--- /dev/null
+From aa220a94f94c20c67acda6df88874dda326b0934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 09:25:11 +0300
+Subject: ARM: at91: pm: fix imbalanced reference counter for ethernet devices
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit ccd4923d18d5698a5910d516646ce125b9155d47 ]
+
+The of_find_device_by_node() function is returning a struct platform_device
+object with the embedded struct device member's reference counter
+incremented. This needs to be dropped when done with the platform device
+returned by of_find_device_by_node().
+
+at91_pm_eth_quirk_is_valid() calls of_find_device_by_node() on
+suspend and resume path. On suspend it calls of_find_device_by_node() and
+on resume and failure paths it drops the counter of
+struct platform_device::dev.
+
+In case ethernet device may not wakeup there is a put_device() on
+at91_pm_eth_quirk_is_valid() which is wrong as it colides with
+put_device() on resume path leading to the reference counter of struct
+device embedded in struct platform_device to be messed, stack trace to be
+displayed (after 5 consecutive suspend/resume cycles) and execution to
+hang.
+
+Along with this the error path of at91_pm_config_quirks() had been also
+adapted to decrement propertly the reference counter of struct device
+embedded in struct platform_device.
+
+Fixes: b7fc72c63399 ("ARM: at91: pm: add quirks for pm")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20230518062511.2988500-1-claudiu.beznea@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-at91/pm.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index 60dc56d8acfb9..437dd0352fd44 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -334,16 +334,14 @@ static bool at91_pm_eth_quirk_is_valid(struct at91_pm_quirk_eth *eth)
+ pdev = of_find_device_by_node(eth->np);
+ if (!pdev)
+ return false;
++ /* put_device(eth->dev) is called at the end of suspend. */
+ eth->dev = &pdev->dev;
+ }
+
+ /* No quirks if device isn't a wakeup source. */
+- if (!device_may_wakeup(eth->dev)) {
+- put_device(eth->dev);
++ if (!device_may_wakeup(eth->dev))
+ return false;
+- }
+
+- /* put_device(eth->dev) is called at the end of suspend. */
+ return true;
+ }
+
+@@ -439,14 +437,14 @@ static int at91_pm_config_quirks(bool suspend)
+ pr_err("AT91: PM: failed to enable %s clocks\n",
+ j == AT91_PM_G_ETH ? "geth" : "eth");
+ }
+- } else {
+- /*
+- * Release the reference to eth->dev taken in
+- * at91_pm_eth_quirk_is_valid().
+- */
+- put_device(eth->dev);
+- eth->dev = NULL;
+ }
++
++ /*
++ * Release the reference to eth->dev taken in
++ * at91_pm_eth_quirk_is_valid().
++ */
++ put_device(eth->dev);
++ eth->dev = NULL;
+ }
+
+ return ret;
+--
+2.39.2
+
--- /dev/null
+From 7f83044019eab6e45f332ef3c60692226b5991ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 08:27:50 +0300
+Subject: ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc
+
+From: Claudiu Beznea <claudiu.beznea@microchip.com>
+
+[ Upstream commit 6b0db163ff9200a55dc77a652dad1d4b0a853f63 ]
+
+There is no atmel,shdwc-debouncer property for SHDWC. The right DT property
+is debounce-delay-us. Use it.
+
+Fixes: 16b161bcf5d4 ("ARM: dts: at91: sama7g5: add shdwc node")
+Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20230523052750.184223-1-claudiu.beznea@microchip.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/at91-sama7g5ek.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/at91-sama7g5ek.dts b/arch/arm/boot/dts/at91-sama7g5ek.dts
+index aa5cc0e98bbab..217e9b96c61e5 100644
+--- a/arch/arm/boot/dts/at91-sama7g5ek.dts
++++ b/arch/arm/boot/dts/at91-sama7g5ek.dts
+@@ -792,7 +792,7 @@ &sdmmc2 {
+ };
+
+ &shdwc {
+- atmel,shdwc-debouncer = <976>;
++ debounce-delay-us = <976>;
+ status = "okay";
+
+ input@0 {
+--
+2.39.2
+
--- /dev/null
+From d2f4758e10e5c06d897cb0334b99ff2dc05db1dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 May 2023 10:38:54 -0500
+Subject: arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit ca50d7765587fe0a8351a6e8d9742cfd4811d925 ]
+
+Add the assigned-clocks and assigned-clock-rates properties for the
+LPUARTx nodes. Without these properties, the default clock rate
+used would be 0, which can cause the UART ports to fail when open.
+
+Fixes: 35f4e9d7530f ("arm64: dts: imx8: split adma ss into dma and audio ss")
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi b/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi
+index a943a1e2797f4..21345ae14eb25 100644
+--- a/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi
+@@ -90,6 +90,8 @@ lpuart0: serial@5a060000 {
+ clocks = <&uart0_lpcg IMX_LPCG_CLK_4>,
+ <&uart0_lpcg IMX_LPCG_CLK_0>;
+ clock-names = "ipg", "baud";
++ assigned-clocks = <&clk IMX_SC_R_UART_0 IMX_SC_PM_CLK_PER>;
++ assigned-clock-rates = <80000000>;
+ power-domains = <&pd IMX_SC_R_UART_0>;
+ status = "disabled";
+ };
+@@ -100,6 +102,8 @@ lpuart1: serial@5a070000 {
+ clocks = <&uart1_lpcg IMX_LPCG_CLK_4>,
+ <&uart1_lpcg IMX_LPCG_CLK_0>;
+ clock-names = "ipg", "baud";
++ assigned-clocks = <&clk IMX_SC_R_UART_1 IMX_SC_PM_CLK_PER>;
++ assigned-clock-rates = <80000000>;
+ power-domains = <&pd IMX_SC_R_UART_1>;
+ status = "disabled";
+ };
+@@ -110,6 +114,8 @@ lpuart2: serial@5a080000 {
+ clocks = <&uart2_lpcg IMX_LPCG_CLK_4>,
+ <&uart2_lpcg IMX_LPCG_CLK_0>;
+ clock-names = "ipg", "baud";
++ assigned-clocks = <&clk IMX_SC_R_UART_2 IMX_SC_PM_CLK_PER>;
++ assigned-clock-rates = <80000000>;
+ power-domains = <&pd IMX_SC_R_UART_2>;
+ status = "disabled";
+ };
+@@ -120,6 +126,8 @@ lpuart3: serial@5a090000 {
+ clocks = <&uart3_lpcg IMX_LPCG_CLK_4>,
+ <&uart3_lpcg IMX_LPCG_CLK_0>;
+ clock-names = "ipg", "baud";
++ assigned-clocks = <&clk IMX_SC_R_UART_3 IMX_SC_PM_CLK_PER>;
++ assigned-clock-rates = <80000000>;
+ power-domains = <&pd IMX_SC_R_UART_3>;
+ status = "disabled";
+ };
+--
+2.39.2
+
--- /dev/null
+From 8f74418feeab46ba44568c0a99217a53776e4620 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 May 2023 06:22:54 -0500
+Subject: arm64: dts: imx8mn-beacon: Fix SPI CS pinmux
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 9bf2e534313fcf420367668cc1f30e10469901dc ]
+
+The final production baseboard had a different chip select than
+earlier prototype boards. When the newer board was released,
+the SPI stopped working because the wrong pin was used in the device
+tree and conflicted with the UART RTS. Fix the pinmux for
+production boards.
+
+Fixes: 36ca3c8ccb53 ("arm64: dts: imx: Add Beacon i.MX8M Nano development kit")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi
+index 9e82069c941fa..5a1f7c30afe57 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi
+@@ -81,7 +81,7 @@ sound {
+ &ecspi2 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_espi2>;
+- cs-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>;
++ cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>;
+ status = "okay";
+
+ eeprom@0 {
+@@ -202,7 +202,7 @@ pinctrl_espi2: espi2grp {
+ MX8MN_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK 0x82
+ MX8MN_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI 0x82
+ MX8MN_IOMUXC_ECSPI2_MISO_ECSPI2_MISO 0x82
+- MX8MN_IOMUXC_ECSPI1_SS0_GPIO5_IO9 0x41
++ MX8MN_IOMUXC_ECSPI2_SS0_GPIO5_IO13 0x41
+ >;
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 721ee0e20832f39b9761cdd9d951dc02fc518e23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 May 2023 08:54:21 -0500
+Subject: arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals
+
+From: Shenwei Wang <shenwei.wang@nxp.com>
+
+[ Upstream commit 2b28fc688cdff225c41cdd22857500e187453ed7 ]
+
+The USDHC2 CD and WP sginal should be on LSIO_GPIO5.
+
+Fixes: 307fd14d4b14 ("arm64: dts: imx: add imx8qm mek support")
+Signed-off-by: Shenwei Wang <shenwei.wang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+index ce9d3f0b98fc0..607cd6b4e9721 100644
+--- a/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
++++ b/arch/arm64/boot/dts/freescale/imx8qm-mek.dts
+@@ -82,8 +82,8 @@ &usdhc2 {
+ pinctrl-0 = <&pinctrl_usdhc2>;
+ bus-width = <4>;
+ vmmc-supply = <®_usdhc2_vmmc>;
+- cd-gpios = <&lsio_gpio4 22 GPIO_ACTIVE_LOW>;
+- wp-gpios = <&lsio_gpio4 21 GPIO_ACTIVE_HIGH>;
++ cd-gpios = <&lsio_gpio5 22 GPIO_ACTIVE_LOW>;
++ wp-gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>;
+ status = "okay";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From d07b66867045109cf958f9b17933afa46a2bcde9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 May 2023 17:19:29 -0700
+Subject: arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified
+ sc7180-lite boards
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 3a735530c159b75e1402c08abe1ba4eb99a1f7a3 ]
+
+In general, the three SKUs of sc7180 (lite, normal, and pro) are
+handled dynamically.
