUTHOR("Vijendar.Mukunda@amd.com");
+ MODULE_AUTHOR("Syed.SabaKareem@amd.com");
+--- a/sound/soc/amd/ps/ps-mach.c
++++ b/sound/soc/amd/ps/ps-mach.c
+@@ -13,11 +13,11 @@
+ #include <linux/io.h>
+ #include <linux/dmi.h>
+
+-#include "acp62.h"
++#include "acp63.h"
+
+ #define DRV_NAME "acp_ps_mach"
+
+-SND_SOC_DAILINK_DEF(acp62_pdm,
++SND_SOC_DAILINK_DEF(acp63_pdm,
+ DAILINK_COMP_ARRAY(COMP_CPU("acp_ps_pdm_dma.0")));
+
+ SND_SOC_DAILINK_DEF(dmic_codec,
+@@ -27,31 +27,31 @@ SND_SOC_DAILINK_DEF(dmic_codec,
+ SND_SOC_DAILINK_DEF(pdm_platform,
+ DAILINK_COMP_ARRAY(COMP_PLATFORM("acp_ps_pdm_dma.0")));
+
+-static struct snd_soc_dai_link acp62_dai_pdm[] = {
++static struct snd_soc_dai_link acp63_dai_pdm[] = {
+ {
+- .name = "acp62-dmic-capture",
++ .name = "acp63-dmic-capture",
+ .stream_name = "DMIC capture",
+ .capture_only = 1,
+- SND_SOC_DAILINK_REG(acp62_pdm, dmic_codec, pdm_platform),
++ SND_SOC_DAILINK_REG(acp63_pdm, dmic_codec, pdm_platform),
+ },
+ };
+
+-static struct snd_soc_card acp62_card = {
+- .name = "acp62",
++static struct snd_soc_card acp63_card = {
++ .name = "acp63",
+ .owner = THIS_MODULE,
+- .dai_link = acp62_dai_pdm,
++ .dai_link = acp63_dai_pdm,
+ .num_links = 1,
+ };
+
+-static int acp62_probe(struct platform_device *pdev)
++static int acp63_probe(struct platform_device *pdev)
+ {
+- struct acp62_pdm *machine = NULL;
++ struct acp63_pdm *machine = NULL;
+ struct snd_soc_card *card;
+ int ret;
+
+- platform_set_drvdata(pdev, &acp62_card);
++ platform_set_drvdata(pdev, &acp63_card);
+ card = platform_get_drvdata(pdev);
+- acp62_card.dev = &pdev->dev;
++ acp63_card.dev = &pdev->dev;
+
+ snd_soc_card_set_drvdata(card, machine);
+ ret = devm_snd_soc_register_card(&pdev->dev, card);
+@@ -64,15 +64,15 @@ static int acp62_probe(struct platform_d
+ return 0;
+ }
+
+-static struct platform_driver acp62_mach_driver = {
++static struct platform_driver acp63_mach_driver = {
+ .driver = {
+ .name = "acp_ps_mach",
+ .pm = &snd_soc_pm_ops,
+ },
+- .probe = acp62_probe,
++ .probe = acp63_probe,
+ };
+
+-module_platform_driver(acp62_mach_driver);
++module_platform_driver(acp63_mach_driver);
+
+ MODULE_AUTHOR("Syed.SabaKareem@amd.com");
+ MODULE_LICENSE("GPL v2");
+--- a/sound/soc/amd/ps/ps-pdm-dma.c
++++ b/sound/soc/amd/ps/ps-pdm-dma.c
+@@ -14,11 +14,11 @@
+ #include <sound/soc-dai.h>
+ #include <linux/pm_runtime.h>
+
+-#include "acp62.h"
++#include "acp63.h"
+
+ #define DRV_NAME "acp_ps_pdm_dma"
+
+-static const struct snd_pcm_hardware acp62_pdm_hardware_capture = {
++static const struct snd_pcm_hardware acp63_pdm_hardware_capture = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED |
+ SNDRV_PCM_INFO_BLOCK_TRANSFER |
+ SNDRV_PCM_INFO_MMAP |
+@@ -37,61 +37,61 @@ static const struct snd_pcm_hardware acp
+ .periods_max = CAPTURE_MAX_NUM_PERIODS,
+ };
+
+-static void acp62_init_pdm_ring_buffer(u32 physical_addr, u32 buffer_size,
++static void acp63_init_pdm_ring_buffer(u32 physical_addr, u32 buffer_size,
+ u32 watermark_size, void __iomem *acp_base)
+ {
+- acp62_writel(physical_addr, acp_base + ACP_WOV_RX_RINGBUFADDR);
+- acp62_writel(buffer_size, acp_base + ACP_WOV_RX_RINGBUFSIZE);
+- acp62_writel(watermark_size, acp_base + ACP_WOV_RX_INTR_WATERMARK_SIZE);
+- acp62_writel(0x01, acp_base + ACPAXI2AXI_ATU_CTRL);
++ acp63_writel(physical_addr, acp_base + ACP_WOV_RX_RINGBUFADDR);
++ acp63_writel(buffer_size, acp_base + ACP_WOV_RX_RINGBUFSIZE);
++ acp63_writel(watermark_size, acp_base + ACP_WOV_RX_INTR_WATERMARK_SIZE);
++ acp63_writel(0x01, acp_base + ACPAXI2AXI_ATU_CTRL);
+ }
+
+-static void acp62_enable_pdm_clock(void __iomem *acp_base)
++static void acp63_enable_pdm_clock(void __iomem *acp_base)
+ {
+ u32 pdm_clk_enable, pdm_ctrl;
+
+ pdm_clk_enable = ACP_PDM_CLK_FREQ_MASK;
+ pdm_ctrl = 0x00;
+
+- acp62_writel(pdm_clk_enable, acp_base + ACP_WOV_CLK_CTRL);
+- pdm_ctrl = acp62_readl(acp_base + ACP_WOV_MISC_CTRL);
++ acp63_writel(pdm_clk_enable, acp_base + ACP_WOV_CLK_CTRL);
++ pdm_ctrl = acp63_readl(acp_base + ACP_WOV_MISC_CTRL);
+ pdm_ctrl |= ACP_WOV_MISC_CTRL_MASK;
+- acp62_writel(pdm_ctrl, acp_base + ACP_WOV_MISC_CTRL);
++ acp63_writel(pdm_ctrl, acp_base + ACP_WOV_MISC_CTRL);
+ }
+
+-static void acp62_enable_pdm_interrupts(void __iomem *acp_base)
++static void acp63_enable_pdm_interrupts(void __iomem *acp_base)
+ {
+ u32 ext_int_ctrl;
+
+- ext_int_ctrl = acp62_readl(acp_base + ACP_EXTERNAL_INTR_CNTL);
++ ext_int_ctrl = acp63_readl(acp_base + ACP_EXTERNAL_INTR_CNTL);
+ ext_int_ctrl |= PDM_DMA_INTR_MASK;
+- acp62_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL);
++ acp63_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL);
+ }
+
+-static void acp62_disable_pdm_interrupts(void __iomem *acp_base)
++static void acp63_disable_pdm_interrupts(void __iomem *acp_base)
+ {
+ u32 ext_int_ctrl;
+
+- ext_int_ctrl = acp62_readl(acp_base + ACP_EXTERNAL_INTR_CNTL);
++ ext_int_ctrl = acp63_readl(acp_base + ACP_EXTERNAL_INTR_CNTL);
+ ext_int_ctrl &= ~PDM_DMA_INTR_MASK;
+- acp62_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL);
++ acp63_writel(ext_int_ctrl, acp_base + ACP_EXTERNAL_INTR_CNTL);
+ }
+
+-static bool acp62_check_pdm_dma_status(void __iomem *acp_base)
++static bool acp63_check_pdm_dma_status(void __iomem *acp_base)
+ {
+ bool pdm_dma_status;
+ u32 pdm_enable, pdm_dma_enable;
+
+ pdm_dma_status = false;
+- pdm_enable = acp62_readl(acp_base + ACP_WOV_PDM_ENABLE);
+- pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
++ pdm_enable = acp63_readl(acp_base + ACP_WOV_PDM_ENABLE);
++ pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
+ if ((pdm_enable & ACP_PDM_ENABLE) && (pdm_dma_enable & ACP_PDM_DMA_EN_STATUS))
+ pdm_dma_status = true;
+
+ return pdm_dma_status;
+ }
+
+-static int acp62_start_pdm_dma(void __iomem *acp_base)
++static int acp63_start_pdm_dma(void __iomem *acp_base)
+ {
+ u32 pdm_enable;
+ u32 pdm_dma_enable;
+@@ -100,12 +100,12 @@ static int acp62_start_pdm_dma(void __io
+ pdm_enable = 0x01;
+ pdm_dma_enable = 0x01;
+
+- acp62_enable_pdm_clock(acp_base);
+- acp62_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE);
+- acp62_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE);
++ acp63_enable_pdm_clock(acp_base);
++ acp63_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE);
++ acp63_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE);
+ timeout = 0;
+ while (++timeout < ACP_COUNTER) {
+- pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
++ pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
+ if ((pdm_dma_enable & 0x02) == ACP_PDM_DMA_EN_STATUS)
+ return 0;
+ udelay(DELAY_US);
+@@ -113,7 +113,7 @@ static int acp62_start_pdm_dma(void __io
+ return -ETIMEDOUT;
+ }
+
+-static int acp62_stop_pdm_dma(void __iomem *acp_base)
++static int acp63_stop_pdm_dma(void __iomem *acp_base)
+ {
+ u32 pdm_enable, pdm_dma_enable;
+ int timeout;
+@@ -121,14 +121,14 @@ static int acp62_stop_pdm_dma(void __iom
+ pdm_enable = 0x00;
+ pdm_dma_enable = 0x00;
+
+- pdm_enable = acp62_readl(acp_base + ACP_WOV_PDM_ENABLE);
+- pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
++ pdm_enable = acp63_readl(acp_base + ACP_WOV_PDM_ENABLE);
++ pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
+ if (pdm_dma_enable & 0x01) {
+ pdm_dma_enable = 0x02;
+- acp62_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE);
++ acp63_writel(pdm_dma_enable, acp_base + ACP_WOV_PDM_DMA_ENABLE);
+ timeout = 0;
+ while (++timeout < ACP_COUNTER) {
+- pdm_dma_enable = acp62_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
++ pdm_dma_enable = acp63_readl(acp_base + ACP_WOV_PDM_DMA_ENABLE);
+ if ((pdm_dma_enable & 0x02) == 0x00)
+ break;
+ udelay(DELAY_US);
+@@ -138,13 +138,13 @@ static int acp62_stop_pdm_dma(void __iom
+ }
+ if (pdm_enable == ACP_PDM_ENABLE) {
+ pdm_enable = ACP_PDM_DISABLE;
+- acp62_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE);
++ acp63_writel(pdm_enable, acp_base + ACP_WOV_PDM_ENABLE);
+ }
+- acp62_writel(0x01, acp_base + ACP_WOV_PDM_FIFO_FLUSH);
++ acp63_writel(0x01, acp_base + ACP_WOV_PDM_FIFO_FLUSH);
+ return 0;
+ }
+
+-static void acp62_config_dma(struct pdm_stream_instance *rtd, int direction)
++static void acp63_config_dma(struct pdm_stream_instance *rtd, int direction)
+ {
+ u16 page_idx;
+ u32 low, high, val;
+@@ -154,24 +154,24 @@ static void acp62_config_dma(struct pdm_
+ val = PDM_PTE_OFFSET;
+
+ /* Group Enable */
+- acp62_writel(ACP_SRAM_PTE_OFFSET | BIT(31), rtd->acp62_base +
++ acp63_writel(ACP_SRAM_PTE_OFFSET | BIT(31), rtd->acp63_base +
+ ACPAXI2AXI_ATU_BASE_ADDR_GRP_1);
+- acp62_writel(PAGE_SIZE_4K_ENABLE, rtd->acp62_base +
++ acp63_writel(PAGE_SIZE_4K_ENABLE, rtd->acp63_base +
+ ACPAXI2AXI_ATU_PAGE_SIZE_GRP_1);
+ for (page_idx = 0; page_idx < rtd->num_pages; page_idx++) {
+ /* Load the low address of page int ACP SRAM through SRBM */
+ low = lower_32_bits(addr);
+ high = upper_32_bits(addr);
+
+- acp62_writel(low, rtd->acp62_base + ACP_SCRATCH_REG_0 + val);
++ acp63_writel(low, rtd->acp63_base + ACP_SCRATCH_REG_0 + val);
+ high |= BIT(31);
+- acp62_writel(high, rtd->acp62_base + ACP_SCRATCH_REG_0 + val + 4);
++ acp63_writel(high, rtd->acp63_base + ACP_SCRATCH_REG_0 + val + 4);
+ val += 8;
+ addr += PAGE_SIZE;
+ }
+ }
+
+-static int acp62_pdm_dma_open(struct snd_soc_component *component,
++static int acp63_pdm_dma_open(struct snd_soc_component *component,
+ struct snd_pcm_substream *substream)
+ {
+ struct snd_pcm_runtime *runtime;
+@@ -186,7 +186,7 @@ static int acp62_pdm_dma_open(struct snd
+ return -EINVAL;
+
+ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+- runtime->hw = acp62_pdm_hardware_capture;
++ runtime->hw = acp63_pdm_hardware_capture;
+
+ ret = snd_pcm_hw_constraint_integer(runtime,
+ SNDRV_PCM_HW_PARAM_PERIODS);
+@@ -196,17 +196,17 @@ static int acp62_pdm_dma_open(struct snd
+ return ret;
+ }
+
+- acp62_enable_pdm_interrupts(adata->acp62_base);
++ acp63_enable_pdm_interrupts(adata->acp63_base);
+
+ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE)
+ adata->capture_stream = substream;
+
+- pdm_data->acp62_base = adata->acp62_base;
++ pdm_data->acp63_base = adata->acp63_base;
+ runtime->private_data = pdm_data;
+ return ret;
+ }
+
+-static int acp62_pdm_dma_hw_params(struct snd_soc_component *component,
++static int acp63_pdm_dma_hw_params(struct snd_soc_component *component,
+ struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params)
+ {
+@@ -220,26 +220,26 @@ static int acp62_pdm_dma_hw_params(struc
+ period_bytes = params_period_bytes(params);
+ rtd->dma_addr = substream->runtime->dma_addr;
+ rtd->num_pages = (PAGE_ALIGN(size) >> PAGE_SHIFT);
+- acp62_config_dma(rtd, substream->stream);
+- acp62_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, size,
+- period_bytes, rtd->acp62_base);
++ acp63_config_dma(rtd, substream->stream);
++ acp63_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, size,
++ period_bytes, rtd->acp63_base);
+ return 0;
+ }
+
+-static u64 acp62_pdm_get_byte_count(struct pdm_stream_instance *rtd,
++static u64 acp63_pdm_get_byte_count(struct pdm_stream_instance *rtd,
+ int direction)
+ {
+ u32 high, low;
+ u64 byte_count;
+
+- high = acp62_readl(rtd->acp62_base + ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH);
++ high = acp63_readl(rtd->acp63_base + ACP_WOV_RX_LINEARPOSITIONCNTR_HIGH);
+ byte_count = high;
+- low = acp62_readl(rtd->acp62_base + ACP_WOV_RX_LINEARPOSITIONCNTR_LOW);
++ low = acp63_readl(rtd->acp63_base + ACP_WOV_RX_LINEARPOSITIONCNTR_LOW);
+ byte_count = (byte_count << 32) | low;
+ return byte_count;
+ }
+
+-static snd_pcm_uframes_t acp62_pdm_dma_pointer(struct snd_soc_component *comp,
++static snd_pcm_uframes_t acp63_pdm_dma_pointer(struct snd_soc_component *comp,
+ struct snd_pcm_substream *stream)
+ {
+ struct pdm_stream_instance *rtd;
+@@ -249,14 +249,14 @@ static snd_pcm_uframes_t acp62_pdm_dma_p
+ rtd = stream->runtime->private_data;
+ buffersize = frames_to_bytes(stream->runtime,
+ stream->runtime->buffer_size);
+- bytescount = acp62_pdm_get_byte_count(rtd, stream->stream);
++ bytescount = acp63_pdm_get_byte_count(rtd, stream->stream);
+ if (bytescount > rtd->bytescount)
+ bytescount -= rtd->bytescount;
+ pos = do_div(bytescount, buffersize);
+ return bytes_to_frames(stream->runtime, pos);
+ }
+
+-static int acp62_pdm_dma_new(struct snd_soc_component *component,
++static int acp63_pdm_dma_new(struct snd_soc_component *component,
+ struct snd_soc_pcm_runtime *rtd)
+ {
+ struct device *parent = component->dev->parent;
+@@ -266,19 +266,19 @@ static int acp62_pdm_dma_new(struct snd_
+ return 0;
+ }
+
+-static int acp62_pdm_dma_close(struct snd_soc_component *component,
++static int acp63_pdm_dma_close(struct snd_soc_component *component,
+ struct snd_pcm_substream *substream)
+ {
+ struct pdm_dev_data *adata = dev_get_drvdata(component->dev);
+ struct snd_pcm_runtime *runtime = substream->runtime;
+
+- acp62_disable_pdm_interrupts(adata->acp62_base);
++ acp63_disable_pdm_interrupts(adata->acp63_base);
+ adata->capture_stream = NULL;
+ kfree(runtime->private_data);
+ return 0;
+ }
+
+-static int acp62_pdm_dai_trigger(struct snd_pcm_substream *substream,
++static int acp63_pdm_dai_trigger(struct snd_pcm_substream *substream,
+ int cmd, struct snd_soc_dai *dai)
+ {
+ struct pdm_stream_instance *rtd;
+@@ -299,20 +299,20 @@ static int acp62_pdm_dai_trigger(struct
+ case SNDRV_PCM_TRIGGER_START:
+ case SNDRV_PCM_TRIGGER_RESUME:
+ case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+- acp62_writel(ch_mask, rtd->acp62_base + ACP_WOV_PDM_NO_OF_CHANNELS);
+- acp62_writel(PDM_DECIMATION_FACTOR, rtd->acp62_base +
++ acp63_writel(ch_mask, rtd->acp63_base + ACP_WOV_PDM_NO_OF_CHANNELS);
++ acp63_writel(PDM_DECIMATION_FACTOR, rtd->acp63_base +
+ ACP_WOV_PDM_DECIMATION_FACTOR);
+- rtd->bytescount = acp62_pdm_get_byte_count(rtd, substream->stream);
+- pdm_status = acp62_check_pdm_dma_status(rtd->acp62_base);
++ rtd->bytescount = acp63_pdm_get_byte_count(rtd, substream->stream);
++ pdm_status = acp63_check_pdm_dma_status(rtd->acp63_base);
+ if (!pdm_status)
+- ret = acp62_start_pdm_dma(rtd->acp62_base);
++ ret = acp63_start_pdm_dma(rtd->acp63_base);
+ break;
+ case SNDRV_PCM_TRIGGER_STOP:
+ case SNDRV_PCM_TRIGGER_SUSPEND:
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+- pdm_status = acp62_check_pdm_dma_status(rtd->acp62_base);
++ pdm_status = acp63_check_pdm_dma_status(rtd->acp63_base);
+ if (pdm_status)
+- ret = acp62_stop_pdm_dma(rtd->acp62_base);
++ ret = acp63_stop_pdm_dma(rtd->acp63_base);
+ break;
+ default:
+ ret = -EINVAL;
+@@ -321,11 +321,11 @@ static int acp62_pdm_dai_trigger(struct
+ return ret;
+ }
+
+-static const struct snd_soc_dai_ops acp62_pdm_dai_ops = {
+- .trigger = acp62_pdm_dai_trigger,
++static const struct snd_soc_dai_ops acp63_pdm_dai_ops = {
++ .trigger = acp63_pdm_dai_trigger,
+ };
+
+-static struct snd_soc_dai_driver acp62_pdm_dai_driver = {
++static struct snd_soc_dai_driver acp63_pdm_dai_driver = {
+ .name = "acp_ps_pdm_dma.0",
+ .capture = {
+ .rates = SNDRV_PCM_RATE_48000,
+@@ -335,19 +335,19 @@ static struct snd_soc_dai_driver acp62_p
+ .rate_min = 48000,
+ .rate_max = 48000,
+ },
+- .ops = &acp62_pdm_dai_ops,
++ .ops = &acp63_pdm_dai_ops,
+ };
+
+-static const struct snd_soc_component_driver acp62_pdm_component = {
++static const struct snd_soc_component_driver acp63_pdm_component = {
+ .name = DRV_NAME,
+- .open = acp62_pdm_dma_open,
+- .close = acp62_pdm_dma_close,
+- .hw_params = acp62_pdm_dma_hw_params,
+- .pointer = acp62_pdm_dma_pointer,
+- .pcm_construct = acp62_pdm_dma_new,
++ .open = acp63_pdm_dma_open,
++ .close = acp63_pdm_dma_close,
++ .hw_params = acp63_pdm_dma_hw_params,
++ .pointer = acp63_pdm_dma_pointer,
++ .pcm_construct = acp63_pdm_dma_new,
+ };
+
+-static int acp62_pdm_audio_probe(struct platform_device *pdev)
++static int acp63_pdm_audio_probe(struct platform_device *pdev)
+ {
+ struct resource *res;
+ struct pdm_dev_data *adata;
+@@ -363,16 +363,16 @@ static int acp62_pdm_audio_probe(struct
+ if (!adata)
+ return -ENOMEM;
+
+- adata->acp62_base = devm_ioremap(&pdev->dev, res->start, resource_size(res));
+- if (!adata->acp62_base)
++ adata->acp63_base = devm_ioremap(&pdev->dev, res->start, resource_size(res));
++ if (!adata->acp63_base)
+ return -ENOMEM;
+
+ adata->capture_stream = NULL;
+
+ dev_set_drvdata(&pdev->dev, adata);
+ status = devm_snd_soc_register_component(&pdev->dev,
+- &acp62_pdm_component,
+- &acp62_pdm_dai_driver, 1);
++ &acp63_pdm_component,
++ &acp63_pdm_dai_driver, 1);
+ if (status) {
+ dev_err(&pdev->dev, "Fail to register acp pdm dai\n");
+
+@@ -385,13 +385,13 @@ static int acp62_pdm_audio_probe(struct
+ return 0;
+ }
+
+-static int acp62_pdm_audio_remove(struct platform_device *pdev)
++static int acp63_pdm_audio_remove(struct platform_device *pdev)
+ {
+ pm_runtime_disable(&pdev->dev);
+ return 0;
+ }
+
+-static int __maybe_unused acp62_pdm_resume(struct device *dev)
++static int __maybe_unused acp63_pdm_resume(struct device *dev)
+ {
+ struct pdm_dev_data *adata;
+ struct snd_pcm_runtime *runtime;
+@@ -404,47 +404,47 @@ static int __maybe_unused acp62_pdm_resu
+ rtd = runtime->private_data;
+ period_bytes = frames_to_bytes(runtime, runtime->period_size);
+ buffer_len = frames_to_bytes(runtime, runtime->buffer_size);
+- acp62_config_dma(rtd, SNDRV_PCM_STREAM_CAPTURE);
+- acp62_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, buffer_len,
+- period_bytes, adata->acp62_base);
++ acp63_config_dma(rtd, SNDRV_PCM_STREAM_CAPTURE);
++ acp63_init_pdm_ring_buffer(PDM_MEM_WINDOW_START, buffer_len,
++ period_bytes, adata->acp63_base);
+ }
+- acp62_enable_pdm_interrupts(adata->acp62_base);
++ acp63_enable_pdm_interrupts(adata->acp63_base);
+ return 0;
+ }
+
+-static int __maybe_unused acp62_pdm_suspend(struct device *dev)
++static int __maybe_unused acp63_pdm_suspend(struct device *dev)
+ {
+ struct pdm_dev_data *adata;
+
+ adata = dev_get_drvdata(dev);
+- acp62_disable_pdm_interrupts(adata->acp62_base);
++ acp63_disable_pdm_interrupts(adata->acp63_base);
+ return 0;
+ }
+
+-static int __maybe_unused acp62_pdm_runtime_resume(struct device *dev)
++static int __maybe_unused acp63_pdm_runtime_resume(struct device *dev)
+ {
+ struct pdm_dev_data *adata;
+
+ adata = dev_get_drvdata(dev);
+- acp62_enable_pdm_interrupts(adata->acp62_base);
++ acp63_enable_pdm_interrupts(adata->acp63_base);
+ return 0;
+ }
+
+-static const struct dev_pm_ops acp62_pdm_pm_ops = {
+- SET_RUNTIME_PM_OPS(acp62_pdm_suspend, acp62_pdm_runtime_resume, NULL)
+- SET_SYSTEM_SLEEP_PM_OPS(acp62_pdm_suspend, acp62_pdm_resume)
++static const struct dev_pm_ops acp63_pdm_pm_ops = {
++ SET_RUNTIME_PM_OPS(acp63_pdm_suspend, acp63_pdm_runtime_resume, NULL)
++ SET_SYSTEM_SLEEP_PM_OPS(acp63_pdm_suspend, acp63_pdm_resume)
+ };
+
+-static struct platform_driver acp62_pdm_dma_driver = {
+- .probe = acp62_pdm_audio_probe,
+- .remove = acp62_pdm_audio_remove,
++static struct platform_driver acp63_pdm_dma_driver = {
++ .probe = acp63_pdm_audio_probe,
++ .remove = acp63_pdm_audio_remove,
+ .driver = {
+ .name = "acp_ps_pdm_dma",
+- .pm = &acp62_pdm_pm_ops,
++ .pm = &acp63_pdm_pm_ops,
+ },
+ };
+
+-module_platform_driver(acp62_pdm_dma_driver);
++module_platform_driver(acp63_pdm_dma_driver);
+
+ MODULE_AUTHOR("Syed.SabaKareem@amd.com");
+ MODULE_DESCRIPTION("AMD PINK SARDINE PDM Driver");
--- /dev/null
+From a4d432e9132c0b29d857b09ca2ec4c1f455b5948 Mon Sep 17 00:00:00 2001
+From: Syed Saba Kareem <Syed.SabaKareem@amd.com>
+Date: Fri, 31 Mar 2023 10:50:23 +0530
+Subject: ASoC: amd: ps: update the acp clock source.