+
+The cpufreq table in sc7180.dtsi includes the superset of all CPU
+frequencies. The "qcom-cpufreq-hw" driver in Linux shows that we can
+dynamically detect which frequencies are actually available on the
+currently running CPU and then we can just enable those ones.
+
+The GPU is similarly dynamic. The nvmem has a fuse in it (see
+"gpu_speed_bin" in sc7180.dtsi) that the GPU driver can use to figure
+out which frequencies to enable.
+
+There is one part, however, that is not so dynamic. The way SDRAM
+frequency works in sc7180 is that it's tied to cpufreq. At the busiest
+cpufreq operating points we'll pick the top supported SDRAM frequency.
+They ramp down together.
+
+For the "pro" SKU of sc7180, we only enable one extra cpufreq step.
+That extra cpufreq step runs SDRAM at the same speed as the step
+below. Thus, for normal and pro things are OK. There is no sc7180-pro
+device tree snippet.
+
+For the "lite" SKU if sc7180, however, things aren't so easy. The
+"lite" SKU drops 3 cpufreq entries but can still run SDRAM at max
+frequency. That messed things up with the whole scheme. This is why we
+added the "sc7180-lite" fragment in commit 8fd01e01fd6f ("arm64: dts:
+qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite").
+
+When the lite scheme came about, it was agreed that the WiFi SKUs of
+lazor would _always_ be "lite" and would, in fact, be the only "lite"
+devices. Unfortunately, this decision changed and folks didn't realize
+that it would be a problem. Specifically, some later lazor WiFi-only
+devices were built with "pro" CPUs.
+
+Building WiFi-only lazor with "pro" CPUs isn't the end of the world.
+The SDRAM will ramp up a little sooner than it otherwise would, but
+aside from a small power hit things work OK. One problem, though, is
+that the SDRAM scaling becomes a bit quirky. Specifically, with the
+current tables we'll max out SDRAM frequency at 2.1GHz but then
+_lower_ it at 2.2GHz / 2.3GHz only to raise it back to max for 2.4GHz
+and 2.55GHz.
+
+Let's at least fix this so that the SDRAM frequency doesn't go down in
+that quirky way. On true "lite" SKUs this change will be a no-op
+because the operating points we're touching are disabled. This change
+is only useful when a board that thinks it has a "lite" CPU actually
+has a "normal" or "pro" one stuffed.
+
+Fixes: 8fd01e01fd6f ("arm64: dts: qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230515171929.1.Ic8dee2cb79ce39ffc04eab2a344dde47b2f9459f@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc7180-lite.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi b/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi
+index d8ed1d7b4ec76..4b306a59d9bec 100644
+--- a/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc7180-lite.dtsi
+@@ -16,3 +16,11 @@ &cpu6_opp11 {
+ &cpu6_opp12 {
+ opp-peak-kBps = <8532000 23347200>;
+ };
++
++&cpu6_opp13 {
++ opp-peak-kBps = <8532000 23347200>;
++};
++
++&cpu6_opp14 {
++ opp-peak-kBps = <8532000 23347200>;
++};
+--
+2.39.2
+
--- /dev/null
+From 39d4ab1f38a3cc561d178213fdf313c507749bb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 May 2023 08:04:25 -0700
+Subject: arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes
+
+From: Bjorn Andersson <quic_bjorande@quicinc.com>
+
+[ Upstream commit ce7c014937c442be677963848c7db62eccd94eac ]
+
+The rpmh driver will cache sleep and wake votes until the cluster
+power-domain is about to enter idle, to avoid unnecessary writes. So
+associate the apps_rsc with the cluster pd, so that it can be notified
+about this event.
+
+Without this, only AMC votes are being commited.
+
+Signed-off-by: Bjorn Andersson <quic_bjorande@quicinc.com>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Fixes: 152d1faf1e2f ("arm64: dts: qcom: add SC8280XP platform")
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230512150425.3171122-1-quic_bjorande@quicinc.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+index 03b679b75201d..f081ca449699a 100644
+--- a/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
++++ b/arch/arm64/boot/dts/qcom/sc8280xp.dtsi
+@@ -3957,6 +3957,7 @@ apps_rsc: rsc@18200000 {
+ qcom,tcs-config = <ACTIVE_TCS 2>, <SLEEP_TCS 3>,
+ <WAKE_TCS 3>, <CONTROL_TCS 1>;
+ label = "apps_rsc";
++ power-domains = <&CLUSTER_PD>;
+
+ apps_bcm_voter: bcm-voter {
+ compatible = "qcom,bcm-voter";
+--
+2.39.2
+
--- /dev/null
+From 1e699268eba1a20081e76c2f12b5740ef2a1a100 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 May 2023 19:06:13 +0200
+Subject: arm64: dts: qcom: sm6375-pdx225: Fix remoteproc firmware paths
+
+From: Konrad Dybcio <konrad.dybcio@linaro.org>
+
+[ Upstream commit a14da6144d16ef27e3022835fa282a3740b8ad7b ]
+
+They were previously missing the SoC name. Fix it.
+
+Fixes: a2ad207c412b ("arm64: dts: qcom: sm6375-pdx225: Enable ADSP & CDSP")
+Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230517-topic-murray-fwname-v1-1-923e87312249@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts b/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts
+index b691c3834b6b6..71970dd3fc1ad 100644
+--- a/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts
++++ b/arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts
+@@ -151,12 +151,12 @@ &qupv3_id_1 {
+ };
+
+ &remoteproc_adsp {
+- firmware-name = "qcom/Sony/murray/adsp.mbn";
++ firmware-name = "qcom/sm6375/Sony/murray/adsp.mbn";
+ status = "okay";
+ };
+
+ &remoteproc_cdsp {
+- firmware-name = "qcom/Sony/murray/cdsp.mbn";
++ firmware-name = "qcom/sm6375/Sony/murray/cdsp.mbn";
+ status = "okay";
+ };
+
+--
+2.39.2
+
--- /dev/null
+From f572d3a489adc092b0ad511bf4c0df77a0106ab0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 May 2023 16:59:55 +0530
+Subject: ASoC: amd: ps: fix for acp_lock access in pdm driver
+
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+
+[ Upstream commit b6b5c6426efe27cbd954409a50604d99c79bd42b ]
+
+Sending the mutex address(acp_lock) as platform
+data during ACP PDM platform driver register sequence,
+its creating copy of the platform data.
+Referencing this platform data in ACP PDM driver results
+incorrect reference to the common lock usage.
+
+Instead of directly passing the lock address as platform
+data, retrieve it from parent driver data structure
+and use the same lock reference in ACP PDM driver.
+
+Fixes: 45aa83cb9388 ("ASoC: amd: ps: use acp_lock to protect common registers in pdm driver")
+
+Signed-off-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Link: https://lore.kernel.org/r/20230525113000.1290758-1-Vijendar.Mukunda@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/ps/pci-ps.c | 3 +--
+ sound/soc/amd/ps/ps-pdm-dma.c | 10 +++++-----
+ 2 files changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/amd/ps/pci-ps.c b/sound/soc/amd/ps/pci-ps.c
+index afddb9a77ba49..b1337b96ea8d6 100644
+--- a/sound/soc/amd/ps/pci-ps.c
++++ b/sound/soc/amd/ps/pci-ps.c
+@@ -211,8 +211,7 @@ static int create_acp63_platform_devs(struct pci_dev *pci, struct acp63_dev_data
+ case ACP63_PDM_DEV_MASK:
+ adata->pdm_dev_index = 0;
+ acp63_fill_platform_dev_info(&pdevinfo[0], parent, NULL, "acp_ps_pdm_dma",
+- 0, adata->res, 1, &adata->acp_lock,
+- sizeof(adata->acp_lock));
++ 0, adata->res, 1, NULL, 0);
+ acp63_fill_platform_dev_info(&pdevinfo[1], parent, NULL, "dmic-codec",
+ 0, NULL, 0, NULL, 0);
+ acp63_fill_platform_dev_info(&pdevinfo[2], parent, NULL, "acp_ps_mach",
+diff --git a/sound/soc/amd/ps/ps-pdm-dma.c b/sound/soc/amd/ps/ps-pdm-dma.c
+index 454dab062e4f5..527594aa9c113 100644
+--- a/sound/soc/amd/ps/ps-pdm-dma.c
++++ b/sound/soc/amd/ps/ps-pdm-dma.c
+@@ -361,12 +361,12 @@ static int acp63_pdm_audio_probe(struct platform_device *pdev)
+ {
+ struct resource *res;
+ struct pdm_dev_data *adata;
++ struct acp63_dev_data *acp_data;
++ struct device *parent;
+ int status;
+
+- if (!pdev->dev.platform_data) {
+- dev_err(&pdev->dev, "platform_data not retrieved\n");
+- return -ENODEV;
+- }
++ parent = pdev->dev.parent;
++ acp_data = dev_get_drvdata(parent);
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ if (!res) {
+ dev_err(&pdev->dev, "IORESOURCE_MEM FAILED\n");
+@@ -382,7 +382,7 @@ static int acp63_pdm_audio_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ adata->capture_stream = NULL;
+- adata->acp_lock = pdev->dev.platform_data;
++ adata->acp_lock = &acp_data->acp_lock;
+ dev_set_drvdata(&pdev->dev, adata);
+ status = devm_snd_soc_register_component(&pdev->dev,
+ &acp63_pdm_component,
+--
+2.39.2
+
--- /dev/null
+From e53dedeaa37081e26ec322988fd73b166bd9c9a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 16:46:05 +0100
+Subject: ASoC: codecs: wsa881x: do not set can_multi_write flag
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 6e7a6d4797ef521c0762914610ed682e102b9d36 ]
+
+regmap-sdw does not support multi register writes, so there is
+no point in setting this flag. This also leads to incorrect
+programming of WSA codecs with regmap_multi_reg_write() call.
+
+This invalid configuration should have been rejected by regmap-sdw.