+
+From: Syed Saba Kareem <Syed.SabaKareem@amd.com>
+
+commit a4d432e9132c0b29d857b09ca2ec4c1f455b5948 upstream.
+
+Updating the clock source from ACLK to default clock
+
+Signed-off-by: Syed Saba Kareem <Syed.SabaKareem@amd.com>
+Link: https://lore.kernel.org/r/20230331052102.2211115-1-Syed.SabaKareem@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/amd/ps/pci-ps.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/soc/amd/ps/pci-ps.c
++++ b/sound/soc/amd/ps/pci-ps.c
+@@ -98,7 +98,6 @@ static int acp63_init(void __iomem *acp_
+ dev_err(dev, "ACP reset failed\n");
+ return ret;
+ }
+- acp63_writel(0x03, acp_base + ACP_CLKMUX_SEL);
+ acp63_enable_interrupts(acp_base);
+ return 0;
+ }
+@@ -113,7 +112,6 @@ static int acp63_deinit(void __iomem *ac
+ dev_err(dev, "ACP reset failed\n");
+ return ret;
+ }
+- acp63_writel(0, acp_base + ACP_CLKMUX_SEL);
+ acp63_writel(0, acp_base + ACP_CONTROL);
+ return 0;
+ }
--- /dev/null
+From stable-owner@vger.kernel.org Thu May 4 12:55:02 2023
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 3 May 2023 20:54:12 -0700
+Subject: blk-crypto: add a blk_crypto_config_supported_natively helper
+To: stable@vger.kernel.org
+Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>
+Message-ID: <20230504035417.61435-3-ebiggers@kernel.org>
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 6715c98b6cf003f26b1b2f655393134e9d999a05 upstream.
+
+Add a blk_crypto_config_supported_natively helper that wraps
+__blk_crypto_cfg_supported to retrieve the crypto_profile from the
+request queue. With this fscrypt can stop including
+blk-crypto-profile.h and rely on the public consumer interface in
+blk-crypto.h.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20221114042944.1009870-3-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-crypto.c | 21 ++++++++++++---------
+ fs/crypto/inline_crypt.c | 6 ++----
+ include/linux/blk-crypto.h | 2 ++
+ 3 files changed, 16 insertions(+), 13 deletions(-)
+
+--- a/block/blk-crypto.c
++++ b/block/blk-crypto.c
+@@ -267,7 +267,6 @@ bool __blk_crypto_bio_prep(struct bio **
+ {
+ struct bio *bio = *bio_ptr;
+ const struct blk_crypto_key *bc_key = bio->bi_crypt_context->bc_key;
+- struct blk_crypto_profile *profile;
+
+ /* Error if bio has no data. */
+ if (WARN_ON_ONCE(!bio_has_data(bio))) {
+@@ -284,10 +283,9 @@ bool __blk_crypto_bio_prep(struct bio **
+ * Success if device supports the encryption context, or if we succeeded
+ * in falling back to the crypto API.
+ */
+- profile = bdev_get_queue(bio->bi_bdev)->crypto_profile;
+- if (__blk_crypto_cfg_supported(profile, &bc_key->crypto_cfg))
++ if (blk_crypto_config_supported_natively(bio->bi_bdev,
++ &bc_key->crypto_cfg))
+ return true;
+-
+ if (blk_crypto_fallback_bio_prep(bio_ptr))
+ return true;
+ fail:
+@@ -352,6 +350,13 @@ int blk_crypto_init_key(struct blk_crypt
+ return 0;
+ }
+
++bool blk_crypto_config_supported_natively(struct block_device *bdev,
++ const struct blk_crypto_config *cfg)
++{
++ return __blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile,
++ cfg);
++}
++
+ /*
+ * Check if bios with @cfg can be en/decrypted by blk-crypto (i.e. either the
+ * block_device it's submitted to supports inline crypto, or the
+@@ -361,8 +366,7 @@ bool blk_crypto_config_supported(struct
+ const struct blk_crypto_config *cfg)
+ {
+ return IS_ENABLED(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK) ||
+- __blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile,
+- cfg);
++ blk_crypto_config_supported_natively(bdev, cfg);
+ }
+
+ /**
+@@ -383,8 +387,7 @@ bool blk_crypto_config_supported(struct
+ int blk_crypto_start_using_key(struct block_device *bdev,
+ const struct blk_crypto_key *key)
+ {
+- if (__blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile,
+- &key->crypto_cfg))
++ if (blk_crypto_config_supported_natively(bdev, &key->crypto_cfg))
+ return 0;
+ return blk_crypto_fallback_start_using_mode(key->crypto_cfg.crypto_mode);
+ }
+@@ -407,7 +410,7 @@ int blk_crypto_evict_key(struct block_de
+ {
+ struct request_queue *q = bdev_get_queue(bdev);
+
+- if (__blk_crypto_cfg_supported(q->crypto_profile, &key->crypto_cfg))
++ if (blk_crypto_config_supported_natively(bdev, &key->crypto_cfg))
+ return __blk_crypto_evict_key(q->crypto_profile, key);
+
+ /*
+--- a/fs/crypto/inline_crypt.c
++++ b/fs/crypto/inline_crypt.c
+@@ -12,7 +12,7 @@
+ * provides the key and IV to use.
+ */
+
+-#include <linux/blk-crypto-profile.h>
++#include <linux/blk-crypto.h>
+ #include <linux/blkdev.h>
+ #include <linux/buffer_head.h>
+ #include <linux/sched/mm.h>
+@@ -77,10 +77,8 @@ static void fscrypt_log_blk_crypto_impl(
+ unsigned int i;
+
+ for (i = 0; i < num_devs; i++) {
+- struct request_queue *q = bdev_get_queue(devs[i]);
+-
+ if (!IS_ENABLED(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK) ||
+- __blk_crypto_cfg_supported(q->crypto_profile, cfg)) {
++ blk_crypto_config_supported_natively(devs[i], cfg)) {
+ if (!xchg(&mode->logged_blk_crypto_native, 1))
+ pr_info("fscrypt: %s using blk-crypto (native)\n",
+ mode->friendly_name);
+--- a/include/linux/blk-crypto.h
++++ b/include/linux/blk-crypto.h
+@@ -97,6 +97,8 @@ int blk_crypto_start_using_key(struct bl
+ int blk_crypto_evict_key(struct block_device *bdev,
+ const struct blk_crypto_key *key);
+
++bool blk_crypto_config_supported_natively(struct block_device *bdev,
++ const struct blk_crypto_config *cfg);
+ bool blk_crypto_config_supported(struct block_device *bdev,
+ const struct blk_crypto_config *cfg);
+
--- /dev/null
+From stable-owner@vger.kernel.org Thu May 4 12:55:02 2023
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 3 May 2023 20:54:14 -0700
+Subject: blk-crypto: Add a missing include directive
+To: stable@vger.kernel.org
+Cc: linux-block@vger.kernel.org, Eric Biggers <ebiggers@google.com>, Bart Van Assche <bvanassche@acm.org>, Jens Axboe <axboe@kernel.dk>
+Message-ID: <20230504035417.61435-5-ebiggers@kernel.org>
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 85168d416e5d3184b77dbec8fee75c9439894afa upstream.
+
+Allow the compiler to verify consistency of function declarations and
+function definitions. This patch fixes the following sparse errors:
+
+block/blk-crypto-profile.c:241:14: error: no previous prototype for ‘blk_crypto_get_keyslot’ [-Werror=missing-prototypes]
+ 241 | blk_status_t blk_crypto_get_keyslot(struct blk_crypto_profile *profile,
+ | ^~~~~~~~~~~~~~~~~~~~~~
+block/blk-crypto-profile.c:318:6: error: no previous prototype for ‘blk_crypto_put_keyslot’ [-Werror=missing-prototypes]
+ 318 | void blk_crypto_put_keyslot(struct blk_crypto_keyslot *slot)
+ | ^~~~~~~~~~~~~~~~~~~~~~
+block/blk-crypto-profile.c:344:6: error: no previous prototype for ‘__blk_crypto_cfg_supported’ [-Werror=missing-prototypes]
+ 344 | bool __blk_crypto_cfg_supported(struct blk_crypto_profile *profile,
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~
+block/blk-crypto-profile.c:373:5: error: no previous prototype for ‘__blk_crypto_evict_key’ [-Werror=missing-prototypes]
+ 373 | int __blk_crypto_evict_key(struct blk_crypto_profile *profile,
+ | ^~~~~~~~~~~~~~~~~~~~~~
+
+Cc: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Link: https://lore.kernel.org/r/20221123172923.434339-1-bvanassche@acm.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-crypto-profile.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/block/blk-crypto-profile.c
++++ b/block/blk-crypto-profile.c
+@@ -32,6 +32,7 @@
+ #include <linux/wait.h>
+ #include <linux/blkdev.h>
+ #include <linux/blk-integrity.h>
++#include "blk-crypto-internal.h"
+
+ struct blk_crypto_keyslot {
+ atomic_t slot_refs;
--- /dev/null
+From stable-owner@vger.kernel.org Thu May 4 12:55:01 2023
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 3 May 2023 20:54:11 -0700
+Subject: blk-crypto: don't use struct request_queue for public interfaces
+To: stable@vger.kernel.org
+Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>
+Message-ID: <20230504035417.61435-2-ebiggers@kernel.org>
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit fce3caea0f241f5d34855c82c399d5e0e2d91f07 upstream.
+
+Switch all public blk-crypto interfaces to use struct block_device
+arguments to specify the device they operate on instead of th
+request_queue, which is a block layer implementation detail.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20221114042944.1009870-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/block/inline-encryption.rst | 12 ++++++------
+ block/blk-crypto.c | 24 ++++++++++++++----------
+ drivers/md/dm-table.c | 2 +-
+ fs/crypto/inline_crypt.c | 8 +++-----
+ include/linux/blk-crypto.h | 11 ++++-------
+ 5 files changed, 28 insertions(+), 29 deletions(-)
+
+--- a/Documentation/block/inline-encryption.rst
++++ b/Documentation/block/inline-encryption.rst
+@@ -142,7 +142,7 @@ Therefore, we also introduce *blk-crypto
+ of inline encryption using the kernel crypto API. blk-crypto-fallback is built
+ into the block layer, so it works on any block device without any special setup.
+ Essentially, when a bio with an encryption context is submitted to a
+-request_queue that doesn't support that encryption context, the block layer will
++block_device that doesn't support that encryption context, the block layer will
+ handle en/decryption of the bio using blk-crypto-fallback.
+
+ For encryption, the data cannot be encrypted in-place, as callers usually rely
+@@ -187,7 +187,7 @@ API presented to users of the block laye
+
+ ``blk_crypto_config_supported()`` allows users to check ahead of time whether
+ inline encryption with particular crypto settings will work on a particular
+-request_queue -- either via hardware or via blk-crypto-fallback. This function
++block_device -- either via hardware or via blk-crypto-fallback. This function
+ takes in a ``struct blk_crypto_config`` which is like blk_crypto_key, but omits
+ the actual bytes of the key and instead just contains the algorithm, data unit
+ size, etc. This function can be useful if blk-crypto-fallback is disabled.
+@@ -195,7 +195,7 @@ size, etc. This function can be useful
+ ``blk_crypto_init_key()`` allows users to initialize a blk_crypto_key.
+
+ Users must call ``blk_crypto_start_using_key()`` before actually starting to use
+-a blk_crypto_key on a request_queue (even if ``blk_crypto_config_supported()``
++a blk_crypto_key on a block_device (even if ``blk_crypto_config_supported()``
+ was called earlier). This is needed to initialize blk-crypto-fallback if it
+ will be needed. This must not be called from the data path, as this may have to
+ allocate resources, which may deadlock in that case.
+@@ -207,7 +207,7 @@ for en/decryption. Users don't need to
+ later, as that happens automatically when the bio is freed or reset.
+
+ Finally, when done using inline encryption with a blk_crypto_key on a
+-request_queue, users must call ``blk_crypto_evict_key()``. This ensures that
++block_device, users must call ``blk_crypto_evict_key()``. This ensures that
+ the key is evicted from all keyslots it may be programmed into and unlinked from
+ any kernel data structures it may be linked into.
+
+@@ -221,9 +221,9 @@ as follows:
+ 5. ``blk_crypto_evict_key()`` (after all I/O has completed)
+ 6. Zeroize the blk_crypto_key (this has no dedicated function)
+
+-If a blk_crypto_key is being used on multiple request_queues, then
++If a blk_crypto_key is being used on multiple block_devices, then
+ ``blk_crypto_config_supported()`` (if used), ``blk_crypto_start_using_key()``,
+-and ``blk_crypto_evict_key()`` must be called on each request_queue.
++and ``blk_crypto_evict_key()`` must be called on each block_device.
+
+ API presented to device drivers
+ ===============================
+--- a/block/blk-crypto.c
++++ b/block/blk-crypto.c
+@@ -354,20 +354,21 @@ int blk_crypto_init_key(struct blk_crypt
+
+ /*
+ * Check if bios with @cfg can be en/decrypted by blk-crypto (i.e. either the
+- * request queue it's submitted to supports inline crypto, or the
++ * block_device it's submitted to supports inline crypto, or the
+ * blk-crypto-fallback is enabled and supports the cfg).
+ */
+-bool blk_crypto_config_supported(struct request_queue *q,
++bool blk_crypto_config_supported(struct block_device *bdev,
+ const struct blk_crypto_config *cfg)
+ {
+ return IS_ENABLED(CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK) ||
+- __blk_crypto_cfg_supported(q->crypto_profile, cfg);
++ __blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile,
++ cfg);
+ }
+
+ /**
+ * blk_crypto_start_using_key() - Start using a blk_crypto_key on a device
++ * @bdev: block device to operate on
+ * @key: A key to use on the device
+- * @q: the request queue for the device
+ *
+ * Upper layers must call this function to ensure that either the hardware
+ * supports the key's crypto settings, or the crypto API fallback has transforms
+@@ -379,10 +380,11 @@ bool blk_crypto_config_supported(struct
+ * blk-crypto-fallback is either disabled or the needed algorithm
+ * is disabled in the crypto API; or another -errno code.
+ */
+-int blk_crypto_start_using_key(const struct blk_crypto_key *key,
+- struct request_queue *q)
++int blk_crypto_start_using_key(struct block_device *bdev,
++ const struct blk_crypto_key *key)
+ {
+- if (__blk_crypto_cfg_supported(q->crypto_profile, &key->crypto_cfg))
++ if (__blk_crypto_cfg_supported(bdev_get_queue(bdev)->crypto_profile,
++ &key->crypto_cfg))
+ return 0;
+ return blk_crypto_fallback_start_using_mode(key->crypto_cfg.crypto_mode);
+ }
+@@ -390,7 +392,7 @@ int blk_crypto_start_using_key(const str
+ /**
+ * blk_crypto_evict_key() - Evict a key from any inline encryption hardware
+ * it may have been programmed into
+- * @q: The request queue who's associated inline encryption hardware this key
++ * @bdev: The block_device who's associated inline encryption hardware this key
+ * might have been programmed into
+ * @key: The key to evict
+ *
+@@ -400,14 +402,16 @@ int blk_crypto_start_using_key(const str
+ *
+ * Return: 0 on success or if the key wasn't in any keyslot; -errno on error.
+ */
+-int blk_crypto_evict_key(struct request_queue *q,
++int blk_crypto_evict_key(struct block_device *bdev,
+ const struct blk_crypto_key *key)
+ {
++ struct request_queue *q = bdev_get_queue(bdev);
++
+ if (__blk_crypto_cfg_supported(q->crypto_profile, &key->crypto_cfg))
+ return __blk_crypto_evict_key(q->crypto_profile, key);
+
+ /*
+- * If the request_queue didn't support the key, then blk-crypto-fallback
++ * If the block_device didn't support the key, then blk-crypto-fallback
+ * may have been used, so try to evict the key from blk-crypto-fallback.
+ */
+ return blk_crypto_fallback_evict_key(key);
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1214,7 +1214,7 @@ static int dm_keyslot_evict_callback(str
+ struct dm_keyslot_evict_args *args = data;
+ int err;
+
+- err = blk_crypto_evict_key(bdev_get_queue(dev->bdev), args->key);
++ err = blk_crypto_evict_key(dev->bdev, args->key);
+ if (!args->err)
+ args->err = err;
+ /* Always try to evict the key from all devices. */
+--- a/fs/crypto/inline_crypt.c
++++ b/fs/crypto/inline_crypt.c
+@@ -139,8 +139,7 @@ int fscrypt_select_encryption_impl(struc
+ return PTR_ERR(devs);
+
+ for (i = 0; i < num_devs; i++) {
+- if (!blk_crypto_config_supported(bdev_get_queue(devs[i]),
+- &crypto_cfg))
++ if (!blk_crypto_config_supported(devs[i], &crypto_cfg))
+ goto out_free_devs;
+ }
+
+@@ -184,8 +183,7 @@ int fscrypt_prepare_inline_crypt_key(str
+ goto fail;
+ }
+ for (i = 0; i < num_devs; i++) {
+- err = blk_crypto_start_using_key(blk_key,
+- bdev_get_queue(devs[i]));
++ err = blk_crypto_start_using_key(devs[i], blk_key);
+ if (err)
+ break;
+ }
+@@ -224,7 +222,7 @@ void fscrypt_destroy_inline_crypt_key(st
+ devs = fscrypt_get_devices(sb, &num_devs);
+ if (!IS_ERR(devs)) {
+ for (i = 0; i < num_devs; i++)
+- blk_crypto_evict_key(bdev_get_queue(devs[i]), blk_key);
++ blk_crypto_evict_key(devs[i], blk_key);
+ kfree(devs);
+ }
+ kfree_sensitive(blk_key);
+--- a/include/linux/blk-crypto.h
++++ b/include/linux/blk-crypto.h
+@@ -71,9 +71,6 @@ struct bio_crypt_ctx {
+ #include <linux/blk_types.h>
+ #include <linux/blkdev.h>
+
+-struct request;
+-struct request_queue;
+-
+ #ifdef CONFIG_BLK_INLINE_ENCRYPTION
+
+ static inline bool bio_has_crypt_ctx(struct bio *bio)
+@@ -94,13 +91,13 @@ int blk_crypto_init_key(struct blk_crypt
+ unsigned int dun_bytes,
+ unsigned int data_unit_size);
+
+-int blk_crypto_start_using_key(const struct blk_crypto_key *key,
+- struct request_queue *q);
++int blk_crypto_start_using_key(struct block_device *bdev,
++ const struct blk_crypto_key *key);
+
+-int blk_crypto_evict_key(struct request_queue *q,
++int blk_crypto_evict_key(struct block_device *bdev,
+ const struct blk_crypto_key *key);
+
+-bool blk_crypto_config_supported(struct request_queue *q,
++bool blk_crypto_config_supported(struct block_device *bdev,
+ const struct blk_crypto_config *cfg);
+
+ #else /* CONFIG_BLK_INLINE_ENCRYPTION */
--- /dev/null
+From stable-owner@vger.kernel.org Thu May 4 12:55:05 2023
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 3 May 2023 20:54:17 -0700
+Subject: blk-crypto: make blk_crypto_evict_key() more robust
+To: stable@vger.kernel.org
+Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>
+Message-ID: <20230504035417.61435-8-ebiggers@kernel.org>
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 5c7cb94452901a93e90c2230632e2c12a681bc92 upstream.
+
+If blk_crypto_evict_key() sees that the key is still in-use (due to a
+bug) or that ->keyslot_evict failed, it currently just returns while
+leaving the key linked into the keyslot management structures.
+
+However, blk_crypto_evict_key() is only called in contexts such as inode
+eviction where failure is not an option. So actually the caller
+proceeds with freeing the blk_crypto_key regardless of the return value
+of blk_crypto_evict_key().
+
+These two assumptions don't match, and the result is that there can be a
+use-after-free in blk_crypto_reprogram_all_keys() after one of these
+errors occurs. (Note, these errors *shouldn't* happen; we're just
+talking about what happens if they do anyway.)
+
+Fix this by making blk_crypto_evict_key() unlink the key from the
+keyslot management structures even on failure.
+
+Also improve some comments.
+
+Fixes: 1b2628397058 ("block: Keyslot Manager for Inline Encryption")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20230315183907.53675-2-ebiggers@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-crypto-profile.c | 46 ++++++++++++++++++++-------------------------
+ block/blk-crypto.c | 28 +++++++++++++++++++--------
+ 2 files changed, 41 insertions(+), 33 deletions(-)
+
+--- a/block/blk-crypto-profile.c
++++ b/block/blk-crypto-profile.c
+@@ -354,28 +354,16 @@ bool __blk_crypto_cfg_supported(struct b
+ return true;
+ }
+
+-/**
+- * __blk_crypto_evict_key() - Evict a key from a device.
+- * @profile: the crypto profile of the device
+- * @key: the key to evict. It must not still be used in any I/O.
+- *
+- * If the device has keyslots, this finds the keyslot (if any) that contains the
+- * specified key and calls the driver's keyslot_evict function to evict it.
+- *
+- * Otherwise, this just calls the driver's keyslot_evict function if it is
+- * implemented, passing just the key (without any particular keyslot). This
+- * allows layered devices to evict the key from their underlying devices.
+- *
+- * Context: Process context. Takes and releases profile->lock.
+- * Return: 0 on success or if there's no keyslot with the specified key, -EBUSY
+- * if the keyslot is still in use, or another -errno value on other
+- * error.
++/*
++ * This is an internal function that evicts a key from an inline encryption
++ * device that can be either a real device or the blk-crypto-fallback "device".
++ * It is used only by blk_crypto_evict_key(); see that function for details.
+ */
+ int __blk_crypto_evict_key(struct blk_crypto_profile *profile,
+ const struct blk_crypto_key *key)
+ {
+ struct blk_crypto_keyslot *slot;
+- int err = 0;
++ int err;
+
+ if (profile->num_slots == 0) {
+ if (profile->ll_ops.keyslot_evict) {
+@@ -389,22 +377,30 @@ int __blk_crypto_evict_key(struct blk_cr
+
+ blk_crypto_hw_enter(profile);
+ slot = blk_crypto_find_keyslot(profile, key);
+- if (!slot)
+- goto out_unlock;
++ if (!slot) {
++ /*
++ * Not an error, since a key not in use by I/O is not guaranteed
++ * to be in a keyslot. There can be more keys than keyslots.
++ */
++ err = 0;
++ goto out;
++ }
+
+ if (WARN_ON_ONCE(atomic_read(&slot->slot_refs) != 0)) {
++ /* BUG: key is still in use by I/O */
+ err = -EBUSY;
+- goto out_unlock;
++ goto out_remove;
+ }
+ err = profile->ll_ops.keyslot_evict(profile, key,
+ blk_crypto_keyslot_index(slot));
+- if (err)
+- goto out_unlock;
+-
++out_remove:
++ /*
++ * Callers free the key even on error, so unlink the key from the hash
++ * table and clear slot->key even on error.
++ */
+ hlist_del(&slot->hash_node);
+ slot->key = NULL;
+- err = 0;
+-out_unlock:
++out:
+ blk_crypto_hw_exit(profile);
+ return err;
+ }
+--- a/block/blk-crypto.c
++++ b/block/blk-crypto.c
+@@ -394,15 +394,19 @@ int blk_crypto_start_using_key(struct bl
+ }
+
+ /**
+- * blk_crypto_evict_key() - Evict a key from any inline encryption hardware
+- * it may have been programmed into
+- * @bdev: The block_device who's associated inline encryption hardware this key
+- * might have been programmed into
+- * @key: The key to evict
++ * blk_crypto_evict_key() - Evict a blk_crypto_key from a block_device
++ * @bdev: a block_device on which I/O using the key may have been done
++ * @key: the key to evict
+ *
+- * Upper layers (filesystems) must call this function to ensure that a key is
+- * evicted from any hardware that it might have been programmed into. The key
+- * must not be in use by any in-flight IO when this function is called.
++ * For a given block_device, this function removes the given blk_crypto_key from
++ * the keyslot management structures and evicts it from any underlying hardware
++ * keyslot(s) or blk-crypto-fallback keyslot it may have been programmed into.
++ *
++ * Upper layers must call this before freeing the blk_crypto_key. It must be
++ * called for every block_device the key may have been used on. The key must no
++ * longer be in use by any I/O when this function is called.
++ *
++ * Context: May sleep.
+ */
+ void blk_crypto_evict_key(struct block_device *bdev,
+ const struct blk_crypto_key *key)
+@@ -414,6 +418,14 @@ void blk_crypto_evict_key(struct block_d
+ err = __blk_crypto_evict_key(q->crypto_profile, key);
+ else
+ err = blk_crypto_fallback_evict_key(key);
++ /*
++ * An error can only occur here if the key failed to be evicted from a
++ * keyslot (due to a hardware or driver issue) or is allegedly still in
++ * use by I/O (due to a kernel bug). Even in these cases, the key is
++ * still unlinked from the keyslot management structures, and the caller
++ * is allowed and expected to free it right away. There's nothing
++ * callers can do to handle errors, so just log them and return void.
++ */
+ if (err)
+ pr_warn_ratelimited("%pg: error %d evicting key\n", bdev, err);
+ }
--- /dev/null
+From stable-owner@vger.kernel.org Thu May 4 12:55:05 2023
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 3 May 2023 20:54:16 -0700
+Subject: blk-crypto: make blk_crypto_evict_key() return void
+To: stable@vger.kernel.org
+Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>
+Message-ID: <20230504035417.61435-7-ebiggers@kernel.org>
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 70493a63ba04f754f7a7dd53a4fcc82700181490 upstream.
+
+blk_crypto_evict_key() is only called in contexts such as inode eviction
+where failure is not an option. So there is nothing the caller can do
+with errors except log them. (dm-table.c does "use" the error code, but
+only to pass on to upper layers, so it doesn't really count.)
+
+Just make blk_crypto_evict_key() return void and log errors itself.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20230315183907.53675-2-ebiggers@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-crypto.c | 20 +++++++++-----------
+ drivers/md/dm-table.c | 19 +++++--------------
+ include/linux/blk-crypto.h | 4 ++--
+ 3 files changed, 16 insertions(+), 27 deletions(-)
+
+--- a/block/blk-crypto.c
++++ b/block/blk-crypto.c
+@@ -13,6 +13,7 @@
+ #include <linux/blkdev.h>
+ #include <linux/blk-crypto-profile.h>
+ #include <linux/module.h>
++#include <linux/ratelimit.h>
+ #include <linux/slab.h>
+
+ #include "blk-crypto-internal.h"
+@@ -402,21 +403,18 @@ int blk_crypto_start_using_key(struct bl
+ * Upper layers (filesystems) must call this function to ensure that a key is
+ * evicted from any hardware that it might have been programmed into. The key
+ * must not be in use by any in-flight IO when this function is called.
+- *
+- * Return: 0 on success or if the key wasn't in any keyslot; -errno on error.
+ */
+-int blk_crypto_evict_key(struct block_device *bdev,
+- const struct blk_crypto_key *key)
++void blk_crypto_evict_key(struct block_device *bdev,
++ const struct blk_crypto_key *key)
+ {
+ struct request_queue *q = bdev_get_queue(bdev);
++ int err;
+
+ if (blk_crypto_config_supported_natively(bdev, &key->crypto_cfg))
+- return __blk_crypto_evict_key(q->crypto_profile, key);
+-
+- /*
+- * If the block_device didn't support the key, then blk-crypto-fallback
+- * may have been used, so try to evict the key from blk-crypto-fallback.
+- */
+- return blk_crypto_fallback_evict_key(key);
++ err = __blk_crypto_evict_key(q->crypto_profile, key);
++ else
++ err = blk_crypto_fallback_evict_key(key);
++ if (err)
++ pr_warn_ratelimited("%pg: error %d evicting key\n", bdev, err);
+ }
+ EXPORT_SYMBOL_GPL(blk_crypto_evict_key);
+--- a/drivers/md/dm-table.c
++++ b/drivers/md/dm-table.c
+@@ -1203,21 +1203,12 @@ struct dm_crypto_profile {
+ struct mapped_device *md;
+ };
+
+-struct dm_keyslot_evict_args {
+- const struct blk_crypto_key *key;
+- int err;
+-};
+-
+ static int dm_keyslot_evict_callback(struct dm_target *ti, struct dm_dev *dev,
+ sector_t start, sector_t len, void *data)
+ {
+- struct dm_keyslot_evict_args *args = data;
+- int err;
++ const struct blk_crypto_key *key = data;
+
+- err = blk_crypto_evict_key(dev->bdev, args->key);
+- if (!args->err)
+- args->err = err;
+- /* Always try to evict the key from all devices. */
++ blk_crypto_evict_key(dev->bdev, key);
+ return 0;
+ }
+
+@@ -1230,7 +1221,6 @@ static int dm_keyslot_evict(struct blk_c
+ {
+ struct mapped_device *md =
+ container_of(profile, struct dm_crypto_profile, profile)->md;
+- struct dm_keyslot_evict_args args = { key };
+ struct dm_table *t;
+ int srcu_idx;
+
+@@ -1243,11 +1233,12 @@ static int dm_keyslot_evict(struct blk_c
+
+ if (!ti->type->iterate_devices)
+ continue;
+- ti->type->iterate_devices(ti, dm_keyslot_evict_callback, &args);
++ ti->type->iterate_devices(ti, dm_keyslot_evict_callback,
++ (void *)key);
+ }
+
+ dm_put_live_table(md, srcu_idx);
+- return args.err;
++ return 0;
+ }
+
+ static int
+--- a/include/linux/blk-crypto.h
++++ b/include/linux/blk-crypto.h
+@@ -94,8 +94,8 @@ int blk_crypto_init_key(struct blk_crypt
+ int blk_crypto_start_using_key(struct block_device *bdev,
+ const struct blk_crypto_key *key);
+
+-int blk_crypto_evict_key(struct block_device *bdev,
+- const struct blk_crypto_key *key);
++void blk_crypto_evict_key(struct block_device *bdev,
++ const struct blk_crypto_key *key);
+
+ bool blk_crypto_config_supported_natively(struct block_device *bdev,
+ const struct blk_crypto_config *cfg);
--- /dev/null
+From stable-owner@vger.kernel.org Thu May 4 12:55:05 2023
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 3 May 2023 20:54:13 -0700
+Subject: blk-crypto: move internal only declarations to blk-crypto-internal.h
+To: stable@vger.kernel.org
+Cc: linux-block@vger.kernel.org, Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>
+Message-ID: <20230504035417.61435-4-ebiggers@kernel.org>
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 3569788c08235c6f3e9e6ca724b2df44787ff487 upstream.
+
+ blk_crypto_get_keyslot, blk_crypto_put_keyslot, __blk_crypto_evict_key
+and __blk_crypto_cfg_supported are only used internally by the
+blk-crypto code, so move the out of blk-crypto-profile.h, which is
+included by drivers that supply blk-crypto functionality.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20221114042944.1009870-4-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-crypto-internal.h | 12 ++++++++++++
+ include/linux/blk-crypto-profile.h | 12 ------------
+ 2 files changed, 12 insertions(+), 12 deletions(-)
+
+--- a/block/blk-crypto-internal.h
++++ b/block/blk-crypto-internal.h
+@@ -65,6 +65,18 @@ static inline bool blk_crypto_rq_is_encr
+ return rq->crypt_ctx;
+ }
+
++blk_status_t blk_crypto_get_keyslot(struct blk_crypto_profile *profile,
++ const struct blk_crypto_key *key,
++ struct blk_crypto_keyslot **slot_ptr);
++
++void blk_crypto_put_keyslot(struct blk_crypto_keyslot *slot);
++
++int __blk_crypto_evict_key(struct blk_crypto_profile *profile,
++ const struct blk_crypto_key *key);
++
++bool __blk_crypto_cfg_supported(struct blk_crypto_profile *profile,
++ const struct blk_crypto_config *cfg);
++
+ #else /* CONFIG_BLK_INLINE_ENCRYPTION */
+
+ static inline int blk_crypto_sysfs_register(struct request_queue *q)
+--- a/include/linux/blk-crypto-profile.h
++++ b/include/linux/blk-crypto-profile.h
+@@ -138,18 +138,6 @@ int devm_blk_crypto_profile_init(struct
+
+ unsigned int blk_crypto_keyslot_index(struct blk_crypto_keyslot *slot);
+
+-blk_status_t blk_crypto_get_keyslot(struct blk_crypto_profile *profile,
+- const struct blk_crypto_key *key,
+- struct blk_crypto_keyslot **slot_ptr);
+-
+-void blk_crypto_put_keyslot(struct blk_crypto_keyslot *slot);
+-
+-bool __blk_crypto_cfg_supported(struct blk_crypto_profile *profile,
+- const struct blk_crypto_config *cfg);
+-
+-int __blk_crypto_evict_key(struct blk_crypto_profile *profile,
+- const struct blk_crypto_key *key);
+-
+ void blk_crypto_reprogram_all_keys(struct blk_crypto_profile *profile);
+
+ void blk_crypto_profile_destroy(struct blk_crypto_profile *profile);
--- /dev/null
+From stable-owner@vger.kernel.org Thu May 4 12:55:05 2023
+From: Eric Biggers <ebiggers@kernel.org>
+Date: Wed, 3 May 2023 20:54:15 -0700
+Subject: blk-mq: release crypto keyslot before reporting I/O complete
+To: stable@vger.kernel.org
+Cc: linux-block@vger.kernel.org, Nathan Huckleberry <nhuck@google.com>, Christoph Hellwig <hch@lst.de>, Jens Axboe <axboe@kernel.dk>
+Message-ID: <20230504035417.61435-6-ebiggers@kernel.org>
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 9cd1e566676bbcb8a126acd921e4e194e6339603 upstream.
+
+Once all I/O using a blk_crypto_key has completed, filesystems can call
+blk_crypto_evict_key(). However, the block layer currently doesn't call
+blk_crypto_put_keyslot() until the request is being freed, which happens
+after upper layers have been told (via bio_endio()) the I/O has
+completed. This causes a race condition where blk_crypto_evict_key()
+can see 'slot_refs != 0' without there being an actual bug.
+
+This makes __blk_crypto_evict_key() hit the
+'WARN_ON_ONCE(atomic_read(&slot->slot_refs) != 0)' and return without
+doing anything, eventually causing a use-after-free in
+blk_crypto_reprogram_all_keys(). (This is a very rare bug and has only
+been seen when per-file keys are being used with fscrypt.)
+
+There are two options to fix this: either release the keyslot before
+bio_endio() is called on the request's last bio, or make
+__blk_crypto_evict_key() ignore slot_refs. Let's go with the first
+solution, since it preserves the ability to report bugs (via
+WARN_ON_ONCE) where a key is evicted while still in-use.
+
+Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq")
+Cc: stable@vger.kernel.org
+Reviewed-by: Nathan Huckleberry <nhuck@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20230315183907.53675-2-ebiggers@kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-crypto-internal.h | 25 +++++++++++++++++++++----
+ block/blk-crypto.c | 24 ++++++++++++------------
+ block/blk-merge.c | 2 ++
+ block/blk-mq.c | 15 ++++++++++++++-
+ 4 files changed, 49 insertions(+), 17 deletions(-)
+
+--- a/block/blk-crypto-internal.h
++++ b/block/blk-crypto-internal.h
+@@ -65,6 +65,11 @@ static inline bool blk_crypto_rq_is_encr
+ return rq->crypt_ctx;
+ }
+
++static inline bool blk_crypto_rq_has_keyslot(struct request *rq)
++{
++ return rq->crypt_keyslot;
++}
++
+ blk_status_t blk_crypto_get_keyslot(struct blk_crypto_profile *profile,
+ const struct blk_crypto_key *key,
+ struct blk_crypto_keyslot **slot_ptr);
+@@ -117,6 +122,11 @@ static inline bool blk_crypto_rq_is_encr
+ return false;
+ }
+
++static inline bool blk_crypto_rq_has_keyslot(struct request *rq)
++{
++ return false;
++}
++
+ #endif /* CONFIG_BLK_INLINE_ENCRYPTION */
+
+ void __bio_crypt_advance(struct bio *bio, unsigned int bytes);
+@@ -151,14 +161,21 @@ static inline bool blk_crypto_bio_prep(s
+ return true;
+ }
+
+-blk_status_t __blk_crypto_init_request(struct request *rq);
+-static inline blk_status_t blk_crypto_init_request(struct request *rq)
++blk_status_t __blk_crypto_rq_get_keyslot(struct request *rq);
++static inline blk_status_t blk_crypto_rq_get_keyslot(struct request *rq)
+ {
+ if (blk_crypto_rq_is_encrypted(rq))
+- return __blk_crypto_init_request(rq);
++ return __blk_crypto_rq_get_keyslot(rq);
+ return BLK_STS_OK;
+ }
+
++void __blk_crypto_rq_put_keyslot(struct request *rq);
++static inline void blk_crypto_rq_put_keyslot(struct request *rq)
++{
++ if (blk_crypto_rq_has_keyslot(rq))
++ __blk_crypto_rq_put_keyslot(rq);
++}
++
+ void __blk_crypto_free_request(struct request *rq);
+ static inline void blk_crypto_free_request(struct request *rq)
+ {
+@@ -197,7 +214,7 @@ static inline blk_status_t blk_crypto_in
+ {
+
+ if (blk_crypto_rq_is_encrypted(rq))
+- return blk_crypto_init_request(rq);
++ return blk_crypto_rq_get_keyslot(rq);
+ return BLK_STS_OK;
+ }
+
+--- a/block/blk-crypto.c
++++ b/block/blk-crypto.c
+@@ -218,27 +218,27 @@ static bool bio_crypt_check_alignment(st
+ return true;
+ }
+
+-blk_status_t __blk_crypto_init_request(struct request *rq)
++blk_status_t __blk_crypto_rq_get_keyslot(struct request *rq)
+ {
+ return blk_crypto_get_keyslot(rq->q->crypto_profile,
+ rq->crypt_ctx->bc_key,
+ &rq->crypt_keyslot);
+ }
+
+-/**
+- * __blk_crypto_free_request - Uninitialize the crypto fields of a request.
+- *
+- * @rq: The request whose crypto fields to uninitialize.
+- *
+- * Completely uninitializes the crypto fields of a request. If a keyslot has
+- * been programmed into some inline encryption hardware, that keyslot is
+- * released. The rq->crypt_ctx is also freed.