+
+Fixes: a0aab9e1404a ("ASoC: codecs: add wsa881x amplifier support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230523154605.4284-2-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wsa881x.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wsa881x.c b/sound/soc/codecs/wsa881x.c
+index f709231b1277a..97f6873a0a8c7 100644
+--- a/sound/soc/codecs/wsa881x.c
++++ b/sound/soc/codecs/wsa881x.c
+@@ -645,7 +645,6 @@ static struct regmap_config wsa881x_regmap_config = {
+ .readable_reg = wsa881x_readable_register,
+ .reg_format_endian = REGMAP_ENDIAN_NATIVE,
+ .val_format_endian = REGMAP_ENDIAN_NATIVE,
+- .can_multi_write = true,
+ };
+
+ enum {
+--
+2.39.2
+
--- /dev/null
+From 5fe94b4d04b5a5f1e2579e20cd0130455d636eca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 May 2023 16:46:04 +0100
+Subject: ASoC: codecs: wsa883x: do not set can_multi_write flag
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 40ba0411074485e2cf1bf8ee0f3db27bdff88394 ]
+
+regmap-sdw does not support multi register writes, so there is
+no point in setting this flag. This also leads to incorrect
+programming of WSA codecs with regmap_multi_reg_write() call.
+
+This invalid configuration should have been rejected by regmap-sdw.
+
+Fixes: 43b8c7dc85a1 ("ASoC: codecs: add wsa883x amplifier support")
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20230523154605.4284-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wsa883x.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wsa883x.c b/sound/soc/codecs/wsa883x.c
+index c609cb63dae6d..e80b531435696 100644
+--- a/sound/soc/codecs/wsa883x.c
++++ b/sound/soc/codecs/wsa883x.c
+@@ -946,7 +946,6 @@ static struct regmap_config wsa883x_regmap_config = {
+ .writeable_reg = wsa883x_writeable_register,
+ .reg_format_endian = REGMAP_ENDIAN_NATIVE,
+ .val_format_endian = REGMAP_ENDIAN_NATIVE,
+- .can_multi_write = true,
+ .use_single_read = true,
+ };
+
+--
+2.39.2
+
--- /dev/null
+From 3f22c00a770d2fd3f51c528751a730ab82497728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 11:33:17 +0800
+Subject: ASoC: mediatek: mt8188: fix use-after-free in driver remove path
+
+From: Trevor Wu <trevor.wu@mediatek.com>
+
+[ Upstream commit fd67a7a1a22ce47fcbc094c4b6e164c34c652cbe ]
+
+During mt8188_afe_init_clock(), mt8188_audsys_clk_register() was called
+followed by several other devm functions. The caller of
+mt8188_afe_init_clock() utilized devm_add_action_or_reset() to call
+mt8188_afe_deinit_clock(). However, the order was incorrect, causing a
+use-after-free issue during remove time.
+
+At probe time, the order of calls was:
+1. mt8188_audsys_clk_register
+2. afe_priv->clk = devm_kcalloc
+3. afe_priv->clk[i] = devm_clk_get
+
+At remove time, the order of calls was:
+1. mt8188_audsys_clk_unregister
+3. free afe_priv->clk[i]
+2. free afe_priv->clk
+
+To resolve the problem, it's necessary to move devm_add_action_or_reset()
+to the appropriate position so that the remove order can be 3->2->1.
+
+Fixes: f6b026479b13 ("ASoC: mediatek: mt8188: support audio clock control")
+Signed-off-by: Trevor Wu <trevor.wu@mediatek.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230601033318.10408-2-trevor.wu@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8188/mt8188-afe-clk.c | 7 ---
+ sound/soc/mediatek/mt8188/mt8188-afe-clk.h | 1 -
+ sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 4 --
+ sound/soc/mediatek/mt8188/mt8188-audsys-clk.c | 47 ++++++++++---------
+ sound/soc/mediatek/mt8188/mt8188-audsys-clk.h | 1 -
+ 5 files changed, 24 insertions(+), 36 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c
+index 743d6a162cb9a..0fb97517f82c6 100644
+--- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c
++++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c
+@@ -418,13 +418,6 @@ int mt8188_afe_init_clock(struct mtk_base_afe *afe)
+ return 0;
+ }
+
+-void mt8188_afe_deinit_clock(void *priv)
+-{
+- struct mtk_base_afe *afe = priv;
+-
+- mt8188_audsys_clk_unregister(afe);
+-}
+-
+ int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk)
+ {
+ int ret;
+diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h
+index 084fdfb1d877a..a4203a87a1e35 100644
+--- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h
++++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h
+@@ -100,7 +100,6 @@ int mt8188_afe_get_mclk_source_clk_id(int sel);
+ int mt8188_afe_get_mclk_source_rate(struct mtk_base_afe *afe, int apll);
+ int mt8188_afe_get_default_mclk_source_by_rate(int rate);
+ int mt8188_afe_init_clock(struct mtk_base_afe *afe);
+-void mt8188_afe_deinit_clock(void *priv);
+ int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk);
+ void mt8188_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk);
+ int mt8188_afe_set_clk_rate(struct mtk_base_afe *afe, struct clk *clk,
+diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c
+index e8e84de865422..45ab6e2829b7a 100644
+--- a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c
++++ b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c
+@@ -3185,10 +3185,6 @@ static int mt8188_afe_pcm_dev_probe(struct platform_device *pdev)
+ if (ret)
+ return dev_err_probe(dev, ret, "init clock error");
+
+- ret = devm_add_action_or_reset(dev, mt8188_afe_deinit_clock, (void *)afe);
+- if (ret)
+- return ret;
+-
+ spin_lock_init(&afe_priv->afe_ctrl_lock);
+
+ mutex_init(&afe->irq_alloc_lock);
+diff --git a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c
+index be1c53bf47298..c796ad8b62eea 100644
+--- a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c
++++ b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c
+@@ -138,6 +138,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = {
+ GATE_AUD6(CLK_AUD_GASRC11, "aud_gasrc11", "top_asm_h", 11),
+ };
+
++static void mt8188_audsys_clk_unregister(void *data)
++{
++ struct mtk_base_afe *afe = data;
++ struct mt8188_afe_private *afe_priv = afe->platform_priv;
++ struct clk *clk;
++ struct clk_lookup *cl;
++ int i;
++
++ if (!afe_priv)
++ return;
++
++ for (i = 0; i < CLK_AUD_NR_CLK; i++) {
++ cl = afe_priv->lookup[i];
++ if (!cl)
++ continue;
++
++ clk = cl->clk;
++ clk_unregister_gate(clk);
++
++ clkdev_drop(cl);
++ }
++}
++
+ int mt8188_audsys_clk_register(struct mtk_base_afe *afe)
+ {
+ struct mt8188_afe_private *afe_priv = afe->platform_priv;
+@@ -179,27 +202,5 @@ int mt8188_audsys_clk_register(struct mtk_base_afe *afe)
+ afe_priv->lookup[i] = cl;
+ }
+
+- return 0;
+-}
+-
+-void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe)
+-{
+- struct mt8188_afe_private *afe_priv = afe->platform_priv;
+- struct clk *clk;
+- struct clk_lookup *cl;
+- int i;
+-
+- if (!afe_priv)
+- return;
+-
+- for (i = 0; i < CLK_AUD_NR_CLK; i++) {
+- cl = afe_priv->lookup[i];
+- if (!cl)
+- continue;
+-
+- clk = cl->clk;
+- clk_unregister_gate(clk);
+-
+- clkdev_drop(cl);
+- }
++ return devm_add_action_or_reset(afe->dev, mt8188_audsys_clk_unregister, afe);
+ }
+diff --git a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h
+index 6c5f463ad7e4d..45b0948c4a06e 100644
+--- a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h
++++ b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h
+@@ -10,6 +10,5 @@
+ #define _MT8188_AUDSYS_CLK_H_
+
+ int mt8188_audsys_clk_register(struct mtk_base_afe *afe);
+-void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe);
+
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 8ca845103e341135df43930354d255e962611718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 16:06:45 +0100
+Subject: ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback
+ returning void
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 6461fee68064ba970e3ba90241fe5f5e038aa9d4 ]
+
+The .remove() callback for a platform driver returns an int which makes
+many driver authors wrongly assume it's possible to do error handling by
+returning an error code. However the value returned is (mostly) ignored
+and this typically results in resource leaks. To improve here there is a
+quest to make the remove callback return void. In the first step of this
+quest all drivers are converted to .remove_new() which already returns
+void.
+
+Trivially convert this driver from always returning zero in the remove
+callback to the void returning variant.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Link: https://lore.kernel.org/r/20230315150745.67084-114-u.kleine-koenig@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Stable-dep-of: dc93f0dcb436 ("ASoC: mediatek: mt8195: fix use-after-free in driver remove path")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c
+index 72b2c6d629b93..9e45efeada55c 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c
++++ b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c
+@@ -3253,7 +3253,7 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+-static int mt8195_afe_pcm_dev_remove(struct platform_device *pdev)
++static void mt8195_afe_pcm_dev_remove(struct platform_device *pdev)
+ {
+ struct mtk_base_afe *afe = platform_get_drvdata(pdev);
+
+@@ -3264,7 +3264,6 @@ static int mt8195_afe_pcm_dev_remove(struct platform_device *pdev)
+ mt8195_afe_runtime_suspend(&pdev->dev);
+
+ mt8195_afe_deinit_clock(afe);
+- return 0;
+ }
+
+ static const struct of_device_id mt8195_afe_pcm_dt_match[] = {
+@@ -3285,7 +3284,7 @@ static struct platform_driver mt8195_afe_pcm_driver = {
+ .pm = &mt8195_afe_pm_ops,
+ },
+ .probe = mt8195_afe_pcm_dev_probe,
+- .remove = mt8195_afe_pcm_dev_remove,
++ .remove_new = mt8195_afe_pcm_dev_remove,
+ };
+
+ module_platform_driver(mt8195_afe_pcm_driver);
+--
+2.39.2
+
--- /dev/null
+From afe7de1febeb486a9a92c5fe7fcad644f8838fe0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 11:33:18 +0800
+Subject: ASoC: mediatek: mt8195: fix use-after-free in driver remove path
+
+From: Trevor Wu <trevor.wu@mediatek.com>
+
+[ Upstream commit dc93f0dcb436dfd24a06c5b3c0f4c5cd9296e8e5 ]
+
+During mt8195_afe_init_clock(), mt8195_audsys_clk_register() was called
+followed by several other devm functions. At mt8195_afe_deinit_clock()
+located at mt8195_afe_pcm_dev_remove(), mt8195_audsys_clk_unregister()
+was called.