+- */
+-void __blk_crypto_free_request(struct request *rq)
++void __blk_crypto_rq_put_keyslot(struct request *rq)
+ {
+ blk_crypto_put_keyslot(rq->crypt_keyslot);
++ rq->crypt_keyslot = NULL;
++}
++
++void __blk_crypto_free_request(struct request *rq)
++{
++ /* The keyslot, if one was needed, should have been released earlier. */
++ if (WARN_ON_ONCE(rq->crypt_keyslot))
++ __blk_crypto_rq_put_keyslot(rq);
++
+ mempool_free(rq->crypt_ctx, bio_crypt_ctx_pool);
+- blk_crypto_rq_set_defaults(rq);
++ rq->crypt_ctx = NULL;
+ }
+
+ /**
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -863,6 +863,8 @@ static struct request *attempt_merge(str
+ if (!blk_discard_mergable(req))
+ elv_merge_requests(q, req, next);
+
++ blk_crypto_rq_put_keyslot(next);
++
+ /*
+ * 'next' is going away, so update stats accordingly
+ */
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -808,6 +808,12 @@ static void blk_complete_request(struct
+ req->q->integrity.profile->complete_fn(req, total_bytes);
+ #endif
+
++ /*
++ * Upper layers may call blk_crypto_evict_key() anytime after the last
++ * bio_endio(). Therefore, the keyslot must be released before that.
++ */
++ blk_crypto_rq_put_keyslot(req);
++
+ blk_account_io_completion(req, total_bytes);
+
+ do {
+@@ -873,6 +879,13 @@ bool blk_update_request(struct request *
+ req->q->integrity.profile->complete_fn(req, nr_bytes);
+ #endif
+
++ /*
++ * Upper layers may call blk_crypto_evict_key() anytime after the last
++ * bio_endio(). Therefore, the keyslot must be released before that.
++ */
++ if (blk_crypto_rq_has_keyslot(req) && nr_bytes >= blk_rq_bytes(req))
++ __blk_crypto_rq_put_keyslot(req);
++
+ if (unlikely(error && !blk_rq_is_passthrough(req) &&
+ !(req->rq_flags & RQF_QUIET)) &&
+ !test_bit(GD_DEAD, &req->q->disk->state)) {
+@@ -2955,7 +2968,7 @@ void blk_mq_submit_bio(struct bio *bio)
+
+ blk_mq_bio_to_request(rq, bio, nr_segs);
+
+- ret = blk_crypto_init_request(rq);
++ ret = blk_crypto_rq_get_keyslot(rq);
+ if (ret != BLK_STS_OK) {
+ bio->bi_status = ret;
+ bio_endio(bio);
--- /dev/null
+From 20de765f6d9da0c47b756429c60b41063b990a10 Mon Sep 17 00:00:00 2001
+From: Chengming Zhou <zhouchengming@bytedance.com>
+Date: Thu, 13 Apr 2023 14:28:04 +0800
+Subject: blk-stat: fix QUEUE_FLAG_STATS clear
+
+From: Chengming Zhou <zhouchengming@bytedance.com>
+
+commit 20de765f6d9da0c47b756429c60b41063b990a10 upstream.
+
+We need to set QUEUE_FLAG_STATS for two cases:
+1. blk_stat_enable_accounting()
+2. blk_stat_add_callback()
+
+So we should clear it only when ((q->stats->accounting == 0) &&
+list_empty(&q->stats->callbacks)).
+
+blk_stat_disable_accounting() only check if q->stats->accounting
+is 0 before clear the flag, this patch fix it.
+
+Also add list_empty(&q->stats->callbacks)) check when enable, or
+the flag is already set.
+
+The bug can be reproduced on kernel without BLK_DEV_THROTTLING
+(since it unconditionally enable accounting, see the next patch).
+
+ # cat /sys/block/sr0/queue/scheduler
+ none mq-deadline [bfq]
+
+ # cat /sys/kernel/debug/block/sr0/state
+ SAME_COMP|IO_STAT|INIT_DONE|STATS|REGISTERED|NOWAIT|30
+
+ # echo none > /sys/block/sr0/queue/scheduler
+
+ # cat /sys/kernel/debug/block/sr0/state
+ SAME_COMP|IO_STAT|INIT_DONE|REGISTERED|NOWAIT
+
+ # cat /sys/block/sr0/queue/wbt_lat_usec
+ 75000
+
+We can see that after changing elevator from "bfq" to "none",
+"STATS" flag is lost even though WBT callback still need it.
+
+Fixes: 68497092bde9 ("block: make queue stat accounting a reference")
+Cc: <stable@vger.kernel.org> # v5.17+
+Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20230413062805.2081970-1-chengming.zhou@linux.dev
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-stat.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/block/blk-stat.c
++++ b/block/blk-stat.c
+@@ -189,7 +189,7 @@ void blk_stat_disable_accounting(struct
+ unsigned long flags;
+
+ spin_lock_irqsave(&q->stats->lock, flags);
+- if (!--q->stats->accounting)
++ if (!--q->stats->accounting && list_empty(&q->stats->callbacks))
+ blk_queue_flag_clear(QUEUE_FLAG_STATS, q);
+ spin_unlock_irqrestore(&q->stats->lock, flags);
+ }
+@@ -200,7 +200,7 @@ void blk_stat_enable_accounting(struct r
+ unsigned long flags;
+
+ spin_lock_irqsave(&q->stats->lock, flags);
+- if (!q->stats->accounting++)
++ if (!q->stats->accounting++ && list_empty(&q->stats->callbacks))
+ blk_queue_flag_set(QUEUE_FLAG_STATS, q);
+ spin_unlock_irqrestore(&q->stats->lock, flags);
+ }
--- /dev/null
+From e3184de9d46c2eebdb776face2e2662c6733331d Mon Sep 17 00:00:00 2001
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+Date: Fri, 31 Mar 2023 16:45:02 +0800
+Subject: fs: fix sysctls.c built
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+commit e3184de9d46c2eebdb776face2e2662c6733331d upstream.
+
+'obj-$(CONFIG_SYSCTL) += sysctls.o' must be moved after "obj-y :=",
+or it won't be built as it is overwrited.
+
+Note that there is nothing that is going to break by linking
+sysctl.o later, we were just being way to cautious and patches
+have been updated to reflect these considerations and sent for
+stable as well with the whole "base" stuff needing to be linked
+prior to child sysctl tables that use that directory. All of
+the kernel sysctl APIs always share the same directory, and races
+against using it should end up re-using the same single created
+directory.
+
+And so something we can do eventually is do away with all the base stuff.
+For now it's fine, it's not creating an issue. It is just a bit pedantic
+and careful.
+
+Fixes: ab171b952c6e ("fs: move namespace sysctls and declare fs base directory")
+Cc: stable@vger.kernel.org # v5.17
+Cc: Christian Brauner <brauner@kernel.org>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+[mcgrof: enhanced commit log for stable criteria and clarify base stuff ]
+Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/Makefile | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/fs/Makefile
++++ b/fs/Makefile
+@@ -6,7 +6,6 @@
+ # Rewritten to use lists instead of if-statements.
+ #
+
+-obj-$(CONFIG_SYSCTL) += sysctls.o
+
+ obj-y := open.o read_write.o file_table.o super.o \
+ char_dev.o stat.o exec.o pipe.o namei.o fcntl.o \
+@@ -49,7 +48,7 @@ obj-$(CONFIG_FS_MBCACHE) += mbcache.o
+ obj-$(CONFIG_FS_POSIX_ACL) += posix_acl.o
+ obj-$(CONFIG_NFS_COMMON) += nfs_common/
+ obj-$(CONFIG_COREDUMP) += coredump.o
+-obj-$(CONFIG_SYSCTL) += drop_caches.o
++obj-$(CONFIG_SYSCTL) += drop_caches.o sysctls.o
+
+ obj-$(CONFIG_FHANDLE) += fhandle.o
+ obj-y += iomap/
--- /dev/null
+From 2a8e41ad337508fc5d598c0f9288890214f8e318 Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Wed, 19 Apr 2023 11:36:55 +1200
+Subject: hwmon: (adt7475) Use device_property APIs when configuring polarity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+
+commit 2a8e41ad337508fc5d598c0f9288890214f8e318 upstream.
+
+On DT unaware platforms of_property_read_u32_array() returns -ENOSYS
+which wasn't handled by the code treating adi,pwm-active-state as
+optional. Update the code to use device_property_read_u32_array() which
+deals gracefully with DT unaware platforms.
+
+Fixes: 86da28eed4fb ("hwmon: (adt7475) Add support for inverting pwm output")
+Reported-by: Mariusz Białończyk <manio@skyboo.net>
+Link: https://lore.kernel.org/linux-hwmon/52e26a67-9131-2dc0-40cb-db5c07370027@alliedtelesis.co.nz/T/#mdd0505801e0a4e72340de009a47c0fca4f771ed3
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Link: https://lore.kernel.org/r/20230418233656.869055-2-chris.packham@alliedtelesis.co.nz
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/adt7475.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -1604,9 +1604,9 @@ static int adt7475_set_pwm_polarity(stru
+ int ret, i;
+ u8 val;
+
+- ret = of_property_read_u32_array(client->dev.of_node,
+- "adi,pwm-active-state", states,
+- ARRAY_SIZE(states));
++ ret = device_property_read_u32_array(&client->dev,
++ "adi,pwm-active-state", states,
++ ARRAY_SIZE(states));
+ if (ret)
+ return ret;
+
--- /dev/null
+From 0c072385348e3ac5229145644055d3e2afb5b3db Mon Sep 17 00:00:00 2001
+From: Babu Moger <Babu.Moger@amd.com>
+Date: Thu, 13 Apr 2023 16:39:58 -0500
+Subject: hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Babu Moger <Babu.Moger@amd.com>
+
+commit 0c072385348e3ac5229145644055d3e2afb5b3db upstream.
+
+Spec says, when CUR_TEMP_TJ_SEL == 3 and CUR_TEMP_RANGE_SEL == 0,
+it should use RangeUnadjusted is 0, which is (CurTmp*0.125 -49) C. The
+CUR_TEMP register is read-write when CUR_TEMP_TJ_SEL == 3 (bit 17-16).
+
+Add the check to detect it.
+
+Sensors command's output before the patch.
+$sensors
+ k10temp-pci-00c3
+ Adapter: PCI adapter
+ Tctl: +76.6°C <- Wrong value
+ Tccd1: +26.5°C
+ Tccd2: +27.5°C
+ Tccd3: +27.2°C
+ Tccd4: +27.5°C
+ Tccd5: +26.0°C
+ Tccd6: +26.2°C
+ Tccd7: +25.0°C
+ Tccd8: +26.5°C
+
+Sensors command's output after the patch.
+$sensors
+ k10temp-pci-00c3
+ Adapter: PCI adapter
+ Tctl: +28.8°C <- corrected value
+ Tccd1: +27.5°C
+ Tccd2: +28.5°C
+ Tccd3: +28.5°C
+ Tccd4: +28.5°C
+ Tccd5: +27.0°C
+ Tccd6: +27.5°C
+ Tccd7: +27.0°C
+ Tccd8: +27.5°C
+
+Signed-off-by: Babu Moger <babu.moger@amd.com>
+Fixes: 1b59788979ac ("hwmon: (k10temp) Add temperature offset for Ryzen 2700X")
+Link: https://lore.kernel.org/r/20230413213958.847634-1-babu.moger@amd.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hwmon/k10temp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -75,6 +75,7 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+
+ #define ZEN_CUR_TEMP_SHIFT 21
+ #define ZEN_CUR_TEMP_RANGE_SEL_MASK BIT(19)
++#define ZEN_CUR_TEMP_TJ_SEL_MASK GENMASK(17, 16)
+
+ struct k10temp_data {
+ struct pci_dev *pdev;
+@@ -155,7 +156,8 @@ static long get_raw_temp(struct k10temp_
+
+ data->read_tempreg(data->pdev, ®val);
+ temp = (regval >> ZEN_CUR_TEMP_SHIFT) * 125;
+- if (regval & data->temp_adjust_mask)
++ if ((regval & data->temp_adjust_mask) ||
++ (regval & ZEN_CUR_TEMP_TJ_SEL_MASK) == ZEN_CUR_TEMP_TJ_SEL_MASK)
+ temp -= 49000;
+ return temp;
+ }
--- /dev/null
+From 9740827468cea80c42db29e7171a50e99acf7328 Mon Sep 17 00:00:00 2001
+From: William Breathitt Gray <william.gray@linaro.org>
+Date: Thu, 6 Apr 2023 10:40:10 -0400
+Subject: iio: addac: stx104: Fix race condition for stx104_write_raw()
+
+From: William Breathitt Gray <william.gray@linaro.org>
+
+commit 9740827468cea80c42db29e7171a50e99acf7328 upstream.
+
+The priv->chan_out_states array and actual DAC value can become
+mismatched if stx104_write_raw() is called concurrently. Prevent such a
+race condition by utilizing a mutex.
+
+Fixes: 97a445dad37a ("iio: Add IIO support for the DAC on the Apex Embedded Systems STX104")
+Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
+Link: https://lore.kernel.org/r/c95c9a77fcef36b2a052282146950f23bbc1ebdc.1680790580.git.william.gray@linaro.org
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/addac/stx104.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/iio/addac/stx104.c
++++ b/drivers/iio/addac/stx104.c
+@@ -15,6 +15,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/moduleparam.h>
++#include <linux/mutex.h>
+ #include <linux/spinlock.h>
+ #include <linux/types.h>
+
+@@ -69,10 +70,12 @@ struct stx104_reg {
+
+ /**
+ * struct stx104_iio - IIO device private data structure
++ * @lock: synchronization lock to prevent I/O race conditions
+ * @chan_out_states: channels' output states
+ * @reg: I/O address offset for the device registers
+ */
+ struct stx104_iio {
++ struct mutex lock;
+ unsigned int chan_out_states[STX104_NUM_OUT_CHAN];
+ struct stx104_reg __iomem *reg;
+ };
+@@ -182,9 +185,12 @@ static int stx104_write_raw(struct iio_d
+ if ((unsigned int)val > 65535)
+ return -EINVAL;
+
++ mutex_lock(&priv->lock);
++
+ priv->chan_out_states[chan->channel] = val;
+ iowrite16(val, &priv->reg->dac[chan->channel]);
+
++ mutex_unlock(&priv->lock);
+ return 0;
+ }
+ return -EINVAL;
+@@ -355,6 +361,8 @@ static int stx104_probe(struct device *d
+
+ indio_dev->name = dev_name(dev);
+
++ mutex_init(&priv->lock);
++
+ /* configure device for software trigger operation */
+ iowrite8(0, &priv->reg->acr);
+
--- /dev/null
+From 4f9b80aefb9e2f542a49d9ec087cf5919730e1dd Mon Sep 17 00:00:00 2001
+From: William Breathitt Gray <william.gray@linaro.org>
+Date: Thu, 6 Apr 2023 10:40:11 -0400
+Subject: iio: addac: stx104: Fix race condition when converting analog-to-digital
+
+From: William Breathitt Gray <william.gray@linaro.org>
+
+commit 4f9b80aefb9e2f542a49d9ec087cf5919730e1dd upstream.
+
+The ADC conversion procedure requires several device I/O operations
+performed in a particular sequence. If stx104_read_raw() is called
+concurrently, the ADC conversion procedure could be clobbered. Prevent
+such a race condition by utilizing a mutex.
+
+Fixes: 4075a283ae83 ("iio: stx104: Add IIO support for the ADC channels")
+Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
+Link: https://lore.kernel.org/r/2ae5e40eed5006ca735e4c12181a9ff5ced65547.1680790580.git.william.gray@linaro.org
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/iio/addac/stx104.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/iio/addac/stx104.c
++++ b/drivers/iio/addac/stx104.c
+@@ -114,6 +114,8 @@ static int stx104_read_raw(struct iio_de
+ return IIO_VAL_INT;
+ }
+
++ mutex_lock(&priv->lock);
++
+ /* select ADC channel */
+ iowrite8(chan->channel | (chan->channel << 4), ®->achan);
+
+@@ -124,6 +126,8 @@ static int stx104_read_raw(struct iio_de
+ while (ioread8(®->cir_asr) & BIT(7));
+
+ *val = ioread16(®->ssr_ad);
++
++ mutex_unlock(&priv->lock);
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_OFFSET:
+ /* get ADC bipolar/unipolar configuration */
--- /dev/null
+From 644f17412f5acf01a19af9d04a921937a2bc86c6 Mon Sep 17 00:00:00 2001
+From: Randy Dunlap <rdunlap@infradead.org>
+Date: Thu, 23 Feb 2023 19:27:03 -0800
+Subject: IMA: allow/fix UML builds
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+commit 644f17412f5acf01a19af9d04a921937a2bc86c6 upstream.
+
+UML supports HAS_IOMEM since 0bbadafdc49d (um: allow disabling
+NO_IOMEM).
+
+Current IMA build on UML fails on allmodconfig (with TCG_TPM=m):
+
+ld: security/integrity/ima/ima_queue.o: in function `ima_add_template_entry':
+ima_queue.c:(.text+0x2d9): undefined reference to `tpm_pcr_extend'
+ld: security/integrity/ima/ima_init.o: in function `ima_init':
+ima_init.c:(.init.text+0x43f): undefined reference to `tpm_default_chip'
+ld: security/integrity/ima/ima_crypto.o: in function `ima_calc_boot_aggregate_tfm':
+ima_crypto.c:(.text+0x1044): undefined reference to `tpm_pcr_read'
+ld: ima_crypto.c:(.text+0x10d8): undefined reference to `tpm_pcr_read'
+
+Modify the IMA Kconfig entry so that it selects TCG_TPM if HAS_IOMEM
+is set, regardless of the UML Kconfig setting.
+This updates TCG_TPM from =m to =y and fixes the linker errors.
+
+Fixes: f4a0391dfa91 ("ima: fix Kconfig dependencies")
+Cc: Stable <stable@vger.kernel.org> # v5.14+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Cc: Johannes Berg <johannes@sipsolutions.net>
+Cc: linux-um@lists.infradead.org
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/integrity/ima/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/security/integrity/ima/Kconfig
++++ b/security/integrity/ima/Kconfig
+@@ -8,7 +8,7 @@ config IMA
+ select CRYPTO_HMAC
+ select CRYPTO_SHA1
+ select CRYPTO_HASH_INFO
+- select TCG_TPM if HAS_IOMEM && !UML
++ select TCG_TPM if HAS_IOMEM
+ select TCG_TIS if TCG_TPM && X86
+ select TCG_CRB if TCG_TPM && ACPI
+ select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES
--- /dev/null
+From 6d2555cde2918409b0331560e66f84a0ad4849c6 Mon Sep 17 00:00:00 2001
+From: Zhang Yuchen <zhangyuchen.lcr@bytedance.com>
+Date: Wed, 12 Apr 2023 15:49:07 +0800
+Subject: ipmi: fix SSIF not responding under certain cond.
+
+From: Zhang Yuchen <zhangyuchen.lcr@bytedance.com>
+
+commit 6d2555cde2918409b0331560e66f84a0ad4849c6 upstream.
+
+The ipmi communication is not restored after a specific version of BMC is
+upgraded on our server.
+The ipmi driver does not respond after printing the following log:
+
+ ipmi_ssif: Invalid response getting flags: 1c 1
+
+I found that after entering this branch, ssif_info->ssif_state always
+holds SSIF_GETTING_FLAGS and never return to IDLE.
+
+As a result, the driver cannot be loaded, because the driver status is
+checked during the unload process and must be IDLE in shutdown_ssif():
+
+ while (ssif_info->ssif_state != SSIF_IDLE)
+ schedule_timeout(1);
+
+The process trigger this problem is:
+
+1. One msg timeout and next msg start send, and call
+ssif_set_need_watch().
+
+2. ssif_set_need_watch()->watch_timeout()->start_flag_fetch() change
+ssif_state to SSIF_GETTING_FLAGS.
+
+3. In msg_done_handler() ssif_state == SSIF_GETTING_FLAGS, if an error
+message is received, the second branch does not modify the ssif_state.
+
+4. All retry action need IS_SSIF_IDLE() == True. Include retry action in
+watch_timeout(), msg_done_handler(). Sending msg does not work either.
+SSIF_IDLE is also checked in start_next_msg().
+
+5. The only thing that can be triggered in the SSIF driver is
+watch_timeout(), after destory_user(), this timer will stop too.
+
+So, if enter this branch, the ssif_state will remain SSIF_GETTING_FLAGS
+and can't send msg, no timer started, can't unload.
+
+We did a comparative test before and after adding this patch, and the
+result is effective.
+
+Fixes: 259307074bfc ("ipmi: Add SMBus interface driver (SSIF)")
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhang Yuchen <zhangyuchen.lcr@bytedance.com>
+Message-Id: <20230412074907.80046-1-zhangyuchen.lcr@bytedance.com>
+Signed-off-by: Corey Minyard <minyard@acm.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -786,9 +786,9 @@ static void msg_done_handler(struct ssif
+ } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2
+ || data[1] != IPMI_GET_MSG_FLAGS_CMD) {
+ /*
+- * Don't abort here, maybe it was a queued
+- * response to a previous command.
++ * Recv error response, give up.
+ */
++ ssif_info->ssif_state = SSIF_IDLE;
+ ipmi_ssif_unlock_cond(ssif_info, flags);
+ dev_warn(&ssif_info->client->dev,
+ "Invalid response getting flags: %x %x\n",
--- /dev/null
+From 6ce7995a43febe693d4894033c6e29314970646a Mon Sep 17 00:00:00 2001
+From: Corey Minyard <minyard@acm.org>
+Date: Tue, 4 Apr 2023 12:09:14 +0000
+Subject: ipmi:ssif: Add send_retries increment
+
+From: Corey Minyard <minyard@acm.org>
+
+commit 6ce7995a43febe693d4894033c6e29314970646a upstream.
+
+A recent change removed an increment of send_retries, re-add it.
+
+Fixes: 95767ed78a18 ipmi:ssif: resend_msg() cannot fail
+Reported-by: Pavel Machek <pavel@denx.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Corey Minyard <minyard@acm.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_ssif.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/ipmi/ipmi_ssif.c
++++ b/drivers/char/ipmi/ipmi_ssif.c
+@@ -557,8 +557,10 @@ static void retry_timeout(struct timer_l
+
+ if (waiting)
+ start_get(ssif_info);
+- if (resend)
++ if (resend) {
+ start_resend(ssif_info);
++ ssif_inc_stat(ssif_info, send_retries);
++ }
+ }
+
+ static void watch_timeout(struct timer_list *t)
--- /dev/null
+From b69edab47f1da8edd8e7bfdf8c70f51a2a5d89fb Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Thu, 2 Mar 2023 14:49:50 -0800
+Subject: kheaders: Use array declaration instead of char
+
+From: Kees Cook <keescook@chromium.org>
+
+commit b69edab47f1da8edd8e7bfdf8c70f51a2a5d89fb upstream.
+
+Under CONFIG_FORTIFY_SOURCE, memcpy() will check the size of destination
+and source buffers. Defining kernel_headers_data as "char" would trip
+this check. Since these addresses are treated as byte arrays, define
+them as arrays (as done everywhere else).
+
+This was seen with:
+
+ $ cat /sys/kernel/kheaders.tar.xz >> /dev/null
+
+ detected buffer overflow in memcpy
+ kernel BUG at lib/string_helpers.c:1027!
+ ...
+ RIP: 0010:fortify_panic+0xf/0x20
+ [...]
+ Call Trace:
+ <TASK>
+ ikheaders_read+0x45/0x50 [kheaders]
+ kernfs_fop_read_iter+0x1a4/0x2f0
+ ...
+
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Link: https://lore.kernel.org/bpf/20230302112130.6e402a98@kernel.org/
+Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Tested-by: Jakub Kicinski <kuba@kernel.org>
+Fixes: 43d8ce9d65a5 ("Provide in-kernel headers to make extending kernel easier")
+Cc: stable@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230302224946.never.243-kees@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/kheaders.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/kernel/kheaders.c
++++ b/kernel/kheaders.c
+@@ -26,15 +26,15 @@ asm (
+ " .popsection \n"
+ );
+
+-extern char kernel_headers_data;
+-extern char kernel_headers_data_end;
++extern char kernel_headers_data[];
++extern char kernel_headers_data_end[];
+
+ static ssize_t
+ ikheaders_read(struct file *file, struct kobject *kobj,
+ struct bin_attribute *bin_attr,
+ char *buf, loff_t off, size_t len)
+ {
+- memcpy(buf, &kernel_headers_data + off, len);
++ memcpy(buf, &kernel_headers_data[off], len);
+ return len;
+ }
+
+@@ -48,8 +48,8 @@ static struct bin_attribute kheaders_att
+
+ static int __init ikheaders_init(void)
+ {
+- kheaders_attr.size = (&kernel_headers_data_end -
+- &kernel_headers_data);
++ kheaders_attr.size = (kernel_headers_data_end -
++ kernel_headers_data);
+ return sysfs_create_bin_file(kernel_kobj, &kheaders_attr);
+ }
+
--- /dev/null
+From 5a4e1b5aed2a36a10d6a3b30fafb6b3bf41c3186 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Thu, 23 Mar 2023 23:44:20 +0100
+Subject: media: ov8856: Do not check for for module version
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 5a4e1b5aed2a36a10d6a3b30fafb6b3bf41c3186 upstream.
+
+It the device is probed in non-zero ACPI D state, the module
+identification is delayed until the first streamon.
+
+The module identification has two parts: deviceID and version. To rea
+the version we have to enable OTP read. This cannot be done during
+streamon, becase it modifies REG_MODE_SELECT.
+
+Since the driver has the same behaviour for all the module versions, do
+not read the module version from the sensor's OTP.
+
+Cc: stable@vger.kernel.org
+Fixes: 0e014f1a8d54 ("media: ov8856: support device probe in non-zero ACPI D state")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/i2c/ov8856.c | 40 ----------------------------------------
+ 1 file changed, 40 deletions(-)
+
+--- a/drivers/media/i2c/ov8856.c
++++ b/drivers/media/i2c/ov8856.c
+@@ -1709,46 +1709,6 @@ static int ov8856_identify_module(struct
+ return -ENXIO;
+ }
+
+- ret = ov8856_write_reg(ov8856, OV8856_REG_MODE_SELECT,
+- OV8856_REG_VALUE_08BIT, OV8856_MODE_STREAMING);
+- if (ret)
+- return ret;
+-
+- ret = ov8856_write_reg(ov8856, OV8856_OTP_MODE_CTRL,
+- OV8856_REG_VALUE_08BIT, OV8856_OTP_MODE_AUTO);
+- if (ret) {
+- dev_err(&client->dev, "failed to set otp mode");
+- return ret;
+- }
+-
+- ret = ov8856_write_reg(ov8856, OV8856_OTP_LOAD_CTRL,
+- OV8856_REG_VALUE_08BIT,
+- OV8856_OTP_LOAD_CTRL_ENABLE);
+- if (ret) {
+- dev_err(&client->dev, "failed to enable load control");
+- return ret;
+- }
+-
+- ret = ov8856_read_reg(ov8856, OV8856_MODULE_REVISION,
+- OV8856_REG_VALUE_08BIT, &val);
+- if (ret) {
+- dev_err(&client->dev, "failed to read module revision");
+- return ret;
+- }
+-
+- dev_info(&client->dev, "OV8856 revision %x (%s) at address 0x%02x\n",
+- val,
+- val == OV8856_2A_MODULE ? "2A" :
+- val == OV8856_1B_MODULE ? "1B" : "unknown revision",
+- client->addr);
+-
+- ret = ov8856_write_reg(ov8856, OV8856_REG_MODE_SELECT,
+- OV8856_REG_VALUE_08BIT, OV8856_MODE_STANDBY);
+- if (ret) {
+- dev_err(&client->dev, "failed to exit streaming mode");
+- return ret;
+- }
+-
+ ov8856->identified = true;
+
+ return 0;
--- /dev/null
+From ee1809ed7bc456a72dc8410b475b73021a3a68d5 Mon Sep 17 00:00:00 2001
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Date: Tue, 11 Apr 2023 12:14:26 +0100
+Subject: MIPS: fw: Allow firmware to pass a empty env
+
+From: Jiaxun Yang <jiaxun.yang@flygoat.com>
+
+commit ee1809ed7bc456a72dc8410b475b73021a3a68d5 upstream.
+
+fw_getenv will use env entry to determine style of env,
+however it is legal for firmware to just pass a empty list.
+
+Check if first entry exist before running strchr to avoid
+null pointer dereference.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/clbr/n64bootloader/issues/5
+Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/fw/lib/cmdline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/fw/lib/cmdline.c
++++ b/arch/mips/fw/lib/cmdline.c
+@@ -53,7 +53,7 @@ char *fw_getenv(char *envname)
+ {
+ char *result = NULL;
+
+- if (_fw_envp != NULL) {
++ if (_fw_envp != NULL && fw_envp(0) != NULL) {
+ /*
+ * Return a pointer to the given environment variable.
+ * YAMON uses "name", "value" pairs, while U-Boot uses
--- /dev/null
+From 3a2776e8a0e156a61f5b59ae341d8fffc730b962 Mon Sep 17 00:00:00 2001
+From: Josh Triplett <josh@joshtriplett.org>
+Date: Sun, 13 Nov 2022 23:23:26 -0800
+Subject: PCI: kirin: Select REGMAP_MMIO
+
+From: Josh Triplett <josh@joshtriplett.org>
+
+commit 3a2776e8a0e156a61f5b59ae341d8fffc730b962 upstream.
+
+pcie-kirin uses regmaps, and needs to pull them in; otherwise, with
+CONFIG_PCIE_KIRIN=y and without CONFIG_REGMAP_MMIO pcie-kirin produces
+a linker failure looking for __devm_regmap_init_mmio_clk().
+
+Fixes: d19afe7be126 ("PCI: kirin: Use regmap for APB registers")
+Link: https://lore.kernel.org/r/04636141da1d6d592174eefb56760511468d035d.1668410580.git.josh@joshtriplett.org
+Signed-off-by: Josh Triplett <josh@joshtriplett.org>
+[lpieralisi@kernel.org: commit log and removed REGMAP select]
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Cc: stable@vger.kernel.org # 5.16+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/controller/dwc/Kconfig
++++ b/drivers/pci/controller/dwc/Kconfig
+@@ -294,6 +294,7 @@ config PCI_MESON
+ default m if ARCH_MESON
+ depends on PCI_MSI_IRQ_DOMAIN
+ select PCIE_DW_HOST
++ select REGMAP_MMIO
+ help
+ Say Y here if you want to enable PCI controller support on Amlogic
+ SoCs. The PCI controller on Amlogic is based on DesignWare hardware
--- /dev/null
+From f5eff5591b8f9c5effd25c92c758a127765f74c1 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Tue, 11 Apr 2023 08:21:02 +0200
+Subject: PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock
+
+From: Lukas Wunner <lukas@wunner.de>
+
+commit f5eff5591b8f9c5effd25c92c758a127765f74c1 upstream.
+
+In 2013, commits
+
+ 2e35afaefe64 ("PCI: pciehp: Add reset_slot() method")
+ 608c388122c7 ("PCI: Add slot reset option to pci_dev_reset()")
+
+amended PCIe hotplug to mask Presence Detect Changed events during a
+Secondary Bus Reset. The reset thus no longer causes gratuitous slot
+bringdown and bringup.
+
+However the commits neglected to serialize reset with code paths reading
+slot registers. For instance, a slot bringup due to an earlier hotplug
+event may see the Presence Detect State bit cleared during a concurrent
+Secondary Bus Reset.
+
+In 2018, commit
+
+ 5b3f7b7d062b ("PCI: pciehp: Avoid slot access during reset")
+
+retrofitted the missing locking. It introduced a reset_lock which
+serializes a Secondary Bus Reset with other parts of pciehp.
+
+Unfortunately the locking turns out to be overzealous: reset_lock is
+held for the entire enumeration and de-enumeration of hotplugged devices,
+including driver binding and unbinding.
+
+Driver binding and unbinding acquires device_lock while the reset_lock
+of the ancestral hotplug port is held. A concurrent Secondary Bus Reset
+acquires the ancestral reset_lock while already holding the device_lock.
+The asymmetric locking order in the two code paths can lead to AB-BA
+deadlocks.
+
+Michael Haeuptle reports such deadlocks on simultaneous hot-removal and
+vfio release (the latter implies a Secondary Bus Reset):
+
+ pciehp_ist() # down_read(reset_lock)
+ pciehp_handle_presence_or_link_change()
+ pciehp_disable_slot()
+ __pciehp_disable_slot()
+ remove_board()
+ pciehp_unconfigure_device()
+ pci_stop_and_remove_bus_device()
+ pci_stop_bus_device()
+ pci_stop_dev()
+ device_release_driver()
+ device_release_driver_internal()
+ __device_driver_lock() # device_lock()
+
+ SYS_munmap()
+ vfio_device_fops_release()
+ vfio_device_group_close()
+ vfio_device_close()
+ vfio_device_last_close()
+ vfio_pci_core_close_device()
+ vfio_pci_core_disable() # device_lock()
+ __pci_reset_function_locked()
+ pci_reset_bus_function()
+ pci_dev_reset_slot_function()
+ pci_reset_hotplug_slot()
+ pciehp_reset_slot() # down_write(reset_lock)
+
+Ian May reports the same deadlock on simultaneous hot-removal and an
+AER-induced Secondary Bus Reset:
+
+ aer_recover_work_func()
+ pcie_do_recovery()
+ aer_root_reset()
+ pci_bus_error_reset()
+ pci_slot_reset()
+ pci_slot_lock() # device_lock()
+ pci_reset_hotplug_slot()
+ pciehp_reset_slot() # down_write(reset_lock)
+
+Fix by releasing the reset_lock during driver binding and unbinding,
+thereby splitting and shrinking the critical section.
+
+Driver binding and unbinding is protected by the device_lock() and thus
+serialized with a Secondary Bus Reset. There's no need to additionally
+protect it with the reset_lock. However, pciehp does not bind and
+unbind devices directly, but rather invokes PCI core functions which
+also perform certain enumeration and de-enumeration steps.
+
+The reset_lock's purpose is to protect slot registers, not enumeration
+and de-enumeration of hotplugged devices. That would arguably be the
+job of the PCI core, not the PCIe hotplug driver. After all, an
+AER-induced Secondary Bus Reset may as well happen during boot-time
+enumeration of the PCI hierarchy and there's no locking to prevent that
+either.
+
+Exempting *de-enumeration* from the reset_lock is relatively harmless:
+A concurrent Secondary Bus Reset may foil config space accesses such as
+PME interrupt disablement. But if the device is physically gone, those
+accesses are pointless anyway. If the device is physically present and
+only logically removed through an Attention Button press or the sysfs
+"power" attribute, PME interrupts as well as DMA cannot come through
+because pciehp_unconfigure_device() disables INTx and Bus Master bits.
+That's still protected by the reset_lock in the present commit.
+
+Exempting *enumeration* from the reset_lock also has limited impact:
+The exempted call to pci_bus_add_device() may perform device accesses
+through pcibios_bus_add_device() and pci_fixup_device() which are now
+no longer protected from a concurrent Secondary Bus Reset. Otherwise
+there should be no impact.
+
+In essence, the present commit seeks to fix the AB-BA deadlocks while
+still retaining a best-effort reset protection for enumeration and
+de-enumeration of hotplugged devices -- until a general solution is
+implemented in the PCI core.
+
+Link: https://lore.kernel.org/linux-pci/CS1PR8401MB0728FC6FDAB8A35C22BD90EC95F10@CS1PR8401MB0728.NAMPRD84.PROD.OUTLOOK.COM
+Link: https://lore.kernel.org/linux-pci/20200615143250.438252-1-ian.may@canonical.com
+Link: https://lore.kernel.org/linux-pci/ce878dab-c0c4-5bd0-a725-9805a075682d@amd.com
+Link: https://lore.kernel.org/linux-pci/ed831249-384a-6d35-0831-70af191e9bce@huawei.com
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=215590
+Fixes: 5b3f7b7d062b ("PCI: pciehp: Avoid slot access during reset")
+Link: https://lore.kernel.org/r/fef2b2e9edf245c049a8c5b94743c0f74ff5008a.1681191902.git.lukas@wunner.de
+Reported-by: Michael Haeuptle <michael.haeuptle@hpe.com>
+Reported-by: Ian May <ian.may@canonical.com>
+Reported-by: Andrey Grodzovsky <andrey2805@gmail.com>
+Reported-by: Rahul Kumar <rahul.kumar1@amd.com>
+Reported-by: Jialin Zhang <zhangjialin11@huawei.com>
+Tested-by: Anatoli Antonovitch <Anatoli.Antonovitch@amd.com>
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org # v4.19+
+Cc: Dan Stein <dstein@hpe.com>
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Alex Michon <amichon@kalrayinc.com>
+Cc: Xiongfeng Wang <wangxiongfeng2@huawei.com>
+Cc: Alex Williamson <alex.williamson@redhat.com>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: Sathyanarayanan Kuppuswamy <sathyanarayanan.kuppuswamy@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/hotplug/pciehp_pci.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/pci/hotplug/pciehp_pci.c
++++ b/drivers/pci/hotplug/pciehp_pci.c
+@@ -63,7 +63,14 @@ int pciehp_configure_device(struct contr
+
+ pci_assign_unassigned_bridge_resources(bridge);
+ pcie_bus_configure_settings(parent);
++
++ /*
++ * Release reset_lock during driver binding
++ * to avoid AB-BA deadlock with device_lock.
++ */
++ up_read(&ctrl->reset_lock);
+ pci_bus_add_devices(parent);
++ down_read_nested(&ctrl->reset_lock, ctrl->depth);
+
+ out:
+ pci_unlock_rescan_remove();
+@@ -104,7 +111,15 @@ void pciehp_unconfigure_device(struct co
+ list_for_each_entry_safe_reverse(dev, temp, &parent->devices,
+ bus_list) {
+ pci_dev_get(dev);
++
++ /*
++ * Release reset_lock during driver unbinding
++ * to avoid AB-BA deadlock with device_lock.
++ */
++ up_read(&ctrl->reset_lock);
+ pci_stop_and_remove_bus_device(dev);
++ down_read_nested(&ctrl->reset_lock, ctrl->depth);
++
+ /*
+ * Ensure that no new Requests will be generated from
+ * the device.
--- /dev/null
+From 2542e16c392508800f1d9037feee881a9c444951 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Date: Thu, 16 Mar 2023 13:40:59 +0530
+Subject: PCI: qcom: Fix the incorrect register usage in v2.7.0 config
+
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+
+commit 2542e16c392508800f1d9037feee881a9c444951 upstream.
+
+Qcom PCIe IP version v2.7.0 and its derivatives don't contain the
+PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT register. Instead, they have the new
+PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2 register. So fix the incorrect
+register usage which is modifying a different register.
+
+Also in this IP version, this register change doesn't depend on MSI
+being enabled. So remove that check also.
+
+Link: https://lore.kernel.org/r/20230316081117.14288-2-manivannan.sadhasivam@linaro.org
+Fixes: ed8cc3b1fc84 ("PCI: qcom: Add support for SDM845 PCIe controller")
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Cc: <stable@vger.kernel.org> # 5.6+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -1276,11 +1276,9 @@ static int qcom_pcie_init_2_7_0(struct q
+ val &= ~REQ_NOT_ENTR_L1;
+ writel(val, pcie->parf + PCIE20_PARF_PM_CTRL);
+
+- if (IS_ENABLED(CONFIG_PCI_MSI)) {
+- val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
+- val |= BIT(31);
+- writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT);
+- }
++ val = readl(pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
++ val |= BIT(31);
++ writel(val, pcie->parf + PCIE20_PARF_AXI_MSTR_WR_ADDR_HALT_V2);
+
+ return 0;
+ err_disable_clocks:
--- /dev/null
+From 1db6b0a4246ce708b89f5136571130b9987741d1 Mon Sep 17 00:00:00 2001
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Date: Fri, 31 Mar 2023 18:12:49 +0300
+Subject: phy: qcom-qmp-pcie: sc8180x PCIe PHY has 2 lanes
+
+From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+
+commit 1db6b0a4246ce708b89f5136571130b9987741d1 upstream.
+
+All PCIe PHYs on sc8180x platform have 2 lanes, so change the number of
+lanes to 2.
+
+Fixes: f839f14e24f2 ("phy: qcom-qmp: Add sc8180x PCIe support")
+Cc: stable@vger.kernel.org # 5.15
+Sgned-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Link: https://lore.kernel.org/r/20230331151250.4049-1-dmitry.baryshkov@linaro.org
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/phy/qualcomm/phy-qcom-qmp-pcie.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie.c
+@@ -1738,7 +1738,7 @@ static const struct qmp_phy_cfg msm8998_
+ };
+
+ static const struct qmp_phy_cfg sc8180x_pciephy_cfg = {
+- .lanes = 1,
++ .lanes = 2,
+
+ .tables = {
+ .serdes = sc8180x_qmp_pcie_serdes_tbl,
--- /dev/null
+From f7abf14f0001a5a47539d9f60bbdca649e43536b Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Mon, 17 Apr 2023 15:37:55 +0200
+Subject: posix-cpu-timers: Implement the missing timer_wait_running callback
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit f7abf14f0001a5a47539d9f60bbdca649e43536b upstream.
+
+For some unknown reason the introduction of the timer_wait_running callback
+missed to fixup posix CPU timers, which went unnoticed for almost four years.
+Marco reported recently that the WARN_ON() in timer_wait_running()
+triggers with a posix CPU timer test case.
+
+Posix CPU timers have two execution models for expiring timers depending on
+CONFIG_POSIX_CPU_TIMERS_TASK_WORK:
+
+1) If not enabled, the expiry happens in hard interrupt context so
+ spin waiting on the remote CPU is reasonably time bound.
+
+ Implement an empty stub function for that case.
+
+2) If enabled, the expiry happens in task work before returning to user
+ space or guest mode. The expired timers are marked as firing and moved
+ from the timer queue to a local list head with sighand lock held. Once
+ the timers are moved, sighand lock is dropped and the expiry happens in
+ fully preemptible context. That means the expiring task can be scheduled
+ out, migrated, interrupted etc. So spin waiting on it is more than
+ suboptimal.
+
+ The timer wheel has a timer_wait_running() mechanism for RT, which uses
+ a per CPU timer-base expiry lock which is held by the expiry code and the
+ task waiting for the timer function to complete blocks on that lock.
+
+ This does not work in the same way for posix CPU timers as there is no
+ timer base and expiry for process wide timers can run on any task
+ belonging to that process, but the concept of waiting on an expiry lock
+ can be used too in a slightly different way:
+
+ - Add a mutex to struct posix_cputimers_work. This struct is per task
+ and used to schedule the expiry task work from the timer interrupt.
+
+ - Add a task_struct pointer to struct cpu_timer which is used to store
+ a the task which runs the expiry. That's filled in when the task
+ moves the expired timers to the local expiry list. That's not
+ affecting the size of the k_itimer union as there are bigger union
+ members already
+
+ - Let the task take the expiry mutex around the expiry function
+
+ - Let the waiter acquire a task reference with rcu_read_lock() held and
+ block on the expiry mutex
+
+ This avoids spin-waiting on a task which might not even be on a CPU and
+ works nicely for RT too.