+
+However, there was an issue with the order in which these functions were
+called. Specifically, the remove callback of platform_driver was called
+before devres released the resource, resulting in a use-after-free issue
+during remove time.
+
+At probe time, the order of calls was:
+1. mt8195_audsys_clk_register
+2. afe_priv->clk = devm_kcalloc
+3. afe_priv->clk[i] = devm_clk_get
+
+At remove time, the order of calls was:
+1. mt8195_audsys_clk_unregister
+3. free afe_priv->clk[i]
+2. free afe_priv->clk
+
+To resolve the problem, we can utilize devm_add_action_or_reset() in
+mt8195_audsys_clk_register() so that the remove order can be changed to
+3->2->1.
+
+Fixes: 6746cc858259 ("ASoC: mediatek: mt8195: add platform driver")
+Signed-off-by: Trevor Wu <trevor.wu@mediatek.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230601033318.10408-3-trevor.wu@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/mediatek/mt8195/mt8195-afe-clk.c | 5 --
+ sound/soc/mediatek/mt8195/mt8195-afe-clk.h | 1 -
+ sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 4 --
+ sound/soc/mediatek/mt8195/mt8195-audsys-clk.c | 47 ++++++++++---------
+ sound/soc/mediatek/mt8195/mt8195-audsys-clk.h | 1 -
+ 5 files changed, 24 insertions(+), 34 deletions(-)
+
+diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-clk.c b/sound/soc/mediatek/mt8195/mt8195-afe-clk.c
+index 9ca2cb8c8a9c2..f35318ae07392 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-afe-clk.c
++++ b/sound/soc/mediatek/mt8195/mt8195-afe-clk.c
+@@ -410,11 +410,6 @@ int mt8195_afe_init_clock(struct mtk_base_afe *afe)
+ return 0;
+ }
+
+-void mt8195_afe_deinit_clock(struct mtk_base_afe *afe)
+-{
+- mt8195_audsys_clk_unregister(afe);
+-}
+-
+ int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk)
+ {
+ int ret;
+diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-clk.h b/sound/soc/mediatek/mt8195/mt8195-afe-clk.h
+index 40663e31becd1..a08c0ee6c8602 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-afe-clk.h
++++ b/sound/soc/mediatek/mt8195/mt8195-afe-clk.h
+@@ -101,7 +101,6 @@ int mt8195_afe_get_mclk_source_clk_id(int sel);
+ int mt8195_afe_get_mclk_source_rate(struct mtk_base_afe *afe, int apll);
+ int mt8195_afe_get_default_mclk_source_by_rate(int rate);
+ int mt8195_afe_init_clock(struct mtk_base_afe *afe);
+-void mt8195_afe_deinit_clock(struct mtk_base_afe *afe);
+ int mt8195_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk);
+ void mt8195_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk);
+ int mt8195_afe_prepare_clk(struct mtk_base_afe *afe, struct clk *clk);
+diff --git a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c
+index 9e45efeada55c..03dabc056b916 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c
++++ b/sound/soc/mediatek/mt8195/mt8195-afe-pcm.c
+@@ -3255,15 +3255,11 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev)
+
+ static void mt8195_afe_pcm_dev_remove(struct platform_device *pdev)
+ {
+- struct mtk_base_afe *afe = platform_get_drvdata(pdev);
+-
+ snd_soc_unregister_component(&pdev->dev);
+
+ pm_runtime_disable(&pdev->dev);
+ if (!pm_runtime_status_suspended(&pdev->dev))
+ mt8195_afe_runtime_suspend(&pdev->dev);
+-
+- mt8195_afe_deinit_clock(afe);
+ }
+
+ static const struct of_device_id mt8195_afe_pcm_dt_match[] = {
+diff --git a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c
+index e0670e0dbd5b0..38594bc3f2f77 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c
++++ b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.c
+@@ -148,6 +148,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = {
+ GATE_AUD6(CLK_AUD_GASRC19, "aud_gasrc19", "top_asm_h", 19),
+ };
+
++static void mt8195_audsys_clk_unregister(void *data)
++{
++ struct mtk_base_afe *afe = data;
++ struct mt8195_afe_private *afe_priv = afe->platform_priv;
++ struct clk *clk;
++ struct clk_lookup *cl;
++ int i;
++
++ if (!afe_priv)
++ return;
++
++ for (i = 0; i < CLK_AUD_NR_CLK; i++) {
++ cl = afe_priv->lookup[i];
++ if (!cl)
++ continue;
++
++ clk = cl->clk;
++ clk_unregister_gate(clk);
++
++ clkdev_drop(cl);
++ }
++}
++
+ int mt8195_audsys_clk_register(struct mtk_base_afe *afe)
+ {
+ struct mt8195_afe_private *afe_priv = afe->platform_priv;
+@@ -188,27 +211,5 @@ int mt8195_audsys_clk_register(struct mtk_base_afe *afe)
+ afe_priv->lookup[i] = cl;
+ }
+
+- return 0;
+-}
+-
+-void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe)
+-{
+- struct mt8195_afe_private *afe_priv = afe->platform_priv;
+- struct clk *clk;
+- struct clk_lookup *cl;
+- int i;
+-
+- if (!afe_priv)
+- return;
+-
+- for (i = 0; i < CLK_AUD_NR_CLK; i++) {
+- cl = afe_priv->lookup[i];
+- if (!cl)
+- continue;
+-
+- clk = cl->clk;
+- clk_unregister_gate(clk);
+-
+- clkdev_drop(cl);
+- }
++ return devm_add_action_or_reset(afe->dev, mt8195_audsys_clk_unregister, afe);
+ }
+diff --git a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h
+index 239d31016ba76..69db2dd1c9e02 100644
+--- a/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h
++++ b/sound/soc/mediatek/mt8195/mt8195-audsys-clk.h
+@@ -10,6 +10,5 @@
+ #define _MT8195_AUDSYS_CLK_H_
+
+ int mt8195_audsys_clk_register(struct mtk_base_afe *afe);
+-void mt8195_audsys_clk_unregister(struct mtk_base_afe *afe);
+
+ #endif
+--
+2.39.2
+
--- /dev/null
+From 9bcf748afa9f316ce25d6738d620c08ad675ab29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 19:19:35 -0600
+Subject: ASoC: simple-card-utils: fix PCM constraint error check
+
+From: Robert Hancock <robert.hancock@calian.com>
+
+[ Upstream commit 635071f5fee31550e921644b2becc42b3ff1036c ]
+
+The code in asoc_simple_startup was treating any non-zero return from
+snd_pcm_hw_constraint_minmax as an error, when this can return 1 in some
+normal cases and only negative values indicate an error.
+
+When this happened, it caused asoc_simple_startup to disable the clocks
+it just enabled and return 1, which was not treated as an error by the
+calling code which only checks for negative return values. Then when the
+PCM is eventually shut down, it causes the clock framework to complain
+about disabling clocks that were not enabled.
+
+Fix the check for snd_pcm_hw_constraint_minmax return value to only
+treat negative values as an error.
+
+Fixes: 5ca2ab459817 ("ASoC: simple-card-utils: Add new system-clock-fixed flag")
+Signed-off-by: Robert Hancock <robert.hancock@calian.com>
+Link: https://lore.kernel.org/r/20230602011936.231931-1-robert.hancock@calian.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card-utils.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
+index 56552a616f21f..1f24344846ae9 100644
+--- a/sound/soc/generic/simple-card-utils.c
++++ b/sound/soc/generic/simple-card-utils.c
+@@ -314,7 +314,7 @@ int asoc_simple_startup(struct snd_pcm_substream *substream)
+ }
+ ret = snd_pcm_hw_constraint_minmax(substream->runtime, SNDRV_PCM_HW_PARAM_RATE,
+ fixed_rate, fixed_rate);
+- if (ret)
++ if (ret < 0)
+ goto codec_err;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From d62c3ed793af09d7f654fb1b81f0b2fd0b960928 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 May 2023 18:12:27 -0400
+Subject: blk-mq: fix blk_mq_hw_ctx active request accounting
+
+From: Tian Lan <tian.lan@twosigma.com>
+
+[ Upstream commit ddad59331a4e16088468ca0ad228a9fe32d7955a ]
+
+The nr_active counter continues to increase over time which causes the
+blk_mq_get_tag to hang until the thread is rescheduled to a different
+core despite there are still tags available.
+
+kernel-stack
+
+ INFO: task inboundIOReacto:3014879 blocked for more than 2 seconds
+ Not tainted 6.1.15-amd64 #1 Debian 6.1.15~debian11
+ "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ task:inboundIOReacto state:D stack:0 pid:3014879 ppid:4557 flags:0x00000000
+ Call Trace:
+ <TASK>
+ __schedule+0x351/0xa20
+ scheduler+0x5d/0xe0
+ io_schedule+0x42/0x70
+ blk_mq_get_tag+0x11a/0x2a0
+ ? dequeue_task_stop+0x70/0x70
+ __blk_mq_alloc_requests+0x191/0x2e0
+
+kprobe output showing RQF_MQ_INFLIGHT bit is not cleared before
+__blk_mq_free_request being called.