+
+Fixes: ec8f954a40da ("posix-timers: Use a callback for cancel synchronization on PREEMPT_RT")
+Reported-by: Marco Elver <elver@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Marco Elver <elver@google.com>
+Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/87zg764ojw.ffs@tglx
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/posix-timers.h | 17 +++++---
+ kernel/time/posix-cpu-timers.c | 81 +++++++++++++++++++++++++++++++++--------
+ kernel/time/posix-timers.c | 4 ++
+ 3 files changed, 82 insertions(+), 20 deletions(-)
+
+--- a/include/linux/posix-timers.h
++++ b/include/linux/posix-timers.h
+@@ -4,6 +4,7 @@
+
+ #include <linux/spinlock.h>
+ #include <linux/list.h>
++#include <linux/mutex.h>
+ #include <linux/alarmtimer.h>
+ #include <linux/timerqueue.h>
+
+@@ -62,16 +63,18 @@ static inline int clockid_to_fd(const cl
+ * cpu_timer - Posix CPU timer representation for k_itimer
+ * @node: timerqueue node to queue in the task/sig
+ * @head: timerqueue head on which this timer is queued
+- * @task: Pointer to target task
++ * @pid: Pointer to target task PID
+ * @elist: List head for the expiry list
+ * @firing: Timer is currently firing
++ * @handling: Pointer to the task which handles expiry
+ */
+ struct cpu_timer {
+- struct timerqueue_node node;
+- struct timerqueue_head *head;
+- struct pid *pid;
+- struct list_head elist;
+- int firing;
++ struct timerqueue_node node;
++ struct timerqueue_head *head;
++ struct pid *pid;
++ struct list_head elist;
++ int firing;
++ struct task_struct __rcu *handling;
+ };
+
+ static inline bool cpu_timer_enqueue(struct timerqueue_head *head,
+@@ -135,10 +138,12 @@ struct posix_cputimers {
+ /**
+ * posix_cputimers_work - Container for task work based posix CPU timer expiry
+ * @work: The task work to be scheduled
++ * @mutex: Mutex held around expiry in context of this task work
+ * @scheduled: @work has been scheduled already, no further processing
+ */
+ struct posix_cputimers_work {
+ struct callback_head work;
++ struct mutex mutex;
+ unsigned int scheduled;
+ };
+
+--- a/kernel/time/posix-cpu-timers.c
++++ b/kernel/time/posix-cpu-timers.c
+@@ -847,6 +847,8 @@ static u64 collect_timerqueue(struct tim
+ return expires;
+
+ ctmr->firing = 1;
++ /* See posix_cpu_timer_wait_running() */
++ rcu_assign_pointer(ctmr->handling, current);
+ cpu_timer_dequeue(ctmr);
+ list_add_tail(&ctmr->elist, firing);
+ }
+@@ -1162,7 +1164,49 @@ static void handle_posix_cpu_timers(stru
+ #ifdef CONFIG_POSIX_CPU_TIMERS_TASK_WORK
+ static void posix_cpu_timers_work(struct callback_head *work)
+ {
++ struct posix_cputimers_work *cw = container_of(work, typeof(*cw), work);
++
++ mutex_lock(&cw->mutex);
+ handle_posix_cpu_timers(current);
++ mutex_unlock(&cw->mutex);
++}
++
++/*
++ * Invoked from the posix-timer core when a cancel operation failed because
++ * the timer is marked firing. The caller holds rcu_read_lock(), which
++ * protects the timer and the task which is expiring it from being freed.
++ */
++static void posix_cpu_timer_wait_running(struct k_itimer *timr)
++{
++ struct task_struct *tsk = rcu_dereference(timr->it.cpu.handling);
++
++ /* Has the handling task completed expiry already? */
++ if (!tsk)
++ return;
++
++ /* Ensure that the task cannot go away */
++ get_task_struct(tsk);
++ /* Now drop the RCU protection so the mutex can be locked */
++ rcu_read_unlock();
++ /* Wait on the expiry mutex */
++ mutex_lock(&tsk->posix_cputimers_work.mutex);
++ /* Release it immediately again. */
++ mutex_unlock(&tsk->posix_cputimers_work.mutex);
++ /* Drop the task reference. */
++ put_task_struct(tsk);
++ /* Relock RCU so the callsite is balanced */
++ rcu_read_lock();
++}
++
++static void posix_cpu_timer_wait_running_nsleep(struct k_itimer *timr)
++{
++ /* Ensure that timr->it.cpu.handling task cannot go away */
++ rcu_read_lock();
++ spin_unlock_irq(&timr->it_lock);
++ posix_cpu_timer_wait_running(timr);
++ rcu_read_unlock();
++ /* @timr is on stack and is valid */
++ spin_lock_irq(&timr->it_lock);
+ }
+
+ /*
+@@ -1178,6 +1222,7 @@ void clear_posix_cputimers_work(struct t
+ sizeof(p->posix_cputimers_work.work));
+ init_task_work(&p->posix_cputimers_work.work,
+ posix_cpu_timers_work);
++ mutex_init(&p->posix_cputimers_work.mutex);
+ p->posix_cputimers_work.scheduled = false;
+ }
+
+@@ -1256,6 +1301,18 @@ static inline void __run_posix_cpu_timer
+ lockdep_posixtimer_exit();
+ }
+
++static void posix_cpu_timer_wait_running(struct k_itimer *timr)
++{
++ cpu_relax();
++}
++
++static void posix_cpu_timer_wait_running_nsleep(struct k_itimer *timr)
++{
++ spin_unlock_irq(&timr->it_lock);
++ cpu_relax();
++ spin_lock_irq(&timr->it_lock);
++}
++
+ static inline bool posix_cpu_timers_work_scheduled(struct task_struct *tsk)
+ {
+ return false;
+@@ -1364,6 +1421,8 @@ static void handle_posix_cpu_timers(stru
+ */
+ if (likely(cpu_firing >= 0))
+ cpu_timer_fire(timer);
++ /* See posix_cpu_timer_wait_running() */
++ rcu_assign_pointer(timer->it.cpu.handling, NULL);
+ spin_unlock(&timer->it_lock);
+ }
+ }
+@@ -1498,23 +1557,16 @@ static int do_cpu_nanosleep(const clocki
+ expires = cpu_timer_getexpires(&timer.it.cpu);
+ error = posix_cpu_timer_set(&timer, 0, &zero_it, &it);
+ if (!error) {
+- /*
+- * Timer is now unarmed, deletion can not fail.
+- */
++ /* Timer is now unarmed, deletion can not fail. */
+ posix_cpu_timer_del(&timer);
++ } else {
++ while (error == TIMER_RETRY) {
++ posix_cpu_timer_wait_running_nsleep(&timer);
++ error = posix_cpu_timer_del(&timer);
++ }
+ }
+- spin_unlock_irq(&timer.it_lock);
+
+- while (error == TIMER_RETRY) {
+- /*
+- * We need to handle case when timer was or is in the
+- * middle of firing. In other cases we already freed
+- * resources.
+- */
+- spin_lock_irq(&timer.it_lock);
+- error = posix_cpu_timer_del(&timer);
+- spin_unlock_irq(&timer.it_lock);
+- }
++ spin_unlock_irq(&timer.it_lock);
+
+ if ((it.it_value.tv_sec | it.it_value.tv_nsec) == 0) {
+ /*
+@@ -1624,6 +1676,7 @@ const struct k_clock clock_posix_cpu = {
+ .timer_del = posix_cpu_timer_del,
+ .timer_get = posix_cpu_timer_get,
+ .timer_rearm = posix_cpu_timer_rearm,
++ .timer_wait_running = posix_cpu_timer_wait_running,
+ };
+
+ const struct k_clock clock_process = {
+--- a/kernel/time/posix-timers.c
++++ b/kernel/time/posix-timers.c
+@@ -846,6 +846,10 @@ static struct k_itimer *timer_wait_runni
+ rcu_read_lock();
+ unlock_timer(timer, *flags);
+
++ /*
++ * kc->timer_wait_running() might drop RCU lock. So @timer
++ * cannot be touched anymore after the function returns!
++ */
+ if (!WARN_ON_ONCE(!kc->timer_wait_running))
+ kc->timer_wait_running(timer);
+
--- /dev/null
+From 648a1783fe2551f5a091c9a5f8f463cb2cbf8745 Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Fri, 7 Apr 2023 14:09:09 +1000
+Subject: powerpc/boot: Fix boot wrapper code generation with CONFIG_POWER10_CPU
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+commit 648a1783fe2551f5a091c9a5f8f463cb2cbf8745 upstream.
+
+-mcpu=power10 will generate prefixed and pcrel code by default, which
+we do not support. The general kernel disables these with cflags, but
+those were missed for the boot wrapper.
+
+Fixes: 4b2a9315f20d ("powerpc/64s: POWER10 CPU Kconfig build option")
+Cc: stable@vger.kernel.org # v6.1+
+Reported-by: Danny Tsen <dtsen@linux.ibm.com>
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://msgid.link/20230407040909.230998-1-npiggin@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/boot/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/powerpc/boot/Makefile
++++ b/arch/powerpc/boot/Makefile
+@@ -34,6 +34,8 @@ endif
+
+ BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ -fno-strict-aliasing -O2 -msoft-float -mno-altivec -mno-vsx \
++ $(call cc-option,-mno-prefixed) $(call cc-option,-mno-pcrel) \
++ $(call cc-option,-mno-mma) \
+ $(call cc-option,-mno-spe) $(call cc-option,-mspe=no) \
+ -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \
+ $(LINUXINCLUDE)
--- /dev/null
+From 146a37e05d620cef4ad430e5d1c9c077fe6fa76f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Fri, 17 Mar 2023 13:33:18 +0200
+Subject: serial: 8250: Fix serial8250_tx_empty() race with DMA Tx
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit 146a37e05d620cef4ad430e5d1c9c077fe6fa76f upstream.
+
+There's a potential race before THRE/TEMT deasserts when DMA Tx is
+starting up (or the next batch of continuous Tx is being submitted).
+This can lead to misdetecting Tx empty condition.
+
+It is entirely normal for THRE/TEMT to be set for some time after the
+DMA Tx had been setup in serial8250_tx_dma(). As Tx side is definitely
+not empty at that point, it seems incorrect for serial8250_tx_empty()
+claim Tx is empty.
+
+Fix the race by also checking in serial8250_tx_empty() whether there's
+DMA Tx active.
+
+Note: This fix only addresses in-kernel race mainly to make using
+TCSADRAIN/FLUSH robust. Userspace can still cause other races but they
+seem userspace concurrency control problems.
+
+Fixes: 9ee4b83e51f74 ("serial: 8250: Add support for dmaengine")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20230317113318.31327-3-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250.h | 12 ++++++++++++
+ drivers/tty/serial/8250/8250_port.c | 7 ++++---
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250.h
++++ b/drivers/tty/serial/8250/8250.h
+@@ -365,6 +365,13 @@ static inline void serial8250_do_prepare
+ if (dma->prepare_rx_dma)
+ dma->prepare_rx_dma(p);
+ }
++
++static inline bool serial8250_tx_dma_running(struct uart_8250_port *p)
++{
++ struct uart_8250_dma *dma = p->dma;
++
++ return dma && dma->tx_running;
++}
+ #else
+ static inline int serial8250_tx_dma(struct uart_8250_port *p)
+ {
+@@ -380,6 +387,11 @@ static inline int serial8250_request_dma
+ return -1;
+ }
+ static inline void serial8250_release_dma(struct uart_8250_port *p) { }
++
++static inline bool serial8250_tx_dma_running(struct uart_8250_port *p)
++{
++ return false;
++}
+ #endif
+
+ static inline int ns16550a_goto_highspeed(struct uart_8250_port *up)
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -2010,18 +2010,19 @@ static int serial8250_tx_threshold_handl
+ static unsigned int serial8250_tx_empty(struct uart_port *port)
+ {
+ struct uart_8250_port *up = up_to_u8250p(port);
++ unsigned int result = 0;
+ unsigned long flags;
+- u16 lsr;
+
+ serial8250_rpm_get(up);
+
+ spin_lock_irqsave(&port->lock, flags);
+- lsr = serial_lsr_in(up);
++ if (!serial8250_tx_dma_running(up) && uart_lsr_tx_empty(serial_lsr_in(up)))
++ result = TIOCSER_TEMT;
+ spin_unlock_irqrestore(&port->lock, flags);
+
+ serial8250_rpm_put(up);
+
+- return uart_lsr_tx_empty(lsr) ? TIOCSER_TEMT : 0;
++ return result;
+ }
+
+ unsigned int serial8250_do_get_mctrl(struct uart_port *port)
--- /dev/null
+From 9e4f2a8004213339e9d837d891a59cc80e082966 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 12 Apr 2023 14:48:11 +0200
+Subject: serial: fix TIOCSRS485 locking
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 9e4f2a8004213339e9d837d891a59cc80e082966 upstream.
+
+The RS485 multipoint addressing support for some reason added a new
+ADDRB termios cflag which is (only!) updated from one of the RS485
+ioctls.
+
+Make sure to take the termios rw semaphore for the right ioctl (i.e.
+set, not get).
+
+Fixes: ae50bb275283 ("serial: take termios_rwsem for ->rs485_config() & pass termios as param")
+Cc: stable@vger.kernel.org # 6.0
+Cc: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20230412124811.11217-1-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/serial_core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1552,7 +1552,7 @@ uart_ioctl(struct tty_struct *tty, unsig
+ goto out;
+
+ /* rs485_config requires more locking than others */
+- if (cmd == TIOCGRS485)
++ if (cmd == TIOCSRS485)
+ down_write(&tty->termios_rwsem);
+
+ mutex_lock(&port->mutex);
+@@ -1595,7 +1595,7 @@ uart_ioctl(struct tty_struct *tty, unsig
+ }
+ out_up:
+ mutex_unlock(&port->mutex);
+- if (cmd == TIOCGRS485)
++ if (cmd == TIOCSRS485)
+ up_write(&tty->termios_rwsem);
+ out:
+ return ret;
--- /dev/null
+From 3f42b142ea1171967e40e10e4b0241c0d6d28d41 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
+Date: Wed, 5 Apr 2023 22:14:23 +0200
+Subject: serial: max310x: fix IO data corruption in batched operations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kundrát <jan.kundrat@cesnet.cz>
+
+commit 3f42b142ea1171967e40e10e4b0241c0d6d28d41 upstream.
+
+After upgrading from 5.16 to 6.1, our board with a MAX14830 started
+producing lots of garbage data over UART. Bisection pointed out commit
+285e76fc049c as the culprit. That patch tried to replace hand-written
+code which I added in 2b4bac48c1084 ("serial: max310x: Use batched reads
+when reasonably safe") with the generic regmap infrastructure for
+batched operations.
+
+Unfortunately, the `regmap_raw_read` and `regmap_raw_write` which were
+used are actually functions which perform IO over *multiple* registers.
+That's not what is needed for accessing these Tx/Rx FIFOs; the
+appropriate functions are the `_noinc_` versions, not the `_raw_` ones.
+
+Fix this regression by using `regmap_noinc_read()` and
+`regmap_noinc_write()` along with the necessary `regmap_config` setup;
+with this patch in place, our board communicates happily again. Since
+our board uses SPI for talking to this chip, the I2C part is completely
+untested.
+
+Fixes: 285e76fc049c ("serial: max310x: use regmap methods for SPI batch operations")
+Cc: stable@vger.kernel.org
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz>
+Link: https://lore.kernel.org/r/79db8e82aadb0e174bc82b9996423c3503c8fb37.1680732084.git.jan.kundrat@cesnet.cz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/max310x.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -525,6 +525,11 @@ static bool max310x_reg_precious(struct
+ return false;
+ }
+
++static bool max310x_reg_noinc(struct device *dev, unsigned int reg)
++{
++ return reg == MAX310X_RHR_REG;
++}
++
+ static int max310x_set_baud(struct uart_port *port, int baud)
+ {
+ unsigned int mode = 0, div = 0, frac = 0, c = 0, F = 0;
+@@ -651,14 +656,14 @@ static void max310x_batch_write(struct u
+ {
+ struct max310x_one *one = to_max310x_port(port);
+
+- regmap_raw_write(one->regmap, MAX310X_THR_REG, txbuf, len);
++ regmap_noinc_write(one->regmap, MAX310X_THR_REG, txbuf, len);
+ }
+
+ static void max310x_batch_read(struct uart_port *port, u8 *rxbuf, unsigned int len)
+ {
+ struct max310x_one *one = to_max310x_port(port);
+
+- regmap_raw_read(one->regmap, MAX310X_RHR_REG, rxbuf, len);
++ regmap_noinc_read(one->regmap, MAX310X_RHR_REG, rxbuf, len);
+ }
+
+ static void max310x_handle_rx(struct uart_port *port, unsigned int rxlen)
+@@ -1472,6 +1477,10 @@ static struct regmap_config regcfg = {
+ .writeable_reg = max310x_reg_writeable,
+ .volatile_reg = max310x_reg_volatile,
+ .precious_reg = max310x_reg_precious,
++ .writeable_noinc_reg = max310x_reg_noinc,
++ .readable_noinc_reg = max310x_reg_noinc,
++ .max_raw_read = MAX310X_FIFO_SIZE,
++ .max_raw_write = MAX310X_FIFO_SIZE,
+ };
+
+ #ifdef CONFIG_SPI_MASTER
+@@ -1557,6 +1566,10 @@ static struct regmap_config regcfg_i2c =
+ .volatile_reg = max310x_reg_volatile,
+ .precious_reg = max310x_reg_precious,
+ .max_register = MAX310X_I2C_REVID_EXTREG,
++ .writeable_noinc_reg = max310x_reg_noinc,
++ .readable_noinc_reg = max310x_reg_noinc,
++ .max_raw_read = MAX310X_FIFO_SIZE,
++ .max_raw_write = MAX310X_FIFO_SIZE,
+ };
+
+ static const struct max310x_if_cfg max310x_i2c_if_cfg = {
asm-generic-io.h-suppress-endianness-warnings-for-re.patch
x86-cpu-add-model-number-for-intel-arrow-lake-proces.patch
wireguard-timers-cast-enum-limits-members-to-int-in-prints.patch
+wifi-mt76-mt7921e-set-memory-space-enable-in-pci_command-if-unset.patch
+asoc-amd-fix-acp-version-typo-mistake.patch
+asoc-amd-ps-update-the-acp-clock-source.patch
+arm64-always-load-shadow-stack-pointer-directly-from-the-task-struct.patch
+arm64-stash-shadow-stack-pointer-in-the-task-struct-on-interrupt.patch
+powerpc-boot-fix-boot-wrapper-code-generation-with-config_power10_cpu.patch
+pci-kirin-select-regmap_mmio.patch
+pci-pciehp-fix-ab-ba-deadlock-between-reset_lock-and-device_lock.patch
+pci-qcom-fix-the-incorrect-register-usage-in-v2.7.0-config.patch
+phy-qcom-qmp-pcie-sc8180x-pcie-phy-has-2-lanes.patch
+ima-allow-fix-uml-builds.patch
+usb-gadget-udc-core-invoke-usb_gadget_connect-only-when-started.patch
+usb-gadget-udc-core-prevent-redundant-calls-to-pullup.patch
+usb-dwc3-gadget-stall-and-restart-ep0-if-host-is-unresponsive.patch
+usb-dwc3-fix-runtime-pm-imbalance-on-probe-errors.patch
+usb-dwc3-fix-runtime-pm-imbalance-on-unbind.patch
+hwmon-k10temp-check-range-scale-when-cur_temp-register-is-read-write.patch
+hwmon-adt7475-use-device_property-apis-when-configuring-polarity.patch
+tpm-add-tpm_amd_is_rng_defective-to-the-hwrng_unregister-call-site.patch
+posix-cpu-timers-implement-the-missing-timer_wait_running-callback.patch
+media-ov8856-do-not-check-for-for-module-version.patch
+blk-stat-fix-queue_flag_stats-clear.patch
+blk-crypto-don-t-use-struct-request_queue-for-public-interfaces.patch
+blk-crypto-add-a-blk_crypto_config_supported_natively-helper.patch
+blk-crypto-move-internal-only-declarations-to-blk-crypto-internal.h.patch
+blk-crypto-add-a-missing-include-directive.patch
+blk-mq-release-crypto-keyslot-before-reporting-i-o-complete.patch
+blk-crypto-make-blk_crypto_evict_key-return-void.patch
+blk-crypto-make-blk_crypto_evict_key-more-robust.patch
+staging-iio-resolver-ads1210-fix-config-mode.patch
+tty-prevent-writing-chars-during-tcsetattr-tcsadrain-flush.patch
+xhci-fix-debugfs-register-accesses-while-suspended.patch
+serial-fix-tiocsrs485-locking.patch
+serial-8250-fix-serial8250_tx_empty-race-with-dma-tx.patch
+serial-max310x-fix-io-data-corruption-in-batched-operations.patch
+tick-nohz-fix-cpu_is_hotpluggable-by-checking-with-nohz-subsystem.patch
+fs-fix-sysctls.c-built.patch
+mips-fw-allow-firmware-to-pass-a-empty-env.patch
+ipmi-ssif-add-send_retries-increment.patch
+ipmi-fix-ssif-not-responding-under-certain-cond.patch
+iio-addac-stx104-fix-race-condition-when-converting-analog-to-digital.patch
+iio-addac-stx104-fix-race-condition-for-stx104_write_raw.patch
+kheaders-use-array-declaration-instead-of-char.patch
+wifi-mt76-add-missing-locking-to-protect-against-concurrent-rx-status-calls.patch
--- /dev/null
+From 16313403d873ff17a587818b61f84c8cb4971cef Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com>
+Date: Mon, 27 Mar 2023 16:54:14 +0200
+Subject: staging: iio: resolver: ads1210: fix config mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+commit 16313403d873ff17a587818b61f84c8cb4971cef upstream.
+
+As stated in the device datasheet [1], bits a0 and a1 have to be set to
+1 for the configuration mode.
+
+[1]: https://www.analog.com/media/en/technical-documentation/data-sheets/ad2s1210.pdf
+
+Fixes: b19e9ad5e2cb9 ("staging:iio:resolver:ad2s1210 general driver cleanup")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://lore.kernel.org/r/20230327145414.1505537-1-nuno.sa@analog.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/iio/resolver/ad2s1210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/iio/resolver/ad2s1210.c
++++ b/drivers/staging/iio/resolver/ad2s1210.c
+@@ -101,7 +101,7 @@ struct ad2s1210_state {
+ static const int ad2s1210_mode_vals[4][2] = {
+ [MOD_POS] = { 0, 0 },
+ [MOD_VEL] = { 0, 1 },
+- [MOD_CONFIG] = { 1, 0 },
++ [MOD_CONFIG] = { 1, 1 },
+ };
+
+ static inline void ad2s1210_set_mode(enum ad2s1210_mode mode,
--- /dev/null
+From 58d7668242647e661a20efe065519abd6454287e Mon Sep 17 00:00:00 2001
+From: "Joel Fernandes (Google)" <joel@joelfernandes.org>
+Date: Tue, 24 Jan 2023 17:31:26 +0000
+Subject: tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
+
+From: Joel Fernandes (Google) <joel@joelfernandes.org>
+
+commit 58d7668242647e661a20efe065519abd6454287e upstream.
+
+For CONFIG_NO_HZ_FULL systems, the tick_do_timer_cpu cannot be offlined.
+However, cpu_is_hotpluggable() still returns true for those CPUs. This causes
+torture tests that do offlining to end up trying to offline this CPU causing
+test failures. Such failure happens on all architectures.
+
+Fix the repeated error messages thrown by this (even if the hotplug errors are
+harmless) by asking the opinion of the nohz subsystem on whether the CPU can be
+hotplugged.
+
+[ Apply Frederic Weisbecker feedback on refactoring tick_nohz_cpu_down(). ]
+
+For drivers/base/ portion:
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Frederic Weisbecker <frederic@kernel.org>
+Cc: Frederic Weisbecker <frederic@kernel.org>
+Cc: "Paul E. McKenney" <paulmck@kernel.org>
+Cc: Zhouyi Zhou <zhouzhouyi@gmail.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: rcu <rcu@vger.kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: 2987557f52b9 ("driver-core/cpu: Expose hotpluggability to the rest of the kernel")
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/cpu.c | 3 ++-
+ include/linux/tick.h | 2 ++
+ kernel/time/tick-sched.c | 11 ++++++++---
+ 3 files changed, 12 insertions(+), 4 deletions(-)
+
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -487,7 +487,8 @@ static const struct attribute_group *cpu
+ bool cpu_is_hotpluggable(unsigned int cpu)
+ {
+ struct device *dev = get_cpu_device(cpu);
+- return dev && container_of(dev, struct cpu, dev)->hotpluggable;
++ return dev && container_of(dev, struct cpu, dev)->hotpluggable
++ && tick_nohz_cpu_hotpluggable(cpu);
+ }
+ EXPORT_SYMBOL_GPL(cpu_is_hotpluggable);
+
+--- a/include/linux/tick.h
++++ b/include/linux/tick.h
+@@ -216,6 +216,7 @@ extern void tick_nohz_dep_set_signal(str
+ enum tick_dep_bits bit);
+ extern void tick_nohz_dep_clear_signal(struct signal_struct *signal,
+ enum tick_dep_bits bit);
++extern bool tick_nohz_cpu_hotpluggable(unsigned int cpu);
+
+ /*
+ * The below are tick_nohz_[set,clear]_dep() wrappers that optimize off-cases
+@@ -280,6 +281,7 @@ static inline void tick_nohz_full_add_cp
+
+ static inline void tick_nohz_dep_set_cpu(int cpu, enum tick_dep_bits bit) { }
+ static inline void tick_nohz_dep_clear_cpu(int cpu, enum tick_dep_bits bit) { }
++static inline bool tick_nohz_cpu_hotpluggable(unsigned int cpu) { return true; }
+
+ static inline void tick_dep_set(enum tick_dep_bits bit) { }
+ static inline void tick_dep_clear(enum tick_dep_bits bit) { }
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -527,7 +527,7 @@ void __init tick_nohz_full_setup(cpumask
+ tick_nohz_full_running = true;
+ }
+
+-static int tick_nohz_cpu_down(unsigned int cpu)
++bool tick_nohz_cpu_hotpluggable(unsigned int cpu)
+ {
+ /*
+ * The tick_do_timer_cpu CPU handles housekeeping duty (unbound
+@@ -535,8 +535,13 @@ static int tick_nohz_cpu_down(unsigned i
+ * CPUs. It must remain online when nohz full is enabled.
+ */
+ if (tick_nohz_full_running && tick_do_timer_cpu == cpu)
+- return -EBUSY;
+- return 0;
++ return false;
++ return true;
++}
++
++static int tick_nohz_cpu_down(unsigned int cpu)
++{
++ return tick_nohz_cpu_hotpluggable(cpu) ? 0 : -EBUSY;
+ }
+
+ void __init tick_nohz_init(void)
--- /dev/null
+From bd8621ca1510e6e802df9855bdc35a04a3cfa932 Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko@kernel.org>
+Date: Sun, 23 Apr 2023 18:49:58 +0300
+Subject: tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site
+
+From: Jarkko Sakkinen <jarkko@kernel.org>
+
+commit bd8621ca1510e6e802df9855bdc35a04a3cfa932 upstream.
+
+The following crash was reported:
+
+[ 1950.279393] list_del corruption, ffff99560d485790->next is NULL
+[ 1950.279400] ------------[ cut here ]------------
+[ 1950.279401] kernel BUG at lib/list_debug.c:49!
+[ 1950.279405] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
+[ 1950.279407] CPU: 11 PID: 5886 Comm: modprobe Tainted: G O 6.2.8_1 #1
+[ 1950.279409] Hardware name: Gigabyte Technology Co., Ltd. B550M AORUS PRO-P/B550M AORUS PRO-P,
+BIOS F15c 05/11/2022
+[ 1950.279410] RIP: 0010:__list_del_entry_valid+0x59/0xc0
+[ 1950.279415] Code: 48 8b 01 48 39 f8 75 5a 48 8b 72 08 48 39 c6 75 65 b8 01 00 00 00 c3 cc cc cc
+cc 48 89 fe 48 c7 c7 08 a8 13 9e e8 b7 0a bc ff <0f> 0b 48 89 fe 48 c7 c7 38 a8 13 9e e8 a6 0a bc
+ff 0f 0b 48 89 fe
+[ 1950.279416] RSP: 0018:ffffa96d05647e08 EFLAGS: 00010246
+[ 1950.279418] RAX: 0000000000000033 RBX: ffff99560d485750 RCX: 0000000000000000
+[ 1950.279419] RDX: 0000000000000000 RSI: ffffffff9e107c59 RDI: 00000000ffffffff
+[ 1950.279420] RBP: ffffffffc19c5168 R08: 0000000000000000 R09: ffffa96d05647cc8
+[ 1950.279421] R10: 0000000000000003 R11: ffffffff9ea2a568 R12: 0000000000000000
+[ 1950.279422] R13: ffff99560140a2e0 R14: ffff99560127d2e0 R15: 0000000000000000
+[ 1950.279422] FS: 00007f67da795380(0000) GS:ffff995d1f0c0000(0000) knlGS:0000000000000000
+[ 1950.279424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1950.279424] CR2: 00007f67da7e65c0 CR3: 00000001feed2000 CR4: 0000000000750ee0
+[ 1950.279426] PKRU: 55555554
+[ 1950.279426] Call Trace:
+[ 1950.279428] <TASK>
+[ 1950.279430] hwrng_unregister+0x28/0xe0 [rng_core]
+[ 1950.279436] tpm_chip_unregister+0xd5/0xf0 [tpm]
+
+Add the forgotten !tpm_amd_is_rng_defective() invariant to the
+hwrng_unregister() call site inside tpm_chip_unregister().
+
+Cc: stable@vger.kernel.org
+Reported-by: Martin Dimov <martin@dmarto.com>
+Link: https://lore.kernel.org/linux-integrity/3d1d7e9dbfb8c96125bc93b6b58b90a7@dmarto.com/
+Fixes: f1324bbc4011 ("tpm: disable hwrng for fTPM on some AMD designs")
+Fixes: b006c439d58d ("hwrng: core - start hwrng kthread also for untrusted sources")
+Tested-by: Martin Dimov <martin@dmarto.com>
+Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/tpm/tpm-chip.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -678,7 +678,8 @@ EXPORT_SYMBOL_GPL(tpm_chip_register);
+ void tpm_chip_unregister(struct tpm_chip *chip)
+ {
+ tpm_del_legacy_sysfs(chip);
+- if (IS_ENABLED(CONFIG_HW_RANDOM_TPM) && !tpm_is_firmware_upgrade(chip))
++ if (IS_ENABLED(CONFIG_HW_RANDOM_TPM) && !tpm_is_firmware_upgrade(chip) &&
++ !tpm_amd_is_rng_defective(chip))
+ hwrng_unregister(&chip->hwrng);
+ tpm_bios_log_teardown(chip);
+ if (chip->flags & TPM_CHIP_FLAG_TPM2 && !tpm_is_firmware_upgrade(chip))
--- /dev/null
+From 094fb49a2d0d6827c86d2e0840873e6db0c491d2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= <ilpo.jarvinen@linux.intel.com>
+Date: Fri, 17 Mar 2023 13:33:17 +0200
+Subject: tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+
+commit 094fb49a2d0d6827c86d2e0840873e6db0c491d2 upstream.
+
+If userspace races tcsetattr() with a write, the drained condition
+might not be guaranteed by the kernel. There is a race window after
+checking Tx is empty before tty_set_termios() takes termios_rwsem for
+write. During that race window, more characters can be queued by a
+racing writer.
+
+Any ongoing transmission might produce garbage during HW's
+->set_termios() call. The intent of TCSADRAIN/FLUSH seems to be
+preventing such a character corruption. If those flags are set, take
+tty's write lock to stop any writer before performing the lower layer
+Tx empty check and wait for the pending characters to be sent (if any).
+
+The initial wait for all-writers-done must be placed outside of tty's
+write lock to avoid deadlock which makes it impossible to use
+tty_wait_until_sent(). The write lock is retried if a racing write is
+detected.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Link: https://lore.kernel.org/r/20230317113318.31327-2-ilpo.jarvinen@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/tty.h | 2 ++
+ drivers/tty/tty_io.c | 4 ++--
+ drivers/tty/tty_ioctl.c | 45 +++++++++++++++++++++++++++++++++------------
+ 3 files changed, 37 insertions(+), 14 deletions(-)
+
+--- a/drivers/tty/tty.h
++++ b/drivers/tty/tty.h
+@@ -62,6 +62,8 @@ int __tty_check_change(struct tty_struct
+ int tty_check_change(struct tty_struct *tty);
+ void __stop_tty(struct tty_struct *tty);
+ void __start_tty(struct tty_struct *tty);
++void tty_write_unlock(struct tty_struct *tty);
++int tty_write_lock(struct tty_struct *tty, int ndelay);
+ void tty_vhangup_session(struct tty_struct *tty);
+ void tty_open_proc_set_tty(struct file *filp, struct tty_struct *tty);
+ int tty_signal_session_leader(struct tty_struct *tty, int exit_session);
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -933,13 +933,13 @@ static ssize_t tty_read(struct kiocb *io
+ return i;
+ }
+
+-static void tty_write_unlock(struct tty_struct *tty)
++void tty_write_unlock(struct tty_struct *tty)
+ {
+ mutex_unlock(&tty->atomic_write_lock);
+ wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
+ }
+
+-static int tty_write_lock(struct tty_struct *tty, int ndelay)
++int tty_write_lock(struct tty_struct *tty, int ndelay)
+ {
+ if (!mutex_trylock(&tty->atomic_write_lock)) {
+ if (ndelay)
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -500,21 +500,42 @@ static int set_termios(struct tty_struct
+ tmp_termios.c_ispeed = tty_termios_input_baud_rate(&tmp_termios);
+ tmp_termios.c_ospeed = tty_termios_baud_rate(&tmp_termios);
+
+- ld = tty_ldisc_ref(tty);
++ if (opt & (TERMIOS_FLUSH|TERMIOS_WAIT)) {
++retry_write_wait:
++ retval = wait_event_interruptible(tty->write_wait, !tty_chars_in_buffer(tty));
++ if (retval < 0)
++ return retval;
+
+- if (ld != NULL) {
+- if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
+- ld->ops->flush_buffer(tty);
+- tty_ldisc_deref(ld);
+- }
++ if (tty_write_lock(tty, 0) < 0)
++ goto retry_write_wait;
+
+- if (opt & TERMIOS_WAIT) {
+- tty_wait_until_sent(tty, 0);
+- if (signal_pending(current))
+- return -ERESTARTSYS;
+- }
++ /* Racing writer? */
++ if (tty_chars_in_buffer(tty)) {
++ tty_write_unlock(tty);
++ goto retry_write_wait;
++ }
++
++ ld = tty_ldisc_ref(tty);
++ if (ld != NULL) {
++ if ((opt & TERMIOS_FLUSH) && ld->ops->flush_buffer)
++ ld->ops->flush_buffer(tty);
++ tty_ldisc_deref(ld);
++ }
+
+- tty_set_termios(tty, &tmp_termios);
++ if ((opt & TERMIOS_WAIT) && tty->ops->wait_until_sent) {
++ tty->ops->wait_until_sent(tty, 0);
++ if (signal_pending(current)) {
++ tty_write_unlock(tty);
++ return -ERESTARTSYS;
++ }
++ }
++
++ tty_set_termios(tty, &tmp_termios);
++
++ tty_write_unlock(tty);
++ } else {
++ tty_set_termios(tty, &tmp_termios);
++ }
+
+ /* FIXME: Arguably if tmp_termios == tty->termios AND the
+ actual requested termios was not tmp_termios then we may
--- /dev/null
+From 9a8ad10c9f2e0925ff26308ec6756b93fc2f4977 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 4 Apr 2023 09:25:14 +0200
+Subject: USB: dwc3: fix runtime pm imbalance on probe errors
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 9a8ad10c9f2e0925ff26308ec6756b93fc2f4977 upstream.
+
+Make sure not to suspend the device when probe fails to avoid disabling
+clocks and phys multiple times.
+
+Fixes: 328082376aea ("usb: dwc3: fix runtime PM in error path")
+Cc: stable@vger.kernel.org # 4.8
+Cc: Roger Quadros <rogerq@ti.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230404072524.19014-2-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1883,13 +1883,11 @@ static int dwc3_probe(struct platform_de
+ spin_lock_init(&dwc->lock);
+ mutex_init(&dwc->mutex);
+
++ pm_runtime_get_noresume(dev);
+ pm_runtime_set_active(dev);
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_set_autosuspend_delay(dev, DWC3_DEFAULT_AUTOSUSPEND_DELAY);
+ pm_runtime_enable(dev);
+- ret = pm_runtime_get_sync(dev);
+- if (ret < 0)
+- goto err1;
+
+ pm_runtime_forbid(dev);
+
+@@ -1954,12 +1952,10 @@ err3:
+ dwc3_free_event_buffers(dwc);
+
+ err2:
+- pm_runtime_allow(&pdev->dev);
+-
+-err1:
+- pm_runtime_put_sync(&pdev->dev);
+- pm_runtime_disable(&pdev->dev);
+-
++ pm_runtime_allow(dev);
++ pm_runtime_disable(dev);
++ pm_runtime_set_suspended(dev);
++ pm_runtime_put_noidle(dev);
+ disable_clks:
+ dwc3_clk_disable(dwc);
+ assert_reset:
--- /dev/null
+From 44d257e9012ee8040e41d224d0e5bfb5ef5427ea Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Tue, 4 Apr 2023 09:25:15 +0200
+Subject: USB: dwc3: fix runtime pm imbalance on unbind
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 44d257e9012ee8040e41d224d0e5bfb5ef5427ea upstream.
+
+Make sure to balance the runtime PM usage count on driver unbind by
+adding back the pm_runtime_allow() call that had been erroneously
+removed.
+
+Fixes: 266d0493900a ("usb: dwc3: core: don't trigger runtime pm when remove driver")
+Cc: stable@vger.kernel.org # 5.9
+Cc: Li Jun <jun.li@nxp.com>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230404072524.19014-3-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1979,6 +1979,7 @@ static int dwc3_remove(struct platform_d
+ dwc3_core_exit(dwc);
+ dwc3_ulpi_exit(dwc);
+
++ pm_runtime_allow(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
--- /dev/null
+From 02435a739b81ae24aff5d6e930efef9458e2af3c Mon Sep 17 00:00:00 2001
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+Date: Thu, 13 Apr 2023 12:57:40 -0700
+Subject: usb: dwc3: gadget: Stall and restart EP0 if host is unresponsive
+
+From: Wesley Cheng <quic_wcheng@quicinc.com>
+
+commit 02435a739b81ae24aff5d6e930efef9458e2af3c upstream.
+
+It was observed that there are hosts that may complete pending SETUP
+transactions before the stop active transfers and controller halt occurs,
+leading to lingering endxfer commands on DEPs on subsequent pullup/gadget
+start iterations.
+
+ dwc3_gadget_ep_disable name=ep8in flags=0x3009 direction=1
+ dwc3_gadget_ep_disable name=ep4in flags=1 direction=1
+ dwc3_gadget_ep_disable name=ep3out flags=1 direction=0
+ usb_gadget_disconnect deactivated=0 connected=0 ret=0
+
+The sequence shows that the USB gadget disconnect (dwc3_gadget_pullup(0))
+routine completed successfully, allowing for the USB gadget to proceed with
+a USB gadget connect. However, if this occurs the system runs into an
+issue where:
+
+ BUG: spinlock already unlocked on CPU
+ spin_bug+0x0
+ dwc3_remove_requests+0x278
+ dwc3_ep0_out_start+0xb0
+ __dwc3_gadget_start+0x25c
+
+This is due to the pending endxfers, leading to gadget start (w/o lock
+held) to execute the remove requests, which will unlock the dwc3
+spinlock as part of giveback.
+
+To mitigate this, resolve the pending endxfers on the pullup disable
+path by re-locating the SETUP phase check after stop active transfers, since
+that is where the DWC3_EP_DELAY_STOP is potentially set. This also allows
+for handling of a host that may be unresponsive by using the completion
+timeout to trigger the stall and restart for EP0.
+
+Fixes: c96683798e27 ("usb: dwc3: ep0: Don't prepare beyond Setup stage")
+Cc: stable@vger.kernel.org
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
+Link: https://lore.kernel.org/r/20230413195742.11821-2-quic_wcheng@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/dwc3/gadget.c | 49 ++++++++++++++++++++++++++++++----------------
+ 1 file changed, 32 insertions(+), 17 deletions(-)
+
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -2522,29 +2522,17 @@ static int __dwc3_gadget_start(struct dw
+ static int dwc3_gadget_soft_disconnect(struct dwc3 *dwc)
+ {
+ unsigned long flags;
++ int ret;
+
+ spin_lock_irqsave(&dwc->lock, flags);
+ dwc->connected = false;
+
+ /*
+- * Per databook, when we want to stop the gadget, if a control transfer
+- * is still in process, complete it and get the core into setup phase.
++ * Attempt to end pending SETUP status phase, and not wait for the
++ * function to do so.
+ */
+- if (dwc->ep0state != EP0_SETUP_PHASE) {
+- int ret;
+-
+- if (dwc->delayed_status)
+- dwc3_ep0_send_delayed_status(dwc);
+-
+- reinit_completion(&dwc->ep0_in_setup);
+-
+- spin_unlock_irqrestore(&dwc->lock, flags);
+- ret = wait_for_completion_timeout(&dwc->ep0_in_setup,
+- msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT));
+- spin_lock_irqsave(&dwc->lock, flags);
+- if (ret == 0)
+- dev_warn(dwc->dev, "timed out waiting for SETUP phase\n");
+- }
++ if (dwc->delayed_status)
++ dwc3_ep0_send_delayed_status(dwc);
+
+ /*
+ * In the Synopsys DesignWare Cores USB3 Databook Rev. 3.30a
+@@ -2558,6 +2546,33 @@ static int dwc3_gadget_soft_disconnect(s
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ /*
++ * Per databook, when we want to stop the gadget, if a control transfer
++ * is still in process, complete it and get the core into setup phase.
++ * In case the host is unresponsive to a SETUP transaction, forcefully
++ * stall the transfer, and move back to the SETUP phase, so that any
++ * pending endxfers can be executed.
++ */
++ if (dwc->ep0state != EP0_SETUP_PHASE) {
++ reinit_completion(&dwc->ep0_in_setup);
++
++ ret = wait_for_completion_timeout(&dwc->ep0_in_setup,
++ msecs_to_jiffies(DWC3_PULL_UP_TIMEOUT));
++ if (ret == 0) {
++ unsigned int dir;
++
++ dev_warn(dwc->dev, "wait for SETUP phase timed out\n");
++ spin_lock_irqsave(&dwc->lock, flags);
++ dir = !!dwc->ep0_expect_in;
++ if (dwc->ep0state == EP0_DATA_PHASE)
++ dwc3_ep0_end_control_data(dwc, dwc->eps[dir]);
++ else
++ dwc3_ep0_end_control_data(dwc, dwc->eps[!dir]);
++ dwc3_ep0_stall_and_restart(dwc);
++ spin_unlock_irqrestore(&dwc->lock, flags);
++ }
++ }
++
++ /*
+ * Note: if the GEVNTCOUNT indicates events in the event buffer, the
+ * driver needs to acknowledge them before the controller can halt.