+
+ 320 320 kworker/29:1H __blk_mq_free_request rq_flags 0x220c0 in-flight 1
+ b'__blk_mq_free_request+0x1 [kernel]'
+ b'bt_iter+0x50 [kernel]'
+ b'blk_mq_queue_tag_busy_iter+0x318 [kernel]'
+ b'blk_mq_timeout_work+0x7c [kernel]'
+ b'process_one_work+0x1c4 [kernel]'
+ b'worker_thread+0x4d [kernel]'
+ b'kthread+0xe6 [kernel]'
+ b'ret_from_fork+0x1f [kernel]'
+
+Signed-off-by: Tian Lan <tian.lan@twosigma.com>
+Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20230513221227.497327-1-tilan7663@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index ae08c4936743d..f2e2ffd135baf 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -717,6 +717,10 @@ static void __blk_mq_free_request(struct request *rq)
+ blk_crypto_free_request(rq);
+ blk_pm_mark_last_busy(rq);
+ rq->mq_hctx = NULL;
++
++ if (rq->rq_flags & RQF_MQ_INFLIGHT)
++ __blk_mq_dec_active_requests(hctx);
++
+ if (rq->tag != BLK_MQ_NO_TAG)
+ blk_mq_put_tag(hctx->tags, ctx, rq->tag);
+ if (sched_tag != BLK_MQ_NO_TAG)
+@@ -728,15 +732,11 @@ static void __blk_mq_free_request(struct request *rq)
+ void blk_mq_free_request(struct request *rq)
+ {
+ struct request_queue *q = rq->q;
+- struct blk_mq_hw_ctx *hctx = rq->mq_hctx;
+
+ if ((rq->rq_flags & RQF_ELVPRIV) &&
+ q->elevator->type->ops.finish_request)
+ q->elevator->type->ops.finish_request(rq);
+
+- if (rq->rq_flags & RQF_MQ_INFLIGHT)
+- __blk_mq_dec_active_requests(hctx);
+-
+ if (unlikely(laptop_mode && !blk_rq_is_passthrough(rq)))
+ laptop_io_completion(q->disk->bdi);
+
+--
+2.39.2
+
--- /dev/null
+From f6f24af6bbcc71e6089c58d9c4ae341fe4c30f6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Jun 2023 19:54:24 -0700
+Subject: eeprom: at24: also select REGMAP
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 7f3c782b3914e510b646a77aedc3adeac2e4a63b ]
+
+Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors,
+so also select REGMAP to prevent the build errors.
+
+../drivers/misc/eeprom/at24.c:540:42: warning: 'struct regmap_config' declared inside parameter list will not be visible outside of this definition or declaration
+ 540 | struct regmap_config *regmap_config)
+../drivers/misc/eeprom/at24.c: In function 'at24_make_dummy_client':
+../drivers/misc/eeprom/at24.c:552:18: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration]
+ 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config);
+../drivers/misc/eeprom/at24.c:552:16: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ 552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config);
+../drivers/misc/eeprom/at24.c: In function 'at24_probe':
+../drivers/misc/eeprom/at24.c:586:16: error: variable 'regmap_config' has initializer but incomplete type
+ 586 | struct regmap_config regmap_config = { };
+../drivers/misc/eeprom/at24.c:586:30: error: storage size of 'regmap_config' isn't known
+ 586 | struct regmap_config regmap_config = { };
+../drivers/misc/eeprom/at24.c:586:30: warning: unused variable 'regmap_config' [-Wunused-variable]
+
+Fixes: 5c015258478e ("eeprom: at24: add basic regmap_i2c support")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/eeprom/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig
+index f0a7531f354c1..2d240bfa819f8 100644
+--- a/drivers/misc/eeprom/Kconfig
++++ b/drivers/misc/eeprom/Kconfig
+@@ -6,6 +6,7 @@ config EEPROM_AT24
+ depends on I2C && SYSFS
+ select NVMEM
+ select NVMEM_SYSFS
++ select REGMAP
+ select REGMAP_I2C
+ help
+ Enable this driver to get read/write support to most I2C EEPROMs
+--
+2.39.2
+
--- /dev/null
+From 1ea6fd9c445933871870f125d26e28a685e68d20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Jun 2023 16:07:49 +0200
+Subject: firmware: arm_ffa: Set handle field to zero in memory descriptor
+
+From: Balint Dobszay <balint.dobszay@arm.com>
+
+[ Upstream commit 3aa0519a4780f1b8e11966bd879d4a2934ba455f ]
+
+As described in the commit 111a833dc5cb ("firmware: arm_ffa: Set
+reserved/MBZ fields to zero in the memory descriptors") some fields in
+the memory descriptor have to be zeroed explicitly. The handle field is
+one of these, but it was left out from that change, fix this now.
+
+Fixes: 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors")
+Reported-by: Imre Kis <imre.kis@arm.com>
+Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
+Link: https://lore.kernel.org/r/20230601140749.93812-1-balint.dobszay@arm.com
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_ffa/driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
+index e234091386671..2109cd178ff70 100644
+--- a/drivers/firmware/arm_ffa/driver.c
++++ b/drivers/firmware/arm_ffa/driver.c
+@@ -424,6 +424,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize,
+ ep_mem_access->flag = 0;
+ ep_mem_access->reserved = 0;
+ }
++ mem_region->handle = 0;
+ mem_region->reserved_0 = 0;
+ mem_region->reserved_1 = 0;
+ mem_region->ep_count = args->nattrs;
+--
+2.39.2
+
--- /dev/null
+From 0bdc39f2ad16b2f61dcc48d64f8cb4f55cefbde3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Jun 2023 20:00:34 +0800
+Subject: gpio: sim: fix memory corruption when adding named lines and unnamed
+ hogs
+
+From: Kent Gibson <warthog618@gmail.com>
+
+[ Upstream commit 95ae9979bfe3174c2ee8d64409c44532f2881907 ]
+
+When constructing the sim, gpio-sim constructs an array of named lines,
+sized based on the largest offset of any named line, and then initializes
+that array with the names of all lines, including unnamed hogs with higher
+offsets. In doing so it writes NULLs beyond the extent of the array.
+
+Add a check that only named lines are used to initialize the array.
+
+Fixes: cb8c474e79be ("gpio: sim: new testing module")
+Signed-off-by: Kent Gibson<warthog618@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-sim.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-sim.c b/drivers/gpio/gpio-sim.c
+index e5dfd636c63c1..09aa0b64859b4 100644
+--- a/drivers/gpio/gpio-sim.c
++++ b/drivers/gpio/gpio-sim.c
+@@ -721,8 +721,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank,
+ if (!line_names)
+ return ERR_PTR(-ENOMEM);
+
+- list_for_each_entry(line, &bank->line_list, siblings)
+- line_names[line->offset] = line->name;
++ list_for_each_entry(line, &bank->line_list, siblings) {
++ if (line->name && (line->offset <= max_offset))
++ line_names[line->offset] = line->name;
++ }
+
+ return line_names;
+ }
+--
+2.39.2
+
--- /dev/null
+From e109f83f2fa777a5ee21367e88024f6c5b48d096 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 May 2023 14:19:40 +0200
+Subject: i2c: mv64xxx: Fix reading invalid status value in atomic mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit 5578d0a79b6430fa1543640dd6f2d397d0886ce7 ]
+
+There seems to be a bug within the mv64xxx I2C controller, wherein the
+status register may not necessarily contain valid value immediately
+after the IFLG flag is set in the control register.
+
+My theory is that the controller:
+- first sets the IFLG in control register
+- then updates the status register
+- then raises an interrupt
+
+This may sometime cause weird bugs when in atomic mode, since in this
+mode we do not wait for an interrupt, but instead we poll the control
+register for IFLG and read status register immediately after.
+
+I encountered -ENXIO from mv64xxx_i2c_fsm() due to this issue when using
+this driver in atomic mode.
+
+Note that I've only seen this issue on Armada 385, I don't know whether
+other SOCs with this controller are also affected. Also note that this
+fix has been in U-Boot for over 4 years [1] without anybody complaining,
+so it should not cause regressions.
+
+[1] https://source.denx.de/u-boot/u-boot/-/commit/d50e29662f78
+
+Fixes: 544a8d75f3d6 ("i2c: mv64xxx: Add atomic_xfer method to driver")
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-mv64xxx.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
+index 047dfef7a6577..878c076ebdc6b 100644
+--- a/drivers/i2c/busses/i2c-mv64xxx.c
++++ b/drivers/i2c/busses/i2c-mv64xxx.c
+@@ -520,6 +520,17 @@ mv64xxx_i2c_intr(int irq, void *dev_id)
+
+ while (readl(drv_data->reg_base + drv_data->reg_offsets.control) &
+ MV64XXX_I2C_REG_CONTROL_IFLG) {
++ /*
++ * It seems that sometime the controller updates the status
++ * register only after it asserts IFLG in control register.
++ * This may result in weird bugs when in atomic mode. A delay
++ * of 100 ns before reading the status register solves this
++ * issue. This bug does not seem to appear when using
++ * interrupts.
++ */
++ if (drv_data->atomic)
++ ndelay(100);
++
+ status = readl(drv_data->reg_base + drv_data->reg_offsets.status);
+ mv64xxx_i2c_fsm(drv_data, status);
+ mv64xxx_i2c_do_action(drv_data);
+--
+2.39.2
+
--- /dev/null
+From 18442eb5a6135d85010cf5c3bc39fac14939e5fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Mar 2023 10:58:19 +0100
+Subject: i2c: sprd: Delete i2c adapter in .remove's error path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit ca0aa17f2db3468fd017038d23a78e17388e2f67 ]
+
+If pm runtime resume fails the .remove callback used to exit early. This
+resulted in an error message by the driver core but the device gets
+removed anyhow. This lets the registered i2c adapter stay around with an
+unbound parent device.
+
+So only skip clk disabling if resume failed, but do delete the adapter.
+
+Fixes: 8b9ec0719834 ("i2c: Add Spreadtrum I2C controller driver")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-sprd.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c
+index 4fe15cd78907e..ffc54fbf814dd 100644
+--- a/drivers/i2c/busses/i2c-sprd.c
++++ b/drivers/i2c/busses/i2c-sprd.c
+@@ -576,12 +576,14 @@ static int sprd_i2c_remove(struct platform_device *pdev)
+ struct sprd_i2c *i2c_dev = platform_get_drvdata(pdev);
+ int ret;
+
+- ret = pm_runtime_resume_and_get(i2c_dev->dev);
++ ret = pm_runtime_get_sync(i2c_dev->dev);
+ if (ret < 0)
+- return ret;
++ dev_err(&pdev->dev, "Failed to resume device (%pe)\n", ERR_PTR(ret));
+
+ i2c_del_adapter(&i2c_dev->adap);
+- clk_disable_unprepare(i2c_dev->clk);
++
++ if (ret >= 0)
++ clk_disable_unprepare(i2c_dev->clk);
+
+ pm_runtime_put_noidle(i2c_dev->dev);
+ pm_runtime_disable(i2c_dev->dev);
+--
+2.39.2
+
--- /dev/null
+From fe1341e6d2e935fd3c42691b4bc8c8dd8f61f666 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 May 2023 15:29:10 +0800
+Subject: riscv: fix kprobe __user string arg print fault issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ruan Jinjie <ruanjinjie@huawei.com>
+
+[ Upstream commit 99a670b2069c725a7b50318aa681d9cae8f89325 ]
+
+On riscv qemu platform, when add kprobe event on do_sys_open() to show
+filename string arg, it just print fault as follow:
+
+echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3
+mode=$arg4' > kprobe_events
+
+bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84)
+dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
+
+bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84)
+dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
+
+bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84)
+dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0
+
+As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE,
+the +0($arg2) addr is processed as a kernel address though it is a
+userspace address, cause the above filename=(fault) print. So select
+ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the
+kprobe trace is ok as below:
+
+bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84)
+dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
+
+bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84)
+dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
+
+bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84)
+dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/"
+flags=0x98800 mode=0x0
+
+Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com>
+Acked-by: Björn Töpel <bjorn@rivosinc.com>
+Fixes: 0ebeea8ca8a4 ("bpf: Restrict bpf_probe_read{, str}() only to archs where they work")
+Link: https://lore.kernel.org/r/20230504072910.3742842-1-ruanjinjie@huawei.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
+index eb7f29a412f87..b462ed7d41fe1 100644
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -25,6 +25,7 @@ config RISCV
+ select ARCH_HAS_GIGANTIC_PAGE
+ select ARCH_HAS_KCOV
+ select ARCH_HAS_MMIOWB
++ select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
+ select ARCH_HAS_PMEM_API
+ select ARCH_HAS_PTE_SPECIAL
+ select ARCH_HAS_SET_DIRECT_MAP if MMU
+--
+2.39.2
+
--- /dev/null
+From 39e88c7b8e3250bd4d518e50dd0f988db42b6b32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Apr 2023 18:28:28 +0800
+Subject: riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable
+
+From: Hsieh-Tseng Shen <woodrow.shen@sifive.com>
+
+[ Upstream commit 6569fc12e442ea973d96db39e542aa19a7bc3a79 ]
+
+Commit 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ")
+allows riscv to use mmap with PROT_WRITE only, and meanwhile mmap with w+x
+is also permitted. However, when userspace tries to access this page with
+PROT_WRITE|PROT_EXEC, which causes infinite loop at load page fault as
+well as it triggers soft lockup. According to riscv privileged spec,
+"Writable pages must also be marked readable". The fix to drop the
+`PAGE_COPY_READ_EXEC` and then `PAGE_COPY_EXEC` would be just used instead.
+This aligns the other arches (i.e arm64) for protection_map.
+
+Fixes: 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ")
+Signed-off-by: Hsieh-Tseng Shen <woodrow.shen@sifive.com>
+Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
+Link: https://lore.kernel.org/r/20230425102828.1616812-1-woodrow.shen@sifive.com
+Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/pgtable.h | 3 +--
+ arch/riscv/mm/init.c | 2 +-
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
+index f641837ccf31d..05eda3281ba90 100644
+--- a/arch/riscv/include/asm/pgtable.h
++++ b/arch/riscv/include/asm/pgtable.h
+@@ -165,8 +165,7 @@ extern struct pt_alloc_ops pt_ops __initdata;
+ _PAGE_EXEC | _PAGE_WRITE)
+
+ #define PAGE_COPY PAGE_READ
+-#define PAGE_COPY_EXEC PAGE_EXEC
+-#define PAGE_COPY_READ_EXEC PAGE_READ_EXEC
++#define PAGE_COPY_EXEC PAGE_READ_EXEC
+ #define PAGE_SHARED PAGE_WRITE
+ #define PAGE_SHARED_EXEC PAGE_WRITE_EXEC
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index dc1793bf01796..309d685d70267 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -286,7 +286,7 @@ static const pgprot_t protection_map[16] = {
+ [VM_EXEC] = PAGE_EXEC,
+ [VM_EXEC | VM_READ] = PAGE_READ_EXEC,
+ [VM_EXEC | VM_WRITE] = PAGE_COPY_EXEC,
+- [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_READ_EXEC,
++ [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_EXEC,
+ [VM_SHARED] = PAGE_NONE,
+ [VM_SHARED | VM_READ] = PAGE_READ,
+ [VM_SHARED | VM_WRITE] = PAGE_SHARED,
+--
+2.39.2
+
usb-usbfs-use-consistent-mmap-functions.patch
mm-page_table_check-make-it-dependent-on-exclusive_system_ram.patch
mm-page_table_check-ensure-user-pages-are-not-slab-pages.patch
+soc-qcom-rpmh-rsc-drop-redundant-unsigned-0-comparis.patch
+arm64-dts-qcom-sc8280xp-flush-rsc-sleep-wake-votes.patch
+arm64-dts-qcom-sm6375-pdx225-fix-remoteproc-firmware.patch
+arm-at91-pm-fix-imbalanced-reference-counter-for-eth.patch
+arm-dts-at91-sama7g5ek-fix-debounce-delay-property-f.patch
+asoc-codecs-wsa883x-do-not-set-can_multi_write-flag.patch
+asoc-codecs-wsa881x-do-not-set-can_multi_write-flag.patch
+soc-qcom-ramp_controller-fix-an-error-handling-path-.patch
+soc-qcom-rmtfs-fix-error-code-in-probe.patch
+arm64-dts-qcom-sc7180-lite-fix-sdram-freq-for-miside.patch
+arm64-dts-imx8qm-mek-correct-gpios-for-usdhc2-cd-and.patch
+arm64-dts-imx8-ss-dma-assign-default-clock-rate-for-.patch
+asoc-amd-ps-fix-for-acp_lock-access-in-pdm-driver.patch
+asoc-mediatek-mt8188-fix-use-after-free-in-driver-re.patch
+asoc-mediatek-mt8195-afe-pcm-convert-to-platform-rem.patch
+asoc-mediatek-mt8195-fix-use-after-free-in-driver-re.patch
+asoc-simple-card-utils-fix-pcm-constraint-error-chec.patch
+blk-mq-fix-blk_mq_hw_ctx-active-request-accounting.patch
+arm64-dts-imx8mn-beacon-fix-spi-cs-pinmux.patch
+i2c-mv64xxx-fix-reading-invalid-status-value-in-atom.patch
+firmware-arm_ffa-set-handle-field-to-zero-in-memory-.patch
+gpio-sim-fix-memory-corruption-when-adding-named-lin.patch
+i2c-sprd-delete-i2c-adapter-in-.remove-s-error-path.patch
+riscv-mm-ensure-prot-of-vm_write-and-vm_exec-must-be.patch
+eeprom-at24-also-select-regmap.patch
+soundwire-stream-add-missing-clear-of-alloc_slave_rt.patch
+riscv-fix-kprobe-__user-string-arg-print-fault-issue.patch
+vduse-avoid-empty-string-for-dev-name.patch
+vdpa-mlx5-fix-hang-when-cvq-commands-are-triggered-d.patch
+vhost-support-packed-when-setting-getting-vring_base.patch
+vhost_vdpa-support-packed-when-setting-getting-vring.patch
--- /dev/null
+From 11942cb868dac91ee2fe2e48b677ef62701ace7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Apr 2023 00:29:35 +0200
+Subject: soc: qcom: ramp_controller: Fix an error handling path in
+ qcom_ramp_controller_probe()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b3d0dcc8e359cf5d57fb6308bc9750af5da574b3 ]
+
+'qrc' is known to be non-NULL at this point.
+Checking for 'qrc->desc' was expected instead, so use it.
+
+Fixes: a723c95fa137 ("soc: qcom: Add Qualcomm Ramp Controller driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/84727a79d0261b4112411aec23b553504015c02c.1681684138.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/ramp_controller.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/ramp_controller.c b/drivers/soc/qcom/ramp_controller.c
+index dc74d2a19de2b..5e3ba0be09035 100644
+--- a/drivers/soc/qcom/ramp_controller.c
++++ b/drivers/soc/qcom/ramp_controller.c
+@@ -296,7 +296,7 @@ static int qcom_ramp_controller_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ qrc->desc = device_get_match_data(&pdev->dev);
+- if (!qrc)
++ if (!qrc->desc)
+ return -EINVAL;
+
+ qrc->regmap = devm_regmap_init_mmio(&pdev->dev, base, &qrc_regmap_config);
+--
+2.39.2
+
--- /dev/null
+From 5d8d99d239292800c0f2fbd12c09bfaa71271ee1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Apr 2023 13:44:21 +0300
+Subject: soc: qcom: rmtfs: Fix error code in probe()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 7b374a2fc8665bfb8a0d93b617463cc0732f533a ]
+
+Return an error code if of_property_count_u32_elems() fails. Don't
+return success.