+ * Simply let the interrupt handler acknowledges and handle the
--- /dev/null
+From 0db213ea8eed5534a5169e807f28103cbc9d23df Mon Sep 17 00:00:00 2001
+From: Badhri Jagan Sridharan <badhri@google.com>
+Date: Fri, 7 Apr 2023 03:07:40 +0000
+Subject: usb: gadget: udc: core: Invoke usb_gadget_connect only when started
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+commit 0db213ea8eed5534a5169e807f28103cbc9d23df upstream.
+
+usb_udc_connect_control does not check to see if the udc has already
+been started. This causes gadget->ops->pullup to be called through
+usb_gadget_connect when invoked from usb_udc_vbus_handler even before
+usb_gadget_udc_start is called. Guard this by checking for udc->started
+in usb_udc_connect_control before invoking usb_gadget_connect.
+
+Guarding udc->vbus, udc->started, gadget->connect, gadget->deactivate
+related functions with connect_lock. usb_gadget_connect_locked,
+usb_gadget_disconnect_locked, usb_udc_connect_control_locked,
+usb_gadget_udc_start_locked, usb_gadget_udc_stop_locked are called with
+this lock held as they can be simulataneously invoked from different code
+paths.
+
+Adding an additional check to make sure udc is started(udc->started)
+before pullup callback is invoked.
+
+Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
+Cc: stable@vger.kernel.org
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://lore.kernel.org/r/20230407030741.3163220-1-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/core.c | 148 +++++++++++++++++++++++++++++-------------
+ 1 file changed, 104 insertions(+), 44 deletions(-)
+
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -37,6 +37,10 @@ static struct bus_type gadget_bus_type;
+ * @vbus: for udcs who care about vbus status, this value is real vbus status;
+ * for udcs who do not care about vbus status, this value is always true
+ * @started: the UDC's started state. True if the UDC had started.
++ * @connect_lock: protects udc->vbus, udc->started, gadget->connect, gadget->deactivate related
++ * functions. usb_gadget_connect_locked, usb_gadget_disconnect_locked,
++ * usb_udc_connect_control_locked, usb_gadget_udc_start_locked, usb_gadget_udc_stop_locked are
++ * called with this lock held.
+ *
+ * This represents the internal data structure which is used by the UDC-class
+ * to hold information about udc driver and gadget together.
+@@ -48,6 +52,7 @@ struct usb_udc {
+ struct list_head list;
+ bool vbus;
+ bool started;
++ struct mutex connect_lock;
+ };
+
+ static struct class *udc_class;
+@@ -660,17 +665,9 @@ out:
+ }
+ EXPORT_SYMBOL_GPL(usb_gadget_vbus_disconnect);
+
+-/**
+- * usb_gadget_connect - software-controlled connect to USB host
+- * @gadget:the peripheral being connected
+- *
+- * Enables the D+ (or potentially D-) pullup. The host will start
+- * enumerating this gadget when the pullup is active and a VBUS session
+- * is active (the link is powered).
+- *
+- * Returns zero on success, else negative errno.
+- */
+-int usb_gadget_connect(struct usb_gadget *gadget)
++/* Internal version of usb_gadget_connect needs to be called with connect_lock held. */
++static int usb_gadget_connect_locked(struct usb_gadget *gadget)
++ __must_hold(&gadget->udc->connect_lock)
+ {
+ int ret = 0;
+
+@@ -679,10 +676,12 @@ int usb_gadget_connect(struct usb_gadget
+ goto out;
+ }
+
+- if (gadget->deactivated) {
++ if (gadget->deactivated || !gadget->udc->started) {
+ /*
+ * If gadget is deactivated we only save new state.
+ * Gadget will be connected automatically after activation.
++ *
++ * udc first needs to be started before gadget can be pulled up.
+ */
+ gadget->connected = true;
+ goto out;
+@@ -697,22 +696,32 @@ out:
+
+ return ret;
+ }
+-EXPORT_SYMBOL_GPL(usb_gadget_connect);
+
+ /**
+- * usb_gadget_disconnect - software-controlled disconnect from USB host
+- * @gadget:the peripheral being disconnected
+- *
+- * Disables the D+ (or potentially D-) pullup, which the host may see
+- * as a disconnect (when a VBUS session is active). Not all systems
+- * support software pullup controls.
++ * usb_gadget_connect - software-controlled connect to USB host
++ * @gadget:the peripheral being connected
+ *
+- * Following a successful disconnect, invoke the ->disconnect() callback
+- * for the current gadget driver so that UDC drivers don't need to.
++ * Enables the D+ (or potentially D-) pullup. The host will start
++ * enumerating this gadget when the pullup is active and a VBUS session
++ * is active (the link is powered).
+ *
+ * Returns zero on success, else negative errno.
+ */
+-int usb_gadget_disconnect(struct usb_gadget *gadget)
++int usb_gadget_connect(struct usb_gadget *gadget)
++{
++ int ret;
++
++ mutex_lock(&gadget->udc->connect_lock);
++ ret = usb_gadget_connect_locked(gadget);
++ mutex_unlock(&gadget->udc->connect_lock);
++
++ return ret;
++}
++EXPORT_SYMBOL_GPL(usb_gadget_connect);
++
++/* Internal version of usb_gadget_disconnect needs to be called with connect_lock held. */
++static int usb_gadget_disconnect_locked(struct usb_gadget *gadget)
++ __must_hold(&gadget->udc->connect_lock)
+ {
+ int ret = 0;
+
+@@ -724,10 +733,12 @@ int usb_gadget_disconnect(struct usb_gad
+ if (!gadget->connected)
+ goto out;
+
+- if (gadget->deactivated) {
++ if (gadget->deactivated || !gadget->udc->started) {
+ /*
+ * If gadget is deactivated we only save new state.
+ * Gadget will stay disconnected after activation.
++ *
++ * udc should have been started before gadget being pulled down.
+ */
+ gadget->connected = false;
+ goto out;
+@@ -747,6 +758,30 @@ out:
+
+ return ret;
+ }
++
++/**
++ * usb_gadget_disconnect - software-controlled disconnect from USB host
++ * @gadget:the peripheral being disconnected
++ *
++ * Disables the D+ (or potentially D-) pullup, which the host may see
++ * as a disconnect (when a VBUS session is active). Not all systems
++ * support software pullup controls.
++ *
++ * Following a successful disconnect, invoke the ->disconnect() callback
++ * for the current gadget driver so that UDC drivers don't need to.
++ *
++ * Returns zero on success, else negative errno.
++ */
++int usb_gadget_disconnect(struct usb_gadget *gadget)
++{
++ int ret;
++
++ mutex_lock(&gadget->udc->connect_lock);
++ ret = usb_gadget_disconnect_locked(gadget);
++ mutex_unlock(&gadget->udc->connect_lock);
++
++ return ret;
++}
+ EXPORT_SYMBOL_GPL(usb_gadget_disconnect);
+
+ /**
+@@ -767,10 +802,11 @@ int usb_gadget_deactivate(struct usb_gad
+ if (gadget->deactivated)
+ goto out;
+
++ mutex_lock(&gadget->udc->connect_lock);
+ if (gadget->connected) {
+- ret = usb_gadget_disconnect(gadget);
++ ret = usb_gadget_disconnect_locked(gadget);
+ if (ret)
+- goto out;
++ goto unlock;
+
+ /*
+ * If gadget was being connected before deactivation, we want
+@@ -780,6 +816,8 @@ int usb_gadget_deactivate(struct usb_gad
+ }
+ gadget->deactivated = true;
+
++unlock:
++ mutex_unlock(&gadget->udc->connect_lock);
+ out:
+ trace_usb_gadget_deactivate(gadget, ret);
+
+@@ -803,6 +841,7 @@ int usb_gadget_activate(struct usb_gadge
+ if (!gadget->deactivated)
+ goto out;
+
++ mutex_lock(&gadget->udc->connect_lock);
+ gadget->deactivated = false;
+
+ /*
+@@ -810,7 +849,8 @@ int usb_gadget_activate(struct usb_gadge
+ * while it was being deactivated, we call usb_gadget_connect().
+ */
+ if (gadget->connected)
+- ret = usb_gadget_connect(gadget);
++ ret = usb_gadget_connect_locked(gadget);
++ mutex_unlock(&gadget->udc->connect_lock);
+
+ out:
+ trace_usb_gadget_activate(gadget, ret);
+@@ -1051,12 +1091,13 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
+
+ /* ------------------------------------------------------------------------- */
+
+-static void usb_udc_connect_control(struct usb_udc *udc)
++/* Acquire connect_lock before calling this function. */
++static void usb_udc_connect_control_locked(struct usb_udc *udc) __must_hold(&udc->connect_lock)
+ {
+- if (udc->vbus)
+- usb_gadget_connect(udc->gadget);
++ if (udc->vbus && udc->started)
++ usb_gadget_connect_locked(udc->gadget);
+ else
+- usb_gadget_disconnect(udc->gadget);
++ usb_gadget_disconnect_locked(udc->gadget);
+ }
+
+ /**
+@@ -1072,10 +1113,12 @@ void usb_udc_vbus_handler(struct usb_gad
+ {
+ struct usb_udc *udc = gadget->udc;
+
++ mutex_lock(&udc->connect_lock);
+ if (udc) {
+ udc->vbus = status;
+- usb_udc_connect_control(udc);
++ usb_udc_connect_control_locked(udc);
+ }
++ mutex_unlock(&udc->connect_lock);
+ }
+ EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
+
+@@ -1097,7 +1140,7 @@ void usb_gadget_udc_reset(struct usb_gad
+ EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);
+
+ /**
+- * usb_gadget_udc_start - tells usb device controller to start up
++ * usb_gadget_udc_start_locked - tells usb device controller to start up
+ * @udc: The UDC to be started
+ *
+ * This call is issued by the UDC Class driver when it's about
+@@ -1108,8 +1151,11 @@ EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);
+ * necessary to have it powered on.
+ *
+ * Returns zero on success, else negative errno.
++ *
++ * Caller should acquire connect_lock before invoking this function.
+ */
+-static inline int usb_gadget_udc_start(struct usb_udc *udc)
++static inline int usb_gadget_udc_start_locked(struct usb_udc *udc)
++ __must_hold(&udc->connect_lock)
+ {
+ int ret;
+
+@@ -1126,7 +1172,7 @@ static inline int usb_gadget_udc_start(s
+ }
+
+ /**
+- * usb_gadget_udc_stop - tells usb device controller we don't need it anymore
++ * usb_gadget_udc_stop_locked - tells usb device controller we don't need it anymore
+ * @udc: The UDC to be stopped
+ *
+ * This call is issued by the UDC Class driver after calling
+@@ -1135,8 +1181,11 @@ static inline int usb_gadget_udc_start(s
+ * The details are implementation specific, but it can go as
+ * far as powering off UDC completely and disable its data
+ * line pullups.
++ *
++ * Caller should acquire connect lock before invoking this function.
+ */
+-static inline void usb_gadget_udc_stop(struct usb_udc *udc)
++static inline void usb_gadget_udc_stop_locked(struct usb_udc *udc)
++ __must_hold(&udc->connect_lock)
+ {
+ if (!udc->started) {
+ dev_err(&udc->dev, "UDC had already stopped\n");
+@@ -1295,6 +1344,7 @@ int usb_add_gadget(struct usb_gadget *ga
+
+ udc->gadget = gadget;
+ gadget->udc = udc;
++ mutex_init(&udc->connect_lock);
+
+ udc->started = false;
+
+@@ -1496,11 +1546,15 @@ static int gadget_bind_driver(struct dev
+ if (ret)
+ goto err_bind;
+
+- ret = usb_gadget_udc_start(udc);
+- if (ret)
++ mutex_lock(&udc->connect_lock);
++ ret = usb_gadget_udc_start_locked(udc);
++ if (ret) {
++ mutex_unlock(&udc->connect_lock);
+ goto err_start;
++ }
+ usb_gadget_enable_async_callbacks(udc);
+- usb_udc_connect_control(udc);
++ usb_udc_connect_control_locked(udc);
++ mutex_unlock(&udc->connect_lock);
+
+ kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
+ return 0;
+@@ -1531,12 +1585,14 @@ static void gadget_unbind_driver(struct
+
+ kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
+
+- usb_gadget_disconnect(gadget);
++ mutex_lock(&udc->connect_lock);
++ usb_gadget_disconnect_locked(gadget);
+ usb_gadget_disable_async_callbacks(udc);
+ if (gadget->irq)
+ synchronize_irq(gadget->irq);
+ udc->driver->unbind(gadget);
+- usb_gadget_udc_stop(udc);
++ usb_gadget_udc_stop_locked(udc);
++ mutex_unlock(&udc->connect_lock);
+
+ mutex_lock(&udc_lock);
+ driver->is_bound = false;
+@@ -1622,11 +1678,15 @@ static ssize_t soft_connect_store(struct
+ }
+
+ if (sysfs_streq(buf, "connect")) {
+- usb_gadget_udc_start(udc);
+- usb_gadget_connect(udc->gadget);
++ mutex_lock(&udc->connect_lock);
++ usb_gadget_udc_start_locked(udc);
++ usb_gadget_connect_locked(udc->gadget);
++ mutex_unlock(&udc->connect_lock);
+ } else if (sysfs_streq(buf, "disconnect")) {
+- usb_gadget_disconnect(udc->gadget);
+- usb_gadget_udc_stop(udc);
++ mutex_lock(&udc->connect_lock);
++ usb_gadget_disconnect_locked(udc->gadget);
++ usb_gadget_udc_stop_locked(udc);
++ mutex_unlock(&udc->connect_lock);
+ } else {
+ dev_err(dev, "unsupported command '%s'\n", buf);
+ ret = -EINVAL;
--- /dev/null
+From a3afbf5cc887fc3401f012fe629810998ed61859 Mon Sep 17 00:00:00 2001
+From: Badhri Jagan Sridharan <badhri@google.com>
+Date: Fri, 7 Apr 2023 03:07:41 +0000
+Subject: usb: gadget: udc: core: Prevent redundant calls to pullup
+
+From: Badhri Jagan Sridharan <badhri@google.com>
+
+commit a3afbf5cc887fc3401f012fe629810998ed61859 upstream.
+
+usb_gadget_connect calls gadget->ops->pullup without checking whether
+gadget->connected was previously set. Make this symmetric to
+usb_gadget_disconnect by returning early if gadget->connected is
+already set.
+
+Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected")
+Cc: stable@vger.kernel.org
+Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
+Link: https://lore.kernel.org/r/20230407030741.3163220-2-badhri@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/gadget/udc/core.c
++++ b/drivers/usb/gadget/udc/core.c
+@@ -676,6 +676,9 @@ static int usb_gadget_connect_locked(str
+ goto out;
+ }
+
++ if (gadget->connected)
++ goto out;
++
+ if (gadget->deactivated || !gadget->udc->started) {
+ /*
+ * If gadget is deactivated we only save new state.
--- /dev/null
+From 5b8ccdfb943f6a03c676d2ea816dd38c149e920b Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 14 Apr 2023 14:10:54 +0200
+Subject: wifi: mt76: add missing locking to protect against concurrent rx/status calls
+
+From: Felix Fietkau <nbd@nbd.name>
+
+commit 5b8ccdfb943f6a03c676d2ea816dd38c149e920b upstream.
+
+According to the documentation, ieee80211_rx_list must not run concurrently
+with ieee80211_tx_status (or its variants).
+
+Cc: stable@vger.kernel.org
+Fixes: 88046b2c9f6d ("mt76: add support for reporting tx status with skb")
+Reported-by: Brian Coverstone <brian@mainsequence.net>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/dma.c | 2 ++
+ drivers/net/wireless/mediatek/mt76/mt7603/mac.c | 5 ++++-
+ drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 5 ++++-
+ drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 5 ++++-
+ drivers/net/wireless/mediatek/mt76/tx.c | 4 ++++
+ 5 files changed, 18 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/mediatek/mt76/dma.c
++++ b/drivers/net/wireless/mediatek/mt76/dma.c
+@@ -436,7 +436,9 @@ free:
+ free_skb:
+ status.skb = tx_info.skb;
+ hw = mt76_tx_status_get_hw(dev, tx_info.skb);
++ spin_lock_bh(&dev->rx_lock);
+ ieee80211_tx_status_ext(hw, &status);
++ spin_unlock_bh(&dev->rx_lock);
+
+ return ret;
+ }
+--- a/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7603/mac.c
+@@ -1279,8 +1279,11 @@ void mt7603_mac_add_txs(struct mt7603_de
+ if (wcidx >= MT7603_WTBL_STA || !sta)
+ goto out;
+
+- if (mt7603_fill_txs(dev, msta, &info, txs_data))
++ if (mt7603_fill_txs(dev, msta, &info, txs_data)) {
++ spin_lock_bh(&dev->mt76.rx_lock);
+ ieee80211_tx_status_noskb(mt76_hw(dev), sta, &info);
++ spin_unlock_bh(&dev->mt76.rx_lock);
++ }
+
+ out:
+ rcu_read_unlock();
+--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c
+@@ -1517,8 +1517,11 @@ static void mt7615_mac_add_txs(struct mt
+ if (wcid->phy_idx && dev->mt76.phys[MT_BAND1])
+ mphy = dev->mt76.phys[MT_BAND1];
+
+- if (mt7615_fill_txs(dev, msta, &info, txs_data))
++ if (mt7615_fill_txs(dev, msta, &info, txs_data)) {
++ spin_lock_bh(&dev->mt76.rx_lock);
+ ieee80211_tx_status_noskb(mphy->hw, sta, &info);
++ spin_unlock_bh(&dev->mt76.rx_lock);
++ }
+
+ out:
+ rcu_read_unlock();
+--- a/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x02_mac.c
+@@ -631,8 +631,11 @@ void mt76x02_send_tx_status(struct mt76x
+
+ mt76_tx_status_unlock(mdev, &list);
+
+- if (!status.skb)
++ if (!status.skb) {
++ spin_lock_bh(&dev->mt76.rx_lock);
+ ieee80211_tx_status_ext(mt76_hw(dev), &status);
++ spin_unlock_bh(&dev->mt76.rx_lock);
++ }
+
+ if (!len)
+ goto out;
+--- a/drivers/net/wireless/mediatek/mt76/tx.c
++++ b/drivers/net/wireless/mediatek/mt76/tx.c
+@@ -77,7 +77,9 @@ mt76_tx_status_unlock(struct mt76_dev *d
+ }
+
+ hw = mt76_tx_status_get_hw(dev, skb);
++ spin_lock_bh(&dev->rx_lock);
+ ieee80211_tx_status_ext(hw, &status);
++ spin_unlock_bh(&dev->rx_lock);
+ }
+ rcu_read_unlock();
+ }
+@@ -263,7 +265,9 @@ void __mt76_tx_complete_skb(struct mt76_
+ if (cb->pktid < MT_PACKET_ID_FIRST) {
+ hw = mt76_tx_status_get_hw(dev, skb);
+ status.sta = wcid_to_sta(wcid);
++ spin_lock_bh(&dev->rx_lock);
+ ieee80211_tx_status_ext(hw, &status);
++ spin_unlock_bh(&dev->rx_lock);
+ goto out;
+ }
+
--- /dev/null
+From 09d4d6da1b65d09414e7bce61459593f3c80ead1 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Wed, 29 Mar 2023 14:57:58 -0500
+Subject: wifi: mt76: mt7921e: Set memory space enable in PCI_COMMAND if unset
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit 09d4d6da1b65d09414e7bce61459593f3c80ead1 upstream.
+
+When the BIOS has been configured for Fast Boot, systems with mt7921e
+have non-functional wifi. Turning on Fast boot caused both bus master
+enable and memory space enable bits in PCI_COMMAND not to get configured.
+
+The mt7921 driver already sets bus master enable, but explicitly check
+and set memory access enable as well to fix this problem.
+
+Tested-by: Anson Tsao <anson.tsao@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Acked-by: Sean Wang <sean.wang@mediatek.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c
+@@ -256,6 +256,7 @@ static int mt7921_pci_probe(struct pci_d
+ struct mt7921_dev *dev;
+ struct mt76_dev *mdev;
+ int ret;
++ u16 cmd;
+
+ ret = pcim_enable_device(pdev);
+ if (ret)
+@@ -265,6 +266,11 @@ static int mt7921_pci_probe(struct pci_d
+ if (ret)
+ return ret;
+
++ pci_read_config_word(pdev, PCI_COMMAND, &cmd);
++ if (!(cmd & PCI_COMMAND_MEMORY)) {
++ cmd |= PCI_COMMAND_MEMORY;
++ pci_write_config_word(pdev, PCI_COMMAND, cmd);
++ }
+ pci_set_master(pdev);
+
+ ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
--- /dev/null
+From 735baf1b23458f71a8b15cb924af22c9ff9cd125 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan+linaro@kernel.org>
+Date: Wed, 5 Apr 2023 11:03:42 +0200
+Subject: xhci: fix debugfs register accesses while suspended
+
+From: Johan Hovold <johan+linaro@kernel.org>
+
+commit 735baf1b23458f71a8b15cb924af22c9ff9cd125 upstream.
+
+Wire up the debugfs regset device pointer so that the controller is
+resumed before accessing registers to avoid crashing or locking up if it
+happens to be runtime suspended.
+
+Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver")
+Cc: stable@vger.kernel.org # 4.15: 30332eeefec8: debugfs: regset32: Add Runtime PM support
+Cc: stable@vger.kernel.org # 4.15
+Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
+Link: https://lore.kernel.org/r/20230405090342.7363-1-johan+linaro@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/host/xhci-debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -133,6 +133,7 @@ static void xhci_debugfs_regset(struct x
+ regset->regs = regs;
+ regset->nregs = nregs;
+ regset->base = hcd->regs + base;
++ regset->dev = hcd->self.controller;
+
+ debugfs_create_regset32((const char *)rgs->name, 0444, parent, regset);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