+
+Fixes: e656cd0bcf3d ("soc: qcom: rmtfs: Optionally map RMTFS to more VMs")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/76b21a14-70ff-4ca9-927d-587543c6699c@kili.mountain
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rmtfs_mem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
+index 0d31377f178d5..d4bda086c141a 100644
+--- a/drivers/soc/qcom/rmtfs_mem.c
++++ b/drivers/soc/qcom/rmtfs_mem.c
+@@ -234,6 +234,7 @@ static int qcom_rmtfs_mem_probe(struct platform_device *pdev)
+ num_vmids = 0;
+ } else if (num_vmids < 0) {
+ dev_err(&pdev->dev, "failed to count qcom,vmid elements: %d\n", num_vmids);
++ ret = num_vmids;
+ goto remove_cdev;
+ } else if (num_vmids > NUM_MAX_VMIDS) {
+ dev_warn(&pdev->dev,
+--
+2.39.2
+
--- /dev/null
+From a7ac150caf539969db0b92ede906decf09c02cef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 May 2023 13:29:13 +0200
+Subject: soc: qcom: rpmh-rsc: drop redundant unsigned >=0 comparision
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+[ Upstream commit 3395d36e6805786c26d13188735bc796b9d7a7c9 ]
+
+Unsigned int "minor" is always >= 0 as reported by Smatch:
+
+ drivers/soc/qcom/rpmh-rsc.c:1076 rpmh_rsc_probe() warn: always true condition '(drv->ver.minor >= 0) => (0-u32max >= 0)'
+
+Fixes: 88704a0cd719 ("soc: qcom: rpmh-rsc: Support RSC v3 minor versions")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230513112913.176009-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/qcom/rpmh-rsc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/qcom/rpmh-rsc.c b/drivers/soc/qcom/rpmh-rsc.c
+index f93544f6d7961..0dd4363ebac8f 100644
+--- a/drivers/soc/qcom/rpmh-rsc.c
++++ b/drivers/soc/qcom/rpmh-rsc.c
+@@ -1073,7 +1073,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev)
+ drv->ver.minor = rsc_id & (MINOR_VER_MASK << MINOR_VER_SHIFT);
+ drv->ver.minor >>= MINOR_VER_SHIFT;
+
+- if (drv->ver.major == 3 && drv->ver.minor >= 0)
++ if (drv->ver.major == 3)
+ drv->regs = rpmh_rsc_reg_offset_ver_3_0;
+ else
+ drv->regs = rpmh_rsc_reg_offset_ver_2_7;
+--
+2.39.2
+
--- /dev/null
+From 222d9b5b220a573cb884f53893977876461c19fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Jun 2023 11:11:36 +0100
+Subject: soundwire: stream: Add missing clear of alloc_slave_rt
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 58d95889f3c2064c6139ee94bb0e4d86e1ad4eab ]
+
+The current path that skips allocating the slave runtime does not clear
+the alloc_slave_rt flag, this is clearly incorrect. Add the missing
+clear, so the runtime won't be erroneously cleaned up.
+
+Fixes: f3016b891c8c ("soundwire: stream: sdw_stream_add_ functions can be called multiple times")
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20230602101140.2040141-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/stream.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
+index 8c6da1739e3d1..3c909853aaf89 100644
+--- a/drivers/soundwire/stream.c
++++ b/drivers/soundwire/stream.c
+@@ -2019,8 +2019,10 @@ int sdw_stream_add_slave(struct sdw_slave *slave,
+
+ skip_alloc_master_rt:
+ s_rt = sdw_slave_rt_find(slave, stream);
+- if (s_rt)
++ if (s_rt) {
++ alloc_slave_rt = false;
+ goto skip_alloc_slave_rt;
++ }
+
+ s_rt = sdw_slave_rt_alloc(slave, m_rt);
+ if (!s_rt) {
+--
+2.39.2
+
--- /dev/null
+From c0c5a4493604c3929db950e46f9acebf598b7413 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 May 2023 12:58:01 +0300
+Subject: vdpa/mlx5: Fix hang when cvq commands are triggered during device
+ unregister
+
+From: Dragos Tatulea <dtatulea@nvidia.com>
+
+[ Upstream commit 73790bdfba076c0886f0f14fd46ff2c70ee31ce9 ]
+
+Currently the vdpa device is unregistered after the workqueue that
+processes vq commands is disabled. However, the device unregister
+process can still send commands to the cvq (a vlan delete for example)
+which leads to a hang because the handing workqueue has been disabled
+and the command never finishes:
+
+ [ 2263.095764] rcu: INFO: rcu_sched self-detected stall on CPU
+ [ 2263.096307] rcu: 9-....: (5250 ticks this GP) idle=dac4/1/0x4000000000000000 softirq=111009/111009 fqs=2544
+ [ 2263.097154] rcu: (t=5251 jiffies g=393549 q=347 ncpus=10)
+ [ 2263.097648] CPU: 9 PID: 94300 Comm: kworker/u20:2 Not tainted 6.3.0-rc6_for_upstream_min_debug_2023_04_14_00_02 #1
+ [ 2263.098535] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+ [ 2263.099481] Workqueue: mlx5_events mlx5_vhca_state_work_handler [mlx5_core]
+ [ 2263.100143] RIP: 0010:virtnet_send_command+0x109/0x170
+ [ 2263.100621] Code: 1d df f5 ff 85 c0 78 5c 48 8b 7b 08 e8 d0 c5 f5 ff 84 c0 75 11 eb 22 48 8b 7b 08 e8 01 b7 f5 ff 84 c0 75 15 f3 90 48 8b 7b 08 <48> 8d 74 24 04 e8 8d c5 f5 ff 48 85 c0 74 de 48 8b 83 f8 00 00 00
+ [ 2263.102148] RSP: 0018:ffff888139cf36e8 EFLAGS: 00000246
+ [ 2263.102624] RAX: 0000000000000000 RBX: ffff888166bea940 RCX: 0000000000000001
+ [ 2263.103244] RDX: 0000000000000000 RSI: ffff888139cf36ec RDI: ffff888146763800
+ [ 2263.103864] RBP: ffff888139cf3710 R08: ffff88810d201000 R09: 0000000000000000
+ [ 2263.104473] R10: 0000000000000002 R11: 0000000000000003 R12: 0000000000000002
+ [ 2263.105082] R13: 0000000000000002 R14: ffff888114528400 R15: ffff888166bea000
+ [ 2263.105689] FS: 0000000000000000(0000) GS:ffff88852cc80000(0000) knlGS:0000000000000000
+ [ 2263.106404] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 2263.106925] CR2: 00007f31f394b000 CR3: 000000010615b006 CR4: 0000000000370ea0
+ [ 2263.107542] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [ 2263.108163] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [ 2263.108769] Call Trace:
+ [ 2263.109059] <TASK>
+ [ 2263.109320] ? check_preempt_wakeup+0x11f/0x230
+ [ 2263.109750] virtnet_vlan_rx_kill_vid+0x5a/0xa0
+ [ 2263.110180] vlan_vid_del+0x9c/0x170
+ [ 2263.110546] vlan_device_event+0x351/0x760 [8021q]
+ [ 2263.111004] raw_notifier_call_chain+0x41/0x60
+ [ 2263.111426] dev_close_many+0xcb/0x120
+ [ 2263.111808] unregister_netdevice_many_notify+0x130/0x770
+ [ 2263.112297] ? wq_worker_running+0xa/0x30
+ [ 2263.112688] unregister_netdevice_queue+0x89/0xc0
+ [ 2263.113128] unregister_netdev+0x18/0x20
+ [ 2263.113512] virtnet_remove+0x4f/0x230
+ [ 2263.113885] virtio_dev_remove+0x31/0x70
+ [ 2263.114273] device_release_driver_internal+0x18f/0x1f0
+ [ 2263.114746] bus_remove_device+0xc6/0x130
+ [ 2263.115146] device_del+0x173/0x3c0
+ [ 2263.115502] ? kernfs_find_ns+0x35/0xd0
+ [ 2263.115895] device_unregister+0x1a/0x60
+ [ 2263.116279] unregister_virtio_device+0x11/0x20
+ [ 2263.116706] device_release_driver_internal+0x18f/0x1f0
+ [ 2263.117182] bus_remove_device+0xc6/0x130
+ [ 2263.117576] device_del+0x173/0x3c0
+ [ 2263.117929] ? vdpa_dev_remove+0x20/0x20 [vdpa]
+ [ 2263.118364] device_unregister+0x1a/0x60
+ [ 2263.118752] mlx5_vdpa_dev_del+0x4c/0x80 [mlx5_vdpa]
+ [ 2263.119232] vdpa_match_remove+0x21/0x30 [vdpa]
+ [ 2263.119663] bus_for_each_dev+0x71/0xc0
+ [ 2263.120054] vdpa_mgmtdev_unregister+0x57/0x70 [vdpa]
+ [ 2263.120520] mlx5v_remove+0x12/0x20 [mlx5_vdpa]
+ [ 2263.120953] auxiliary_bus_remove+0x18/0x30
+ [ 2263.121356] device_release_driver_internal+0x18f/0x1f0
+ [ 2263.121830] bus_remove_device+0xc6/0x130
+ [ 2263.122223] device_del+0x173/0x3c0
+ [ 2263.122581] ? devl_param_driverinit_value_get+0x29/0x90
+ [ 2263.123070] mlx5_rescan_drivers_locked+0xc4/0x2d0 [mlx5_core]
+ [ 2263.123633] mlx5_unregister_device+0x54/0x80 [mlx5_core]
+ [ 2263.124169] mlx5_uninit_one+0x54/0x150 [mlx5_core]
+ [ 2263.124656] mlx5_sf_dev_remove+0x45/0x90 [mlx5_core]
+ [ 2263.125153] auxiliary_bus_remove+0x18/0x30
+ [ 2263.125560] device_release_driver_internal+0x18f/0x1f0
+ [ 2263.126052] bus_remove_device+0xc6/0x130
+ [ 2263.126451] device_del+0x173/0x3c0
+ [ 2263.126815] mlx5_sf_dev_remove+0x39/0xf0 [mlx5_core]
+ [ 2263.127318] mlx5_sf_dev_state_change_handler+0x178/0x270 [mlx5_core]
+ [ 2263.127920] blocking_notifier_call_chain+0x5a/0x80
+ [ 2263.128379] mlx5_vhca_state_work_handler+0x151/0x200 [mlx5_core]
+ [ 2263.128951] process_one_work+0x1bb/0x3c0
+ [ 2263.129355] ? process_one_work+0x3c0/0x3c0
+ [ 2263.129766] worker_thread+0x4d/0x3c0
+ [ 2263.130140] ? process_one_work+0x3c0/0x3c0
+ [ 2263.130548] kthread+0xb9/0xe0
+ [ 2263.130895] ? kthread_complete_and_exit+0x20/0x20
+ [ 2263.131349] ret_from_fork+0x1f/0x30
+ [ 2263.131717] </TASK>
+
+The fix is to disable and destroy the workqueue after the device
+unregister. It is expected that vhost will not trigger kicks after
+the unregister. But even if it would, the wq is disabled already by
+setting the pointer to NULL (done so in the referenced commit).
+
+Fixes: ad6dc1daaf29 ("vdpa/mlx5: Avoid processing works if workqueue was destroyed")
+Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
+Message-Id: <20230516095800.3549932-1-dtatulea@nvidia.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+index 97a16f7eb8941..0b228fbb2a68b 100644
+--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c
++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c
+@@ -3323,10 +3323,10 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *
+ mlx5_vdpa_remove_debugfs(ndev->debugfs);
+ ndev->debugfs = NULL;
+ unregister_link_notifier(ndev);
++ _vdpa_unregister_device(dev);
+ wq = mvdev->wq;
+ mvdev->wq = NULL;
+ destroy_workqueue(wq);
+- _vdpa_unregister_device(dev);
+ mgtdev->ndev = NULL;
+ }
+
+--
+2.39.2
+
--- /dev/null
+From de71f4532ada2ebd862a83d142dbd9ca4ba04a89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 May 2023 11:36:26 +0800
+Subject: vduse: avoid empty string for dev name
+
+From: Sheng Zhao <sheng.zhao@bytedance.com>
+
+[ Upstream commit a90e8608eb0ed93d31ac0feb055f77ce59512542 ]
+
+Syzkaller hits a kernel WARN when the first character of the dev name
+provided is NULL. Solution is to add a NULL check before calling
+cdev_device_add() in vduse_create_dev().
+
+kobject: (0000000072042169): attempted to be registered with empty name!
+WARNING: CPU: 0 PID: 112695 at lib/kobject.c:236
+Call Trace:
+ kobject_add_varg linux/src/lib/kobject.c:390 [inline]
+ kobject_add+0xf6/0x150 linux/src/lib/kobject.c:442
+ device_add+0x28f/0xc20 linux/src/drivers/base/core.c:2167
+ cdev_device_add+0x83/0xc0 linux/src/fs/char_dev.c:546
+ vduse_create_dev linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2254 [inline]
+ vduse_ioctl+0x7b5/0xf30 linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2316
+ vfs_ioctl linux/src/fs/ioctl.c:47 [inline]
+ file_ioctl linux/src/fs/ioctl.c:510 [inline]
+ do_vfs_ioctl+0x14b/0xa80 linux/src/fs/ioctl.c:697
+ ksys_ioctl+0x7c/0xa0 linux/src/fs/ioctl.c:714
+ __do_sys_ioctl linux/src/fs/ioctl.c:721 [inline]
+ __se_sys_ioctl linux/src/fs/ioctl.c:719 [inline]
+ __x64_sys_ioctl+0x42/0x50 linux/src/fs/ioctl.c:719
+ do_syscall_64+0x94/0x330 linux/src/arch/x86/entry/common.c:291
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
+Cc: "Xie Yongji" <xieyongji@bytedance.com>
+Reported-by: Xianjun Zeng <zengxianjun@bytedance.com>
+Signed-off-by: Sheng Zhao <sheng.zhao@bytedance.com>
+Message-Id: <20230530033626.1266794-1-sheng.zhao@bytedance.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
+Cc: "Michael S. Tsirkin"<mst@redhat.com>, "Jason Wang"<jasowang@redhat.com>,
+Reviewed-by: Xie Yongji <xieyongji@bytedance.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c
+index 0c3b48616a9f3..695b20b17e010 100644
+--- a/drivers/vdpa/vdpa_user/vduse_dev.c
++++ b/drivers/vdpa/vdpa_user/vduse_dev.c
+@@ -1443,6 +1443,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config)
+ if (config->vq_num > 0xffff)
+ return false;
+
++ if (!config->name[0])
++ return false;
++
+ if (!device_is_allowed(config->device_id))
+ return false;
+
+--
+2.39.2
+
--- /dev/null
+From 694541002d112e667299e0f9dc6ddb9707478c98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 15:50:30 -0700
+Subject: vhost: support PACKED when setting-getting vring_base
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit 55d8122f5cd62d5aaa225d7167dcd14a44c850b9 ]
+
+Use the right structs for PACKED or split vqs when setting and
+getting the vring base.
+
+Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend")
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Message-Id: <20230424225031.18947-3-shannon.nelson@amd.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vhost.c | 18 +++++++++++++-----
+ drivers/vhost/vhost.h | 8 ++++++--
+ 2 files changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index f11bdbe4c2c5f..f64efda48f21c 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -1633,17 +1633,25 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg
+ r = -EFAULT;
+ break;
+ }
+- if (s.num > 0xffff) {
+- r = -EINVAL;
+- break;
++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) {
++ vq->last_avail_idx = s.num & 0xffff;
++ vq->last_used_idx = (s.num >> 16) & 0xffff;
++ } else {
++ if (s.num > 0xffff) {
++ r = -EINVAL;
++ break;
++ }
++ vq->last_avail_idx = s.num;
+ }
+- vq->last_avail_idx = s.num;
+ /* Forget the cached index value. */
+ vq->avail_idx = vq->last_avail_idx;
+ break;
+ case VHOST_GET_VRING_BASE:
+ s.index = idx;
+- s.num = vq->last_avail_idx;
++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED))
++ s.num = (u32)vq->last_avail_idx | ((u32)vq->last_used_idx << 16);
++ else
++ s.num = vq->last_avail_idx;
+ if (copy_to_user(argp, &s, sizeof s))
+ r = -EFAULT;
+ break;
+diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
+index 1647b750169c7..6f73f29d59791 100644
+--- a/drivers/vhost/vhost.h
++++ b/drivers/vhost/vhost.h
+@@ -85,13 +85,17 @@ struct vhost_virtqueue {
+ /* The routine to call when the Guest pings us, or timeout. */
+ vhost_work_fn_t handle_kick;
+
+- /* Last available index we saw. */
++ /* Last available index we saw.
++ * Values are limited to 0x7fff, and the high bit is used as
++ * a wrap counter when using VIRTIO_F_RING_PACKED. */
+ u16 last_avail_idx;
+
+ /* Caches available index value from user. */
+ u16 avail_idx;
+
+- /* Last index we used. */
++ /* Last index we used.
++ * Values are limited to 0x7fff, and the high bit is used as
++ * a wrap counter when using VIRTIO_F_RING_PACKED. */
+ u16 last_used_idx;
+
+ /* Used flags */
+--
+2.39.2
+
--- /dev/null
+From d3a9322fc545819a800c802db0e227b2658df84f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Apr 2023 15:50:31 -0700
+Subject: vhost_vdpa: support PACKED when setting-getting vring_base
+
+From: Shannon Nelson <shannon.nelson@amd.com>
+
+[ Upstream commit beee7fdb5b56a46415a4992d28dd4c2d06eb52df ]
+
+Use the right structs for PACKED or split vqs when setting and
+getting the vring base.
+
+Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend")
+Signed-off-by: Shannon Nelson <shannon.nelson@amd.com>
+Message-Id: <20230424225031.18947-4-shannon.nelson@amd.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vhost/vdpa.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
+index 74c7d1f978b75..779fc44677162 100644
+--- a/drivers/vhost/vdpa.c
++++ b/drivers/vhost/vdpa.c
+@@ -572,7 +572,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
+ if (r)
+ return r;
+
+- vq->last_avail_idx = vq_state.split.avail_index;
++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) {
++ vq->last_avail_idx = vq_state.packed.last_avail_idx |
++ (vq_state.packed.last_avail_counter << 15);
++ vq->last_used_idx = vq_state.packed.last_used_idx |
++ (vq_state.packed.last_used_counter << 15);
++ } else {
++ vq->last_avail_idx = vq_state.split.avail_index;
++ }
+ break;
+ }
+
+@@ -590,9 +597,15 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
+ break;
+
+ case VHOST_SET_VRING_BASE:
+- vq_state.split.avail_index = vq->last_avail_idx;
+- if (ops->set_vq_state(vdpa, idx, &vq_state))
+- r = -EINVAL;
++ if (vhost_has_feature(vq, VIRTIO_F_RING_PACKED)) {
++ vq_state.packed.last_avail_idx = vq->last_avail_idx & 0x7fff;
++ vq_state.packed.last_avail_counter = !!(vq->last_avail_idx & 0x8000);
++ vq_state.packed.last_used_idx = vq->last_used_idx & 0x7fff;
++ vq_state.packed.last_used_counter = !!(vq->last_used_idx & 0x8000);
++ } else {
++ vq_state.split.avail_index = vq->last_avail_idx;
++ }
++ r = ops->set_vq_state(vdpa, idx, &vq_state);
+ break;
+
+ case VHOST_SET_VRING_CALL:
+--
+2.39.2
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
